engineering-memory 1.11.27 → 1.11.29

package/runtime/dist/src/runtime/bridge-service.js

@@ -23,6 +23,9 @@ import { sameHolder, suggestedBranchNames, taskStartChoice } from './task-start.
 import { catalogueLanguages, copies, fetchLanguage, format } from './texts.js';
 import * as z from 'zod/v4';
 import { BridgeRecoveryError } from './recovery-error.js';
+import { gitLabRemote } from '../providers/gitlab.js';
+import { awaitsReviewRequest, concludedReview, opensAsDraft, reviewDeliveries, reviewDeliverySchema, waitingReview, } from './merge-request-sync.js';
+import { maskFinding } from './review-masking.js';
 export const validationIds = [
     'format',
     'static_analysis',
@@ -451,6 +454,7 @@ export class BridgeService {
                 taskKind: input.taskKind,
                 workItemKey: input.workItemKey,
                 workItemId: input.workItemId,
+                reviewFixOf: input.reviewFixOf,
                 mode: input.mode,
                 knownRevisions: input.knownRevisions,
             }, repository.repoRoot);
@@ -511,6 +515,9 @@ export class BridgeService {
                 this.poolAllocations.set(repository.repoRoot, poolAllocation);
             }
             const checkpointId = deterministicUuid('session.bootstrap', projectId, repository.repoFingerprint, input.externalTaskId);
+            const reviewed = persistedBootstrap.reviewFixOf
+                ? (await this.review(projectId, persistedBootstrap.reviewFixOf)).delivery
+                : null;
             const response = await this.requestWithNewerFields(endpoints.sessionBootstrap, ['checkoutFingerprints'], {
                 method: 'POST',
                 idempotencyKey: checkpointId,
@@ -521,7 +528,8 @@ export class BridgeService {
                     objective: persistedBootstrap.objective,
                     taskKind: persistedBootstrap.taskKind,
                     workItemKey: persistedBootstrap.workItemKey,
-                    workItemId: persistedBootstrap.workItemId,
+                    workItemId: persistedBootstrap.workItemId ?? reviewed?.workItemId ?? undefined,
+                    reviewFixOfTaskId: persistedBootstrap.reviewFixOf,
                     mode: persistedBootstrap.mode ?? 'write',
                     repoFingerprint: repository.repoFingerprint,
                     checkoutFingerprints: await this.dependencies.repositories.checkoutFingerprints(repository.repoRoot),
@@ -2606,6 +2614,14 @@ export class BridgeService {
                 if (unusable)
                     throw refuse(unusable, 'task.branch');
             }
+            const reviewed = input.reviewFixOf
+                ? (await this.review(repository.projectId, input.reviewFixOf)).delivery
+                : null;
+            if (reviewed &&
+                (!waitingReview.includes(reviewed.reviewState ?? '') ||
+                    !reviewed.pushed ||
+                    !reviewed.branch))
+                throw refuse(`The review of ${reviewed.externalTaskId} is not waiting for a fix (${reviewed.reviewState ?? 'no review'}${reviewed.pushed ? '' : ', not pushed'}), so there is no pull request branch to fix. Read it with review.get.`, 'review.get');
             const [preferences, currentBranch, folder, suggestedName] = await Promise.all([
                 this.dependencies.client.request(endpoints.projectGitPreferences(repository.projectId)),
                 this.dependencies.repositories.git.currentBranch(repository.repoRoot),
@@ -2619,6 +2635,9 @@ export class BridgeService {
                 currentCommit: repository.git.head,
                 folder,
                 suggestedName,
+                reviewFix: reviewed
+                    ? { branch: reviewed.branch, externalTaskId: reviewed.externalTaskId }
+                    : null,
                 ...(input.workItemId
                     ? await this.workItemBranches(repository.repoRoot, repository.projectId, input.workItemProjectId ?? repository.projectId, input.workItemId, preferences.data)
                     : { planBranch: null, continueBranches: [] }),
@@ -3774,6 +3793,10 @@ export class BridgeService {
                 query.set('limit', String(input.limit));
             const suffix = query.size > 0 ? `?${query.toString()}` : '';
             const response = await this.dependencies.client.request(`${endpoints.workItemList(input.projectId)}${suffix}`);
+            this.followMergeRequests(input.projectId, async () => {
+                const here = await this.dependencies.repositories.resolveIdentity(process.cwd());
+                return here.projectId === input.projectId ? here.repoRoot : null;
+            });
             return asJsonValue({
                 selectionRequired: true,
                 questionnaire: 'Select the project work item to run in this chat',
@@ -4163,7 +4186,7 @@ export class BridgeService {
             const livePointers = authenticated && state === 'bound'
                 ? this.dependencies.activeContexts.list(repository.repoFingerprint)
                 : Promise.resolve([]);
-            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries,] = await Promise.all([
+            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries, reviews, codeReviews,] = await Promise.all([
                 this.clientUpdate(authenticated),
                 livePointers,
                 authenticated && state === 'bound' && projectId
@@ -4187,8 +4210,17 @@ export class BridgeService {
                 authenticated && state === 'bound' && projectId
                     ? this.openDeliveries(projectId)
                     : Promise.resolve(null),
+                authenticated && state === 'bound' && projectId
+                    ? this.reviewCandidates(projectId)
+                    : Promise.resolve(null),
+                authenticated && state === 'bound' && projectId
+                    ? this.awaitingReviews(projectId)
+                    : Promise.resolve(null),
             ]);
             timer.mark('independent_lookups');
+            if (projectId && reviews)
+                this.followMergeRequests(projectId, repository.repoRoot, reviews);
+            const awaiting = reviews?.filter(awaitsReviewRequest) ?? [];
             const liveTasks = liveTasksRaw.map(describePointer);
             const shipped = objectValue(objectValue(client)?.shippedKnowledge);
             const incomplete = shipped && (shipped.failure !== null || Number(shipped.live) < Number(shipped.expected));
@@ -4235,6 +4267,23 @@ export class BridgeService {
                     ? { deferredTaskStarts: pendingQuestionnaires.deferred }
                     : {}),
                 ...(deliveries ? { openDeliveries: deliveries } : {}),
+                ...(awaiting.length
+                    ? {
+                        awaitingReviewRequests: {
+                            total: awaiting.length,
+                            items: awaiting.slice(0, 5).map((delivery) => ({
+                                taskId: delivery.taskId,
+                                externalTaskId: delivery.externalTaskId ?? null,
+                                workItemKey: delivery.workItemKey ?? null,
+                                branch: delivery.branch ?? null,
+                                targetBranch: delivery.baseBranch ?? null,
+                                draft: opensAsDraft(delivery),
+                            })),
+                            nextAction: 'These delivered tasks chose a pull request, but none is recorded for them yet. Mention them to the user in one line. On a GitLab remote, task.open_review_request opens one from this computer when the user asks; a pull request opened anywhere else is recorded with task.review_request, as a draft where draft is true. A merge request someone opened by hand on a GitLab this computer follows is found by itself.',
+                        },
+                    }
+                    : {}),
+                ...(codeReviews ? { awaitingReviews: codeReviews } : {}),
                 client,
                 ...moved,
                 ...(incomplete && state === 'bound'
@@ -4354,6 +4403,42 @@ export class BridgeService {
             return null;
         }
     }
+    async awaitingReviews(projectId) {
+        try {
+            const response = await this.dependencies.client.request(`${endpoints.reviewQueue(projectId)}?offset=0&limit=5`);
+            const page = z
+                .object({
+                total: z.number().int(),
+                items: z.array(reviewDeliverySchema.extend({
+                    openRound: z.object({ number: z.number().int(), createdAt: z.string() }).nullish(),
+                    openFindings: z.number().int(),
+                })),
+            })
+                .parse(response.data);
+            if (!page.total)
+                return null;
+            return asJsonValue({
+                total: page.total,
+                items: page.items.map((item) => ({
+                    taskId: item.taskId,
+                    externalTaskId: item.externalTaskId ?? null,
+                    workItemKey: item.workItemKey ?? null,
+                    reviewState: item.reviewState ?? null,
+                    pullRequest: item.reviewRequest
+                        ? { url: item.reviewRequest.url, state: item.reviewRequest.state }
+                        : null,
+                    openRound: item.openRound
+                        ? { number: item.openRound.number, since: item.openRound.createdAt }
+                        : null,
+                    openFindings: item.openFindings,
+                })),
+                nextAction: 'These deliveries wait for code review. Mention them to the user in one line and start nothing on your own. When the user asks, review.get reads one and review.start runs its next round from a clone of this project; a review that ended while its PR/MR is still a draft waits for review.make_ready.',
+            });
+        }
+        catch {
+            return null;
+        }
+    }
     async actionableWorkItems(projectId) {
         try {
             const response = await this.dependencies.client.request(`${endpoints.workItemList(projectId)}?limit=100&actionable=true`);
@@ -4664,6 +4749,7 @@ export class BridgeService {
             expectedVersion: input.expectedVersion,
             choice: input.choice,
             baseBranch: input.baseBranch,
+            expectedReviewPolicy: input.expectedReviewPolicy,
             answerSource: input.answerSource,
         })));
     }
@@ -4673,6 +4759,73 @@ export class BridgeService {
     async taskReviewRequest(input) {
         return this.execute(() => this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: input.url, state: input.state }));
     }
+    async taskOpenReviewRequest(input) {
+        return this.execute(async () => {
+            const gitlab = this.gitlab();
+            const repository = await this.dependencies.repositories.resolveIdentity(input.repoRoot ?? process.cwd());
+            if (repository.projectId !== input.projectId)
+                throw refuse("Call this in a clone of the task's project repository: this folder belongs to another project, or to none.", 'session.entry');
+            const opened = await gitlab.requests.open({ ...input, repoRoot: repository.repoRoot });
+            if ('recorded' in opened)
+                return asJsonValue({ alreadyRecorded: opened.recorded });
+            try {
+                const report = await this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: opened.url, state: opened.state, source: 'machine' });
+                return asJsonValue({ mergeRequest: opened, report });
+            }
+            catch (error) {
+                return asJsonValue({
+                    mergeRequest: opened,
+                    reportRefused: error instanceof Error ? error.message : String(error),
+                });
+            }
+        });
+    }
+    async gitlabToken(input = {}) {
+        return this.execute(async () => {
+            const gitlab = this.gitlab();
+            if (!(await this.dependencies.credentials.get('access-token')))
+                throw refuse('Sign in to Engineering Memory first: a GitLab token is kept for the signed-in account.', 'auth.signin_browser');
+            await this.language(input.language);
+            const git = this.dependencies.repositories.git;
+            const pushUrl = await git
+                .findRoot(input.repoRoot ?? process.cwd())
+                .then(async (root) => (await git.pushDestination(root)).pushUrl)
+                .catch(() => null);
+            const remote = pushUrl ? gitLabRemote(pushUrl) : null;
+            if (remote && 'refusal' in remote && remote.refusal === 'github')
+                throw refuse('This repository is on GitHub. Engineering Memory opens merge requests only on GitLab so far; a GitHub pull request is opened with the tools you have and recorded with task.review_request.', 'task.review_request');
+            const target = remote && !('refusal' in remote)
+                ? {
+                    host: remote.host,
+                    address: (await gitlab.tokens.address(remote.host)) ?? remote.address,
+                }
+                : { host: null, address: null };
+            const link = await gitlab.page.open(target);
+            return asJsonValue({
+                ...link,
+                address: target.address,
+                tokenSaved: target.address ? Boolean(await gitlab.tokens.token(target.address)) : false,
+                nextAction: "Give this link to the user to open in a browser on this computer, and tell them to enter their GitLab address and personal access token there: the api scope lets Engineering Memory open merge requests, read_api only lets it follow them. Never open the link, fill in the page or ask for the token yourself, and if the user pastes a token into the chat, do not use it: ask them to revoke it and use the page. The page checks the token with GitLab, keeps it in this computer's credential store and closes after one save or removal, or after 10 minutes. When the user says it is saved, retry what needed it.",
+            });
+        });
+    }
+    gitlab() {
+        if (!this.dependencies.gitlab)
+            throw refuse('This bridge was started without GitLab support. Open the merge request in GitLab and record it with task.review_request.', 'task.review_request');
+        return this.dependencies.gitlab;
+    }
+    followMergeRequests(projectId, repoRoot, deliveries) {
+        this.dependencies.gitlab?.requests.schedule(projectId, repoRoot, deliveries);
+    }
+    async reviewCandidates(projectId) {
+        try {
+            const response = await this.dependencies.client.request(`${endpoints.projectDeliveries(projectId)}?state=review&limit=100`);
+            return reviewDeliveries(response.data);
+        }
+        catch {
+            return null;
+        }
+    }
     async taskDeliveryRecord(input) {
         return this.execute(async () => {
             const response = await this.dependencies.client.request(endpoints.taskDelivery(input.projectId, input.taskId));
@@ -4683,6 +4836,201 @@ export class BridgeService {
             });
         });
     }
+    async projectReviewPolicy(input) {
+        return this.execute(async () => {
+            const projects = await this.dependencies.client.request(endpoints.projectList);
+            const project = z
+                .array(z.object({
+                id: z.string(),
+                name: z.string(),
+                lockVersion: z.number().int(),
+                role: z.string().optional(),
+                reviewPolicy: reviewPolicySchema.optional(),
+                reviewPolicyChangedAt: z.string().nullish(),
+            }))
+                .parse(projects.data)
+                .find((candidate) => candidate.id === input.projectId);
+            if (!project)
+                throw refuse('This project is not among the projects you can open.', 'project.list');
+            if (!project.reviewPolicy)
+                throw refuse('This Engineering Memory server has no code review setting yet.', 'session.entry');
+            return asJsonValue(project);
+        });
+    }
+    async reviewQueue(input) {
+        return this.execute(async () => {
+            const query = new URLSearchParams({
+                offset: String(input.offset ?? 0),
+                limit: String(input.limit ?? 20),
+            });
+            return asJsonValue((await this.dependencies.client.request(`${endpoints.reviewQueue(input.projectId)}?${query}`)).data);
+        });
+    }
+    async reviewGet(input) {
+        return this.execute(async () => asJsonValue((await this.dependencies.client.request(endpoints.review(input.projectId, input.taskId))).data));
+    }
+    async reviewStart(input) {
+        return this.execute(async () => {
+            const repository = await this.dependencies.repositories.resolveIdentity(input.repoRoot ?? process.cwd());
+            if (repository.projectId !== input.projectId)
+                throw refuse("Call this in a clone of the reviewed task's project repository: this folder belongs to another project, or to none.", 'session.entry');
+            const { delivery } = await this.review(input.projectId, input.taskId);
+            const task = delivery.externalTaskId;
+            if (!waitingReview.includes(delivery.reviewState ?? ''))
+                throw refuse(delivery.reviewState && concludedReview.includes(delivery.reviewState)
+                    ? `The review of ${task} already ended (${delivery.reviewState}), so there is nothing to review. review.make_ready makes its PR/MR ready.`
+                    : `No code review was asked for ${task}. A review starts when its delivery chooses a reviewed PR/MR, or, where review is required, when its PR/MR is recorded.`, 'review.get');
+            if (delivery.state !== 'delivered' || !delivery.pushed || !delivery.branch)
+                throw refuse(`${task} is not pushed yet, and a review reads the pushed branch. Push it and record the delivery (worktree.release with deliveryOutcome delivered), then call review.start again.`, 'review.get');
+            const target = input.targetBranch ?? delivery.baseBranch;
+            if (!target)
+                throw refuse(`The delivery of ${task} names no target branch. Call review.start again with targetBranch: the branch its PR/MR goes into.`, 'review.start');
+            const git = this.dependencies.repositories.git;
+            const fetched = (branch) => git.fetchBranchCommit(repository.repoRoot, 'origin', branch).catch(() => null);
+            const head = await fetched(delivery.branch);
+            if (!head)
+                throw refuse(`This review reads ${delivery.branch} from origin, and this clone could not fetch it: either its origin remote is not the project's repository, or this computer cannot reach the Git server. If the server is reachable only from the company network, connect (for example through the VPN) and call review.start again; any member's computer that reaches it can run the review.`, 'review.start');
+            const tip = await fetched(target);
+            if (!tip)
+                throw refuse(`The target branch ${target} could not be fetched from origin. If the PR/MR goes into another branch, call review.start again with targetBranch.`, 'review.start');
+            const base = await git.mergeBase(repository.repoRoot, head.sourceCommit, tip.sourceCommit);
+            const started = reviewSchema.parse((await this.dependencies.client.request(endpoints.reviewRounds(input.projectId, input.taskId), {
+                method: 'POST',
+                body: cleanJson({ commit: head.sourceCommit, baseCommit: base ?? undefined }),
+            })).data);
+            const round = started.rounds.find((candidate) => candidate.state === 'open');
+            if (!round)
+                throw refuse(`The review of ${task} has no open round. Read it with review.get.`, 'review.get');
+            const files = base
+                ? await git.changedFiles(repository.repoRoot, base, head.sourceCommit)
+                : [];
+            const records = await this.dependencies.client.request(`${endpoints.reviewRoundRules(input.projectId, round.id)}?offset=0&limit=5`);
+            const range = base ? `${base} ${head.sourceCommit}` : head.sourceCommit;
+            return asJsonValue({
+                review: {
+                    projectId: input.projectId,
+                    taskId: input.taskId,
+                    externalTaskId: task,
+                    workItemKey: delivery.workItemKey ?? null,
+                    reviewPolicy: delivery.reviewPolicy ?? null,
+                    branch: delivery.branch,
+                    targetBranch: target,
+                    pullRequest: delivery.reviewRequest?.url ?? null,
+                },
+                round: {
+                    id: round.id,
+                    number: round.number,
+                    headCommit: head.sourceCommit,
+                    baseCommit: base,
+                },
+                changedFiles: files.slice(0, 300),
+                changedFileCount: files.length,
+                earlierFindings: round.number > 1 ? started.findings : [],
+                records: records.data,
+                commands: base
+                    ? [
+                        `git diff --stat ${range}`,
+                        `git diff ${range} -- <path>`,
+                        `git show ${head.sourceCommit}:<path>`,
+                        `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
+                        `git log --oneline ${base}..${head.sourceCommit}`,
+                    ]
+                    : [
+                        `git show --stat ${head.sourceCommit}`,
+                        `git show ${head.sourceCommit}:<path>`,
+                        `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
+                    ],
+                nextAction: `Give this packet to a fresh subagent that did not write the change; if your host cannot start one, review it yourself under the same rules. The reviewer reads the change from baseCommit to headCommit only through the listed read-only Git commands: it never checks out, switches branches, edits, commits or pushes, and changes no file. It judges the change against the records (more with review.rules for this round from offset 5 while more are listed) and says whether each earlier finding still holds. Each finding names the file path, the line in headCommit when there is one, the ruleKey of the record it breaks when one applies, and a plain description of what is wrong and why. Then call review.submit with this projectId, roundId and the findings, an empty list when there are none.`,
+            });
+        });
+    }
+    async reviewRules(input) {
+        return this.execute(async () => {
+            const query = new URLSearchParams({
+                offset: String(input.offset ?? 0),
+                limit: String(input.limit ?? 5),
+            });
+            return asJsonValue((await this.dependencies.client.request(`${endpoints.reviewRoundRules(input.projectId, input.roundId)}?${query}`)).data);
+        });
+    }
+    async reviewSubmit(input) {
+        return this.execute(async () => {
+            const absolute = input.findings.findIndex(({ path }) => /^(?:[A-Za-z]:|~)?[\\/]/.test(path));
+            if (absolute >= 0)
+                throw refuse(`Finding ${absolute + 1} names its file by an absolute path. Name it by its path in the repository, as git diff shows it (for example src/app.ts), and call review.submit again.`, 'review.submit');
+            const checked = input.findings.map((finding) => ({
+                finding,
+                mask: maskFinding(finding.description),
+            }));
+            const unsafe = checked.findIndex(({ mask }) => mask.left);
+            if (unsafe >= 0)
+                throw refuse(`The description of finding ${unsafe + 1} still looks like it holds private data (${checked[unsafe].mask.left}) after e-mail addresses, IP addresses and user folders were masked. Describe the problem without the value itself, for example "a secret is committed in this file", and call review.submit again.`, 'review.submit');
+            const findings = checked.map(({ finding, mask }) => ({
+                ...finding,
+                description: mask.text,
+            }));
+            const idempotencyKey = deterministicUuid('review.submit', input.roundId, stableStringify(findings));
+            const response = await this.dependencies.client.request(endpoints.reviewRoundResult(input.projectId, input.roundId), { method: 'POST', body: cleanJson({ idempotencyKey, findings }) });
+            return asJsonValue({
+                review: response.data,
+                masked: [...new Set(checked.flatMap(({ mask }) => mask.masked))],
+            });
+        });
+    }
+    async reviewRejectFinding(input) {
+        return this.execute(async () => asJsonValue((await this.dependencies.client.request(endpoints.reviewFindingRejection(input.projectId, input.findingId), { method: 'POST', body: { reason: input.reason } })).data));
+    }
+    async reviewConclude(input) {
+        return this.execute(async () => {
+            const path = input.outcome === 'passed'
+                ? endpoints.reviewPass(input.projectId, input.taskId)
+                : input.outcome === 'skipped'
+                    ? endpoints.reviewSkip(input.projectId, input.taskId)
+                    : endpoints.reviewExemption(input.projectId, input.taskId);
+            return asJsonValue((await this.dependencies.client.request(path, {
+                method: 'POST',
+                ...(input.outcome === 'exempted' ? { body: { reason: input.reason ?? '' } } : {}),
+            })).data);
+        });
+    }
+    async reviewMakeReady(input) {
+        return this.execute(async () => {
+            const { delivery } = await this.review(input.projectId, input.taskId);
+            const task = delivery.externalTaskId;
+            const request = delivery.reviewRequest;
+            if (waitingReview.includes(delivery.reviewState ?? ''))
+                throw refuse(`The review of ${task} has not ended (${delivery.reviewState}), so its PR/MR stays a draft until it does.`, 'review.get');
+            if (!request)
+                return asJsonValue({
+                    ready: false,
+                    nextAction: `No PR/MR is recorded for ${task}. Open it now as ready: on GitLab task.open_review_request with draft false; elsewhere with your own tools, then record it with task.review_request.`,
+                });
+            if (request.state !== 'draft')
+                return asJsonValue({
+                    ready: request.state === 'ready',
+                    pullRequest: { url: request.url, state: request.state },
+                    nextAction: `${request.url} is ${request.state} already; nothing was changed.`,
+                });
+            if (request.provider !== 'gitlab' || !this.dependencies.gitlab)
+                return asJsonValue({
+                    ready: false,
+                    pullRequest: { url: request.url, state: request.state },
+                    nextAction: `Mark ${request.url} ready for review with your own tools (on GitHub, gh pr ready or the "Ready for review" button), or ask the user to, then record it with task.review_request state ready.`,
+                });
+            const readied = await this.dependencies.gitlab.requests.markReady(request);
+            if (readied.state !== 'ready')
+                return asJsonValue({
+                    ready: false,
+                    pullRequest: readied,
+                    nextAction: `GitLab still shows ${readied.url} as ${readied.state}. Ask the user to mark it ready in GitLab ("Mark as ready"); Engineering Memory follows it.`,
+                });
+            const report = await this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: readied.url, state: 'ready', source: 'machine' });
+            return asJsonValue({ ready: true, pullRequest: readied, report });
+        });
+    }
+    async review(projectId, taskId) {
+        return reviewSchema.parse((await this.dependencies.client.request(endpoints.review(projectId, taskId))).data);
+    }
     async reportDeliveryOutcome(report) {
         const path = report.outcome === 'delivered'
             ? endpoints.taskDeliveryDeliver(report.projectId, report.taskId)
@@ -5699,7 +6047,7 @@ function deliveryQuestion(touchedContract, destination, publishApplicable, commi
                 alsoAsk: 'This task changed an endpoint contract. Ask whether to document the change for the linked project, and if so write what the other side must do differently with memory.propose_revision as an integration_note.',
             }
             : {}),
-        afterPullRequest: 'Do not end the turn once a pull request exists. Record it with task.review_request: its link, and draft or ready as it was opened. Then check whether it merges cleanly, report the conflicting files if it does not, and ask whether to resolve them before touching anything. When the user later says it became ready, was merged or was closed, record that with task.review_request too.',
+        afterPullRequest: 'Do not end the turn once the pull request is due. On a GitLab remote, task.open_review_request opens it from this computer and records it in one call; when it says no GitLab token is saved, gitlab.token gives the user a page on this computer to save their own. Anywhere else, open it with the tools you have and record it with task.review_request: its link, and draft or ready as it was opened. Then check whether it merges cleanly, report the conflicting files if it does not, and ask whether to resolve them before touching anything. When the user later says it became ready, was merged or was closed, record that with task.review_request too; a GitLab merge request this computer can read is also followed by itself.',
         afterCommit,
     });
 }
@@ -5859,6 +6207,21 @@ function slugify(value) {
         .replace(/[^a-z0-9]+/g, '-')
         .replace(/^-|-$/g, '');
 }
+const reviewPolicySchema = z.enum(['none', 'optional', 'required']);
+const reviewSchema = z.object({
+    delivery: reviewDeliverySchema.extend({
+        externalTaskId: z.string(),
+        workItemId: z.string().nullish(),
+        reviewPolicy: reviewPolicySchema.optional(),
+    }),
+    rounds: z.array(z.object({
+        id: z.string(),
+        number: z.number().int(),
+        state: z.string(),
+        headCommit: z.string(),
+    })),
+    findings: z.array(z.unknown()),
+});
 function deterministicUuid(...parts) {
     const value = sha256(parts.join('\n')).slice(0, 32).split('');
     value[12] = '5';

package/runtime/dist/src/runtime/create-bridge-service.js

@@ -18,7 +18,10 @@ import { RepositoryDecisionStore } from './repository-decision-store.js';
 import { ShadowNoticeStore } from './shadow-notice-store.js';
 import { LanguageStore } from './language-store.js';
 import { UpdateChoiceStore } from './update-choice-store.js';
-import { PrincipalStateGuard } from './principal-state.js';
+import { PrincipalStateGuard, principalFingerprint } from './principal-state.js';
+import { MergeRequests } from './merge-request-sync.js';
+import { GitLabClient, GitLabTokens } from '../providers/gitlab.js';
+import { GitLabTokenPage } from '../providers/gitlab-token-page.js';
 import { OnboardingStore } from './onboarding-store.js';
 import { QuestionnaireStore } from './questionnaire-store.js';
 import { sha256 } from '../utilities/hash.js';
@@ -78,8 +81,14 @@ export function createBridgeService(options = {}) {
         knownReservations,
     });
     const gate = new VerificationGate(stateRoot, git, outbox, undefined, worktreePool);
-    const principalState = new PrincipalStateGuard(stateRoot, credentials, cache, outbox, activeContexts, gate);
+    const gitlabTokens = new GitLabTokens(stateRoot, credentials);
+    const principalState = new PrincipalStateGuard(stateRoot, credentials, cache, outbox, activeContexts, gate, gitlabTokens);
     const languages = new LanguageStore(stateRoot);
+    const gitlab = new GitLabClient(config.requestTimeoutMs);
+    const signedInLanguage = async () => {
+        const accessToken = await credentials.get('access-token');
+        return languages.read(accessToken ? principalFingerprint(accessToken) : sha256('anonymous'));
+    };
     return (service = new BridgeService({
         live,
         releaseNotes: new ReleaseNotes(stateRoot, client, credentials),
@@ -101,6 +110,11 @@ export function createBridgeService(options = {}) {
         onboarding: new OnboardingStore(stateRoot),
         clientVersion: options.clientVersion === undefined ? config.clientVersion : options.clientVersion,
         principalState,
+        gitlab: {
+            tokens: gitlabTokens,
+            page: new GitLabTokenPage(gitlabTokens, gitlab, signedInLanguage),
+            requests: new MergeRequests(client, gitlabTokens, gitlab, git),
+        },
     }));
 }
 //# sourceMappingURL=create-bridge-service.js.map