engineering-memory 1.11.26 → 1.11.28

package/runtime/dist/src/runtime/bridge-service.js

@@ -23,6 +23,8 @@ import { sameHolder, suggestedBranchNames, taskStartChoice } from './task-start.
 import { catalogueLanguages, copies, fetchLanguage, format } from './texts.js';
 import * as z from 'zod/v4';
 import { BridgeRecoveryError } from './recovery-error.js';
+import { gitLabRemote } from '../providers/gitlab.js';
+import { awaitsReviewRequest, reviewDeliveries, } from './merge-request-sync.js';
 export const validationIds = [
     'format',
     'static_analysis',
@@ -987,6 +989,7 @@ export class BridgeService {
                 await this.live.taskStarted(backendTask.id);
             }
             const backendFresh = responseSource !== 'stale_cache';
+            const deliveryState = objectValue(backend.taskDelivery)?.state;
             return asJsonValue({
                 backend: resumeBackendView(backend, backendFresh || !localJournal.projection),
                 requirements: backend.requirements ?? null,
@@ -999,7 +1002,12 @@ export class BridgeService {
                         staleReason: backend.staleReason ?? null,
                         nextAction: contextRefreshAction(backend.staleReason, resumedBaseline),
                     }
-                    : {}),
+                    : backendTask.status === 'closed' &&
+                        (deliveryState === 'unanswered' || deliveryState === 'answered')
+                        ? {
+                            nextAction: 'This task is closed and its changes are not delivered yet. Its delivery continues as before: task.close in this folder asks the delivery question. If the user asks for a further change instead, call context.prepare_change with this sessionId and the paths the change touches: that reopens the task, and the next task.close asks the delivery question again for the new content.',
+                        }
+                        : {}),
                 repository: publicRepository(repository),
                 worktree: (await this.ownedAllocation(projectId, repository.repoRoot)) ?? null,
                 localJournal: backendFresh ? journalSummary(localJournal) : localJournal,
@@ -1165,6 +1173,9 @@ export class BridgeService {
             const response = await this.dependencies.client.request(endpoints.contextPrepareChange, {
                 method: 'POST',
                 body,
+                ...(this.dependencies.clientVersion
+                    ? { headers: { 'x-client-version': this.dependencies.clientVersion } }
+                    : {}),
                 ...(input.transitionToWrite
                     ? {}
                     : {
@@ -1174,6 +1185,8 @@ export class BridgeService {
             });
             const responseSource = this.dependencies.client.getResponseSource(response);
             if (responseSource === 'stale_cache') {
+                if (pointer.closedAt)
+                    throw refuse('This task is closed, and reopening it for a further change needs Engineering Memory, which cannot be reached now. Try again once it is reachable.', 'context.prepare_change');
                 validateOfflineLease(response.data, input.sessionId, changedPaths, baselineDiffHash);
                 await this.dependencies.activeContexts.setChangeBaseline(repository.repoFingerprint, input.sessionId, repository.git, changedPaths);
                 return asJsonValue({
@@ -1192,7 +1205,8 @@ export class BridgeService {
                     resumeConflicts: pointer.resumeConflicts.filter((value) => value !== 'backend_resume_is_stale'),
                 });
             }
-            const preparedTask = objectValue(objectValue(response.data)?.task);
+            const preparedData = objectValue(response.data);
+            const preparedTask = objectValue(preparedData?.task);
             await this.dependencies.activeContexts.setChangeBaseline(repository.repoFingerprint, input.sessionId, repository.git, changedPaths, preparedTask &&
                 typeof preparedTask.id === 'string' &&
                 typeof preparedTask.lockVersion === 'number'
@@ -1201,8 +1215,16 @@ export class BridgeService {
                     taskVersion: numericTaskVersion(preparedTask.lockVersion),
                     lastSequence: numericSequence(preparedTask.lastSequence),
                 }
-                : undefined);
-            const preparedPointer = await this.dependencies.activeContexts.loadForSession(repository.repoFingerprint, input.sessionId);
+                : undefined, selfReviewRecords(preparedData?.selfReviewRequired));
+            let preparedPointer = await this.dependencies.activeContexts.loadForSession(repository.repoFingerprint, input.sessionId);
+            if (preparedPointer?.closedAt && preparedTask?.status === 'open') {
+                const allocation = await this.ownedAllocation(preparedPointer.projectId, repository.repoRoot);
+                if (allocation && this.dependencies.worktreePool)
+                    await this.dependencies.worktreePool.reopen(preparedPointer.projectId, repository.repoRoot, allocation.generation);
+                const { closedAt: _closedAt, ...reopened } = preparedPointer;
+                await this.dependencies.activeContexts.save(reopened);
+                preparedPointer = reopened;
+            }
             if (preparedPointer) {
                 if (decision) {
                     await this.dependencies.repositories.git
@@ -1221,7 +1243,6 @@ export class BridgeService {
                         allocation.taskId = preparedPointer.taskId;
                     }
                 }
-                const preparedData = objectValue(response.data);
                 await this.seedResumeSnapshot(preparedPointer, {
                     ...objectOrEmpty(response.data),
                     ...(preparedData?.lease ? { activeLease: preparedData.lease } : {}),
@@ -1910,10 +1931,18 @@ export class BridgeService {
     }
     async taskSelfReview(input) {
         const reviewed = await this.execute(async () => {
+            const checkout = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
+            const pointer = await this.dependencies.activeContexts.loadForTask(checkout.repoFingerprint, input.taskId);
+            const named = new Set(input.files.flatMap(({ rules }) => rules.map((rule) => rule.resourceId)));
+            const leasePaths = pointer?.changeBaseline?.leasePaths ?? [];
+            const unnamed = (pointer?.changeBaseline?.selfReviewRequired ?? []).filter(({ resourceId }) => !named.has(resourceId));
+            if (unnamed.length > 0)
+                throw refuse(`This self review leaves out records the change lease requires, so task.verify would refuse it: ${unnamed
+                    .map(({ resourceKey, title, paths }) => `${resourceKey} "${title}" (${paths.length === leasePaths.length ? 'every leased path' : paths.join(', ') || 'no single path'})`)
+                    .join('; ')}. Read the changed files against each of them and name it on a changed file it covers, or on any changed file when it covers no single path; then record task.self_review again. Nothing was recorded.`, 'task.self_review');
             const files = await this.approvedDeviations(input);
             assertSafeToPersist(cleanJson({ files }));
-            const checkout = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
-            const repository = await this.taskRepository(checkout, await this.dependencies.activeContexts.loadForTask(checkout.repoFingerprint, input.taskId));
+            const repository = await this.taskRepository(checkout, pointer);
             if (this.deferDeliveries) {
                 return this.enqueueTaskReceipt('task.self_review', endpoints.taskSelfReview, input.taskId, repository.repoRoot, cleanJson({
                     diffHash: repository.git.diffHash,
@@ -3747,6 +3776,10 @@ export class BridgeService {
                 query.set('limit', String(input.limit));
             const suffix = query.size > 0 ? `?${query.toString()}` : '';
             const response = await this.dependencies.client.request(`${endpoints.workItemList(input.projectId)}${suffix}`);
+            this.followMergeRequests(input.projectId, async () => {
+                const here = await this.dependencies.repositories.resolveIdentity(process.cwd());
+                return here.projectId === input.projectId ? here.repoRoot : null;
+            });
             return asJsonValue({
                 selectionRequired: true,
                 questionnaire: 'Select the project work item to run in this chat',
@@ -4136,7 +4169,7 @@ export class BridgeService {
             const livePointers = authenticated && state === 'bound'
                 ? this.dependencies.activeContexts.list(repository.repoFingerprint)
                 : Promise.resolve([]);
-            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries,] = await Promise.all([
+            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries, reviews,] = await Promise.all([
                 this.clientUpdate(authenticated),
                 livePointers,
                 authenticated && state === 'bound' && projectId
@@ -4160,8 +4193,14 @@ export class BridgeService {
                 authenticated && state === 'bound' && projectId
                     ? this.openDeliveries(projectId)
                     : Promise.resolve(null),
+                authenticated && state === 'bound' && projectId
+                    ? this.reviewCandidates(projectId)
+                    : Promise.resolve(null),
             ]);
             timer.mark('independent_lookups');
+            if (projectId && reviews)
+                this.followMergeRequests(projectId, repository.repoRoot, reviews);
+            const awaiting = reviews?.filter(awaitsReviewRequest) ?? [];
             const liveTasks = liveTasksRaw.map(describePointer);
             const shipped = objectValue(objectValue(client)?.shippedKnowledge);
             const incomplete = shipped && (shipped.failure !== null || Number(shipped.live) < Number(shipped.expected));
@@ -4208,6 +4247,22 @@ export class BridgeService {
                     ? { deferredTaskStarts: pendingQuestionnaires.deferred }
                     : {}),
                 ...(deliveries ? { openDeliveries: deliveries } : {}),
+                ...(awaiting.length
+                    ? {
+                        awaitingReviewRequests: {
+                            total: awaiting.length,
+                            items: awaiting.slice(0, 5).map((delivery) => ({
+                                taskId: delivery.taskId,
+                                externalTaskId: delivery.externalTaskId ?? null,
+                                workItemKey: delivery.workItemKey ?? null,
+                                branch: delivery.branch ?? null,
+                                targetBranch: delivery.baseBranch ?? null,
+                                draft: delivery.choice === 'commit_push_draft_pr',
+                            })),
+                            nextAction: 'These delivered tasks chose a pull request, but none is recorded for them yet. Mention them to the user in one line. On a GitLab remote, task.open_review_request opens one from this computer when the user asks; a pull request opened anywhere else is recorded with task.review_request. A merge request someone opened by hand on a GitLab this computer follows is found by itself.',
+                        },
+                    }
+                    : {}),
                 client,
                 ...moved,
                 ...(incomplete && state === 'bound'
@@ -4519,9 +4574,9 @@ export class BridgeService {
                 const taskEntries = (await this.dependencies.outbox.list()).filter((entry) => taskIdFromDeliverySafe(entry) === input.taskId);
                 const pointer = await this.resolveCheckpointPointer(input, repoRoot);
                 if (pointer.closedAt && correction)
-                    throw refuse(`Task ${pointer.taskSlug} is closed, so it takes no more corrections. Record the user's correction as a proposal for the rule it concerns with memory.propose_revision, or in the task that next changes this code.`, 'memory.propose_revision');
+                    throw refuse(`Task ${pointer.taskSlug} is closed, so it takes no more corrections. When the correction asks for a further code change and the task's changes are not delivered yet, call context.prepare_change in its session first: that reopens the task, and the correction is then recorded on it. Otherwise record it as a proposal for the rule it concerns with memory.propose_revision, or in the task that next changes this code.`, 'memory.propose_revision');
                 if (pointer.closedAt)
-                    throw refuse(`Task ${pointer.taskSlug} is closed, so it takes no more checkpoints. Further work belongs to a new task.`, 'session.bootstrap');
+                    throw refuse(`Task ${pointer.taskSlug} is closed, so it takes no more checkpoints. While its changes are not delivered, a further change continues it: call context.prepare_change in its session with the paths the change touches, which reopens it. Work after its delivery belongs to a new task.`, 'context.prepare_change');
                 const blockedEntry = taskEntries.find((entry) => entry.lastError && entry.lastError !== 'backend_unavailable');
                 if (blockedEntry && blockedEntry.idempotencyKey !== idempotencyKey) {
                     throw refuse('A blocked task delivery must be explicitly resolved before checkpointing', 'task.resolve_pending_delivery');
@@ -4643,6 +4698,76 @@ export class BridgeService {
     async taskDeliveryCancel(input) {
         return this.execute(() => this.mutateWithOutbox('task.delivery', endpoints.taskDeliveryCancel(input.projectId, input.taskId), { reason: input.reason }));
     }
+    async taskReviewRequest(input) {
+        return this.execute(() => this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: input.url, state: input.state }));
+    }
+    async taskOpenReviewRequest(input) {
+        return this.execute(async () => {
+            const gitlab = this.gitlab();
+            const repository = await this.dependencies.repositories.resolveIdentity(input.repoRoot ?? process.cwd());
+            if (repository.projectId !== input.projectId)
+                throw refuse("Call this in a clone of the task's project repository: this folder belongs to another project, or to none.", 'session.entry');
+            const opened = await gitlab.requests.open({ ...input, repoRoot: repository.repoRoot });
+            if ('recorded' in opened)
+                return asJsonValue({ alreadyRecorded: opened.recorded });
+            try {
+                const report = await this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: opened.url, state: opened.state, source: 'machine' });
+                return asJsonValue({ mergeRequest: opened, report });
+            }
+            catch (error) {
+                return asJsonValue({
+                    mergeRequest: opened,
+                    reportRefused: error instanceof Error ? error.message : String(error),
+                });
+            }
+        });
+    }
+    async gitlabToken(input = {}) {
+        return this.execute(async () => {
+            const gitlab = this.gitlab();
+            if (!(await this.dependencies.credentials.get('access-token')))
+                throw refuse('Sign in to Engineering Memory first: a GitLab token is kept for the signed-in account.', 'auth.signin_browser');
+            await this.language(input.language);
+            const git = this.dependencies.repositories.git;
+            const pushUrl = await git
+                .findRoot(input.repoRoot ?? process.cwd())
+                .then(async (root) => (await git.pushDestination(root)).pushUrl)
+                .catch(() => null);
+            const remote = pushUrl ? gitLabRemote(pushUrl) : null;
+            if (remote && 'refusal' in remote && remote.refusal === 'github')
+                throw refuse('This repository is on GitHub. Engineering Memory opens merge requests only on GitLab so far; a GitHub pull request is opened with the tools you have and recorded with task.review_request.', 'task.review_request');
+            const target = remote && !('refusal' in remote)
+                ? {
+                    host: remote.host,
+                    address: (await gitlab.tokens.address(remote.host)) ?? remote.address,
+                }
+                : { host: null, address: null };
+            const link = await gitlab.page.open(target);
+            return asJsonValue({
+                ...link,
+                address: target.address,
+                tokenSaved: target.address ? Boolean(await gitlab.tokens.token(target.address)) : false,
+                nextAction: "Give this link to the user to open in a browser on this computer, and tell them to enter their GitLab address and personal access token there: the api scope lets Engineering Memory open merge requests, read_api only lets it follow them. Never open the link, fill in the page or ask for the token yourself, and if the user pastes a token into the chat, do not use it: ask them to revoke it and use the page. The page checks the token with GitLab, keeps it in this computer's credential store and closes after one save or removal, or after 10 minutes. When the user says it is saved, retry what needed it.",
+            });
+        });
+    }
+    gitlab() {
+        if (!this.dependencies.gitlab)
+            throw refuse('This bridge was started without GitLab support. Open the merge request in GitLab and record it with task.review_request.', 'task.review_request');
+        return this.dependencies.gitlab;
+    }
+    followMergeRequests(projectId, repoRoot, deliveries) {
+        this.dependencies.gitlab?.requests.schedule(projectId, repoRoot, deliveries);
+    }
+    async reviewCandidates(projectId) {
+        try {
+            const response = await this.dependencies.client.request(`${endpoints.projectDeliveries(projectId)}?state=review&limit=100`);
+            return reviewDeliveries(response.data);
+        }
+        catch {
+            return null;
+        }
+    }
     async taskDeliveryRecord(input) {
         return this.execute(async () => {
             const response = await this.dependencies.client.request(endpoints.taskDelivery(input.projectId, input.taskId));
@@ -5669,7 +5794,7 @@ function deliveryQuestion(touchedContract, destination, publishApplicable, commi
                 alsoAsk: 'This task changed an endpoint contract. Ask whether to document the change for the linked project, and if so write what the other side must do differently with memory.propose_revision as an integration_note.',
             }
             : {}),
-        afterPullRequest: 'Do not end the turn once a pull request exists. Check whether it merges cleanly, report the conflicting files if it does not, and ask whether to resolve them before touching anything.',
+        afterPullRequest: 'Do not end the turn once the pull request is due. On a GitLab remote, task.open_review_request opens it from this computer and records it in one call; when it says no GitLab token is saved, gitlab.token gives the user a page on this computer to save their own. Anywhere else, open it with the tools you have and record it with task.review_request: its link, and draft or ready as it was opened. Then check whether it merges cleanly, report the conflicting files if it does not, and ask whether to resolve them before touching anything. When the user later says it became ready, was merged or was closed, record that with task.review_request too; a GitLab merge request this computer can read is also followed by itself.',
         afterCommit,
     });
 }
@@ -5732,6 +5857,27 @@ function checkpointView(checkpoint) {
         documents: documentViews(checkpoint.documents),
     };
 }
+function selfReviewRecords(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    return value.flatMap((entry) => {
+        const record = objectValue(entry);
+        return record &&
+            typeof record.resourceId === 'string' &&
+            typeof record.resourceKey === 'string' &&
+            typeof record.title === 'string' &&
+            Array.isArray(record.paths)
+            ? [
+                {
+                    resourceId: record.resourceId,
+                    resourceKey: record.resourceKey,
+                    title: record.title,
+                    paths: record.paths.filter((path) => typeof path === 'string'),
+                },
+            ]
+            : [];
+    });
+}
 function resumeBackendView(backend, includeDocuments) {
     const rest = Object.fromEntries(Object.entries(backend).filter(([key]) => key !== 'requirements'));
     const task = objectValue(backend.task);

package/runtime/dist/src/runtime/create-bridge-service.js

@@ -18,7 +18,10 @@ import { RepositoryDecisionStore } from './repository-decision-store.js';
 import { ShadowNoticeStore } from './shadow-notice-store.js';
 import { LanguageStore } from './language-store.js';
 import { UpdateChoiceStore } from './update-choice-store.js';
-import { PrincipalStateGuard } from './principal-state.js';
+import { PrincipalStateGuard, principalFingerprint } from './principal-state.js';
+import { MergeRequests } from './merge-request-sync.js';
+import { GitLabClient, GitLabTokens } from '../providers/gitlab.js';
+import { GitLabTokenPage } from '../providers/gitlab-token-page.js';
 import { OnboardingStore } from './onboarding-store.js';
 import { QuestionnaireStore } from './questionnaire-store.js';
 import { sha256 } from '../utilities/hash.js';
@@ -78,8 +81,14 @@ export function createBridgeService(options = {}) {
         knownReservations,
     });
     const gate = new VerificationGate(stateRoot, git, outbox, undefined, worktreePool);
-    const principalState = new PrincipalStateGuard(stateRoot, credentials, cache, outbox, activeContexts, gate);
+    const gitlabTokens = new GitLabTokens(stateRoot, credentials);
+    const principalState = new PrincipalStateGuard(stateRoot, credentials, cache, outbox, activeContexts, gate, gitlabTokens);
     const languages = new LanguageStore(stateRoot);
+    const gitlab = new GitLabClient(config.requestTimeoutMs);
+    const signedInLanguage = async () => {
+        const accessToken = await credentials.get('access-token');
+        return languages.read(accessToken ? principalFingerprint(accessToken) : sha256('anonymous'));
+    };
     return (service = new BridgeService({
         live,
         releaseNotes: new ReleaseNotes(stateRoot, client, credentials),
@@ -101,6 +110,11 @@ export function createBridgeService(options = {}) {
         onboarding: new OnboardingStore(stateRoot),
         clientVersion: options.clientVersion === undefined ? config.clientVersion : options.clientVersion,
         principalState,
+        gitlab: {
+            tokens: gitlabTokens,
+            page: new GitLabTokenPage(gitlabTokens, gitlab, signedInLanguage),
+            requests: new MergeRequests(client, gitlabTokens, gitlab, git),
+        },
     }));
 }
 //# sourceMappingURL=create-bridge-service.js.map

package/runtime/dist/src/runtime/merge-request-sync.js

@@ -0,0 +1,281 @@
+import { randomUUID } from 'node:crypto';
+import * as z from 'zod/v4';
+import { endpoints } from '../config.js';
+import { GitLabError, gitLabRemote, projectPath, reviewState, } from '../providers/gitlab.js';
+import { BridgeRecoveryError } from './recovery-error.js';
+export const reviewDeliverySchema = z.object({
+    taskId: z.string(),
+    externalTaskId: z.string().nullish(),
+    state: z.string(),
+    choice: z.string().nullish(),
+    baseBranch: z.string().nullish(),
+    deliveredCommit: z.string().nullish(),
+    pushed: z.boolean().nullish(),
+    branch: z.string().nullish(),
+    workItemKey: z.string().nullish(),
+    reviewRequest: z
+        .object({
+        provider: z.string(),
+        host: z.string(),
+        repository: z.string(),
+        number: z.number().int().positive(),
+        url: z.string(),
+        state: z.string(),
+        source: z.string().optional(),
+    })
+        .nullish(),
+});
+const pullRequestChoices = ['commit_push_draft_pr', 'commit_push_pr'];
+export function awaitsReviewRequest(delivery) {
+    return (!delivery.reviewRequest &&
+        delivery.state === 'delivered' &&
+        delivery.pushed === true &&
+        pullRequestChoices.includes(delivery.choice ?? ''));
+}
+export function reviewDeliveries(data) {
+    const items = z.object({ items: z.array(z.unknown()) }).safeParse(data);
+    return (items.success ? items.data.items : []).flatMap((item) => {
+        const delivery = reviewDeliverySchema.safeParse(item);
+        return delivery.success ? [delivery.data] : [];
+    });
+}
+const manualWay = 'Opening it in GitLab yourself always works: record it afterwards with task.review_request and its link.';
+export class MergeRequests {
+    client;
+    tokens;
+    gitlab;
+    git;
+    passes = new Map();
+    running = new Set();
+    constructor(client, tokens, gitlab, git) {
+        this.client = client;
+        this.tokens = tokens;
+        this.gitlab = gitlab;
+        this.git = git;
+    }
+    async open(input) {
+        const delivery = reviewDeliverySchema.parse((await this.client.request(endpoints.taskDelivery(input.projectId, input.taskId)))
+            .data);
+        if (delivery.reviewRequest)
+            return { recorded: { url: delivery.reviewRequest.url, state: delivery.reviewRequest.state } };
+        if (delivery.state === 'cancelled')
+            throw new BridgeRecoveryError('This delivery was concluded without delivering, so it gets no merge request.', 'task.delivery');
+        const branch = delivery.branch;
+        if (!branch)
+            throw new BridgeRecoveryError('This task has no branch, so there is nothing to open a merge request from.', 'task.review_request');
+        const chosen = pullRequestChoices.includes(delivery.choice ?? '');
+        const target = input.targetBranch ?? (chosen ? delivery.baseBranch : null);
+        if (!target)
+            throw new BridgeRecoveryError('The delivery answer did not choose a pull request, so it names no target branch. If the user wants a merge request, call again with the targetBranch they name.', 'task.open_review_request');
+        const draft = input.draft ?? delivery.choice === 'commit_push_draft_pr';
+        const pushUrl = await this.git.branchPushUrl(input.repoRoot, branch);
+        if (!pushUrl)
+            throw new BridgeRecoveryError(`This clone has no remote that ${branch} is pushed to. ${manualWay}`, 'task.review_request');
+        const remote = gitLabRemote(pushUrl);
+        if ('refusal' in remote)
+            throw new BridgeRecoveryError(remoteRefusal(remote.refusal, pushUrl), 'task.review_request');
+        const address = (await this.tokens.address(remote.host)) ?? remote.address;
+        const token = await this.tokens.token(address);
+        if (!token)
+            throw new BridgeRecoveryError(`No GitLab token is saved on this computer for ${address}. Call gitlab.token and give the user the link it returns; they save their own token there, and then this call works. ${manualWay}`, 'gitlab.token', { address });
+        const path = projectPath(address, remote.path);
+        try {
+            const project = await this.gitlab.project(address, token, path);
+            if (!project)
+                throw new BridgeRecoveryError(`GitLab at ${address} shows no project ${path} to this token. If GitLab runs under a path (like https://host/gitlab), save that address with gitlab.token; otherwise the token's user needs access to the project. ${manualWay}`, 'gitlab.token', { address, project: path });
+            const remoteHead = await this.gitlab.branch(address, token, path, branch);
+            if (!remoteHead)
+                throw new BridgeRecoveryError(`${branch} is not on GitLab yet. Push it, then call again.`, 'task.open_review_request');
+            const local = await this.git.branchCommit(input.repoRoot, branch).catch(() => null);
+            const delivered = local?.commit ?? delivery.deliveredCommit ?? null;
+            if (delivered &&
+                delivered !== remoteHead.commit &&
+                !(await this.gitlab.contains(address, token, path, branch, delivered)))
+                throw new BridgeRecoveryError(`${branch} on GitLab does not have ${delivered.slice(0, 12)} yet, so a merge request would lack it. Push the branch, then call again.`, 'task.open_review_request');
+            const source = { id: project.id, path };
+            const existing = (await this.gitlab.mergeRequests(address, token, source, branch, 'opened'))[0];
+            if (existing)
+                return opened(existing, true);
+            if (!(await this.gitlab.branch(address, token, path, target)))
+                throw new BridgeRecoveryError(`The target branch ${target} does not exist on GitLab. Ask the user which branch the merge request goes into and call again with targetBranch.`, 'task.open_review_request');
+            const title = ((draft ? 'Draft: ' : '') +
+                (input.title ??
+                    defaultTitle(local?.subject || remoteHead.title || branch, delivery.workItemKey))).slice(0, 255);
+            try {
+                return opened(await this.gitlab.createMergeRequest(address, token, path, {
+                    source: branch,
+                    target,
+                    title,
+                    ...(input.description ? { description: input.description } : {}),
+                }), false);
+            }
+            catch (error) {
+                if (!(error instanceof GitLabError) ||
+                    !['conflict', 'unknown_outcome', 'server_error'].includes(error.failure))
+                    throw error;
+                const found = (await this.gitlab.mergeRequests(address, token, source, branch, 'opened'))[0];
+                if (found)
+                    return opened(found, true);
+                throw error;
+            }
+        }
+        catch (error) {
+            if (error instanceof GitLabError)
+                throw gitLabRefusal(error);
+            throw error;
+        }
+    }
+    schedule(projectId, repoRoot, deliveries) {
+        const now = Date.now();
+        const last = this.passes.get(projectId);
+        if (last !== undefined && now - last < 5 * 60 * 1000)
+            return;
+        this.passes.set(projectId, now);
+        const pass = this.read(projectId, repoRoot, deliveries).then(() => undefined, () => undefined);
+        this.running.add(pass);
+        void pass.finally(() => this.running.delete(pass));
+    }
+    async settle() {
+        while (this.running.size)
+            await Promise.all([...this.running]);
+    }
+    async read(projectId, root, given) {
+        if (!(await this.tokens.any()))
+            return { reported: 0 };
+        const repoRoot = typeof root === 'function' ? await root().catch(() => null) : root;
+        const deliveries = given ??
+            reviewDeliveries((await this.client.request(`${endpoints.projectDeliveries(projectId)}?state=review&limit=100`)).data);
+        const pass = { failed: new Set(), projects: new Map(), calls: 100 };
+        const queue = [...deliveries];
+        let reported = 0;
+        const worker = async () => {
+            for (let delivery = queue.shift(); delivery && pass.calls > 0; delivery = queue.shift()) {
+                const found = await this.follow(delivery, repoRoot, pass).catch(() => null);
+                if (found && (await this.report(projectId, delivery.taskId, found)))
+                    reported++;
+            }
+        };
+        await Promise.all([worker(), worker(), worker(), worker()]);
+        return { reported };
+    }
+    async follow(delivery, repoRoot, pass) {
+        const known = delivery.reviewRequest;
+        if (known) {
+            if (known.provider !== 'gitlab' || !['draft', 'ready'].includes(known.state))
+                return null;
+            const link = await this.tokens.forLink(known.host, known.repository);
+            const token = link && !pass.failed.has(link.address) ? await this.tokens.token(link.address) : null;
+            if (!link || !token)
+                return null;
+            const request = await this.call(pass, link.address, () => this.gitlab.mergeRequest(link.address, token, link.project, known.number));
+            if (!request)
+                return null;
+            const state = reviewState(request);
+            return state !== known.state || known.source !== 'machine' ? { url: known.url, state } : null;
+        }
+        if (!repoRoot || !delivery.branch)
+            return null;
+        const pushUrl = await this.git.branchPushUrl(repoRoot, delivery.branch).catch(() => null);
+        const remote = pushUrl ? gitLabRemote(pushUrl) : null;
+        if (!remote || 'refusal' in remote)
+            return null;
+        const address = (await this.tokens.address(remote.host)) ?? remote.address;
+        const token = pass.failed.has(address) ? null : await this.tokens.token(address);
+        if (!token)
+            return null;
+        const path = projectPath(address, remote.path);
+        const key = `${address}\n${path}`;
+        if (!pass.projects.has(key))
+            pass.projects.set(key, await this.call(pass, address, () => this.gitlab.project(address, token, path)));
+        const project = pass.projects.get(key);
+        if (!project)
+            return null;
+        const requests = await this.call(pass, address, () => this.gitlab.mergeRequests(address, token, { id: project.id, path }, delivery.branch));
+        const rank = (request) => request.state === 'opened' || request.state === 'locked'
+            ? 0
+            : request.state === 'merged'
+                ? 1
+                : 2;
+        const chosen = (requests ?? [])
+            .filter((request) => rank(request) < 2)
+            .sort((left, right) => rank(left) - rank(right) ||
+            Number(right.sha === delivery.deliveredCommit) -
+                Number(left.sha === delivery.deliveredCommit))[0];
+        return chosen ? { url: chosen.web_url, state: reviewState(chosen) } : null;
+    }
+    async call(pass, address, request) {
+        if (pass.failed.has(address) || pass.calls <= 0)
+            return null;
+        pass.calls--;
+        try {
+            return await request();
+        }
+        catch (error) {
+            if (!(error instanceof GitLabError))
+                throw error;
+            pass.failed.add(address);
+            return null;
+        }
+    }
+    async report(projectId, taskId, found) {
+        try {
+            await this.client.request(endpoints.taskReviewRequest(projectId, taskId), {
+                method: 'POST',
+                body: { url: found.url, state: found.state, source: 'machine' },
+                idempotencyKey: randomUUID(),
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+function opened(request, reused) {
+    return {
+        url: request.web_url,
+        state: reviewState(request),
+        sourceBranch: request.source_branch,
+        targetBranch: request.target_branch,
+        reused,
+    };
+}
+export function defaultTitle(subject, workItemKey) {
+    const title = subject.trim().slice(0, 240) || 'Merge request';
+    return workItemKey && !title.toLowerCase().includes(workItemKey.toLowerCase())
+        ? `${workItemKey}: ${title}`
+        : title;
+}
+function remoteRefusal(refusal, pushUrl) {
+    switch (refusal) {
+        case 'github':
+            return `The branch is pushed to GitHub (${pushUrl}). Engineering Memory opens merge requests only on GitLab so far: open the pull request with the tools you have and record it with task.review_request.`;
+        case 'ip':
+            return `The remote is reached by an IP address (${pushUrl}), and Engineering Memory records no link with an IP address in it. Open the merge request in GitLab and move the work item with work_item.update.`;
+        case 'local':
+            return `The remote is a folder on disk (${pushUrl}), not a GitLab server. ${manualWay}`;
+        default:
+            return `The remote address ${pushUrl} is not one Engineering Memory can read as a GitLab project. ${manualWay}`;
+    }
+}
+function gitLabRefusal(error) {
+    const at = error.address;
+    const details = { address: at, failure: error.failure, status: error.status };
+    switch (error.failure) {
+        case 'token_rejected':
+            return new BridgeRecoveryError(`GitLab at ${at} no longer accepts the saved token (expired or revoked). Call gitlab.token so the user can save a new one. ${manualWay}`, 'gitlab.token', details);
+        case 'not_allowed':
+            return new BridgeRecoveryError(`GitLab at ${at} refused this with the saved token: it needs the api scope and a role that may open merge requests in the project (Developer or higher). Nothing was opened. ${manualWay}`, 'gitlab.token', details);
+        case 'unreachable':
+            return new BridgeRecoveryError(`This computer cannot reach ${at}. If GitLab is only reachable from the company network, the user connects (for example through the VPN) and you call again. Nothing was opened.`, 'task.open_review_request', details);
+        case 'untrusted_certificate':
+            return new BridgeRecoveryError(`This computer does not trust the certificate of ${at}. If the company uses its own certificate, the user sets NODE_EXTRA_CA_CERTS to its file and restarts the coding agent. Nothing was opened.`, 'task.open_review_request', details);
+        case 'unknown_outcome':
+            return new BridgeRecoveryError(`The answer from ${at} was lost after the merge request was sent, and it is not visible yet. Call again: an open merge request of the branch is reused, never opened twice.`, 'task.open_review_request', details);
+        case 'redirected':
+            return new BridgeRecoveryError(`${at} answered with a redirect, so the saved address is probably not GitLab's own. Call gitlab.token so the user can correct the address.`, 'gitlab.token', details);
+        default:
+            return new BridgeRecoveryError(`GitLab at ${at} answered ${error.failure.replace(/_/g, ' ')}${error.status ? ` (${error.status})` : ''}${error.detail ? `: ${error.detail}` : ''}. Nothing more was done. ${manualWay}`, 'task.open_review_request', details);
+    }
+}
+//# sourceMappingURL=merge-request-sync.js.map

package/runtime/dist/src/runtime/principal-state.js

@@ -9,15 +9,17 @@ export class PrincipalStateGuard {
     outbox;
     activeContexts;
     gate;
+    gitlabTokens;
     ownerPath;
     queue = Promise.resolve();
-    constructor(stateRoot, credentials, cache, outbox, activeContexts, gate) {
+    constructor(stateRoot, credentials, cache, outbox, activeContexts, gate, gitlabTokens) {
         this.stateRoot = stateRoot;
         this.credentials = credentials;
         this.cache = cache;
         this.outbox = outbox;
         this.activeContexts = activeContexts;
         this.gate = gate;
+        this.gitlabTokens = gitlabTokens;
         this.ownerPath = join(stateRoot, 'principal-owner.json');
     }
     async ensure() {
@@ -55,6 +57,7 @@ export class PrincipalStateGuard {
         await this.cache.clear();
         await this.activeContexts.clear();
         await this.gate.clear();
+        await this.gitlabTokens?.clear();
         await removeFile(this.ownerPath, this.stateRoot);
     }
     async exclusive(action) {

package/runtime/dist/src/runtime/worktree-pool.js

@@ -588,6 +588,15 @@ export class WorktreePool {
             await this.save(registry);
         });
     }
+    async reopen(projectId, repoRoot, generation) {
+        return this.transaction(async (registry) => {
+            const entry = this.owned(registry, projectId, repoRoot, generation);
+            entry.phase = 'working';
+            entry.pendingDelivery = false;
+            entry.lastActivityAt = this.now();
+            await this.save(registry);
+        });
+    }
     async release(projectId, repoRoot, generation, deliveryOutcome) {
         return this.transaction(async (registry) => {
             const entry = await this.deliveryOwned(registry, projectId, repoRoot, generation);