engineering-memory 1.11.28 → 1.11.30

package/runtime/dist/src/runtime/bridge-service.js

@@ -15,7 +15,7 @@ import { minimatch } from 'minimatch';
 import { endpoints } from '../config.js';
 import { startPhaseTimer } from './phase-timer.js';
 import { sha256, stableStringify } from '../utilities/hash.js';
-import { ApiResponseError, BackendUnavailableError, } from './api-client.js';
+import { ApiResponseError, BackendUnavailableError, backendRejectsField, } from './api-client.js';
 import { assertSafeToPersist, normalizeRepositoryPaths } from './offline-outbox.js';
 import { restrictedValueKind } from './privacy-detector.js';
 import { principalFingerprint } from './principal-state.js';
@@ -24,7 +24,9 @@ import { catalogueLanguages, copies, fetchLanguage, format } from './texts.js';
 import * as z from 'zod/v4';
 import { BridgeRecoveryError } from './recovery-error.js';
 import { gitLabRemote } from '../providers/gitlab.js';
-import { awaitsReviewRequest, reviewDeliveries, } from './merge-request-sync.js';
+import { awaitsReviewRequest, concludedReview, opensAsDraft, reviewDeliveries, reviewDeliverySchema, waitingReview, } from './merge-request-sync.js';
+import { maskFinding } from './review-masking.js';
+import { commentReviewSchema, dueComment, markComment } from './review-comment.js';
 export const validationIds = [
     'format',
     'static_analysis',
@@ -453,6 +455,7 @@ export class BridgeService {
                 taskKind: input.taskKind,
                 workItemKey: input.workItemKey,
                 workItemId: input.workItemId,
+                reviewFixOf: input.reviewFixOf,
                 mode: input.mode,
                 knownRevisions: input.knownRevisions,
             }, repository.repoRoot);
@@ -513,6 +516,9 @@ export class BridgeService {
                 this.poolAllocations.set(repository.repoRoot, poolAllocation);
             }
             const checkpointId = deterministicUuid('session.bootstrap', projectId, repository.repoFingerprint, input.externalTaskId);
+            const reviewed = persistedBootstrap.reviewFixOf
+                ? (await this.review(projectId, persistedBootstrap.reviewFixOf)).delivery
+                : null;
             const response = await this.requestWithNewerFields(endpoints.sessionBootstrap, ['checkoutFingerprints'], {
                 method: 'POST',
                 idempotencyKey: checkpointId,
@@ -523,7 +529,8 @@ export class BridgeService {
                     objective: persistedBootstrap.objective,
                     taskKind: persistedBootstrap.taskKind,
                     workItemKey: persistedBootstrap.workItemKey,
-                    workItemId: persistedBootstrap.workItemId,
+                    workItemId: persistedBootstrap.workItemId ?? reviewed?.workItemId ?? undefined,
+                    reviewFixOfTaskId: persistedBootstrap.reviewFixOf,
                     mode: persistedBootstrap.mode ?? 'write',
                     repoFingerprint: repository.repoFingerprint,
                     checkoutFingerprints: await this.dependencies.repositories.checkoutFingerprints(repository.repoRoot),
@@ -2608,6 +2615,14 @@ export class BridgeService {
                 if (unusable)
                     throw refuse(unusable, 'task.branch');
             }
+            const reviewed = input.reviewFixOf
+                ? (await this.review(repository.projectId, input.reviewFixOf)).delivery
+                : null;
+            if (reviewed &&
+                (!waitingReview.includes(reviewed.reviewState ?? '') ||
+                    !reviewed.pushed ||
+                    !reviewed.branch))
+                throw refuse(`The review of ${reviewed.externalTaskId} is not waiting for a fix (${reviewed.reviewState ?? 'no review'}${reviewed.pushed ? '' : ', not pushed'}), so there is no pull request branch to fix. Read it with review.get.`, 'review.get');
             const [preferences, currentBranch, folder, suggestedName] = await Promise.all([
                 this.dependencies.client.request(endpoints.projectGitPreferences(repository.projectId)),
                 this.dependencies.repositories.git.currentBranch(repository.repoRoot),
@@ -2621,6 +2636,9 @@ export class BridgeService {
                 currentCommit: repository.git.head,
                 folder,
                 suggestedName,
+                reviewFix: reviewed
+                    ? { branch: reviewed.branch, externalTaskId: reviewed.externalTaskId }
+                    : null,
                 ...(input.workItemId
                     ? await this.workItemBranches(repository.repoRoot, repository.projectId, input.workItemProjectId ?? repository.projectId, input.workItemId, preferences.data)
                     : { planBranch: null, continueBranches: [] }),
@@ -4169,7 +4187,7 @@ export class BridgeService {
             const livePointers = authenticated && state === 'bound'
                 ? this.dependencies.activeContexts.list(repository.repoFingerprint)
                 : Promise.resolve([]);
-            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries, reviews,] = await Promise.all([
+            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries, reviews, codeReviews,] = await Promise.all([
                 this.clientUpdate(authenticated),
                 livePointers,
                 authenticated && state === 'bound' && projectId
@@ -4196,6 +4214,9 @@ export class BridgeService {
                 authenticated && state === 'bound' && projectId
                     ? this.reviewCandidates(projectId)
                     : Promise.resolve(null),
+                authenticated && state === 'bound' && projectId
+                    ? this.awaitingReviews(projectId)
+                    : Promise.resolve(null),
             ]);
             timer.mark('independent_lookups');
             if (projectId && reviews)
@@ -4257,12 +4278,13 @@ export class BridgeService {
                                 workItemKey: delivery.workItemKey ?? null,
                                 branch: delivery.branch ?? null,
                                 targetBranch: delivery.baseBranch ?? null,
-                                draft: delivery.choice === 'commit_push_draft_pr',
+                                draft: opensAsDraft(delivery),
                             })),
-                            nextAction: 'These delivered tasks chose a pull request, but none is recorded for them yet. Mention them to the user in one line. On a GitLab remote, task.open_review_request opens one from this computer when the user asks; a pull request opened anywhere else is recorded with task.review_request. A merge request someone opened by hand on a GitLab this computer follows is found by itself.',
+                            nextAction: 'These delivered tasks chose a pull request, but none is recorded for them yet. Mention them to the user in one line. On a GitLab remote, task.open_review_request opens one from this computer when the user asks; a pull request opened anywhere else is recorded with task.review_request, as a draft where draft is true. A merge request someone opened by hand on a GitLab this computer follows is found by itself.',
                         },
                     }
                     : {}),
+                ...(codeReviews ? { awaitingReviews: codeReviews } : {}),
                 client,
                 ...moved,
                 ...(incomplete && state === 'bound'
@@ -4382,6 +4404,55 @@ export class BridgeService {
             return null;
         }
     }
+    async awaitingReviews(projectId) {
+        try {
+            const response = await this.dependencies.client.request(`${endpoints.reviewQueue(projectId)}?offset=0&limit=5`);
+            const page = z
+                .object({
+                total: z.number().int(),
+                items: z.array(reviewDeliverySchema.extend({
+                    reviewReopenReason: z.string().nullish(),
+                    providerJobSince: z.string().nullish(),
+                    providerFailure: z.string().nullish(),
+                    openRound: z.object({ number: z.number().int(), createdAt: z.string() }).nullish(),
+                    openFindings: z.number().int(),
+                })),
+            })
+                .parse(response.data);
+            if (!page.total)
+                return null;
+            return asJsonValue({
+                total: page.total,
+                items: page.items.map((item) => ({
+                    taskId: item.taskId,
+                    externalTaskId: item.externalTaskId ?? null,
+                    workItemKey: item.workItemKey ?? null,
+                    reviewState: item.reviewState ?? null,
+                    reopened: item.reviewReopenReason ?? null,
+                    pullRequest: item.reviewRequest
+                        ? { url: item.reviewRequest.url, state: item.reviewRequest.state }
+                        : null,
+                    readyBeforeReview: waitingReview.includes(item.reviewState ?? '') && item.reviewRequest?.state === 'ready',
+                    pullRequestChange: item.providerJob
+                        ? {
+                            job: item.providerJob,
+                            since: item.providerJobSince ?? null,
+                            failure: item.providerFailure ?? null,
+                            failedAt: item.providerFailedAt ?? null,
+                        }
+                        : null,
+                    openRound: item.openRound
+                        ? { number: item.openRound.number, since: item.openRound.createdAt }
+                        : null,
+                    openFindings: item.openFindings,
+                })),
+                nextAction: 'These deliveries wait for code review. Mention them to the user in one line and start nothing on your own. When the user asks, review.get reads one and review.start runs its next round from a clone of this project; a review that ended while its PR/MR is still a draft waits for review.make_ready. reopened (new_commit or new_target) means the review had passed and then a new commit or a new target branch arrived, so it waits again; readyBeforeReview means its PR/MR was made ready while the review had not ended; pullRequestChange is a make-ready or make-draft that a member computer with a GitLab token does in the background, with the last failure when one was recorded.',
+            });
+        }
+        catch {
+            return null;
+        }
+    }
     async actionableWorkItems(projectId) {
         try {
             const response = await this.dependencies.client.request(`${endpoints.workItemList(projectId)}?limit=100&actionable=true`);
@@ -4692,6 +4763,7 @@ export class BridgeService {
             expectedVersion: input.expectedVersion,
             choice: input.choice,
             baseBranch: input.baseBranch,
+            expectedReviewPolicy: input.expectedReviewPolicy,
             answerSource: input.answerSource,
         })));
     }
@@ -4699,7 +4771,18 @@ export class BridgeService {
         return this.execute(() => this.mutateWithOutbox('task.delivery', endpoints.taskDeliveryCancel(input.projectId, input.taskId), { reason: input.reason }));
     }
     async taskReviewRequest(input) {
-        return this.execute(() => this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: input.url, state: input.state }));
+        return this.execute(() => {
+            const report = (reading) => this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), cleanJson({
+                url: input.url,
+                state: input.state,
+                ...(reading ? { headCommit: input.headCommit, targetBranch: input.targetBranch } : {}),
+            }));
+            return report(true).catch((error) => {
+                if (!backendRejectsField(error, ['headCommit', 'targetBranch']))
+                    throw error;
+                return report(false);
+            });
+        });
     }
     async taskOpenReviewRequest(input) {
         return this.execute(async () => {
@@ -4778,6 +4861,282 @@ export class BridgeService {
             });
         });
     }
+    async projectReviewPolicy(input) {
+        return this.execute(async () => {
+            const projects = await this.dependencies.client.request(endpoints.projectList);
+            const project = z
+                .array(z.object({
+                id: z.string(),
+                name: z.string(),
+                lockVersion: z.number().int(),
+                role: z.string().optional(),
+                reviewPolicy: reviewPolicySchema.optional(),
+                reviewPolicyChangedAt: z.string().nullish(),
+            }))
+                .parse(projects.data)
+                .find((candidate) => candidate.id === input.projectId);
+            if (!project)
+                throw refuse('This project is not among the projects you can open.', 'project.list');
+            if (!project.reviewPolicy)
+                throw refuse('This Engineering Memory server has no code review setting yet.', 'session.entry');
+            return asJsonValue(project);
+        });
+    }
+    async reviewQueue(input) {
+        return this.execute(async () => {
+            const query = new URLSearchParams({
+                offset: String(input.offset ?? 0),
+                limit: String(input.limit ?? 20),
+            });
+            return asJsonValue((await this.dependencies.client.request(`${endpoints.reviewQueue(input.projectId)}?${query}`)).data);
+        });
+    }
+    async reviewGet(input) {
+        return this.execute(async () => asJsonValue((await this.dependencies.client.request(endpoints.review(input.projectId, input.taskId))).data));
+    }
+    async reviewStart(input) {
+        return this.execute(async () => {
+            const repository = await this.dependencies.repositories.resolveIdentity(input.repoRoot ?? process.cwd());
+            if (repository.projectId !== input.projectId)
+                throw refuse("Call this in a clone of the reviewed task's project repository: this folder belongs to another project, or to none.", 'session.entry');
+            const { delivery } = await this.review(input.projectId, input.taskId);
+            const task = delivery.externalTaskId;
+            if (!waitingReview.includes(delivery.reviewState ?? ''))
+                throw refuse(delivery.reviewState && concludedReview.includes(delivery.reviewState)
+                    ? `The review of ${task} already ended (${delivery.reviewState}), so there is nothing to review. review.make_ready makes its PR/MR ready.`
+                    : `No code review was asked for ${task}. A review starts when its delivery chooses a reviewed PR/MR, or, where review is required, when its PR/MR is recorded.`, 'review.get');
+            if (delivery.state !== 'delivered' || !delivery.pushed || !delivery.branch)
+                throw refuse(`${task} is not pushed yet, and a review reads the pushed branch. Push it and record the delivery (worktree.release with deliveryOutcome delivered), then call review.start again.`, 'review.get');
+            const target = input.targetBranch ?? delivery.reviewRequest?.targetBranch ?? delivery.baseBranch;
+            if (!target)
+                throw refuse(`The delivery of ${task} names no target branch. Call review.start again with targetBranch: the branch its PR/MR goes into.`, 'review.start');
+            const git = this.dependencies.repositories.git;
+            const fetched = (branch) => git.fetchBranchCommit(repository.repoRoot, 'origin', branch).catch(() => null);
+            const head = await fetched(delivery.branch);
+            if (!head)
+                throw refuse(`This review reads ${delivery.branch} from origin, and this clone could not fetch it: either its origin remote is not the project's repository, or this computer cannot reach the Git server. If the server is reachable only from the company network, connect (for example through the VPN) and call review.start again; any member's computer that reaches it can run the review.`, 'review.start');
+            const tip = await fetched(target);
+            if (!tip)
+                throw refuse(`The target branch ${target} could not be fetched from origin. If the PR/MR goes into another branch, call review.start again with targetBranch.`, 'review.start');
+            const base = await git.mergeBase(repository.repoRoot, head.sourceCommit, tip.sourceCommit);
+            const startRound = (withTarget) => this.dependencies.client.request(endpoints.reviewRounds(input.projectId, input.taskId), {
+                method: 'POST',
+                body: cleanJson({
+                    commit: head.sourceCommit,
+                    baseCommit: base ?? undefined,
+                    targetBranch: withTarget ? target : undefined,
+                }),
+            });
+            const started = reviewSchema.parse((await startRound(true).catch((error) => {
+                if (!backendRejectsField(error, ['targetBranch']))
+                    throw error;
+                return startRound(false);
+            })).data);
+            const round = started.rounds.find((candidate) => candidate.state === 'open');
+            if (!round)
+                throw refuse(`The review of ${task} has no open round. Read it with review.get.`, 'review.get');
+            const files = base
+                ? await git.changedFiles(repository.repoRoot, base, head.sourceCommit)
+                : [];
+            const previous = started.rounds.find((candidate) => candidate.state === 'submitted' && candidate.number < round.number);
+            const since = previous &&
+                previous.headCommit !== head.sourceCommit &&
+                (await git.isAncestor(repository.repoRoot, previous.headCommit, head.sourceCommit))
+                ? await git.changedFiles(repository.repoRoot, previous.headCommit, head.sourceCommit)
+                : null;
+            const records = await this.dependencies.client.request(`${endpoints.reviewRoundRules(input.projectId, round.id)}?offset=0&limit=5`);
+            const range = base ? `${base} ${head.sourceCommit}` : head.sourceCommit;
+            return asJsonValue({
+                review: {
+                    projectId: input.projectId,
+                    taskId: input.taskId,
+                    externalTaskId: task,
+                    workItemKey: delivery.workItemKey ?? null,
+                    reviewPolicy: delivery.reviewPolicy ?? null,
+                    branch: delivery.branch,
+                    targetBranch: target,
+                    pullRequest: delivery.reviewRequest?.url ?? null,
+                },
+                round: {
+                    id: round.id,
+                    number: round.number,
+                    headCommit: head.sourceCommit,
+                    baseCommit: base,
+                },
+                changedFiles: files.slice(0, 300),
+                changedFileCount: files.length,
+                ...(previous && since
+                    ? {
+                        sinceLastRound: {
+                            commit: previous.headCommit,
+                            changedFiles: since.slice(0, 300),
+                            changedFileCount: since.length,
+                        },
+                    }
+                    : {}),
+                earlierFindings: round.number > 1 ? started.findings : [],
+                records: records.data,
+                commands: [
+                    ...(base
+                        ? [
+                            `git diff --stat ${range}`,
+                            `git diff ${range} -- <path>`,
+                            `git show ${head.sourceCommit}:<path>`,
+                            `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
+                            `git log --oneline ${base}..${head.sourceCommit}`,
+                        ]
+                        : [
+                            `git show --stat ${head.sourceCommit}`,
+                            `git show ${head.sourceCommit}:<path>`,
+                            `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
+                        ]),
+                    ...(previous && since
+                        ? [`git diff ${previous.headCommit} ${head.sourceCommit} -- <path>`]
+                        : []),
+                ],
+                nextAction: `Give this packet to a fresh subagent that did not write the change; if your host cannot start one, review it yourself under the same rules. The reviewer reads the change from baseCommit to headCommit only through the listed read-only Git commands: it never checks out, switches branches, edits, commits or pushes, and changes no file. It judges the change against the records (more with review.rules for this round from offset 5 while more are listed) and says whether each earlier finding still holds${previous && since ? ', starting from sinceLastRound: what changed since the previous round' : ''}. Each finding names the file path, the line in headCommit when there is one, the ruleKey of the record it breaks when one applies, and a plain description of what is wrong and why. Then call review.submit with this projectId, roundId and the findings, an empty list when there are none.`,
+            });
+        });
+    }
+    async reviewRules(input) {
+        return this.execute(async () => {
+            const query = new URLSearchParams({
+                offset: String(input.offset ?? 0),
+                limit: String(input.limit ?? 5),
+            });
+            return asJsonValue((await this.dependencies.client.request(`${endpoints.reviewRoundRules(input.projectId, input.roundId)}?${query}`)).data);
+        });
+    }
+    async reviewSubmit(input) {
+        return this.execute(async () => {
+            const absolute = input.findings.findIndex(({ path }) => /^(?:[A-Za-z]:|~)?[\\/]/.test(path));
+            if (absolute >= 0)
+                throw refuse(`Finding ${absolute + 1} names its file by an absolute path. Name it by its path in the repository, as git diff shows it (for example src/app.ts), and call review.submit again.`, 'review.submit');
+            const checked = input.findings.map((finding) => ({
+                finding,
+                mask: maskFinding(finding.description),
+            }));
+            const unsafe = checked.findIndex(({ mask }) => mask.left);
+            if (unsafe >= 0)
+                throw refuse(`The description of finding ${unsafe + 1} still looks like it holds private data (${checked[unsafe].mask.left}) after e-mail addresses, IP addresses and user folders were masked. Describe the problem without the value itself, for example "a secret is committed in this file", and call review.submit again.`, 'review.submit');
+            const findings = checked.map(({ finding, mask }) => ({
+                ...finding,
+                description: mask.text,
+            }));
+            const idempotencyKey = deterministicUuid('review.submit', input.roundId, stableStringify(findings));
+            const response = await this.dependencies.client.request(endpoints.reviewRoundResult(input.projectId, input.roundId), { method: 'POST', body: cleanJson({ idempotencyKey, findings }) });
+            const comment = await this.reviewComment(input.projectId, response.data);
+            return asJsonValue({
+                review: response.data,
+                masked: [...new Set(checked.flatMap(({ mask }) => mask.masked))],
+                ...(comment ? { comment } : {}),
+            });
+        });
+    }
+    async reviewRejectFinding(input) {
+        return this.execute(async () => {
+            const response = await this.dependencies.client.request(endpoints.reviewFindingRejection(input.projectId, input.findingId), { method: 'POST', body: { reason: input.reason } });
+            const comment = await this.reviewComment(input.projectId, response.data);
+            return asJsonValue({ ...objectOrEmpty(response.data), ...(comment ? { comment } : {}) });
+        });
+    }
+    async reviewConclude(input) {
+        return this.execute(async () => {
+            const path = input.outcome === 'passed'
+                ? endpoints.reviewPass(input.projectId, input.taskId)
+                : input.outcome === 'skipped'
+                    ? endpoints.reviewSkip(input.projectId, input.taskId)
+                    : endpoints.reviewExemption(input.projectId, input.taskId);
+            const response = await this.dependencies.client.request(path, {
+                method: 'POST',
+                ...(input.outcome === 'exempted' ? { body: { reason: input.reason ?? '' } } : {}),
+            });
+            const comment = await this.reviewComment(input.projectId, response.data);
+            return asJsonValue({ ...objectOrEmpty(response.data), ...(comment ? { comment } : {}) });
+        });
+    }
+    async reviewMakeReady(input) {
+        return this.execute(async () => {
+            const data = (await this.dependencies.client.request(endpoints.review(input.projectId, input.taskId))).data;
+            const { delivery } = reviewSchema.parse(data);
+            const task = delivery.externalTaskId;
+            const request = delivery.reviewRequest;
+            if (waitingReview.includes(delivery.reviewState ?? ''))
+                throw refuse(`The review of ${task} has not ended (${delivery.reviewState}), so its PR/MR stays a draft until it does.`, 'review.get');
+            if (!request)
+                return asJsonValue({
+                    ready: false,
+                    nextAction: `No PR/MR is recorded for ${task}. Open it now as ready: on GitLab task.open_review_request with draft false; elsewhere with your own tools, then record it with task.review_request.`,
+                });
+            const comment = await this.reviewComment(input.projectId, data);
+            const commented = comment ? { comment } : {};
+            if (request.state !== 'draft')
+                return asJsonValue({
+                    ready: request.state === 'ready',
+                    pullRequest: { url: request.url, state: request.state },
+                    ...commented,
+                    nextAction: `${request.url} is ${request.state} already; nothing was changed.`,
+                });
+            if (request.provider !== 'gitlab' || !this.dependencies.gitlab)
+                return asJsonValue({
+                    ready: false,
+                    pullRequest: { url: request.url, state: request.state },
+                    ...commented,
+                    nextAction: `Mark ${request.url} ready for review with your own tools (on GitHub, gh pr ready or the "Ready for review" button), or ask the user to, then record it with task.review_request state ready.`,
+                });
+            const readied = await this.dependencies.gitlab.requests
+                .markReady(request)
+                .catch(async (error) => {
+                const failure = error instanceof BridgeRecoveryError ? objectValue(error.details)?.failure : undefined;
+                if (delivery.providerJob === 'make_ready' && typeof failure === 'string')
+                    await this.dependencies.client
+                        .request(endpoints.reviewProviderFailure(input.projectId, input.taskId), {
+                        method: 'POST',
+                        body: { job: 'make_ready', failure },
+                    })
+                        .catch(() => undefined);
+                throw error;
+            });
+            if (readied.state !== 'ready')
+                return asJsonValue({
+                    ready: false,
+                    pullRequest: readied,
+                    ...commented,
+                    nextAction: `GitLab still shows ${readied.url} as ${readied.state}. Ask the user to mark it ready in GitLab ("Mark as ready"); Engineering Memory follows it.`,
+                });
+            const report = await this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: readied.url, state: 'ready', source: 'machine' });
+            return asJsonValue({ ready: true, pullRequest: readied, ...commented, report });
+        });
+    }
+    async review(projectId, taskId) {
+        return reviewSchema.parse((await this.dependencies.client.request(endpoints.review(projectId, taskId))).data);
+    }
+    async reviewComment(projectId, data) {
+        const review = commentReviewSchema.safeParse(data);
+        const request = review.success ? review.data.delivery.reviewRequest : null;
+        const comment = review.success && request ? dueComment(review.data, (await this.language()) ?? 'en') : null;
+        if (!review.success || !request || !comment)
+            return null;
+        const taskId = review.data.delivery.taskId;
+        if (request.provider === 'gitlab' && this.dependencies.gitlab) {
+            const written = await this.dependencies.gitlab.requests.comment(projectId, taskId, request, comment);
+            if (written.posted)
+                return { posted: true };
+            return {
+                posted: false,
+                ...(written.failure ? { failure: written.failure } : {}),
+                nextAction: written.failure
+                    ? `GitLab refused the review comment on ${request.url} (${written.failure.replace(/_/g, ' ')}); a member computer with a GitLab token writes it later, and nothing waits for it.`
+                    : `No GitLab token is saved on this computer, so the review comment was not written on ${request.url}; a member computer with a GitLab token writes it later, and gitlab.token lets this computer write it too.`,
+            };
+        }
+        await markComment(this.dependencies.client, projectId, taskId, comment);
+        return {
+            posted: false,
+            body: comment.body,
+            nextAction: `Post body unchanged as a comment on ${request.url} with your own tools (on GitHub, gh pr comment with the body in a file), so the team sees the review there. It is recorded as handed over and is not handed over again.`,
+        };
+    }
     async reportDeliveryOutcome(report) {
         const path = report.outcome === 'delivered'
             ? endpoints.taskDeliveryDeliver(report.projectId, report.taskId)
@@ -5954,6 +6313,21 @@ function slugify(value) {
         .replace(/[^a-z0-9]+/g, '-')
         .replace(/^-|-$/g, '');
 }
+const reviewPolicySchema = z.enum(['none', 'optional', 'required']);
+const reviewSchema = z.object({
+    delivery: reviewDeliverySchema.extend({
+        externalTaskId: z.string(),
+        workItemId: z.string().nullish(),
+        reviewPolicy: reviewPolicySchema.optional(),
+    }),
+    rounds: z.array(z.object({
+        id: z.string(),
+        number: z.number().int(),
+        state: z.string(),
+        headCommit: z.string(),
+    })),
+    findings: z.array(z.unknown()),
+});
 function deterministicUuid(...parts) {
     const value = sha256(parts.join('\n')).slice(0, 32).split('');
     value[12] = '5';
@@ -5973,11 +6347,6 @@ function classifyError(error) {
     }
     return 'bridge_delivery_error';
 }
-function backendRejectsField(error, fields) {
-    return (error instanceof ApiResponseError &&
-        error.httpStatus === 400 &&
-        fields.some((field) => error.message.includes(`property ${field} should not exist`)));
-}
 function isDefinitiveAuthenticationFailure(error) {
     return (error instanceof ApiResponseError &&
         (error.httpStatus === 400 || error.httpStatus === 401 || error.httpStatus === 403));

package/runtime/dist/src/runtime/create-bridge-service.js

@@ -113,7 +113,7 @@ export function createBridgeService(options = {}) {
         gitlab: {
             tokens: gitlabTokens,
             page: new GitLabTokenPage(gitlabTokens, gitlab, signedInLanguage),
-            requests: new MergeRequests(client, gitlabTokens, gitlab, git),
+            requests: new MergeRequests(client, gitlabTokens, gitlab, git, signedInLanguage),
         },
     }));
 }

package/runtime/dist/src/runtime/live-signals.js

@@ -29,6 +29,9 @@ const kindByPrefix = [
     ['sync-start-', 'project_onboarding'],
     ['workflow-apply-', 'project_onboarding'],
     ['status-description-', 'project_onboarding'],
+    ['review-policy-', 'review_decision'],
+    ['review-reject-', 'review_decision'],
+    ['review-conclude-', 'review_decision'],
 ];
 export function liveQuestionKind(record) {
     if (record.owner?.tool === 'decision.mode')