cyrus-edge-worker 0.2.37 → 0.2.39

package/dist/EdgeWorker.js

@@ -10,6 +10,7 @@ import { CLIIssueTrackerService, CLIRPCServer, createLogger, DEFAULT_PROXY_URL,
 import { CursorRunner } from "cyrus-cursor-runner";
 import { GeminiRunner } from "cyrus-gemini-runner";
 import { extractCommentAuthor, extractCommentBody, extractCommentId, extractCommentUrl, extractPRBaseBranchRef, extractPRBranchRef, extractPRNumber, extractPRTitle, extractRepoFullName, extractRepoName, extractRepoOwner, extractSessionKey, GitHubCommentService, GitHubEventTransport, isCommentOnPullRequest, isIssueCommentPayload, isPullRequestReviewCommentPayload, isPullRequestReviewPayload, stripMention, } from "cyrus-github-event-transport";
+import { extractDiscussionId, extractSessionKey as extractGitLabSessionKey, extractMRBaseBranchRef, extractMRBranchRef, extractMRIid, extractMRTitle, extractNoteAuthor, extractNoteBody, extractNoteId, extractNoteUrl, extractProjectId, extractProjectPath, GitLabCommentService, GitLabEventTransport, isNoteOnMergeRequest, stripMention as stripGitLabMention, } from "cyrus-gitlab-event-transport";
 import { LinearEventTransport, LinearIssueTrackerService, } from "cyrus-linear-event-transport";
 import { createCyrusToolsServer, } from "cyrus-mcp-tools";
 import { SlackEventTransport, } from "cyrus-slack-event-transport";
@@ -24,7 +25,7 @@ import { GitService } from "./GitService.js";
 import { GlobalSessionRegistry } from "./GlobalSessionRegistry.js";
 import { McpConfigService } from "./McpConfigService.js";
 import { PromptBuilder } from "./PromptBuilder.js";
-import { ProcedureAnalyzer, } from "./procedures/index.js";
+import { applyPlatformSubroutines, ProcedureAnalyzer, } from "./procedures/index.js";
 import { RepositoryRouter, } from "./RepositoryRouter.js";
 import { RunnerConfigBuilder } from "./RunnerConfigBuilder.js";
 import { RunnerSelectionService } from "./RunnerSelectionService.js";
@@ -48,9 +49,11 @@ export class EdgeWorker extends EventEmitter {
     issueTrackers = new Map(); // one issue tracker per Linear workspace (keyed by linearWorkspaceId)
     linearEventTransport = null; // Single event transport for webhook delivery
     gitHubEventTransport = null; // GitHub event transport for forwarded GitHub webhooks
+    gitLabEventTransport = null; // GitLab event transport for forwarded GitLab webhooks
     slackEventTransport = null;
     chatSessionHandler = null;
     gitHubCommentService; // Service for posting comments back to GitHub PRs
+    gitLabCommentService; // Service for posting comments back to GitLab MRs
     cliRPCServer = null; // CLI RPC server for CLI platform mode
     configUpdater = null; // Single config updater for configuration updates
     persistenceManager;
@@ -95,6 +98,8 @@ export class EdgeWorker extends EventEmitter {
         this.persistenceManager = new PersistenceManager(join(this.cyrusHome, "state"));
         // Initialize GitHub comment service for posting replies to GitHub PRs
         this.gitHubCommentService = new GitHubCommentService();
+        // Initialize GitLab comment service for posting replies to GitLab MRs
+        this.gitLabCommentService = new GitLabCommentService();
         // Initialize global session registry (centralized session storage)
         this.globalSessionRegistry = new GlobalSessionRegistry();
         // Initialize procedure router for fast classification
@@ -288,6 +293,8 @@ export class EdgeWorker extends EventEmitter {
             await this.removeDeletedRepositories(changes.removed);
             await this.updateModifiedRepositories(changes.modified);
             await this.addNewRepositories(changes.added);
+            // Detect and apply workspace token changes before overwriting config
+            this.updateLinearWorkspaceTokens(changes.newConfig);
             const prevDefaultRunner = this.config.defaultRunner;
             this.config = changes.newConfig;
             this.configManager.setConfig(changes.newConfig);
@@ -321,50 +328,39 @@ export class EdgeWorker extends EventEmitter {
      * Initialize and register components (routes) before server starts
      */
     async initializeComponents() {
-        // Get the first active repository for configuration
-        const firstRepo = Array.from(this.repositories.values())[0];
-        if (!firstRepo) {
-            throw new Error("No active repositories configured");
-        }
-        // Platform-specific initialization
+        // 1. Platform-specific initialization
         if (this.config.platform === "cli") {
-            // CLI mode: Create and register CLIRPCServer
-            const firstIssueTracker = this.issueTrackers.get(requireLinearWorkspaceId(firstRepo));
-            if (!firstIssueTracker) {
-                throw new Error("Issue tracker not found for first repository");
-            }
-            // Type guard to ensure it's a CLIIssueTrackerService
-            if (!(firstIssueTracker instanceof CLIIssueTrackerService)) {
-                throw new Error("CLI platform requires CLIIssueTrackerService but found different implementation");
+            // CLI mode: find any available CLIIssueTrackerService
+            const firstCliTracker = Array.from(this.issueTrackers.values()).find((tracker) => tracker instanceof CLIIssueTrackerService);
+            if (firstCliTracker) {
+                this.cliRPCServer = new CLIRPCServer({
+                    fastifyServer: this.sharedApplicationServer.getFastifyInstance(),
+                    issueTracker: firstCliTracker,
+                    version: "1.0.0",
+                });
+                // Register the /cli/rpc endpoint
+                this.cliRPCServer.register();
+                this.logger.info("✅ CLI RPC server registered");
+                this.logger.info("   RPC endpoint: /cli/rpc");
+                // Create CLI event transport and register listener
+                const cliEventTransport = firstCliTracker.createEventTransport({
+                    platform: "cli",
+                    fastifyServer: this.sharedApplicationServer.getFastifyInstance(),
+                });
+                // Listen for webhook events
+                cliEventTransport.on("event", (event) => {
+                    const repos = Array.from(this.repositories.values());
+                    this.handleWebhook(event, repos);
+                });
+                // Listen for errors
+                cliEventTransport.on("error", (error) => {
+                    this.handleError(error);
+                });
+                // Register the CLI event transport endpoints
+                cliEventTransport.register();
+                this.logger.info("✅ CLI event transport registered");
+                this.logger.info("   Event listener: listening for AgentSessionCreated events");
             }
-            this.cliRPCServer = new CLIRPCServer({
-                fastifyServer: this.sharedApplicationServer.getFastifyInstance(),
-                issueTracker: firstIssueTracker,
-                version: "1.0.0",
-            });
-            // Register the /cli/rpc endpoint
-            this.cliRPCServer.register();
-            this.logger.info("✅ CLI RPC server registered");
-            this.logger.info("   RPC endpoint: /cli/rpc");
-            // Create CLI event transport and register listener
-            const cliEventTransport = firstIssueTracker.createEventTransport({
-                platform: "cli",
-                fastifyServer: this.sharedApplicationServer.getFastifyInstance(),
-            });
-            // Listen for webhook events (same pattern as Linear mode)
-            cliEventTransport.on("event", (event) => {
-                // Get all active repositories for webhook handling
-                const repos = Array.from(this.repositories.values());
-                this.handleWebhook(event, repos);
-            });
-            // Listen for errors
-            cliEventTransport.on("error", (error) => {
-                this.handleError(error);
-            });
-            // Register the CLI event transport endpoints
-            cliEventTransport.register();
-            this.logger.info("✅ CLI event transport registered");
-            this.logger.info("   Event listener: listening for AgentSessionCreated events");
         }
         else {
             // Linear mode: Create and register LinearEventTransport
@@ -381,7 +377,6 @@ export class EdgeWorker extends EventEmitter {
             });
             // Listen for legacy webhook events (deprecated, kept for backward compatibility)
             this.linearEventTransport.on("event", (event) => {
-                // Get all active repositories for webhook handling
                 const repos = Array.from(this.repositories.values());
                 this.handleWebhook(event, repos);
             });
@@ -398,10 +393,11 @@ export class EdgeWorker extends EventEmitter {
             this.logger.info(`✅ Linear event transport registered (${verificationMode} mode)`);
             this.logger.info(`   Webhook endpoint: ${this.sharedApplicationServer.getWebhookUrl()}`);
         }
-        // 2. Register GitHub event transport (for forwarded GitHub webhooks from CYHOST)
-        // This is registered regardless of platform mode since GitHub webhooks can come from CYHOST
+        // 2. Register GitHub and Slack event transports unconditionally
+        // These don't require repositories and must be available during onboarding
+        // for webhook URL verification to succeed.
         this.registerGitHubEventTransport();
-        // 2b. Register Slack event transport (for forwarded Slack webhooks from CYHOST)
+        this.registerGitLabEventTransport();
         this.registerSlackEventTransport();
         // 3. Create and register ConfigUpdater (both platforms)
         this.configUpdater = new ConfigUpdater(this.sharedApplicationServer.getFastifyInstance(), this.cyrusHome, process.env.CYRUS_API_KEY || "");
@@ -486,6 +482,43 @@ export class EdgeWorker extends EventEmitter {
         this.logger.info(`GitHub event transport registered (${verificationMode} mode)`);
         this.logger.info("Webhook endpoint: POST /github-webhook");
     }
+    /**
+     * Register the GitLab event transport for receiving forwarded GitLab webhooks.
+     * This creates a /gitlab-webhook endpoint that handles note events on merge requests.
+     */
+    registerGitLabEventTransport() {
+        const isExternalHost = process.env.CYRUS_HOST_EXTERNAL?.toLowerCase().trim() === "true";
+        const hasGitlabWebhookSecret = process.env.GITLAB_WEBHOOK_SECRET != null &&
+            process.env.GITLAB_WEBHOOK_SECRET !== "";
+        const useSignatureVerification = isExternalHost && hasGitlabWebhookSecret;
+        const verificationMode = useSignatureVerification ? "signature" : "proxy";
+        const secret = useSignatureVerification
+            ? process.env.GITLAB_WEBHOOK_SECRET
+            : process.env.CYRUS_API_KEY || "";
+        this.gitLabEventTransport = new GitLabEventTransport({
+            fastifyServer: this.sharedApplicationServer.getFastifyInstance(),
+            verificationMode,
+            secret,
+        });
+        // Listen for legacy GitLab webhook events
+        this.gitLabEventTransport.on("event", (event) => {
+            this.handleGitLabWebhook(event).catch((error) => {
+                this.logger.error("Failed to handle GitLab webhook", error instanceof Error ? error : new Error(String(error)));
+            });
+        });
+        // Listen for unified internal messages (new message bus)
+        this.gitLabEventTransport.on("message", (message) => {
+            this.handleMessage(message);
+        });
+        // Listen for errors
+        this.gitLabEventTransport.on("error", (error) => {
+            this.handleError(error);
+        });
+        // Register the /gitlab-webhook endpoint
+        this.gitLabEventTransport.register();
+        this.logger.info(`GitLab event transport registered (${verificationMode} mode)`);
+        this.logger.info("Webhook endpoint: POST /gitlab-webhook");
+    }
     /**
      * Register the Slack event transport for receiving forwarded Slack webhooks from CYHOST.
      * This creates a /slack-webhook endpoint that handles @mention events from Slack.
@@ -1009,6 +1042,373 @@ ${taskSection}`;
             this.logger.error("Failed to post GitHub reply", error instanceof Error ? error : new Error(String(error)));
         }
     }
+    /**
+     * Handle an incoming GitLab webhook event (note on a merge request).
+     * Mirrors the GitHub webhook handler but uses GitLab-specific utilities.
+     */
+    async handleGitLabWebhook(event) {
+        this.activeWebhookCount++;
+        try {
+            // Only handle notes on merge requests
+            if (!isNoteOnMergeRequest(event)) {
+                this.logger.debug("Ignoring GitLab event: not a note on a merge request");
+                return;
+            }
+            const projectPath = extractProjectPath(event);
+            const mrIid = extractMRIid(event);
+            const noteBody = extractNoteBody(event);
+            const noteAuthor = extractNoteAuthor(event);
+            const mrTitle = extractMRTitle(event);
+            const sessionKey = extractGitLabSessionKey(event);
+            // Skip comments from the bot itself to prevent infinite loops
+            const botUsername = process.env.GITLAB_BOT_USERNAME;
+            if (botUsername && noteAuthor === botUsername) {
+                this.logger.debug(`Ignoring note from bot user @${botUsername} on ${projectPath}!${mrIid}`);
+                return;
+            }
+            // Only trigger on notes that mention the bot (when configured)
+            if (botUsername && !noteBody.includes(`@${botUsername}`)) {
+                this.logger.debug(`Ignoring note without @${botUsername} mention on ${projectPath}!${mrIid}`);
+                return;
+            }
+            this.logger.info(`Processing GitLab webhook: ${projectPath}!${mrIid} by @${noteAuthor}`);
+            // Add "eyes" emoji reaction to acknowledge receipt
+            const reactionToken = event.accessToken || process.env.GITLAB_ACCESS_TOKEN;
+            const noteId = extractNoteId(event);
+            const projectId = extractProjectId(event);
+            if (reactionToken && noteId && projectId && mrIid) {
+                this.gitLabCommentService
+                    .addAwardEmoji({
+                    token: reactionToken,
+                    projectId,
+                    mrIid,
+                    noteId,
+                    name: "eyes",
+                })
+                    .catch((err) => {
+                    this.logger.warn(`Failed to add GitLab emoji reaction: ${err instanceof Error ? err.message : err}`);
+                });
+            }
+            // Find the repository configuration that matches this GitLab project
+            const repository = this.findRepositoryByGitLabUrl(projectPath);
+            if (!repository) {
+                this.logger.warn(`No repository configured for GitLab project: ${projectPath}`);
+                return;
+            }
+            const agentSessionManager = this.agentSessionManager;
+            // Branch refs are available directly from the MR payload
+            const branchRef = extractMRBranchRef(event);
+            const baseBranchRef = extractMRBaseBranchRef(event);
+            if (!branchRef || !mrIid) {
+                this.logger.error(`Could not determine branch or MR iid for ${projectPath}!${mrIid}`);
+                return;
+            }
+            // Strip the bot mention to get the task instructions
+            const mentionHandle = botUsername ? `@${botUsername}` : "@cyrusagent";
+            const taskInstructions = stripGitLabMention(noteBody, mentionHandle);
+            // Check for an existing multi-repo session that includes this repository
+            let workspace = null;
+            const multiRepoSession = agentSessionManager.getActiveMultiRepoSessionForRepository(repository.id);
+            if (multiRepoSession) {
+                const subWorktreePath = multiRepoSession.workspace.repoPaths?.[repository.id];
+                if (subWorktreePath) {
+                    workspace = {
+                        path: subWorktreePath,
+                        isGitWorktree: true,
+                    };
+                    this.logger.info(`Resolved multi-repo sub-worktree for ${repository.name}: ${subWorktreePath}`);
+                }
+                else {
+                    this.logger.warn(`No sub-worktree found for repo ${repository.name} in multi-repo session ${multiRepoSession.id}, falling back to root workspace`);
+                    workspace = {
+                        path: multiRepoSession.workspace.path,
+                        isGitWorktree: true,
+                    };
+                }
+            }
+            else {
+                // Single-repo or no existing session: create workspace
+                workspace = await this.createGitLabWorkspace(repository, branchRef, mrIid);
+            }
+            if (!workspace) {
+                this.logger.error(`Failed to create workspace for ${projectPath}!${mrIid}`);
+                return;
+            }
+            this.logger.info(`GitLab workspace created at: ${workspace.path}`);
+            // Check if another active session is already using this branch/workspace
+            const existingSessions = agentSessionManager.getActiveSessionsByBranchName(branchRef);
+            const firstExisting = existingSessions[0];
+            if (firstExisting) {
+                this.logger.warn(`Reusing workspace from active session ${firstExisting.id} — concurrent writes possible`);
+            }
+            // Create a synthetic session for this GitLab MR note
+            const issueMinimal = {
+                id: sessionKey,
+                identifier: `${projectPath}!${mrIid}`,
+                title: mrTitle || `MR !${mrIid}`,
+                branchName: branchRef,
+            };
+            // Create an internal agent session (no Linear session for GitLab)
+            const gitlabSessionId = `gitlab-${Date.now()}`;
+            agentSessionManager.createCyrusAgentSession(gitlabSessionId, sessionKey, issueMinimal, workspace, "gitlab", // Don't stream activities to Linear for GitLab sources
+            [
+                {
+                    repositoryId: repository.id,
+                    branchName: branchRef,
+                    baseBranchName: baseBranchRef ?? repository.baseBranch,
+                },
+            ]);
+            // Register session-to-repo mapping and activity sink
+            this.sessionRepositories.set(gitlabSessionId, repository.id);
+            const activitySink = this.activitySinks.get(repository.id);
+            if (activitySink) {
+                agentSessionManager.setActivitySink(gitlabSessionId, activitySink);
+            }
+            const session = agentSessionManager.getSession(gitlabSessionId);
+            if (!session) {
+                this.logger.error(`Failed to create session for GitLab webhook on ${projectPath}!${mrIid}`);
+                return;
+            }
+            // Initialize procedure metadata
+            if (!session.metadata) {
+                session.metadata = {};
+            }
+            // Store GitLab-specific metadata for reply posting
+            // Reuse commentId for note ID (serves the same purpose across platforms)
+            session.metadata.commentId = String(noteId);
+            // Build the system prompt for this GitLab MR session
+            // TODO: Use buildGitLabChangeRequestSystemPrompt for merge_request approval events
+            const isMergeRequestEvent = event.eventType === "merge_request";
+            const systemPrompt = isMergeRequestEvent
+                ? this.buildGitLabChangeRequestSystemPrompt(event, branchRef, taskInstructions)
+                : this.buildGitLabSystemPrompt(event, branchRef, taskInstructions);
+            // Build allowed tools and directories
+            // Exclude Slack MCP tools from GitLab sessions
+            const allowedTools = this.buildAllowedTools(repository).filter((t) => t !== "mcp__slack");
+            const disallowedTools = this.buildDisallowedTools(repository);
+            const allowedDirectories = [repository.repositoryPath];
+            // Create agent runner using the standard config builder
+            const { config: runnerConfig, runnerType } = this.buildAgentRunnerConfig(session, repository, gitlabSessionId, systemPrompt, allowedTools, allowedDirectories, disallowedTools, undefined, // resumeSessionId
+            undefined, // labels
+            undefined, // issueDescription
+            200, // maxTurns
+            false, // singleTurn
+            undefined, // disallowAllTools
+            { excludeSlackMcp: true });
+            const runner = this.createRunnerForType(runnerType, runnerConfig);
+            // Store the runner in the session manager
+            agentSessionManager.addAgentRunner(gitlabSessionId, runner);
+            // Save persisted state
+            await this.savePersistedState();
+            this.emit("session:started", sessionKey, issueMinimal, repository.id);
+            this.logger.info(`Starting ${runnerType} runner for GitLab MR ${projectPath}!${mrIid}`);
+            // Start the session and handle completion
+            try {
+                const sessionInfo = await runner.start(taskInstructions);
+                this.logger.info(`GitLab session started: ${sessionInfo.sessionId}`);
+                // When session completes, post the reply back to GitLab
+                await this.postGitLabReply(event, runner, repository);
+            }
+            catch (error) {
+                this.logger.error(`GitLab session error for ${projectPath}!${mrIid}`, error instanceof Error ? error : new Error(String(error)));
+            }
+            finally {
+                await this.savePersistedState();
+            }
+        }
+        catch (error) {
+            this.logger.error("Failed to process GitLab webhook", error instanceof Error ? error : new Error(String(error)));
+        }
+        finally {
+            this.activeWebhookCount--;
+        }
+    }
+    /**
+     * Find a repository configuration that matches a GitLab project URL.
+     * Matches against the gitlabUrl field in repository config.
+     */
+    findRepositoryByGitLabUrl(projectPath) {
+        for (const repo of this.repositories.values()) {
+            if (!repo.gitlabUrl)
+                continue;
+            if (repo.gitlabUrl.includes(projectPath) ||
+                repo.gitlabUrl.endsWith(`/${projectPath}`)) {
+                return repo;
+            }
+        }
+        return null;
+    }
+    /**
+     * Create a git worktree for a GitLab MR branch.
+     * If the worktree already exists for this branch, reuse it.
+     */
+    async createGitLabWorkspace(repository, branchRef, mrIid) {
+        try {
+            // Create a synthetic issue-like object for the git service
+            const syntheticIssue = {
+                id: `gitlab-mr-${mrIid}`,
+                identifier: `MR-${mrIid}`,
+                title: `MR !${mrIid}`,
+                description: null,
+                url: "",
+                branchName: branchRef,
+                assigneeId: null,
+                stateId: null,
+                teamId: null,
+                labelIds: [],
+                priority: 0,
+                createdAt: new Date(),
+                updatedAt: new Date(),
+                archivedAt: null,
+                state: Promise.resolve(undefined),
+                assignee: Promise.resolve(undefined),
+                team: Promise.resolve(undefined),
+                parent: Promise.resolve(undefined),
+                project: Promise.resolve(undefined),
+                labels: () => Promise.resolve({ nodes: [] }),
+                comments: () => Promise.resolve({ nodes: [] }),
+                attachments: () => Promise.resolve({ nodes: [] }),
+                children: () => Promise.resolve({ nodes: [] }),
+                inverseRelations: () => Promise.resolve({ nodes: [] }),
+                update: () => Promise.resolve({
+                    success: true,
+                    issue: undefined,
+                    lastSyncId: 0,
+                }),
+            };
+            return await this.gitService.createGitWorktree(syntheticIssue, [
+                repository,
+            ]);
+        }
+        catch (error) {
+            this.logger.error(`Failed to create GitLab workspace for MR !${mrIid}`, error instanceof Error ? error : new Error(String(error)));
+            return null;
+        }
+    }
+    /**
+     * Build a system prompt for a GitLab MR note session.
+     */
+    buildGitLabSystemPrompt(event, branchRef, taskInstructions) {
+        const projectPath = extractProjectPath(event);
+        const mrIid = extractMRIid(event);
+        const mrTitle = extractMRTitle(event);
+        const noteAuthor = extractNoteAuthor(event);
+        const noteUrl = extractNoteUrl(event);
+        return `You are working on a GitLab Merge Request.
+
+## Context
+- **Project**: ${projectPath}
+- **MR**: !${mrIid} - ${mrTitle || "Untitled"}
+- **Branch**: ${branchRef}
+- **Requested by**: @${noteAuthor}
+- **Note URL**: ${noteUrl}
+
+## Task
+${taskInstructions}
+
+## Instructions
+- You are already checked out on the MR branch \`${branchRef}\`
+- Make changes directly to the code on this branch
+- After making changes, commit and push them to the branch
+- Use \`glab\` CLI commands for GitLab-specific operations
+- Be concise in your responses as they will be posted back to the GitLab MR`;
+    }
+    /**
+     * Build a system prompt for a GitLab MR change request session.
+     */
+    buildGitLabChangeRequestSystemPrompt(event, branchRef, reviewBody) {
+        const projectPath = extractProjectPath(event);
+        const mrIid = extractMRIid(event);
+        const mrTitle = extractMRTitle(event);
+        const noteAuthor = extractNoteAuthor(event);
+        const noteUrl = extractNoteUrl(event);
+        const hasReviewBody = reviewBody.trim().length > 0;
+        const taskSection = hasReviewBody
+            ? `## Reviewer Feedback
+${reviewBody}
+
+## Instructions
+- Read the MR diff and the reviewer's feedback above to understand all requested changes
+- You are already checked out on the MR branch \`${branchRef}\`
+- Address all the reviewer's feedback and make the necessary changes
+- After making changes, commit and push them to the branch
+- Respond with a concise summary of the changes you made`
+            : `## Instructions
+- The reviewer has requested changes but did not leave a summary comment
+- Use \`glab mr view ${mrIid}\` and \`glab mr diff ${mrIid}\` to review the MR context
+- You are already checked out on the MR branch \`${branchRef}\`
+- Address all the reviewer's feedback and make the necessary changes
+- After making changes, commit and push them to the branch
+- Respond with a concise summary of the changes you made`;
+        return `You are working on a GitLab Merge Request that has received a change request review.
+
+## Context
+- **Project**: ${projectPath}
+- **MR**: !${mrIid} - ${mrTitle || "Untitled"}
+- **Branch**: ${branchRef}
+- **Reviewer**: @${noteAuthor}
+- **Note URL**: ${noteUrl}
+
+${taskSection}`;
+    }
+    /**
+     * Post a reply back to the GitLab MR after the session completes.
+     */
+    async postGitLabReply(event, runner, _repository) {
+        try {
+            // Get the last assistant message from the runner as the summary
+            const messages = runner.getMessages();
+            const lastAssistantMessage = [...messages]
+                .reverse()
+                .find((m) => m.type === "assistant");
+            let summary = "Task completed. Please review the changes on this branch.";
+            if (lastAssistantMessage &&
+                lastAssistantMessage.type === "assistant" &&
+                "message" in lastAssistantMessage) {
+                const msg = lastAssistantMessage;
+                const textBlock = msg.message.content?.find((block) => block.type === "text" && block.text);
+                if (textBlock?.text) {
+                    summary = textBlock.text;
+                }
+            }
+            const projectId = extractProjectId(event);
+            const mrIid = extractMRIid(event);
+            const discussionId = extractDiscussionId(event);
+            if (!mrIid) {
+                this.logger.warn("Cannot post GitLab reply: no MR iid");
+                return;
+            }
+            const token = event.accessToken || process.env.GITLAB_ACCESS_TOKEN;
+            if (!token) {
+                this.logger.warn("Cannot post GitLab reply: no access token or GITLAB_ACCESS_TOKEN configured");
+                this.logger.debug(`Would have posted reply to ${extractProjectPath(event)}!${mrIid}: ${summary}`);
+                return;
+            }
+            if (discussionId) {
+                // Reply to the specific discussion thread
+                await this.gitLabCommentService.postDiscussionReply({
+                    token,
+                    projectId,
+                    mrIid,
+                    discussionId,
+                    body: summary,
+                });
+            }
+            else {
+                // Post as a top-level MR note
+                await this.gitLabCommentService.postMRNote({
+                    token,
+                    projectId,
+                    mrIid,
+                    body: summary,
+                });
+            }
+            this.logger.info(`Posted GitLab reply to ${extractProjectPath(event)}!${mrIid}`);
+        }
+        catch (error) {
+            this.logger.error("Failed to post GitLab reply", error instanceof Error ? error : new Error(String(error)));
+        }
+    }
     /**
      * Compute the current status of the Cyrus process
      * @returns "idle" if the process can be safely restarted, "busy" if work is in progress
@@ -1228,6 +1628,43 @@ ${taskSection}`;
             this.logger.error(`Failed to re-run verifications:`, error);
         }
     }
+    /**
+     * Detect workspace token changes and update all dependent services.
+     *
+     * When an OAuth token is refreshed (at least once per day), the new token is
+     * persisted to config.json which triggers the file watcher.  This method
+     * compares the previous in-memory tokens against the new config and calls
+     * `setAccessToken()` on any affected `LinearIssueTrackerService` instances,
+     * and pushes the updated workspace configs to `AttachmentService`.
+     */
+    updateLinearWorkspaceTokens(newConfig) {
+        const oldWorkspaces = this.config.linearWorkspaces ?? {};
+        const newWorkspaces = newConfig.linearWorkspaces ?? {};
+        let anyTokenChanged = false;
+        for (const [workspaceId, newWsConfig] of Object.entries(newWorkspaces)) {
+            const oldToken = oldWorkspaces[workspaceId]?.linearToken;
+            const newToken = newWsConfig.linearToken;
+            if (oldToken === newToken)
+                continue;
+            anyTokenChanged = true;
+            // Update existing issue tracker in-place
+            const issueTracker = this.issueTrackers.get(workspaceId);
+            if (issueTracker) {
+                issueTracker.setAccessToken(newToken);
+                this.logger.info(`🔑 Updated Linear token for workspace ${workspaceId}`);
+            }
+            else if (this.config.platform !== "cli") {
+                // Workspace is new — create a tracker for it
+                const newIssueTracker = new LinearIssueTrackerService(new LinearClient({ accessToken: newToken }), this.buildOAuthConfig(workspaceId));
+                this.issueTrackers.set(workspaceId, newIssueTracker);
+                this.logger.info(`🔑 Created issue tracker for new workspace ${workspaceId}`);
+            }
+        }
+        if (anyTokenChanged) {
+            // Push refreshed workspace configs to AttachmentService
+            this.attachmentService.setLinearWorkspaces(newWorkspaces);
+        }
+    }
     /**
      * Add new repositories to the running EdgeWorker
      */
@@ -2173,6 +2610,13 @@ ${taskSection}`;
             finalClassification = routingDecision.classification;
             log.info(`AI routing: ${routingDecision.classification} → ${finalProcedure.name}`);
         }
+        // Apply platform-specific subroutine substitution (e.g., gh-pr → glab-mr for GitLab repos)
+        const hostingPlatform = primaryRepo.gitlabUrl
+            ? "gitlab"
+            : primaryRepo.githubUrl
+                ? "github"
+                : undefined;
+        finalProcedure = applyPlatformSubroutines(finalProcedure, hostingPlatform);
         // Initialize procedure metadata in session with final decision
         this.procedureAnalyzer.initializeProcedureMetadata(session, finalProcedure);
         // Post single procedure selection result (replaces ephemeral routing thought)
@@ -3605,6 +4049,13 @@ ${input.userComment}
             finalClassification = routingDecision.classification;
             this.logger.info(`AI routing: ${routingDecision.classification} → ${selectedProcedure.name}`);
         }
+        // Apply platform-specific subroutine substitution (e.g., gh-pr → glab-mr for GitLab repos)
+        const hostingPlatform = repository.gitlabUrl
+            ? "gitlab"
+            : repository.githubUrl
+                ? "github"
+                : undefined;
+        selectedProcedure = applyPlatformSubroutines(selectedProcedure, hostingPlatform);
         // Initialize procedure metadata in session (resets currentSubroutine)
         this.procedureAnalyzer.initializeProcedureMetadata(session, selectedProcedure);
         // Post procedure selection result (replaces ephemeral routing thought)