gitlab-ai-provider 5.0.0

package/dist/index.mjs

@@ -0,0 +1,4220 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/gitlab-anthropic-language-model.ts
+import Anthropic from "@anthropic-ai/sdk";
+
+// src/gitlab-direct-access.ts
+import { z } from "zod";
+
+// src/gitlab-error.ts
+var GitLabError = class _GitLabError extends Error {
+  statusCode;
+  responseBody;
+  cause;
+  constructor(options) {
+    super(options.message);
+    this.name = "GitLabError";
+    this.statusCode = options.statusCode;
+    this.responseBody = options.responseBody;
+    this.cause = options.cause;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _GitLabError);
+    }
+  }
+  static fromResponse(response, body) {
+    return new _GitLabError({
+      message: `GitLab API error: ${response.status} ${response.statusText}`,
+      statusCode: response.status,
+      responseBody: body
+    });
+  }
+  isAuthError() {
+    return this.statusCode === 401;
+  }
+  isRateLimitError() {
+    return this.statusCode === 429;
+  }
+  isForbiddenError() {
+    return this.statusCode === 403;
+  }
+  isServerError() {
+    return this.statusCode !== void 0 && this.statusCode >= 500;
+  }
+  /**
+   * Check if this error is a context overflow error (prompt too long).
+   * These errors occur when the conversation exceeds the model's token limit.
+   */
+  isContextOverflowError() {
+    if (this.statusCode !== 400) {
+      return false;
+    }
+    const message = this.message?.toLowerCase() || "";
+    return message.includes("context overflow") || message.includes("prompt is too long") || message.includes("prompt too long") || message.includes("tokens") && message.includes("maximum");
+  }
+};
+
+// src/gitlab-direct-access.ts
+var directAccessTokenSchema = z.object({
+  headers: z.record(z.string()),
+  token: z.string()
+});
+var DEFAULT_AI_GATEWAY_URL = "https://cloud.gitlab.com";
+var GitLabDirectAccessClient = class {
+  config;
+  fetchFn;
+  aiGatewayUrl;
+  cachedToken = null;
+  tokenExpiresAt = 0;
+  constructor(config) {
+    this.config = config;
+    this.fetchFn = config.fetch ?? fetch;
+    this.aiGatewayUrl = config.aiGatewayUrl || process.env["GITLAB_AI_GATEWAY_URL"] || DEFAULT_AI_GATEWAY_URL;
+  }
+  /**
+   * Get a direct access token for the Anthropic proxy.
+   * Tokens are cached for 25 minutes (they expire after 30 minutes).
+   * @param forceRefresh - If true, ignores the cache and fetches a new token
+   */
+  async getDirectAccessToken(forceRefresh = false) {
+    const now = Date.now();
+    if (!forceRefresh && this.cachedToken && this.tokenExpiresAt > now) {
+      return this.cachedToken;
+    }
+    if (forceRefresh) {
+      this.invalidateToken();
+    }
+    const url = `${this.config.instanceUrl}/api/v4/ai/third_party_agents/direct_access`;
+    const requestBody = {};
+    if (this.config.featureFlags && Object.keys(this.config.featureFlags).length > 0) {
+      requestBody.feature_flags = this.config.featureFlags;
+    }
+    try {
+      const response = await this.fetchFn(url, {
+        method: "POST",
+        headers: {
+          ...this.config.getHeaders(),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(requestBody)
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        if (response.status === 401 && this.config.refreshApiKey && !forceRefresh) {
+          try {
+            await this.config.refreshApiKey();
+            return await this.getDirectAccessToken(true);
+          } catch (refreshError) {
+            throw new GitLabError({
+              message: `Failed to get direct access token: ${response.status} ${response.statusText} - ${errorText}`,
+              statusCode: response.status,
+              responseBody: errorText
+            });
+          }
+        }
+        if (response.status === 403) {
+          throw new GitLabError({
+            message: `Access denied to GitLab AI features (${this.config.instanceUrl}). This may indicate that: (1) GitLab Duo is not enabled on this instance, (2) Your account does not have access to AI features, or (3) The third-party agents feature is not available. Original error: ${response.status} ${response.statusText} - ${errorText}`,
+            statusCode: response.status,
+            responseBody: errorText
+          });
+        }
+        throw new GitLabError({
+          message: `Failed to get direct access token: ${response.status} ${response.statusText} - ${errorText}`,
+          statusCode: response.status,
+          responseBody: errorText
+        });
+      }
+      const data = await response.json();
+      const token = directAccessTokenSchema.parse(data);
+      this.cachedToken = token;
+      this.tokenExpiresAt = now + 25 * 60 * 1e3;
+      return token;
+    } catch (error) {
+      if (error instanceof GitLabError) {
+        throw error;
+      }
+      throw new GitLabError({
+        message: `Failed to get direct access token: ${error}`,
+        cause: error
+      });
+    }
+  }
+  /**
+   * Get the Anthropic proxy base URL
+   */
+  getAnthropicProxyUrl() {
+    const baseUrl = this.aiGatewayUrl.replace(/\/$/, "");
+    return `${baseUrl}/ai/v1/proxy/anthropic/`;
+  }
+  /**
+   * Get the OpenAI proxy base URL
+   * Note: The OpenAI SDK expects a base URL like https://api.openai.com/v1
+   * and appends paths like /chat/completions. So we need /v1 at the end.
+   */
+  getOpenAIProxyUrl() {
+    const baseUrl = this.aiGatewayUrl.replace(/\/$/, "");
+    return `${baseUrl}/ai/v1/proxy/openai/v1`;
+  }
+  /**
+   * Invalidate the cached token
+   */
+  invalidateToken() {
+    this.cachedToken = null;
+    this.tokenExpiresAt = 0;
+  }
+};
+
+// src/gitlab-anthropic-language-model.ts
+var GitLabAnthropicLanguageModel = class {
+  specificationVersion = "v2";
+  modelId;
+  supportedUrls = {};
+  config;
+  directAccessClient;
+  anthropicClient = null;
+  constructor(modelId, config) {
+    this.modelId = modelId;
+    this.config = config;
+    this.directAccessClient = new GitLabDirectAccessClient({
+      instanceUrl: config.instanceUrl,
+      getHeaders: config.getHeaders,
+      refreshApiKey: config.refreshApiKey,
+      fetch: config.fetch,
+      featureFlags: config.featureFlags,
+      aiGatewayUrl: config.aiGatewayUrl
+    });
+  }
+  get provider() {
+    return this.config.provider;
+  }
+  /**
+   * Get or create an Anthropic client with valid credentials
+   * @param forceRefresh - If true, forces a token refresh before creating the client
+   */
+  async getAnthropicClient(forceRefresh = false) {
+    const tokenData = await this.directAccessClient.getDirectAccessToken(forceRefresh);
+    const { "x-api-key": _removed, ...filteredHeaders } = tokenData.headers;
+    const mergedHeaders = {
+      ...filteredHeaders,
+      ...this.config.aiGatewayHeaders
+    };
+    this.anthropicClient = new Anthropic({
+      apiKey: null,
+      authToken: tokenData.token,
+      baseURL: this.directAccessClient.getAnthropicProxyUrl(),
+      defaultHeaders: mergedHeaders
+    });
+    return this.anthropicClient;
+  }
+  /**
+   * Check if an error is a token-related authentication error that can be retried
+   */
+  isTokenError(error) {
+    if (error instanceof Anthropic.APIError) {
+      if (error.status === 401) {
+        return true;
+      }
+      const message = error.message?.toLowerCase() || "";
+      if (message.includes("token") && (message.includes("expired") || message.includes("revoked") || message.includes("invalid"))) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Check if an error is a context overflow error (prompt too long)
+   * These should NOT trigger token refresh and should be reported to the user.
+   */
+  isContextOverflowError(error) {
+    if (error instanceof Anthropic.APIError) {
+      if (error.status === 400) {
+        const message = error.message?.toLowerCase() || "";
+        if (message.includes("prompt is too long") || message.includes("prompt too long") || message.includes("tokens") && message.includes("maximum")) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+  /**
+   * Convert AI SDK tools to Anthropic tool format
+   */
+  convertTools(tools) {
+    if (!tools || tools.length === 0) {
+      return void 0;
+    }
+    return tools.filter((tool) => tool.type === "function").map((tool) => {
+      const schema = tool.inputSchema;
+      return {
+        name: tool.name,
+        description: tool.description || "",
+        input_schema: {
+          type: "object",
+          properties: schema?.properties || {},
+          required: schema?.required || []
+        }
+      };
+    });
+  }
+  /**
+   * Convert AI SDK tool choice to Anthropic format
+   */
+  convertToolChoice(toolChoice) {
+    if (!toolChoice) {
+      return void 0;
+    }
+    switch (toolChoice.type) {
+      case "auto":
+        return { type: "auto" };
+      case "none":
+        return void 0;
+      case "required":
+        return { type: "any" };
+      case "tool":
+        return { type: "tool", name: toolChoice.toolName };
+      default:
+        return void 0;
+    }
+  }
+  /**
+   * Convert AI SDK prompt to Anthropic messages format
+   */
+  convertPrompt(prompt) {
+    let systemMessage;
+    const messages = [];
+    for (const message of prompt) {
+      if (message.role === "system") {
+        systemMessage = message.content;
+        continue;
+      }
+      if (message.role === "user") {
+        const content = [];
+        for (const part of message.content) {
+          if (part.type === "text") {
+            content.push({ type: "text", text: part.text });
+          } else if (part.type === "file") {
+          }
+        }
+        if (content.length > 0) {
+          messages.push({ role: "user", content });
+        }
+      } else if (message.role === "assistant") {
+        const content = [];
+        for (const part of message.content) {
+          if (part.type === "text") {
+            content.push({ type: "text", text: part.text });
+          } else if (part.type === "tool-call") {
+            content.push({
+              type: "tool_use",
+              id: part.toolCallId,
+              name: part.toolName,
+              input: typeof part.input === "string" ? JSON.parse(part.input) : part.input
+            });
+          }
+        }
+        if (content.length > 0) {
+          messages.push({ role: "assistant", content });
+        }
+      } else if (message.role === "tool") {
+        const content = [];
+        for (const part of message.content) {
+          if (part.type === "tool-result") {
+            let resultContent;
+            if (part.output.type === "text") {
+              resultContent = part.output.value;
+            } else if (part.output.type === "json") {
+              resultContent = JSON.stringify(part.output.value);
+            } else if (part.output.type === "error-text") {
+              resultContent = part.output.value;
+            } else if (part.output.type === "error-json") {
+              resultContent = JSON.stringify(part.output.value);
+            } else {
+              resultContent = JSON.stringify(part.output);
+            }
+            content.push({
+              type: "tool_result",
+              tool_use_id: part.toolCallId,
+              content: resultContent,
+              is_error: part.output.type.startsWith("error")
+            });
+          }
+        }
+        if (content.length > 0) {
+          messages.push({ role: "user", content });
+        }
+      }
+    }
+    return { system: systemMessage, messages };
+  }
+  /**
+   * Convert Anthropic finish reason to AI SDK format
+   */
+  convertFinishReason(stopReason) {
+    switch (stopReason) {
+      case "end_turn":
+        return "stop";
+      case "stop_sequence":
+        return "stop";
+      case "max_tokens":
+        return "length";
+      case "tool_use":
+        return "tool-calls";
+      default:
+        return "unknown";
+    }
+  }
+  async doGenerate(options) {
+    return this.doGenerateWithRetry(options, false);
+  }
+  async doGenerateWithRetry(options, isRetry) {
+    const client = await this.getAnthropicClient(isRetry);
+    const { system, messages } = this.convertPrompt(options.prompt);
+    const tools = this.convertTools(options.tools);
+    const toolChoice = options.toolChoice?.type !== "none" ? this.convertToolChoice(options.toolChoice) : void 0;
+    const anthropicModel = this.config.anthropicModel || "claude-sonnet-4-5-20250929";
+    const maxTokens = options.maxOutputTokens || this.config.maxTokens || 8192;
+    try {
+      const response = await client.messages.create({
+        model: anthropicModel,
+        max_tokens: maxTokens,
+        system,
+        messages,
+        tools,
+        tool_choice: tools ? toolChoice : void 0,
+        temperature: options.temperature,
+        top_p: options.topP,
+        stop_sequences: options.stopSequences
+      });
+      const content = [];
+      for (const block of response.content) {
+        if (block.type === "text") {
+          content.push({
+            type: "text",
+            text: block.text
+          });
+        } else if (block.type === "tool_use") {
+          content.push({
+            type: "tool-call",
+            toolCallId: block.id,
+            toolName: block.name,
+            input: JSON.stringify(block.input)
+          });
+        }
+      }
+      const usage = {
+        inputTokens: response.usage.input_tokens,
+        outputTokens: response.usage.output_tokens,
+        totalTokens: response.usage.input_tokens + response.usage.output_tokens
+      };
+      return {
+        content,
+        finishReason: this.convertFinishReason(response.stop_reason),
+        usage,
+        warnings: []
+      };
+    } catch (error) {
+      if (this.isContextOverflowError(error)) {
+        const apiError = error;
+        throw new GitLabError({
+          message: `Context overflow: ${apiError.message}. Please start a new session or use /compact to reduce context.`,
+          statusCode: 400,
+          cause: error
+        });
+      }
+      if (!isRetry && this.isTokenError(error)) {
+        this.directAccessClient.invalidateToken();
+        return this.doGenerateWithRetry(options, true);
+      }
+      if (error instanceof Anthropic.APIError) {
+        throw new GitLabError({
+          message: `Anthropic API error: ${error.message}`,
+          statusCode: error.status,
+          cause: error
+        });
+      }
+      throw error;
+    }
+  }
+  async doStream(options) {
+    return this.doStreamWithRetry(options, false);
+  }
+  async doStreamWithRetry(options, isRetry) {
+    const client = await this.getAnthropicClient(isRetry);
+    const { system, messages } = this.convertPrompt(options.prompt);
+    const tools = this.convertTools(options.tools);
+    const toolChoice = options.toolChoice?.type !== "none" ? this.convertToolChoice(options.toolChoice) : void 0;
+    const anthropicModel = this.config.anthropicModel || "claude-sonnet-4-5-20250929";
+    const maxTokens = options.maxOutputTokens || this.config.maxTokens || 8192;
+    const requestBody = {
+      model: anthropicModel,
+      max_tokens: maxTokens,
+      system,
+      messages,
+      tools,
+      tool_choice: tools ? toolChoice : void 0,
+      temperature: options.temperature,
+      top_p: options.topP,
+      stop_sequences: options.stopSequences,
+      stream: true
+    };
+    const self = this;
+    const stream = new ReadableStream({
+      start: async (controller) => {
+        const contentBlocks = {};
+        const usage = {
+          inputTokens: 0,
+          outputTokens: 0,
+          totalTokens: 0
+        };
+        let finishReason = "unknown";
+        try {
+          const anthropicStream = client.messages.stream(requestBody, {
+            signal: options.abortSignal
+          });
+          controller.enqueue({
+            type: "stream-start",
+            warnings: []
+          });
+          await new Promise((resolve2, reject) => {
+            anthropicStream.on("streamEvent", (event) => {
+              try {
+                switch (event.type) {
+                  case "message_start":
+                    if (event.message.usage) {
+                      usage.inputTokens = event.message.usage.input_tokens;
+                    }
+                    controller.enqueue({
+                      type: "response-metadata",
+                      id: event.message.id,
+                      modelId: event.message.model
+                    });
+                    break;
+                  case "content_block_start":
+                    if (event.content_block.type === "text") {
+                      const textId = `text-${event.index}`;
+                      contentBlocks[event.index] = { type: "text", id: textId };
+                      controller.enqueue({
+                        type: "text-start",
+                        id: textId
+                      });
+                    } else if (event.content_block.type === "tool_use") {
+                      contentBlocks[event.index] = {
+                        type: "tool-call",
+                        toolCallId: event.content_block.id,
+                        toolName: event.content_block.name,
+                        input: ""
+                      };
+                      controller.enqueue({
+                        type: "tool-input-start",
+                        id: event.content_block.id,
+                        toolName: event.content_block.name
+                      });
+                    }
+                    break;
+                  case "content_block_delta": {
+                    const block = contentBlocks[event.index];
+                    if (event.delta.type === "text_delta" && block?.type === "text") {
+                      controller.enqueue({
+                        type: "text-delta",
+                        id: block.id,
+                        delta: event.delta.text
+                      });
+                    } else if (event.delta.type === "input_json_delta" && block?.type === "tool-call") {
+                      block.input += event.delta.partial_json;
+                      controller.enqueue({
+                        type: "tool-input-delta",
+                        id: block.toolCallId,
+                        delta: event.delta.partial_json
+                      });
+                    }
+                    break;
+                  }
+                  case "content_block_stop": {
+                    const block = contentBlocks[event.index];
+                    if (block?.type === "text") {
+                      controller.enqueue({
+                        type: "text-end",
+                        id: block.id
+                      });
+                    } else if (block?.type === "tool-call") {
+                      controller.enqueue({
+                        type: "tool-input-end",
+                        id: block.toolCallId
+                      });
+                      controller.enqueue({
+                        type: "tool-call",
+                        toolCallId: block.toolCallId,
+                        toolName: block.toolName,
+                        input: block.input === "" ? "{}" : block.input
+                      });
+                    }
+                    delete contentBlocks[event.index];
+                    break;
+                  }
+                  case "message_delta":
+                    if (event.usage) {
+                      usage.outputTokens = event.usage.output_tokens;
+                      usage.totalTokens = (usage.inputTokens || 0) + event.usage.output_tokens;
+                    }
+                    if (event.delta.stop_reason) {
+                      finishReason = self.convertFinishReason(event.delta.stop_reason);
+                    }
+                    break;
+                  case "message_stop": {
+                    controller.enqueue({
+                      type: "finish",
+                      finishReason,
+                      usage
+                    });
+                    break;
+                  }
+                }
+              } catch (error) {
+                controller.enqueue({
+                  type: "error",
+                  error: error instanceof Error ? error : new Error(String(error))
+                });
+              }
+            });
+            anthropicStream.on("end", () => {
+              resolve2();
+            });
+            anthropicStream.on("error", (error) => {
+              reject(error);
+            });
+          });
+          for (const [, block] of Object.entries(contentBlocks)) {
+            if (block.type === "tool-call") {
+              controller.enqueue({
+                type: "tool-input-end",
+                id: block.toolCallId
+              });
+              controller.enqueue({
+                type: "tool-call",
+                toolCallId: block.toolCallId,
+                toolName: block.toolName,
+                input: block.input === "" ? "{}" : block.input
+              });
+            }
+          }
+          controller.close();
+        } catch (error) {
+          for (const [, block] of Object.entries(contentBlocks)) {
+            if (block.type === "tool-call") {
+              controller.enqueue({
+                type: "tool-input-end",
+                id: block.toolCallId
+              });
+              controller.enqueue({
+                type: "tool-call",
+                toolCallId: block.toolCallId,
+                toolName: block.toolName,
+                input: block.input === "" ? "{}" : block.input
+              });
+            }
+          }
+          if (self.isContextOverflowError(error)) {
+            const apiError = error;
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({
+                message: `Context overflow: ${apiError.message}. Please start a new session or use /compact to reduce context.`,
+                statusCode: 400,
+                cause: error
+              })
+            });
+            controller.close();
+            return;
+          }
+          if (!isRetry && self.isTokenError(error)) {
+            self.directAccessClient.invalidateToken();
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({
+                message: "TOKEN_REFRESH_NEEDED",
+                cause: error
+              })
+            });
+            controller.close();
+            return;
+          }
+          if (error instanceof Anthropic.APIError) {
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({
+                message: `Anthropic API error: ${error.message}`,
+                statusCode: error.status,
+                cause: error
+              })
+            });
+          } else {
+            controller.enqueue({
+              type: "error",
+              error
+            });
+          }
+          controller.close();
+        }
+      }
+    });
+    return {
+      stream,
+      request: { body: requestBody }
+    };
+  }
+};
+
+// src/gitlab-openai-language-model.ts
+import OpenAI from "openai";
+
+// src/model-mappings.ts
+var MODEL_MAPPINGS = {
+  // Anthropic models
+  "duo-chat-opus-4-6": { provider: "anthropic", model: "claude-opus-4-6" },
+  "duo-chat-sonnet-4-6": { provider: "anthropic", model: "claude-sonnet-4-6" },
+  "duo-chat-opus-4-5": { provider: "anthropic", model: "claude-opus-4-5-20251101" },
+  "duo-chat-sonnet-4-5": { provider: "anthropic", model: "claude-sonnet-4-5-20250929" },
+  "duo-chat-haiku-4-5": { provider: "anthropic", model: "claude-haiku-4-5-20251001" },
+  // OpenAI models - Chat Completions API
+  "duo-chat-gpt-5-1": { provider: "openai", model: "gpt-5.1-2025-11-13", openaiApiType: "chat" },
+  "duo-chat-gpt-5-2": { provider: "openai", model: "gpt-5.2-2025-12-11", openaiApiType: "chat" },
+  "duo-chat-gpt-5-mini": {
+    provider: "openai",
+    model: "gpt-5-mini-2025-08-07",
+    openaiApiType: "chat"
+  },
+  // OpenAI models - Responses API (Codex models)
+  "duo-chat-gpt-5-codex": { provider: "openai", model: "gpt-5-codex", openaiApiType: "responses" },
+  "duo-chat-gpt-5-2-codex": {
+    provider: "openai",
+    model: "gpt-5.2-codex",
+    openaiApiType: "responses"
+  },
+  "duo-chat-gpt-5-3-codex": {
+    provider: "openai",
+    model: "gpt-5.3-codex",
+    openaiApiType: "responses"
+  },
+  // Duo Agent Platform model (server-side agentic via DWS WebSocket).
+  // This is the single user-facing model ID. The actual underlying model ref
+  // is resolved dynamically at runtime via GitLabModelDiscovery.
+  "duo-workflow": { provider: "workflow", model: "default" },
+  // Internal model refs — kept for backwards compatibility and direct use.
+  // Not intended as user-facing model IDs.
+  "duo-workflow-default": { provider: "workflow", model: "default" },
+  "duo-workflow-sonnet-4-5": {
+    provider: "workflow",
+    model: "anthropic/claude-sonnet-4-5-20250929"
+  },
+  "duo-workflow-sonnet-4-6": { provider: "workflow", model: "claude_sonnet_4_6" },
+  "duo-workflow-opus-4-5": {
+    provider: "workflow",
+    model: "anthropic/claude-opus-4-5-20251101"
+  },
+  "duo-workflow-haiku-4-5": { provider: "workflow", model: "claude_haiku_4_5_20251001" },
+  "duo-workflow-opus-4-6": { provider: "workflow", model: "claude_opus_4_6_20260205" }
+};
+function getModelMapping(modelId) {
+  return MODEL_MAPPINGS[modelId];
+}
+function getProviderForModelId(modelId) {
+  return MODEL_MAPPINGS[modelId]?.provider;
+}
+function getValidModelsForProvider(provider) {
+  return Object.values(MODEL_MAPPINGS).filter((m) => m.provider === provider).map((m) => m.model);
+}
+function getAnthropicModelForModelId(modelId) {
+  const mapping = MODEL_MAPPINGS[modelId];
+  return mapping?.provider === "anthropic" ? mapping.model : void 0;
+}
+function getOpenAIModelForModelId(modelId) {
+  const mapping = MODEL_MAPPINGS[modelId];
+  return mapping?.provider === "openai" ? mapping.model : void 0;
+}
+function getOpenAIApiType(modelId) {
+  const mapping = MODEL_MAPPINGS[modelId];
+  return mapping?.openaiApiType ?? "chat";
+}
+function isResponsesApiModel(modelId) {
+  return getOpenAIApiType(modelId) === "responses";
+}
+function isWorkflowModel(modelId) {
+  return MODEL_MAPPINGS[modelId]?.provider === "workflow";
+}
+function getWorkflowModelRef(modelId) {
+  const mapping = MODEL_MAPPINGS[modelId];
+  return mapping?.provider === "workflow" ? mapping.model : void 0;
+}
+var MODEL_ID_TO_ANTHROPIC_MODEL = Object.fromEntries(
+  Object.entries(MODEL_MAPPINGS).filter(([, v]) => v.provider === "anthropic").map(([k, v]) => [k, v.model])
+);
+
+// src/gitlab-openai-language-model.ts
+var GitLabOpenAILanguageModel = class {
+  specificationVersion = "v2";
+  modelId;
+  supportedUrls = {};
+  config;
+  directAccessClient;
+  useResponsesApi;
+  openaiClient = null;
+  constructor(modelId, config) {
+    this.modelId = modelId;
+    this.config = config;
+    this.useResponsesApi = config.useResponsesApi ?? isResponsesApiModel(modelId);
+    this.directAccessClient = new GitLabDirectAccessClient({
+      instanceUrl: config.instanceUrl,
+      getHeaders: config.getHeaders,
+      refreshApiKey: config.refreshApiKey,
+      fetch: config.fetch,
+      featureFlags: config.featureFlags,
+      aiGatewayUrl: config.aiGatewayUrl
+    });
+  }
+  get provider() {
+    return this.config.provider;
+  }
+  async getOpenAIClient(forceRefresh = false) {
+    const tokenData = await this.directAccessClient.getDirectAccessToken(forceRefresh);
+    const { "x-api-key": _removed, ...filteredHeaders } = tokenData.headers;
+    const mergedHeaders = {
+      ...filteredHeaders,
+      ...this.config.aiGatewayHeaders
+    };
+    this.openaiClient = new OpenAI({
+      apiKey: tokenData.token,
+      baseURL: this.directAccessClient.getOpenAIProxyUrl(),
+      defaultHeaders: mergedHeaders
+    });
+    return this.openaiClient;
+  }
+  isTokenError(error) {
+    if (error instanceof OpenAI.APIError) {
+      if (error.status === 401) {
+        return true;
+      }
+      const message = error.message?.toLowerCase() || "";
+      if (message.includes("token") && (message.includes("expired") || message.includes("revoked") || message.includes("invalid"))) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Check if an error is a context overflow error (prompt too long)
+   * These should NOT trigger token refresh and should be reported to the user.
+   */
+  isContextOverflowError(error) {
+    if (error instanceof OpenAI.APIError) {
+      if (error.status === 400) {
+        const message = error.message?.toLowerCase() || "";
+        if (message.includes("prompt is too long") || message.includes("prompt too long") || message.includes("tokens") && message.includes("maximum")) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+  convertTools(tools) {
+    if (!tools || tools.length === 0) {
+      return void 0;
+    }
+    return tools.filter((tool) => tool.type === "function").map((tool) => {
+      const schema = tool.inputSchema;
+      return {
+        type: "function",
+        function: {
+          name: tool.name,
+          description: tool.description || "",
+          // Ensure the schema has type: 'object' as OpenAI requires it
+          parameters: {
+            type: "object",
+            ...schema
+          }
+        }
+      };
+    });
+  }
+  convertToolChoice(toolChoice) {
+    if (!toolChoice) {
+      return void 0;
+    }
+    switch (toolChoice.type) {
+      case "auto":
+        return "auto";
+      case "none":
+        return "none";
+      case "required":
+        return "required";
+      case "tool":
+        return { type: "function", function: { name: toolChoice.toolName } };
+      default:
+        return void 0;
+    }
+  }
+  convertPrompt(prompt) {
+    const messages = [];
+    for (const message of prompt) {
+      if (message.role === "system") {
+        messages.push({ role: "system", content: message.content });
+        continue;
+      }
+      if (message.role === "user") {
+        const textParts = message.content.filter((part) => part.type === "text").map((part) => part.text);
+        if (textParts.length > 0) {
+          messages.push({ role: "user", content: textParts.join("\n") });
+        }
+      } else if (message.role === "assistant") {
+        const textParts = [];
+        const toolCalls = [];
+        for (const part of message.content) {
+          if (part.type === "text") {
+            textParts.push(part.text);
+          } else if (part.type === "tool-call") {
+            toolCalls.push({
+              id: part.toolCallId,
+              type: "function",
+              function: {
+                name: part.toolName,
+                arguments: typeof part.input === "string" ? part.input : JSON.stringify(part.input)
+              }
+            });
+          }
+        }
+        const assistantMessage = {
+          role: "assistant",
+          content: textParts.length > 0 ? textParts.join("\n") : null
+        };
+        if (toolCalls.length > 0) {
+          assistantMessage.tool_calls = toolCalls;
+        }
+        messages.push(assistantMessage);
+      } else if (message.role === "tool") {
+        for (const part of message.content) {
+          if (part.type === "tool-result") {
+            let resultContent;
+            if (part.output.type === "text") {
+              resultContent = part.output.value;
+            } else if (part.output.type === "json") {
+              resultContent = JSON.stringify(part.output.value);
+            } else if (part.output.type === "error-text") {
+              resultContent = part.output.value;
+            } else if (part.output.type === "error-json") {
+              resultContent = JSON.stringify(part.output.value);
+            } else {
+              resultContent = JSON.stringify(part.output);
+            }
+            messages.push({
+              role: "tool",
+              tool_call_id: part.toolCallId,
+              content: resultContent
+            });
+          }
+        }
+      }
+    }
+    return messages;
+  }
+  convertFinishReason(finishReason) {
+    switch (finishReason) {
+      case "stop":
+        return "stop";
+      case "length":
+        return "length";
+      case "tool_calls":
+        return "tool-calls";
+      case "content_filter":
+        return "content-filter";
+      default:
+        return "unknown";
+    }
+  }
+  /**
+   * Convert tools to Responses API format
+   */
+  convertToolsForResponses(tools) {
+    if (!tools || tools.length === 0) {
+      return void 0;
+    }
+    return tools.filter((tool) => tool.type === "function").map((tool) => {
+      const schema = { ...tool.inputSchema };
+      delete schema["$schema"];
+      return {
+        type: "function",
+        name: tool.name,
+        description: tool.description || "",
+        parameters: schema,
+        strict: false
+      };
+    });
+  }
+  /**
+   * Convert prompt to Responses API input format
+   */
+  convertPromptForResponses(prompt) {
+    const items = [];
+    for (const message of prompt) {
+      if (message.role === "system") {
+        continue;
+      }
+      if (message.role === "user") {
+        const textParts = message.content.filter((part) => part.type === "text").map((part) => part.text);
+        if (textParts.length > 0) {
+          items.push({
+            type: "message",
+            role: "user",
+            content: textParts.map((text) => ({ type: "input_text", text }))
+          });
+        }
+      } else if (message.role === "assistant") {
+        const textParts = [];
+        for (const part of message.content) {
+          if (part.type === "text") {
+            textParts.push(part.text);
+          } else if (part.type === "tool-call") {
+            items.push({
+              type: "function_call",
+              call_id: part.toolCallId,
+              name: part.toolName,
+              arguments: typeof part.input === "string" ? part.input : JSON.stringify(part.input)
+            });
+          }
+        }
+        if (textParts.length > 0) {
+          items.push({
+            type: "message",
+            role: "assistant",
+            content: [{ type: "output_text", text: textParts.join("\n"), annotations: [] }]
+          });
+        }
+      } else if (message.role === "tool") {
+        for (const part of message.content) {
+          if (part.type === "tool-result") {
+            let resultContent;
+            if (part.output.type === "text") {
+              resultContent = part.output.value;
+            } else if (part.output.type === "json") {
+              resultContent = JSON.stringify(part.output.value);
+            } else if (part.output.type === "error-text") {
+              resultContent = part.output.value;
+            } else if (part.output.type === "error-json") {
+              resultContent = JSON.stringify(part.output.value);
+            } else {
+              resultContent = JSON.stringify(part.output);
+            }
+            items.push({
+              type: "function_call_output",
+              call_id: part.toolCallId,
+              output: resultContent
+            });
+          }
+        }
+      }
+    }
+    return items;
+  }
+  /**
+   * Extract system instructions from prompt
+   */
+  extractSystemInstructions(prompt) {
+    const systemMessages = prompt.filter((m) => m.role === "system").map((m) => m.content).join("\n");
+    return systemMessages || void 0;
+  }
+  /**
+   * Convert Responses API status to finish reason
+   * Note: Responses API returns 'completed' even when making tool calls,
+   * so we need to check the content for tool calls separately.
+   */
+  convertResponsesStatus(status, hasToolCalls = false) {
+    if (hasToolCalls) {
+      return "tool-calls";
+    }
+    switch (status) {
+      case "completed":
+        return "stop";
+      case "incomplete":
+        return "length";
+      case "cancelled":
+        return "stop";
+      case "failed":
+        return "error";
+      default:
+        return "unknown";
+    }
+  }
+  async doGenerate(options) {
+    if (this.useResponsesApi) {
+      return this.doGenerateWithResponsesApi(options, false);
+    }
+    return this.doGenerateWithChatApi(options, false);
+  }
+  async doGenerateWithChatApi(options, isRetry) {
+    const client = await this.getOpenAIClient(isRetry);
+    const messages = this.convertPrompt(options.prompt);
+    const tools = this.convertTools(options.tools);
+    const toolChoice = options.toolChoice?.type !== "none" ? this.convertToolChoice(options.toolChoice) : void 0;
+    const openaiModel = this.config.openaiModel || "gpt-4o";
+    const maxTokens = options.maxOutputTokens || this.config.maxTokens || 8192;
+    try {
+      const response = await client.chat.completions.create({
+        model: openaiModel,
+        max_completion_tokens: maxTokens,
+        messages,
+        tools,
+        tool_choice: tools ? toolChoice : void 0,
+        temperature: options.temperature,
+        top_p: options.topP,
+        stop: options.stopSequences
+      });
+      const choice = response.choices[0];
+      const content = [];
+      if (choice?.message.content) {
+        content.push({ type: "text", text: choice.message.content });
+      }
+      if (choice?.message.tool_calls) {
+        for (const toolCall of choice.message.tool_calls) {
+          if (toolCall.type === "function") {
+            content.push({
+              type: "tool-call",
+              toolCallId: toolCall.id,
+              toolName: toolCall.function.name,
+              input: toolCall.function.arguments
+            });
+          }
+        }
+      }
+      const usage = {
+        inputTokens: response.usage?.prompt_tokens || 0,
+        outputTokens: response.usage?.completion_tokens || 0,
+        totalTokens: response.usage?.total_tokens || 0
+      };
+      return {
+        content,
+        finishReason: this.convertFinishReason(choice?.finish_reason),
+        usage,
+        warnings: []
+      };
+    } catch (error) {
+      if (this.isContextOverflowError(error)) {
+        const apiError = error;
+        throw new GitLabError({
+          message: `Context overflow: ${apiError.message}. Please start a new session or use /compact to reduce context.`,
+          statusCode: 400,
+          cause: error
+        });
+      }
+      if (!isRetry && this.isTokenError(error)) {
+        this.directAccessClient.invalidateToken();
+        return this.doGenerateWithChatApi(options, true);
+      }
+      if (error instanceof OpenAI.APIError) {
+        throw new GitLabError({
+          message: `OpenAI API error: ${error.message}`,
+          statusCode: error.status,
+          cause: error
+        });
+      }
+      throw error;
+    }
+  }
+  async doGenerateWithResponsesApi(options, isRetry) {
+    const client = await this.getOpenAIClient(isRetry);
+    const input = this.convertPromptForResponses(options.prompt);
+    const tools = this.convertToolsForResponses(options.tools);
+    const instructions = this.extractSystemInstructions(options.prompt);
+    const openaiModel = this.config.openaiModel || "gpt-5-codex";
+    const maxTokens = options.maxOutputTokens || this.config.maxTokens || 8192;
+    try {
+      const response = await client.responses.create({
+        model: openaiModel,
+        input,
+        instructions,
+        tools,
+        max_output_tokens: maxTokens,
+        temperature: options.temperature,
+        top_p: options.topP,
+        store: false
+      });
+      const content = [];
+      let hasToolCalls = false;
+      for (const item of response.output || []) {
+        if (item.type === "message" && item.role === "assistant") {
+          for (const contentItem of item.content || []) {
+            if (contentItem.type === "output_text") {
+              content.push({ type: "text", text: contentItem.text });
+            }
+          }
+        } else if (item.type === "function_call") {
+          hasToolCalls = true;
+          content.push({
+            type: "tool-call",
+            toolCallId: item.call_id,
+            toolName: item.name,
+            input: item.arguments
+          });
+        }
+      }
+      const usage = {
+        inputTokens: response.usage?.input_tokens || 0,
+        outputTokens: response.usage?.output_tokens || 0,
+        totalTokens: response.usage?.total_tokens || 0
+      };
+      return {
+        content,
+        finishReason: this.convertResponsesStatus(response.status, hasToolCalls),
+        usage,
+        warnings: []
+      };
+    } catch (error) {
+      if (this.isContextOverflowError(error)) {
+        const apiError = error;
+        throw new GitLabError({
+          message: `Context overflow: ${apiError.message}. Please start a new session or use /compact to reduce context.`,
+          statusCode: 400,
+          cause: error
+        });
+      }
+      if (!isRetry && this.isTokenError(error)) {
+        this.directAccessClient.invalidateToken();
+        return this.doGenerateWithResponsesApi(options, true);
+      }
+      if (error instanceof OpenAI.APIError) {
+        throw new GitLabError({
+          message: `OpenAI API error: ${error.message}`,
+          statusCode: error.status,
+          cause: error
+        });
+      }
+      throw error;
+    }
+  }
+  async doStream(options) {
+    if (this.useResponsesApi) {
+      return this.doStreamWithResponsesApi(options, false);
+    }
+    return this.doStreamWithChatApi(options, false);
+  }
+  async doStreamWithChatApi(options, isRetry) {
+    const client = await this.getOpenAIClient(isRetry);
+    const messages = this.convertPrompt(options.prompt);
+    const tools = this.convertTools(options.tools);
+    const toolChoice = options.toolChoice?.type !== "none" ? this.convertToolChoice(options.toolChoice) : void 0;
+    const openaiModel = this.config.openaiModel || "gpt-4o";
+    const maxTokens = options.maxOutputTokens || this.config.maxTokens || 8192;
+    const requestBody = {
+      model: openaiModel,
+      max_completion_tokens: maxTokens,
+      messages,
+      tools,
+      tool_choice: tools ? toolChoice : void 0,
+      temperature: options.temperature,
+      top_p: options.topP,
+      stop: options.stopSequences,
+      stream: true,
+      stream_options: { include_usage: true }
+    };
+    const self = this;
+    const stream = new ReadableStream({
+      start: async (controller) => {
+        const toolCalls = {};
+        const usage = {
+          inputTokens: 0,
+          outputTokens: 0,
+          totalTokens: 0
+        };
+        let finishReason = "unknown";
+        let textStarted = false;
+        const textId = "text-0";
+        try {
+          const openaiStream = await client.chat.completions.create({
+            ...requestBody,
+            stream: true
+          });
+          controller.enqueue({ type: "stream-start", warnings: [] });
+          for await (const chunk of openaiStream) {
+            const choice = chunk.choices?.[0];
+            if (chunk.id && !textStarted) {
+              controller.enqueue({
+                type: "response-metadata",
+                id: chunk.id,
+                modelId: chunk.model
+              });
+            }
+            if (choice?.delta?.content) {
+              if (!textStarted) {
+                controller.enqueue({ type: "text-start", id: textId });
+                textStarted = true;
+              }
+              controller.enqueue({
+                type: "text-delta",
+                id: textId,
+                delta: choice.delta.content
+              });
+            }
+            if (choice?.delta?.tool_calls) {
+              for (const tc of choice.delta.tool_calls) {
+                const idx = tc.index;
+                if (!toolCalls[idx]) {
+                  toolCalls[idx] = {
+                    id: tc.id || "",
+                    name: tc.function?.name || "",
+                    arguments: ""
+                  };
+                  controller.enqueue({
+                    type: "tool-input-start",
+                    id: toolCalls[idx].id,
+                    toolName: toolCalls[idx].name
+                  });
+                }
+                if (tc.function?.arguments) {
+                  toolCalls[idx].arguments += tc.function.arguments;
+                  controller.enqueue({
+                    type: "tool-input-delta",
+                    id: toolCalls[idx].id,
+                    delta: tc.function.arguments
+                  });
+                }
+              }
+            }
+            if (choice?.finish_reason) {
+              finishReason = self.convertFinishReason(choice.finish_reason);
+            }
+            if (chunk.usage) {
+              usage.inputTokens = chunk.usage.prompt_tokens || 0;
+              usage.outputTokens = chunk.usage.completion_tokens || 0;
+              usage.totalTokens = chunk.usage.total_tokens || 0;
+            }
+          }
+          if (textStarted) {
+            controller.enqueue({ type: "text-end", id: textId });
+          }
+          for (const [, tc] of Object.entries(toolCalls)) {
+            controller.enqueue({ type: "tool-input-end", id: tc.id });
+            controller.enqueue({
+              type: "tool-call",
+              toolCallId: tc.id,
+              toolName: tc.name,
+              input: tc.arguments || "{}"
+            });
+          }
+          controller.enqueue({ type: "finish", finishReason, usage });
+          controller.close();
+        } catch (error) {
+          if (self.isContextOverflowError(error)) {
+            const apiError = error;
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({
+                message: `Context overflow: ${apiError.message}. Please start a new session or use /compact to reduce context.`,
+                statusCode: 400,
+                cause: error
+              })
+            });
+            controller.close();
+            return;
+          }
+          if (!isRetry && self.isTokenError(error)) {
+            self.directAccessClient.invalidateToken();
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({ message: "TOKEN_REFRESH_NEEDED", cause: error })
+            });
+            controller.close();
+            return;
+          }
+          if (error instanceof OpenAI.APIError) {
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({
+                message: `OpenAI API error: ${error.message}`,
+                statusCode: error.status,
+                cause: error
+              })
+            });
+          } else {
+            controller.enqueue({ type: "error", error });
+          }
+          controller.close();
+        }
+      }
+    });
+    return { stream, request: { body: requestBody } };
+  }
+  async doStreamWithResponsesApi(options, isRetry) {
+    const client = await this.getOpenAIClient(isRetry);
+    const input = this.convertPromptForResponses(options.prompt);
+    const tools = this.convertToolsForResponses(options.tools);
+    const instructions = this.extractSystemInstructions(options.prompt);
+    const openaiModel = this.config.openaiModel || "gpt-5-codex";
+    const maxTokens = options.maxOutputTokens || this.config.maxTokens || 8192;
+    const requestBody = {
+      model: openaiModel,
+      input,
+      instructions,
+      tools,
+      max_output_tokens: maxTokens,
+      temperature: options.temperature,
+      top_p: options.topP,
+      store: false,
+      stream: true
+    };
+    const self = this;
+    const stream = new ReadableStream({
+      start: async (controller) => {
+        const toolCalls = {};
+        const usage = {
+          inputTokens: 0,
+          outputTokens: 0,
+          totalTokens: 0
+        };
+        let finishReason = "unknown";
+        let textStarted = false;
+        const textId = "text-0";
+        try {
+          const openaiStream = await client.responses.create({
+            ...requestBody,
+            stream: true
+          });
+          controller.enqueue({ type: "stream-start", warnings: [] });
+          for await (const event of openaiStream) {
+            if (event.type === "response.created") {
+              controller.enqueue({
+                type: "response-metadata",
+                id: event.response.id,
+                modelId: event.response.model
+              });
+            } else if (event.type === "response.output_item.added") {
+              if (event.item.type === "function_call") {
+                const outputIndex = event.output_index;
+                const callId = event.item.call_id;
+                toolCalls[outputIndex] = {
+                  callId,
+                  name: event.item.name,
+                  arguments: ""
+                };
+                controller.enqueue({
+                  type: "tool-input-start",
+                  id: callId,
+                  toolName: event.item.name
+                });
+              }
+            } else if (event.type === "response.output_text.delta") {
+              if (!textStarted) {
+                controller.enqueue({ type: "text-start", id: textId });
+                textStarted = true;
+              }
+              controller.enqueue({
+                type: "text-delta",
+                id: textId,
+                delta: event.delta
+              });
+            } else if (event.type === "response.function_call_arguments.delta") {
+              const outputIndex = event.output_index;
+              const tc = toolCalls[outputIndex];
+              if (tc) {
+                tc.arguments += event.delta;
+                controller.enqueue({
+                  type: "tool-input-delta",
+                  id: tc.callId,
+                  delta: event.delta
+                });
+              }
+            } else if (event.type === "response.function_call_arguments.done") {
+              const outputIndex = event.output_index;
+              const tc = toolCalls[outputIndex];
+              if (tc) {
+                tc.arguments = event.arguments;
+              }
+            } else if (event.type === "response.completed") {
+              const hasToolCalls2 = Object.keys(toolCalls).length > 0;
+              finishReason = self.convertResponsesStatus(event.response.status, hasToolCalls2);
+              if (event.response.usage) {
+                usage.inputTokens = event.response.usage.input_tokens || 0;
+                usage.outputTokens = event.response.usage.output_tokens || 0;
+                usage.totalTokens = event.response.usage.total_tokens || 0;
+              }
+            }
+          }
+          if (textStarted) {
+            controller.enqueue({ type: "text-end", id: textId });
+          }
+          const hasToolCalls = Object.keys(toolCalls).length > 0;
+          if (hasToolCalls && finishReason === "stop") {
+            finishReason = "tool-calls";
+          }
+          for (const tc of Object.values(toolCalls)) {
+            controller.enqueue({ type: "tool-input-end", id: tc.callId });
+            controller.enqueue({
+              type: "tool-call",
+              toolCallId: tc.callId,
+              toolName: tc.name,
+              input: tc.arguments || "{}"
+            });
+          }
+          controller.enqueue({ type: "finish", finishReason, usage });
+          controller.close();
+        } catch (error) {
+          if (self.isContextOverflowError(error)) {
+            const apiError = error;
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({
+                message: `Context overflow: ${apiError.message}. Please start a new session or use /compact to reduce context.`,
+                statusCode: 400,
+                cause: error
+              })
+            });
+            controller.close();
+            return;
+          }
+          if (!isRetry && self.isTokenError(error)) {
+            self.directAccessClient.invalidateToken();
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({ message: "TOKEN_REFRESH_NEEDED", cause: error })
+            });
+            controller.close();
+            return;
+          }
+          if (error instanceof OpenAI.APIError) {
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({
+                message: `OpenAI API error: ${error.message}`,
+                statusCode: error.status,
+                cause: error
+              })
+            });
+          } else {
+            controller.enqueue({ type: "error", error });
+          }
+          controller.close();
+        }
+      }
+    });
+    return { stream, request: { body: requestBody } };
+  }
+};
+
+// src/gitlab-workflow-client.ts
+import WebSocket from "isomorphic-ws";
+
+// src/version.ts
+var VERSION = true ? "3.6.0" : "0.0.0-dev";
+
+// src/gitlab-workflow-types.ts
+var WorkflowType = /* @__PURE__ */ ((WorkflowType2) => {
+  WorkflowType2["CHAT"] = "chat";
+  WorkflowType2["SOFTWARE_DEVELOPMENT"] = "software_development";
+  return WorkflowType2;
+})(WorkflowType || {});
+var WS_KEEPALIVE_PING_INTERVAL_MS = 45e3;
+var WS_HEARTBEAT_INTERVAL_MS = 6e4;
+var DEFAULT_WORKFLOW_DEFINITION = "chat" /* CHAT */;
+var DEFAULT_CLIENT_CAPABILITIES = ["shell_command"];
+var CLIENT_VERSION = "1.0";
+var STOP_REASON_USER = "USER_ACTION_TRIGGERED_STOP";
+var AGENT_PRIVILEGES = {
+  READ_WRITE_FILES: 1,
+  READ_ONLY_GITLAB: 2,
+  READ_WRITE_GITLAB: 3,
+  RUN_COMMANDS: 4,
+  USE_GIT: 5,
+  RUN_MCP_TOOLS: 6
+};
+var DEFAULT_AGENT_PRIVILEGES = [
+  AGENT_PRIVILEGES.READ_WRITE_FILES,
+  AGENT_PRIVILEGES.READ_ONLY_GITLAB,
+  AGENT_PRIVILEGES.READ_WRITE_GITLAB,
+  AGENT_PRIVILEGES.RUN_COMMANDS,
+  AGENT_PRIVILEGES.RUN_MCP_TOOLS,
+  AGENT_PRIVILEGES.USE_GIT
+];
+var WORKFLOW_ENVIRONMENT = "ide";
+
+// src/gitlab-workflow-client.ts
+var GitLabWorkflowClient = class {
+  socket = null;
+  keepaliveInterval = null;
+  heartbeatInterval = null;
+  eventCallback = null;
+  closed = false;
+  lastSendTime = 0;
+  /**
+   * Connect to the DWS WebSocket and start listening for events.
+   *
+   * @param options - Connection parameters
+   * @param onEvent - Callback invoked for each WorkflowClientEvent
+   * @returns Promise that resolves when the connection is open
+   */
+  connect(options, onEvent) {
+    this.validateOptions(options);
+    this.eventCallback = onEvent;
+    this.closed = false;
+    this.cleanedUp = false;
+    return new Promise((resolve2, reject) => {
+      const wsUrl = this.buildWebSocketUrl(options);
+      const wsHeaders = this.buildWebSocketHeaders(options);
+      this.socket = new WebSocket(wsUrl, { headers: wsHeaders });
+      let resolved = false;
+      this.socket.onopen = () => {
+        resolved = true;
+        this.startKeepalive();
+        this.startHeartbeat();
+        resolve2();
+      };
+      this.socket.onmessage = (event) => {
+        try {
+          const data = typeof event.data === "string" ? event.data : event.data.toString();
+          const action = JSON.parse(data);
+          if (!action || typeof action !== "object") {
+            throw new Error("Invalid message structure: expected object");
+          }
+          this.handleAction(action);
+        } catch (error) {
+          this.emit({
+            type: "failed",
+            error: error instanceof Error ? error : new Error(String(error))
+          });
+        }
+      };
+      this.socket.onerror = (event) => {
+        const error = new Error(`WebSocket error: ${event.message || "unknown"}`);
+        if (!resolved) {
+          reject(error);
+        } else {
+          this.emit({ type: "failed", error });
+        }
+      };
+      this.socket.onclose = (event) => {
+        this.cleanup();
+        if (!resolved) {
+          reject(
+            new Error(
+              `WebSocket closed before open: code=${event.code} reason=${event.reason || ""}`
+            )
+          );
+          return;
+        }
+        if (!this.closed) {
+          this.emit({
+            type: "closed",
+            code: event.code,
+            reason: event.reason || ""
+          });
+        }
+      };
+    });
+  }
+  /**
+   * Send a startRequest to begin the workflow.
+   */
+  sendStartRequest(request) {
+    this.send({ startRequest: request });
+  }
+  /**
+   * Send an actionResponse (tool result) back to DWS.
+   */
+  sendActionResponse(requestID, response, error) {
+    this.sendHeartbeatIfNeeded();
+    const payload = {
+      requestID,
+      plainTextResponse: {
+        response,
+        error: error ?? null
+      }
+    };
+    this.send({ actionResponse: payload });
+  }
+  /**
+   * Stop the workflow gracefully.
+   */
+  stop() {
+    this.send({ stopWorkflow: { reason: STOP_REASON_USER } });
+    this.closed = true;
+  }
+  /**
+   * Close the WebSocket connection.
+   */
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.cleanup();
+    const sock = this.socket;
+    this.socket = null;
+    if (sock) {
+      if (sock.readyState === WebSocket.OPEN || sock.readyState === WebSocket.CONNECTING) {
+        sock.close(1e3, "Client closing");
+      }
+    }
+  }
+  /**
+   * Check if the WebSocket is currently connected.
+   */
+  get isConnected() {
+    return this.socket?.readyState === WebSocket.OPEN;
+  }
+  // ---------------------------------------------------------------------------
+  // Private
+  // ---------------------------------------------------------------------------
+  validateOptions(options) {
+    if (!options.instanceUrl || typeof options.instanceUrl !== "string") {
+      throw new Error("instanceUrl is required");
+    }
+    const parsed = new URL(options.instanceUrl);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      throw new Error(`Invalid instanceUrl protocol: ${parsed.protocol}`);
+    }
+    if (parsed.username || parsed.password) {
+      throw new Error(
+        "instanceUrl must not contain authentication credentials (username/password)"
+      );
+    }
+    if (!options.headers || typeof options.headers !== "object") {
+      throw new Error("headers are required");
+    }
+    if (options.modelRef && typeof options.modelRef !== "string") {
+      throw new Error("modelRef must be a string");
+    }
+  }
+  buildWebSocketUrl(options) {
+    const baseUrl = new URL(options.instanceUrl.replace(/\/?$/, "/"));
+    const url = new URL("./api/v4/ai/duo_workflows/ws", baseUrl);
+    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+    if (options.modelRef && options.modelRef !== "default") {
+      url.searchParams.set("user_selected_model_identifier", options.modelRef);
+    }
+    return url.toString();
+  }
+  buildWebSocketHeaders(options) {
+    const headers = {};
+    for (const [key, value] of Object.entries(options.headers)) {
+      headers[key.toLowerCase()] = value;
+    }
+    delete headers["content-type"];
+    headers["x-gitlab-client-type"] = "node-websocket";
+    const parsedUrl = new URL(options.instanceUrl);
+    const origin = parsedUrl.origin;
+    headers["origin"] = origin;
+    if (options.requestId) {
+      headers["x-request-id"] = options.requestId;
+    }
+    if (options.projectId) {
+      headers["x-gitlab-project-id"] = options.projectId;
+    }
+    if (options.namespaceId) {
+      headers["x-gitlab-namespace-id"] = options.namespaceId;
+    }
+    if (options.rootNamespaceId) {
+      headers["x-gitlab-root-namespace-id"] = options.rootNamespaceId;
+    }
+    if (!headers["user-agent"]) {
+      headers["user-agent"] = `gitlab-ai-provider/${VERSION}`;
+    }
+    return headers;
+  }
+  handleAction(action) {
+    if (action.newCheckpoint) {
+      const checkpoint = action.newCheckpoint;
+      this.emit({ type: "checkpoint", data: checkpoint });
+      if (checkpoint.status === "FINISHED" || checkpoint.status === "COMPLETED") {
+        this.emit({ type: "completed" });
+      } else if (checkpoint.status === "FAILED") {
+        this.emit({
+          type: "failed",
+          error: new Error(checkpoint.content || "Workflow failed")
+        });
+      } else if (checkpoint.status === "STOPPED" || checkpoint.status === "CANCELLED") {
+        this.emit({ type: "completed" });
+      }
+      return;
+    }
+    if (action.runMCPTool && action.requestID) {
+      this.emit({
+        type: "tool-request",
+        requestID: action.requestID,
+        data: action.runMCPTool
+      });
+      return;
+    }
+    const builtinTools = [
+      ["runReadFile", action.runReadFile],
+      ["runReadFiles", action.runReadFiles],
+      ["runWriteFile", action.runWriteFile],
+      ["runShellCommand", action.runShellCommand],
+      ["runEditFile", action.runEditFile],
+      ["listDirectory", action.listDirectory],
+      ["findFiles", action.findFiles],
+      ["grep", action.grep],
+      ["mkdir", action.mkdir],
+      ["runCommand", action.runCommand],
+      ["runGitCommand", action.runGitCommand],
+      ["runHTTPRequest", action.runHTTPRequest]
+    ];
+    for (const [toolName, data] of builtinTools) {
+      if (data && action.requestID) {
+        this.emit({
+          type: "builtin-tool-request",
+          requestID: action.requestID,
+          toolName,
+          data
+        });
+        return;
+      }
+    }
+  }
+  send(event) {
+    if (this.socket?.readyState === WebSocket.OPEN) {
+      const json = JSON.stringify(event);
+      this.socket.send(json);
+      this.lastSendTime = Date.now();
+    }
+  }
+  sendHeartbeatIfNeeded() {
+    const elapsed = Date.now() - this.lastSendTime;
+    if (elapsed >= WS_HEARTBEAT_INTERVAL_MS / 2) {
+      this.send({ heartbeat: { timestamp: Date.now() } });
+    }
+  }
+  emit(event) {
+    this.eventCallback?.(event);
+  }
+  /**
+   * Start ws.ping() keepalive (45s interval).
+   * Keeps TCP connection alive through proxies/load balancers.
+   */
+  startKeepalive() {
+    this.keepaliveInterval = setInterval(() => {
+      if (this.socket?.readyState === WebSocket.OPEN) {
+        try {
+          this.socket.ping();
+        } catch {
+        }
+      }
+    }, WS_KEEPALIVE_PING_INTERVAL_MS);
+  }
+  /**
+   * Start application-level heartbeat (60s interval).
+   * Prevents DWS from timing out the workflow.
+   */
+  startHeartbeat() {
+    this.heartbeatInterval = setInterval(() => {
+      this.send({ heartbeat: { timestamp: Date.now() } });
+    }, WS_HEARTBEAT_INTERVAL_MS);
+  }
+  cleanedUp = false;
+  /**
+   * Clean up intervals. Idempotent — safe to call multiple times.
+   */
+  cleanup() {
+    if (this.cleanedUp) return;
+    this.cleanedUp = true;
+    if (this.keepaliveInterval) {
+      clearInterval(this.keepaliveInterval);
+      this.keepaliveInterval = null;
+    }
+    if (this.heartbeatInterval) {
+      clearInterval(this.heartbeatInterval);
+      this.heartbeatInterval = null;
+    }
+  }
+};
+
+// src/gitlab-workflow-builtins.ts
+function validateNoShellMetachars(value, fieldName) {
+  const dangerousChars = /[;&|`$()<>]/;
+  if (dangerousChars.test(value)) {
+    throw new Error(
+      `Invalid ${fieldName}: contains shell metacharacters. Use structured arguments instead.`
+    );
+  }
+}
+function shellEscape(arg) {
+  return "'" + String(arg).replace(/'/g, "'\\''") + "'";
+}
+var ALLOWED_URL_SCHEMES = ["http:", "https:"];
+function sanitizeErrorMessage(message) {
+  if (!message) return "";
+  return message.replace(/\bBearer\s+[A-Za-z0-9\-_.~+/]+=*/gi, "Bearer [REDACTED]").replace(/\bgl(?:pat|oat|cbt|dt|oas|rt|soat|ffct|sapat)-[A-Za-z0-9_-]+/g, "[REDACTED]").replace(/([?&](?:private_token|access_token|token)=)[^&\s"']*/gi, "$1[REDACTED]").replace(/:\/\/([^:@/\s]+):([^@/\s]+)@/g, "://$1:[REDACTED]@");
+}
+function mapBuiltinTool(dwsToolName, data) {
+  switch (dwsToolName) {
+    case "runReadFile":
+      return { toolName: "read", args: { filePath: data.filepath } };
+    case "runReadFiles": {
+      const paths = data.filepaths ?? [];
+      if (paths.length <= 1) {
+        return { toolName: "read", args: { filePath: paths[0] ?? "" } };
+      }
+      return {
+        toolName: "read",
+        args: { filePaths: paths }
+      };
+    }
+    case "runWriteFile":
+      return {
+        toolName: "write",
+        args: { filePath: data.filepath, content: data.contents }
+      };
+    case "runEditFile":
+      return {
+        toolName: "edit",
+        args: {
+          filePath: data.filepath,
+          oldString: data.oldString ?? data.old_string,
+          newString: data.newString ?? data.new_string
+        }
+      };
+    case "runShellCommand": {
+      const command = data.command;
+      if (!command || typeof command !== "string") {
+        throw new Error("runShellCommand: command is required and must be a string");
+      }
+      if (command.length > 1e4) {
+        throw new Error("runShellCommand: command exceeds maximum length of 10000 characters");
+      }
+      return {
+        toolName: "bash",
+        args: { command, description: "DWS shell command" }
+      };
+    }
+    case "runCommand": {
+      const program = data.program;
+      if (!program || typeof program !== "string") {
+        throw new Error("runCommand: program is required and must be a string");
+      }
+      validateNoShellMetachars(program, "program");
+      const flags = data.flags ?? [];
+      const cmdArgs = data.arguments ?? [];
+      for (const flag of flags) {
+        if (typeof flag === "string") {
+          validateNoShellMetachars(flag, "flag");
+        }
+      }
+      for (const arg of cmdArgs) {
+        if (typeof arg === "string") {
+          validateNoShellMetachars(arg, "argument");
+        }
+      }
+      return {
+        toolName: "bash",
+        args: {
+          command: [program, ...flags, ...cmdArgs].map((a) => shellEscape(String(a))).join(" "),
+          description: `DWS run: ${program}`
+        }
+      };
+    }
+    case "runGitCommand": {
+      const gitCmd = data.command;
+      if (!gitCmd || typeof gitCmd !== "string") {
+        throw new Error("runGitCommand: command is required and must be a string");
+      }
+      validateNoShellMetachars(gitCmd, "git command");
+      const gitArgs = data.arguments ?? [];
+      for (const arg of gitArgs) {
+        if (typeof arg === "string") {
+          validateNoShellMetachars(arg, "git argument");
+        }
+      }
+      return {
+        toolName: "bash",
+        args: {
+          command: ["git", gitCmd, ...gitArgs].map((a) => shellEscape(String(a))).join(" "),
+          description: `DWS git: ${gitCmd}`
+        }
+      };
+    }
+    case "listDirectory":
+      return { toolName: "read", args: { filePath: data.directory ?? "." } };
+    case "findFiles":
+      return { toolName: "glob", args: { pattern: data.name_pattern ?? data.namePattern } };
+    case "grep":
+      return {
+        toolName: "grep",
+        args: {
+          pattern: data.pattern,
+          path: data.search_directory ?? data.searchDirectory
+        }
+      };
+    case "mkdir": {
+      const dirPath = String(data.directory_path ?? data.directoryPath ?? "");
+      if (!dirPath) {
+        throw new Error("mkdir: directory_path is required");
+      }
+      if (dirPath.includes("\0")) {
+        throw new Error("mkdir: directory_path contains null bytes");
+      }
+      return {
+        toolName: "bash",
+        args: {
+          command: `mkdir -p ${shellEscape(dirPath)}`,
+          description: "DWS mkdir"
+        }
+      };
+    }
+    case "runHTTPRequest": {
+      const methodRaw = String(data.method ?? "GET").toUpperCase();
+      const allowedMethods = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
+      if (!allowedMethods.includes(methodRaw)) {
+        throw new Error(`runHTTPRequest: invalid HTTP method '${methodRaw}'`);
+      }
+      const urlPath = String(data.path ?? "");
+      if (!urlPath) {
+        throw new Error("runHTTPRequest: path is required");
+      }
+      try {
+        const parsedUrl = new URL(urlPath);
+        if (!ALLOWED_URL_SCHEMES.includes(parsedUrl.protocol)) {
+          throw new Error(
+            `runHTTPRequest: only http:// and https:// schemes are allowed, got '${parsedUrl.protocol}'`
+          );
+        }
+      } catch (e) {
+        if (e instanceof Error && e.message.startsWith("runHTTPRequest:")) throw e;
+      }
+      const method = shellEscape(methodRaw);
+      const escapedPath = shellEscape(urlPath);
+      const bodyArg = data.body ? ` -d ${shellEscape(String(data.body))}` : "";
+      return {
+        toolName: "bash",
+        args: {
+          command: `curl -s -X ${method} -- ${escapedPath}${bodyArg}`,
+          description: `DWS HTTP ${methodRaw}`
+        }
+      };
+    }
+    default:
+      return { toolName: dwsToolName, args: data };
+  }
+}
+
+// src/gitlab-workflow-token-client.ts
+var TOKEN_CACHE_DURATION_MS = 25 * 60 * 1e3;
+var MAX_ERROR_TEXT_LENGTH = 500;
+function sanitizeErrorText(text) {
+  const truncated = text.length > MAX_ERROR_TEXT_LENGTH ? text.slice(0, MAX_ERROR_TEXT_LENGTH) + "..." : text;
+  return sanitizeErrorMessage(truncated);
+}
+var CHAT_SHARED_TOKEN_KEY = "__chat_shared__";
+var GitLabWorkflowTokenClient = class {
+  config;
+  fetchFn;
+  /**
+   * Token cache keyed by workflow definition type.
+   *
+   * - CHAT workflows use a shared key (CHAT_SHARED_TOKEN_KEY) so tokens
+   *   are reused across ALL chat sessions (matching gitlab-lsp behavior).
+   * - SOFTWARE_DEVELOPMENT workflows would use per-workflow-id keys,
+   *   but since we fetch tokens before creating workflows, we key by type.
+   */
+  tokenCache = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.config = config;
+    this.fetchFn = config.fetch ?? fetch;
+  }
+  /**
+   * Resolve the cache key for a given workflow definition.
+   * CHAT workflows share a single token per namespace; other types get per-type keys.
+   */
+  getCacheKey(workflowDefinition, rootNamespaceId) {
+    const base = workflowDefinition === "chat" /* CHAT */ ? CHAT_SHARED_TOKEN_KEY : workflowDefinition;
+    return rootNamespaceId ? `${base}:${rootNamespaceId}` : base;
+  }
+  /**
+   * Get a DWS token, using cached value if still valid.
+   *
+   * Token caching strategy (matches gitlab-lsp):
+   * - CHAT workflows: shared token across all sessions
+   * - Other workflows: per-type token
+   *
+   * @param workflowDefinition - Workflow type (default: 'chat')
+   * @param rootNamespaceId - Optional root namespace for scoping
+   * @param forceRefresh - Bypass cache
+   */
+  async getToken(workflowDefinition = DEFAULT_WORKFLOW_DEFINITION, rootNamespaceId, forceRefresh = false) {
+    const now = Date.now();
+    const cacheKey = this.getCacheKey(workflowDefinition, rootNamespaceId);
+    const cached = this.tokenCache.get(cacheKey);
+    if (!forceRefresh && cached && cached.expiresAt > now) {
+      return cached.token;
+    }
+    if (forceRefresh) {
+      this.tokenCache.delete(cacheKey);
+    }
+    const url = `${this.config.instanceUrl}/api/v4/ai/duo_workflows/direct_access`;
+    const body = {
+      workflow_definition: workflowDefinition
+    };
+    if (rootNamespaceId) {
+      body.root_namespace_id = rootNamespaceId;
+    }
+    if (this.config.featureFlags && Object.keys(this.config.featureFlags).length > 0) {
+      body.feature_flags = this.config.featureFlags;
+    }
+    try {
+      const response = await this.fetchFn(url, {
+        method: "POST",
+        headers: {
+          ...this.config.getHeaders(),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        const safeError = sanitizeErrorText(errorText);
+        if (response.status === 401 && this.config.refreshApiKey && !forceRefresh) {
+          try {
+            await this.config.refreshApiKey();
+            return await this.getToken(workflowDefinition, rootNamespaceId, true);
+          } catch {
+            throw new GitLabError({
+              message: `Failed to get workflow token: ${response.status} ${response.statusText} - ${safeError}`,
+              statusCode: response.status,
+              responseBody: safeError
+            });
+          }
+        }
+        if (response.status === 403) {
+          throw new GitLabError({
+            message: `GitLab Duo Agent Platform access denied. GitLab Duo Agent Platform requires GitLab Ultimate with Duo Enterprise add-on. Ensure: (1) Your instance has GitLab Ultimate, (2) Duo Enterprise add-on is enabled, (3) Your account has access to AI features.`,
+            statusCode: response.status,
+            responseBody: safeError
+          });
+        }
+        throw new GitLabError({
+          message: `Failed to get workflow token: ${response.status} ${response.statusText} - ${safeError}`,
+          statusCode: response.status,
+          responseBody: safeError
+        });
+      }
+      const data = await response.json();
+      this.tokenCache.set(cacheKey, {
+        token: data,
+        expiresAt: now + TOKEN_CACHE_DURATION_MS
+      });
+      return data;
+    } catch (error) {
+      if (error instanceof GitLabError) throw error;
+      throw new GitLabError({
+        message: `Failed to get workflow token: ${error}`,
+        cause: error
+      });
+    }
+  }
+  /**
+   * Create a new workflow on the GitLab instance.
+   *
+   * @param goal - The user's message / goal for this workflow
+   * @param options - Additional workflow creation options
+   * @returns The created workflow's ID
+   */
+  async createWorkflow(goal, options) {
+    if (!goal || typeof goal !== "string") {
+      throw new GitLabError({ message: "goal is required and must be a non-empty string" });
+    }
+    if (goal.length > 1e4) {
+      throw new GitLabError({ message: "goal exceeds maximum length of 10000 characters" });
+    }
+    const url = `${this.config.instanceUrl}/api/v4/ai/duo_workflows/workflows`;
+    const body = {
+      goal,
+      project_id: options?.projectId,
+      namespace_id: options?.namespaceId,
+      workflow_definition: options?.workflowDefinition ?? DEFAULT_WORKFLOW_DEFINITION,
+      agent_privileges: options?.agentPrivileges ?? DEFAULT_AGENT_PRIVILEGES,
+      environment: options?.environment ?? WORKFLOW_ENVIRONMENT,
+      allow_agent_to_request_user: options?.allowAgentToRequestUser ?? true
+    };
+    try {
+      const response = await this.fetchFn(url, {
+        method: "POST",
+        headers: {
+          ...this.config.getHeaders(),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        const safeError = sanitizeErrorText(errorText);
+        throw new GitLabError({
+          message: `Failed to create workflow: ${response.status} ${response.statusText} - ${safeError}`,
+          statusCode: response.status,
+          responseBody: safeError
+        });
+      }
+      const data = await response.json();
+      return data.id.toString();
+    } catch (error) {
+      if (error instanceof GitLabError) throw error;
+      throw new GitLabError({
+        message: `Failed to create workflow: ${error}`,
+        cause: error
+      });
+    }
+  }
+  /**
+   * Invalidate cached tokens.
+   *
+   * @param workflowDefinition - If provided, only invalidate for this type.
+   *                             If omitted, clears ALL cached tokens.
+   */
+  invalidateToken(workflowDefinition, rootNamespaceId) {
+    if (workflowDefinition) {
+      this.tokenCache.delete(this.getCacheKey(workflowDefinition, rootNamespaceId));
+    } else {
+      this.tokenCache.clear();
+    }
+  }
+};
+
+// src/gitlab-project-detector.ts
+import { spawn } from "child_process";
+import * as path from "path";
+
+// src/gitlab-project-cache.ts
+var GitLabProjectCache = class {
+  cache = /* @__PURE__ */ new Map();
+  defaultTTL;
+  /**
+   * Create a new project cache
+   * @param defaultTTL - Default time-to-live in milliseconds (default: 5 minutes)
+   */
+  constructor(defaultTTL = 5 * 60 * 1e3) {
+    this.defaultTTL = defaultTTL;
+  }
+  /**
+   * Get a cached project by key
+   * @param key - Cache key (typically the working directory path)
+   * @returns The cached project or null if not found or expired
+   */
+  get(key) {
+    const entry = this.cache.get(key);
+    if (!entry) {
+      return null;
+    }
+    if (Date.now() > entry.expiresAt) {
+      this.cache.delete(key);
+      return null;
+    }
+    return entry.project;
+  }
+  /**
+   * Store a project in the cache
+   * @param key - Cache key (typically the working directory path)
+   * @param project - The project to cache
+   * @param ttl - Optional custom TTL in milliseconds
+   */
+  set(key, project, ttl) {
+    this.cache.set(key, {
+      project,
+      expiresAt: Date.now() + (ttl ?? this.defaultTTL)
+    });
+  }
+  /**
+   * Check if a key exists in the cache (and is not expired)
+   * @param key - Cache key to check
+   * @returns true if the key exists and is not expired
+   */
+  has(key) {
+    return this.get(key) !== null;
+  }
+  /**
+   * Remove a specific entry from the cache
+   * @param key - Cache key to remove
+   */
+  delete(key) {
+    this.cache.delete(key);
+  }
+  /**
+   * Clear all entries from the cache
+   */
+  clear() {
+    this.cache.clear();
+  }
+  /**
+   * Get the number of entries in the cache (including expired ones)
+   */
+  get size() {
+    return this.cache.size;
+  }
+  /**
+   * Clean up expired entries from the cache
+   * This is useful for long-running processes to prevent memory leaks
+   */
+  cleanup() {
+    const now = Date.now();
+    for (const [key, entry] of this.cache.entries()) {
+      if (now > entry.expiresAt) {
+        this.cache.delete(key);
+      }
+    }
+  }
+};
+
+// src/gitlab-project-detector.ts
+var GitLabProjectDetector = class {
+  config;
+  fetchFn;
+  cache;
+  constructor(config) {
+    this.config = {
+      gitTimeout: 5e3,
+      // 5 seconds default
+      ...config
+    };
+    this.fetchFn = config.fetch ?? fetch;
+    this.cache = config.cache ?? new GitLabProjectCache();
+  }
+  /**
+   * Auto-detect GitLab project from git remote in the working directory
+   *
+   * @param workingDirectory - The directory to check for git remote
+   * @param remoteName - The git remote name to use (default: 'origin')
+   * @returns The detected project or null if not a git repo / no matching remote
+   * @throws GitLabError if the API call or an unexpected error occurs
+   */
+  async detectProject(workingDirectory, remoteName = "origin") {
+    const cacheKey = path.resolve(workingDirectory);
+    const cached = this.cache.get(cacheKey);
+    if (cached) {
+      return cached;
+    }
+    try {
+      const remoteUrl = await this.getGitRemoteUrl(workingDirectory, remoteName);
+      if (!remoteUrl) {
+        return null;
+      }
+      const projectPath = this.parseGitRemoteUrl(remoteUrl, this.config.instanceUrl);
+      if (!projectPath) {
+        return null;
+      }
+      const project = await this.getProjectByPath(projectPath);
+      this.cache.set(cacheKey, project);
+      return project;
+    } catch (error) {
+      throw error instanceof GitLabError ? error : new GitLabError({
+        message: `Project detection failed: ${error}`,
+        cause: error
+      });
+    }
+  }
+  /**
+   * Parse a git remote URL to extract the project path
+   *
+   * Supports:
+   * - SSH: git@gitlab.com:namespace/project.git
+   * - HTTPS: https://gitlab.com/namespace/project.git
+   * - HTTP: http://gitlab.local/namespace/project.git
+   * - Custom domains and ports
+   *
+   * @param remoteUrl - The git remote URL
+   * @param instanceUrl - The GitLab instance URL to match against
+   * @returns The project path (e.g., "namespace/project") or null if parsing fails
+   */
+  parseGitRemoteUrl(remoteUrl, instanceUrl) {
+    try {
+      const instanceHost = new URL(instanceUrl).hostname;
+      const sshMatch = remoteUrl.match(/^git@([^:]+):(.+?)(?:\.git)?$/);
+      if (sshMatch) {
+        const [, host, pathPart] = sshMatch;
+        const hostWithoutPort = host.split(":")[0];
+        if (hostWithoutPort === instanceHost) {
+          const cleanPath = pathPart.replace(/^\d+\//, "");
+          return cleanPath.endsWith(".git") ? cleanPath.slice(0, -4) : cleanPath;
+        }
+      }
+      const httpsMatch = remoteUrl.match(/^(https?):\/\/([^/]+)\/(.+?)(?:\.git)?$/);
+      if (httpsMatch) {
+        const [, , hostWithPort, pathPart] = httpsMatch;
+        const host = hostWithPort.split(":")[0];
+        if (host === instanceHost) {
+          return pathPart.endsWith(".git") ? pathPart.slice(0, -4) : pathPart;
+        }
+      }
+      return null;
+    } catch (error) {
+      return null;
+    }
+  }
+  /**
+   * Get the git remote URL from a working directory
+   *
+   * @param workingDirectory - The directory to check
+   * @param remoteName - The git remote name (default: 'origin')
+   * @returns The remote URL or null if not found
+   */
+  async getGitRemoteUrl(workingDirectory, remoteName = "origin") {
+    return new Promise((resolve2) => {
+      const child = spawn("git", ["config", "--get", `remote.${remoteName}.url`], {
+        cwd: workingDirectory,
+        timeout: this.config.gitTimeout
+      });
+      let stdout = "";
+      let _stderr = "";
+      child.stdout?.on("data", (data) => {
+        stdout += data.toString();
+      });
+      child.stderr?.on("data", (data) => {
+        _stderr += data.toString();
+      });
+      child.on("close", (exitCode) => {
+        if (exitCode === 0 && stdout.trim()) {
+          resolve2(stdout.trim());
+        } else {
+          resolve2(null);
+        }
+      });
+      child.on("error", () => {
+        resolve2(null);
+      });
+    });
+  }
+  /**
+   * Fetch project details from GitLab API by project path
+   *
+   * @param projectPath - The project path (e.g., "namespace/project")
+   * @returns The project details
+   * @throws GitLabError if the API call fails
+   */
+  async getProjectByPath(projectPath) {
+    const encodedPath = encodeURIComponent(projectPath);
+    const url = `${this.config.instanceUrl}/api/v4/projects/${encodedPath}`;
+    try {
+      const response = await this.fetchFn(url, {
+        method: "GET",
+        headers: this.config.getHeaders()
+      });
+      if (!response.ok) {
+        throw new GitLabError({
+          message: `Failed to fetch project '${projectPath}': ${response.status} ${response.statusText}`
+        });
+      }
+      const data = await response.json();
+      return {
+        id: data.id,
+        path: data.path,
+        pathWithNamespace: data.path_with_namespace,
+        name: data.name,
+        namespaceId: data.namespace?.id
+      };
+    } catch (error) {
+      if (error instanceof GitLabError) {
+        throw error;
+      }
+      throw new GitLabError({
+        message: `Failed to fetch project '${projectPath}': ${error}`,
+        cause: error
+      });
+    }
+  }
+  /**
+   * Clear the project cache
+   */
+  clearCache() {
+    this.cache.clear();
+  }
+  /**
+   * Get the cache instance (useful for testing)
+   */
+  getCache() {
+    return this.cache;
+  }
+};
+
+// src/gitlab-model-discovery.ts
+var AI_CHAT_AVAILABLE_MODELS_QUERY = `
+  query aiChatAvailableModels($rootNamespaceId: GroupID!) {
+    metadata {
+      featureFlags(names: ["ai_user_model_switching"]) {
+        enabled
+        name
+      }
+      version
+    }
+
+    aiChatAvailableModels(rootNamespaceId: $rootNamespaceId) {
+      defaultModel {
+        name
+        ref
+      }
+      selectableModels {
+        name
+        ref
+      }
+      pinnedModel {
+        name
+        ref
+      }
+    }
+  }
+`;
+var DISCOVERY_CACHE_TTL_MS = 10 * 60 * 1e3;
+var GitLabModelDiscovery = class {
+  config;
+  fetchFn;
+  cache = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.config = config;
+    this.fetchFn = config.fetch ?? fetch;
+  }
+  /**
+   * Discover available models for a given root namespace.
+   *
+   * Results are cached per `rootNamespaceId` with a 10-minute TTL.
+   * Use `invalidateCache()` to force an immediate refresh.
+   *
+   * @param rootNamespaceId - GitLab group ID (e.g., 'gid://gitlab/Group/12345')
+   */
+  async discover(rootNamespaceId) {
+    const cached = this.cache.get(rootNamespaceId);
+    if (cached && cached.expiresAt > Date.now()) {
+      return cached.data;
+    }
+    const url = `${this.config.instanceUrl}/api/graphql`;
+    try {
+      const response = await this.fetchFn(url, {
+        method: "POST",
+        headers: {
+          ...this.config.getHeaders(),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          query: AI_CHAT_AVAILABLE_MODELS_QUERY,
+          variables: { rootNamespaceId }
+        })
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        throw new GitLabError({
+          message: `Model discovery GraphQL request failed: ${response.status} ${response.statusText} - ${errorText}`,
+          statusCode: response.status,
+          responseBody: errorText
+        });
+      }
+      const json = await response.json();
+      if (json.errors && json.errors.length > 0) {
+        throw new GitLabError({
+          message: `Model discovery GraphQL errors: ${json.errors.map((e) => e.message).join(", ")}`
+        });
+      }
+      const models = json.data?.aiChatAvailableModels;
+      const metadata = json.data?.metadata;
+      const modelSwitchingEnabled = metadata?.featureFlags?.find((f) => f.name === "ai_user_model_switching")?.enabled ?? false;
+      const result = {
+        defaultModel: models?.defaultModel ?? null,
+        selectableModels: models?.selectableModels ?? [],
+        pinnedModel: models?.pinnedModel ?? null,
+        modelSwitchingEnabled,
+        instanceVersion: metadata?.version ?? null
+      };
+      this.cache.set(rootNamespaceId, {
+        data: result,
+        expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS
+      });
+      return result;
+    } catch (error) {
+      if (error instanceof GitLabError) throw error;
+      throw new GitLabError({
+        message: `Model discovery failed: ${error}`,
+        cause: error
+      });
+    }
+  }
+  /**
+   * Get the effective model ref to use for a workflow.
+   *
+   * Priority: pinned > user-selected > default.
+   *
+   * @param rootNamespaceId - GitLab group ID
+   * @param userSelectedRef - Optional user preference
+   */
+  async getEffectiveModelRef(rootNamespaceId, userSelectedRef) {
+    const discovered = await this.discover(rootNamespaceId);
+    if (discovered.pinnedModel) {
+      return discovered.pinnedModel.ref;
+    }
+    if (userSelectedRef && discovered.modelSwitchingEnabled) {
+      const isValid = discovered.selectableModels.some((m) => m.ref === userSelectedRef);
+      if (isValid) {
+        return userSelectedRef;
+      }
+    }
+    return discovered.defaultModel?.ref ?? null;
+  }
+  /**
+   * Invalidate the cached discovery results.
+   */
+  invalidateCache() {
+    this.cache.clear();
+  }
+};
+
+// src/gitlab-model-cache.ts
+import * as fs from "fs";
+import * as path2 from "path";
+import * as os from "os";
+import * as crypto from "crypto";
+function getCacheFilePath() {
+  const cacheHome = process.env.XDG_CACHE_HOME || path2.join(os.homedir(), ".cache");
+  return path2.join(cacheHome, "opencode", "gitlab-workflow-model-cache.json");
+}
+function computeCacheKey(workDir, instanceUrl) {
+  const normalizedUrl = (instanceUrl || "https://gitlab.com").replace(/\/$/, "");
+  return crypto.createHash("sha256").update(`${workDir}\0${normalizedUrl}`).digest("hex").slice(0, 12);
+}
+var GitLabModelCache = class {
+  filePath;
+  key;
+  constructor(workDir, instanceUrl) {
+    this.filePath = getCacheFilePath();
+    this.key = computeCacheKey(workDir, instanceUrl);
+  }
+  readAll() {
+    try {
+      if (!fs.existsSync(this.filePath)) {
+        return {};
+      }
+      const raw = fs.readFileSync(this.filePath, "utf-8");
+      return JSON.parse(raw);
+    } catch {
+      return {};
+    }
+  }
+  writeAll(data) {
+    try {
+      const dir = path2.dirname(this.filePath);
+      fs.mkdirSync(dir, { recursive: true, mode: 448 });
+      fs.writeFileSync(this.filePath, JSON.stringify(data, null, 2), { mode: 384 });
+    } catch {
+    }
+  }
+  /**
+   * Load the cached entry for this workspace.
+   * Returns null if no cache exists or is unreadable.
+   */
+  load() {
+    return this.readAll()[this.key] ?? null;
+  }
+  /**
+   * Persist the full cache entry to disk.
+   */
+  save(entry) {
+    const data = this.readAll();
+    data[this.key] = entry;
+    this.writeAll(data);
+  }
+  /**
+   * Update only the discovery portion of the cache, preserving selection.
+   */
+  saveDiscovery(discovery) {
+    const existing = this.load();
+    this.save({
+      discovery,
+      selectedModelRef: existing?.selectedModelRef ?? null,
+      selectedModelName: existing?.selectedModelName ?? null,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  /**
+   * Update only the selected model, preserving the discovery data.
+   */
+  saveSelection(ref, name) {
+    const existing = this.load();
+    this.save({
+      discovery: existing?.discovery ?? null,
+      selectedModelRef: ref,
+      selectedModelName: name,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  /**
+   * Remove the entry for this workspace from the cache file.
+   */
+  clear() {
+    const data = this.readAll();
+    delete data[this.key];
+    if (Object.keys(data).length === 0) {
+      try {
+        if (fs.existsSync(this.filePath)) {
+          fs.unlinkSync(this.filePath);
+        }
+      } catch {
+      }
+    } else {
+      this.writeAll(data);
+    }
+  }
+  /**
+   * Convenience: get the cached selected model ref (or null).
+   */
+  getSelectedModelRef() {
+    return this.load()?.selectedModelRef ?? null;
+  }
+  /**
+   * Convenience: get the cached selected model name (or null).
+   */
+  getSelectedModelName() {
+    return this.load()?.selectedModelName ?? null;
+  }
+  /**
+   * Convenience: get the cached discovery result (or null).
+   */
+  getDiscovery() {
+    return this.load()?.discovery ?? null;
+  }
+};
+
+// src/gitlab-workflow-language-model.ts
+function simplifySchemaObj(schema) {
+  if (!schema || typeof schema !== "object") return schema;
+  const result = {};
+  for (const [key, value] of Object.entries(schema)) {
+    if (key === "description" || key === "examples" || key === "default") {
+      continue;
+    }
+    if (key === "properties" && typeof value === "object" && value !== null) {
+      const props = {};
+      for (const [propName, propValue] of Object.entries(value)) {
+        if (typeof propValue === "object" && propValue !== null) {
+          props[propName] = simplifySchemaObj(propValue);
+        } else {
+          props[propName] = propValue;
+        }
+      }
+      result[key] = props;
+    } else if (key === "items" && typeof value === "object" && value !== null) {
+      result[key] = simplifySchemaObj(value);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function simplifySchema(schemaStr) {
+  try {
+    return JSON.stringify(simplifySchemaObj(JSON.parse(schemaStr)));
+  } catch {
+    return schemaStr;
+  }
+}
+function minimalSchemaObj(schema) {
+  if (!schema || typeof schema !== "object") return schema;
+  const result = { type: schema.type || "object" };
+  if (schema.required) {
+    result.required = schema.required;
+  }
+  if (schema.properties && typeof schema.properties === "object") {
+    const props = {};
+    for (const [propName, propValue] of Object.entries(
+      schema.properties
+    )) {
+      if (typeof propValue === "object" && propValue !== null) {
+        const pv = propValue;
+        props[propName] = { type: pv.type || "string" };
+      } else {
+        props[propName] = { type: "string" };
+      }
+    }
+    result.properties = props;
+  }
+  return result;
+}
+function minimalSchema(schemaStr) {
+  try {
+    return JSON.stringify(minimalSchemaObj(JSON.parse(schemaStr)));
+  } catch {
+    return schemaStr;
+  }
+}
+var GitLabWorkflowLanguageModel = class _GitLabWorkflowLanguageModel {
+  specificationVersion = "v2";
+  modelId;
+  supportedUrls = {};
+  config;
+  workflowOptions;
+  tokenClient;
+  projectDetector;
+  modelDiscovery;
+  modelCache;
+  // Cached detected project path
+  detectedProjectPath = null;
+  // Workflow ID persisted across turns for multi-turn conversations.
+  // When DWS sends INPUT_REQUIRED, the workflow stays alive server-side.
+  // On the next doStream() call we reuse this ID (skip createWorkflow).
+  currentWorkflowId = null;
+  // Persisted across turns so that cumulative DWS chat logs don't re-emit
+  // messages that were already streamed in a previous doStream() call.
+  persistedAgentEmitted = /* @__PURE__ */ new Map();
+  // Track all active stream clients so stopWorkflow() can stop them all.
+  activeClients = /* @__PURE__ */ new Set();
+  // Cache resolved values to avoid redundant GraphQL calls
+  _selectedModelRef;
+  _selectedModelName;
+  _rootNamespaceId;
+  _discoveryPromise;
+  /**
+   * Get the cached selected model ref.
+   */
+  get selectedModelRef() {
+    return this._selectedModelRef ?? null;
+  }
+  /**
+   * Set the selected model ref (e.g., from an eager discover call).
+   * This will be used by resolveModelRef() to skip the picker.
+   * Also persists to the file-based workspace cache.
+   */
+  set selectedModelRef(ref) {
+    this._selectedModelRef = ref ?? void 0;
+    this.modelCache.saveSelection(ref, this._selectedModelName ?? null);
+  }
+  /**
+   * Get the cached selected model display name.
+   */
+  get selectedModelName() {
+    return this._selectedModelName ?? null;
+  }
+  /**
+   * Set the selected model display name.
+   * Also persists to the file-based workspace cache.
+   */
+  set selectedModelName(name) {
+    this._selectedModelName = name ?? void 0;
+    this.modelCache.saveSelection(this._selectedModelRef ?? null, name);
+  }
+  /**
+   * Optional external tool executor. When set, this is called for tool
+   * requests instead of looking up tools from `options.tools`.
+   * This allows the consumer (OpenCode) to wire in its permission system.
+   *
+   * The executor is automatically bound to the async context at the time
+   * it is set, so that AsyncLocalStorage-based contexts (like Instance)
+   * remain available when the executor is invoked from WebSocket callbacks.
+   */
+  _toolExecutor = null;
+  /**
+   * Optional callback invoked with intermediate token usage estimates
+   * after each tool execution completes. This allows the consumer to
+   * display live token counts during long-running DWS workflows, since
+   * the AI SDK only surfaces usage via finish-step at stream end.
+   */
+  onUsageUpdate = null;
+  /**
+   * Optional callback invoked when multiple workflow models are available
+   * and the user should pick one. Set per-stream by the host (e.g., OpenCode)
+   * alongside `toolExecutor`. Takes precedence over `workflowOptions.onSelectModel`.
+   */
+  onSelectModel = null;
+  get toolExecutor() {
+    return this._toolExecutor;
+  }
+  set toolExecutor(executor) {
+    if (executor) {
+      try {
+        const { AsyncResource } = __require("async_hooks");
+        this._toolExecutor = AsyncResource.bind(executor);
+      } catch {
+        this._toolExecutor = executor;
+      }
+    } else {
+      this._toolExecutor = null;
+    }
+  }
+  constructor(modelId, config, workflowOptions = {}) {
+    this.modelId = modelId;
+    this.config = config;
+    this.workflowOptions = workflowOptions;
+    const workDir = workflowOptions.workingDirectory ?? process.cwd();
+    this.modelCache = new GitLabModelCache(workDir, config.instanceUrl);
+    const cached = this.modelCache.load();
+    if (cached?.selectedModelRef) {
+      this._selectedModelRef = cached.selectedModelRef;
+    }
+    if (cached?.selectedModelName) {
+      this._selectedModelName = cached.selectedModelName;
+    }
+    this.tokenClient = new GitLabWorkflowTokenClient({
+      instanceUrl: config.instanceUrl,
+      getHeaders: config.getHeaders,
+      refreshApiKey: config.refreshApiKey,
+      fetch: config.fetch,
+      featureFlags: config.featureFlags
+    });
+    this.projectDetector = new GitLabProjectDetector({
+      instanceUrl: config.instanceUrl,
+      getHeaders: config.getHeaders,
+      fetch: config.fetch
+    });
+    this.modelDiscovery = new GitLabModelDiscovery({
+      instanceUrl: config.instanceUrl,
+      getHeaders: config.getHeaders,
+      fetch: config.fetch
+    });
+  }
+  get provider() {
+    return this.config.provider;
+  }
+  /**
+   * Resolve the project ID (path) to use for workflow creation.
+   * Priority: explicit option > auto-detected from git remote > undefined.
+   */
+  async resolveProjectId() {
+    if (this.workflowOptions.projectId) {
+      return this.workflowOptions.projectId;
+    }
+    if (this.detectedProjectPath) {
+      return this.detectedProjectPath;
+    }
+    const workDir = this.workflowOptions.workingDirectory ?? process.cwd();
+    const project = await this.projectDetector.detectProject(workDir);
+    if (project) {
+      this.detectedProjectPath = project.pathWithNamespace;
+      return project.pathWithNamespace;
+    }
+    return void 0;
+  }
+  /**
+   * Resolve the root namespace GID to use for model discovery.
+   *
+   * Priority:
+   *   1. Explicit `rootNamespaceId` in workflowOptions (caller-provided GID)
+   *   2. Auto-detected from git remote via project detector (namespace.id → GID)
+   *   3. Cached from previous call
+   */
+  async resolveRootNamespaceId() {
+    if (this.workflowOptions.rootNamespaceId) {
+      return this.workflowOptions.rootNamespaceId;
+    }
+    if (this._rootNamespaceId !== void 0) {
+      return this._rootNamespaceId;
+    }
+    const workDir = this.workflowOptions.workingDirectory ?? process.cwd();
+    const project = await this.projectDetector.detectProject(workDir);
+    if (project?.namespaceId) {
+      const gid = `gid://gitlab/Group/${project.namespaceId}`;
+      this._rootNamespaceId = gid;
+      return gid;
+    }
+    this._rootNamespaceId = null;
+    return null;
+  }
+  /**
+   * Resolve the effective DWS model ref to use for this stream.
+   * Deduplicates concurrent calls via a shared promise.
+   *
+   * Priority for the canonical `duo-workflow` model ID:
+   *   1. Admin-pinned model (from GitLabModelDiscovery) — always wins
+   *   2. User selection via onSelectModel callback (if model switching enabled)
+   *   3. Workspace default model
+   *   4. File-cached discovery/selection — used when live discovery fails
+   *   5. Hard-coded 'default' (DWS decides) — fallback when discovery fails
+   *
+   * For all other `duo-workflow-*` model IDs the static mapping is used as-is.
+   */
+  async resolveModelRef() {
+    const staticRef = getWorkflowModelRef(this.modelId);
+    if (this.modelId !== "duo-workflow") {
+      return staticRef ?? "default";
+    }
+    if (this._selectedModelRef) {
+      return this._selectedModelRef;
+    }
+    if (!this._discoveryPromise) {
+      this._discoveryPromise = this.doResolveModelRef();
+      this._discoveryPromise.finally(() => {
+        this._discoveryPromise = void 0;
+      });
+    }
+    return this._discoveryPromise;
+  }
+  async doResolveModelRef() {
+    const rootNamespaceId = await this.resolveRootNamespaceId();
+    if (!rootNamespaceId) {
+      this._selectedModelRef = "default";
+      return "default";
+    }
+    try {
+      const discovered = await this.modelDiscovery.discover(rootNamespaceId);
+      this.modelCache.saveDiscovery(discovered);
+      if (discovered.pinnedModel) {
+        this._selectedModelRef = discovered.pinnedModel.ref;
+        this._selectedModelName = discovered.pinnedModel.name;
+        this.modelCache.saveSelection(discovered.pinnedModel.ref, discovered.pinnedModel.name);
+        return discovered.pinnedModel.ref;
+      }
+      const selectFn = this.onSelectModel ?? this.workflowOptions.onSelectModel;
+      if (discovered.selectableModels.length > 0 && selectFn) {
+        const selected = await selectFn(discovered.selectableModels);
+        if (selected) {
+          const match = discovered.selectableModels.find((m) => m.ref === selected);
+          if (match) {
+            this._selectedModelRef = match.ref;
+            this._selectedModelName = match.name;
+            this.modelCache.saveSelection(match.ref, match.name);
+            return match.ref;
+          }
+        }
+      }
+      if (discovered.defaultModel) {
+        this._selectedModelRef = discovered.defaultModel.ref;
+        this._selectedModelName = discovered.defaultModel.name;
+        this.modelCache.saveSelection(discovered.defaultModel.ref, discovered.defaultModel.name);
+        return discovered.defaultModel.ref;
+      }
+    } catch {
+      const cachedEntry = this.modelCache.load();
+      if (cachedEntry?.selectedModelRef) {
+        this._selectedModelRef = cachedEntry.selectedModelRef;
+        this._selectedModelName = cachedEntry.selectedModelName ?? void 0;
+        return cachedEntry.selectedModelRef;
+      }
+    }
+    this._selectedModelRef = "default";
+    return "default";
+  }
+  /**
+   * Pre-fetch available models for the workspace.
+   * Call this early (e.g., on IDE startup) to avoid blocking the first stream.
+   * Results are persisted to the workspace model cache.
+   *
+   * @param rootNamespaceId - GitLab group ID (e.g., 'gid://gitlab/Group/12345')
+   * @returns Discovered models with default, selectable, and pinned models
+   */
+  async discoverModels(rootNamespaceId) {
+    const result = await this.modelDiscovery.discover(rootNamespaceId);
+    this.modelCache.saveDiscovery(result);
+    return result;
+  }
+  /**
+   * Get the file-based model cache instance for this workspace.
+   * Useful for consumers that need direct cache access (e.g., the discover route).
+   */
+  getModelCache() {
+    return this.modelCache;
+  }
+  /**
+   * Stop the active workflow.
+   */
+  stopWorkflow() {
+    for (const client of this.activeClients) {
+      if (client.isConnected) {
+        client.stop();
+      }
+    }
+  }
+  /**
+   * Reset the workflow state, forcing a new workflow to be created on the
+   * next doStream() call. Call this when starting a new conversation.
+   */
+  resetWorkflow() {
+    this.currentWorkflowId = null;
+    this.persistedAgentEmitted.clear();
+  }
+  /**
+   * Get the current workflow ID (if any).
+   * Useful for consumers that need to track workflow state.
+   */
+  get workflowId() {
+    return this.currentWorkflowId;
+  }
+  // ---------------------------------------------------------------------------
+  // LanguageModelV2 — doGenerate (non-streaming)
+  // ---------------------------------------------------------------------------
+  async doGenerate(options) {
+    const { stream } = await this.doStream(options);
+    const reader = stream.getReader();
+    const textParts = [];
+    const toolCalls = [];
+    let finishReason = "unknown";
+    const usage = { inputTokens: 0, outputTokens: 0, totalTokens: 0 };
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        switch (value.type) {
+          case "text-delta":
+            textParts.push(value.delta);
+            break;
+          case "tool-call":
+            toolCalls.push({
+              type: "tool-call",
+              toolCallId: value.toolCallId,
+              toolName: value.toolName,
+              input: value.input
+            });
+            break;
+          case "finish":
+            finishReason = value.finishReason;
+            if (value.usage) {
+              usage.inputTokens = value.usage.inputTokens ?? 0;
+              usage.outputTokens = value.usage.outputTokens ?? 0;
+              usage.totalTokens = value.usage.totalTokens ?? 0;
+            }
+            break;
+          case "error":
+            throw value.error;
+        }
+      }
+    } finally {
+      reader.releaseLock();
+    }
+    const content = [];
+    const fullText = textParts.join("");
+    if (fullText) {
+      content.push({ type: "text", text: fullText });
+    }
+    content.push(...toolCalls);
+    return { content, finishReason, usage, warnings: [] };
+  }
+  // ---------------------------------------------------------------------------
+  // LanguageModelV2 — doStream (streaming)
+  // ---------------------------------------------------------------------------
+  async doStream(options) {
+    const goal = this.extractGoalFromPrompt(options.prompt);
+    const modelRef = await this.resolveModelRef();
+    const mcpTools = this.extractMcpTools(options);
+    const preapprovedTools = this.workflowOptions.preapprovedTools ?? mcpTools.map((t) => t.name);
+    const additionalContext = this.buildAdditionalContext(options.prompt);
+    const toolExecutor = this.toolExecutor ?? null;
+    await this.tokenClient.getToken(
+      this.workflowOptions.workflowDefinition ?? DEFAULT_WORKFLOW_DEFINITION,
+      this.workflowOptions.rootNamespaceId
+    );
+    const projectId = await this.resolveProjectId();
+    let workflowId;
+    if (this.currentWorkflowId) {
+      workflowId = this.currentWorkflowId;
+    } else {
+      workflowId = await this.tokenClient.createWorkflow(goal, {
+        projectId,
+        namespaceId: this.workflowOptions.namespaceId,
+        workflowDefinition: this.workflowOptions.workflowDefinition
+      });
+      this.currentWorkflowId = workflowId;
+    }
+    const wsClient = new GitLabWorkflowClient();
+    this.activeClients.add(wsClient);
+    let textBlockCounter = 0;
+    const ss = {
+      streamClosed: false,
+      streamedInputChars: 0,
+      streamedOutputChars: 0,
+      pendingToolCount: 0,
+      deferredClose: null,
+      activeTextBlockId: null,
+      agentMessageEmitted: new Map(this.persistedAgentEmitted),
+      currentAgentMessageId: "",
+      activeClient: wsClient
+    };
+    for (const msg of options.prompt) {
+      if (msg.role === "system") {
+        ss.streamedInputChars += msg.content.length;
+      } else if (msg.role === "user") {
+        for (const part of msg.content) {
+          if (part.type === "text") {
+            ss.streamedInputChars += part.text.length;
+          }
+        }
+      }
+    }
+    const stream = new ReadableStream({
+      start: async (controller) => {
+        try {
+          await wsClient.connect(
+            {
+              instanceUrl: this.config.instanceUrl,
+              modelRef,
+              headers: this.config.getHeaders(),
+              projectId: this.workflowOptions.projectId,
+              namespaceId: this.workflowOptions.namespaceId,
+              rootNamespaceId: this.workflowOptions.rootNamespaceId
+            },
+            (event) => {
+              this.handleWorkflowEvent(
+                ss,
+                event,
+                controller,
+                wsClient,
+                toolExecutor,
+                () => `text-${textBlockCounter++}`
+              );
+            }
+          );
+          const workflowDef = this.workflowOptions.workflowDefinition ?? DEFAULT_WORKFLOW_DEFINITION;
+          const capabilities = this.workflowOptions.clientCapabilities ?? DEFAULT_CLIENT_CAPABILITIES;
+          const workflowMetadata = await this.buildWorkflowMetadata();
+          const metadataStr = JSON.stringify(workflowMetadata);
+          const basePayload = {
+            workflowID: workflowId,
+            clientVersion: CLIENT_VERSION,
+            workflowDefinition: workflowDef,
+            goal,
+            workflowMetadata: metadataStr,
+            clientCapabilities: capabilities,
+            preapproved_tools: preapprovedTools
+          };
+          const baseSize = JSON.stringify(basePayload).length + 100;
+          const trimmed = this.trimPayload(mcpTools, additionalContext, baseSize);
+          const trimmedPreapproved = preapprovedTools.filter(
+            (name) => trimmed.mcpTools.some((t) => t.name === name)
+          );
+          const startReq = {
+            workflowID: workflowId,
+            clientVersion: CLIENT_VERSION,
+            workflowDefinition: workflowDef,
+            goal,
+            workflowMetadata: metadataStr,
+            additional_context: trimmed.additionalContext,
+            clientCapabilities: capabilities,
+            mcpTools: trimmed.mcpTools,
+            preapproved_tools: trimmedPreapproved
+          };
+          if (this.workflowOptions.flowConfig) {
+            startReq.flowConfig = this.workflowOptions.flowConfig;
+          }
+          if (this.workflowOptions.flowConfigSchemaVersion) {
+            startReq.flowConfigSchemaVersion = this.workflowOptions.flowConfigSchemaVersion;
+          }
+          wsClient.sendStartRequest(startReq);
+          controller.enqueue({
+            type: "stream-start",
+            warnings: []
+          });
+          controller.enqueue({
+            type: "response-metadata",
+            id: workflowId,
+            modelId: modelRef
+          });
+        } catch (error) {
+          if (!ss.streamClosed) {
+            controller.enqueue({
+              type: "error",
+              error: error instanceof GitLabError ? error : new GitLabError({
+                message: `Workflow connection failed: ${error}`,
+                cause: error
+              })
+            });
+            ss.streamClosed = true;
+            controller.close();
+          }
+        }
+      },
+      cancel: (_reason) => {
+        wsClient.stop();
+        wsClient.close();
+        this.activeClients.delete(wsClient);
+        ss.activeClient = null;
+        this.currentWorkflowId = null;
+      }
+    });
+    return {
+      stream,
+      request: {
+        body: { workflowId, modelRef, goal }
+      }
+    };
+  }
+  // ---------------------------------------------------------------------------
+  // Event handling
+  // ---------------------------------------------------------------------------
+  handleWorkflowEvent(ss, event, controller, wsClient, toolExecutor, nextTextId) {
+    if (ss.streamClosed) {
+      return;
+    }
+    switch (event.type) {
+      case "checkpoint": {
+        this.processCheckpoint(ss, event.data, controller, nextTextId);
+        break;
+      }
+      case "tool-request": {
+        const { requestID, data } = event;
+        let parsedArgs;
+        try {
+          JSON.parse(data.args);
+          parsedArgs = data.args;
+        } catch {
+          parsedArgs = data.args || "{}";
+        }
+        if (ss.activeTextBlockId) {
+          controller.enqueue({ type: "text-end", id: ss.activeTextBlockId });
+          ss.activeTextBlockId = null;
+        }
+        controller.enqueue({
+          type: "tool-input-start",
+          id: requestID,
+          toolName: data.name,
+          providerExecuted: true
+        });
+        controller.enqueue({
+          type: "tool-input-delta",
+          id: requestID,
+          delta: parsedArgs
+        });
+        controller.enqueue({
+          type: "tool-input-end",
+          id: requestID
+        });
+        controller.enqueue({
+          type: "tool-call",
+          toolCallId: requestID,
+          toolName: data.name,
+          input: parsedArgs,
+          providerExecuted: true
+        });
+        this.executeToolAndRespond(
+          ss,
+          wsClient,
+          controller,
+          requestID,
+          data.name,
+          parsedArgs,
+          toolExecutor
+        ).catch(() => {
+        });
+        break;
+      }
+      case "builtin-tool-request": {
+        const mapped = mapBuiltinTool(event.toolName, event.data);
+        const mappedArgs = JSON.stringify(mapped.args);
+        if (ss.activeTextBlockId) {
+          controller.enqueue({ type: "text-end", id: ss.activeTextBlockId });
+          ss.activeTextBlockId = null;
+        }
+        controller.enqueue({
+          type: "tool-input-start",
+          id: event.requestID,
+          toolName: mapped.toolName,
+          providerExecuted: true
+        });
+        controller.enqueue({
+          type: "tool-input-delta",
+          id: event.requestID,
+          delta: mappedArgs
+        });
+        controller.enqueue({
+          type: "tool-input-end",
+          id: event.requestID
+        });
+        controller.enqueue({
+          type: "tool-call",
+          toolCallId: event.requestID,
+          toolName: mapped.toolName,
+          input: mappedArgs,
+          providerExecuted: true
+        });
+        this.executeToolAndRespond(
+          ss,
+          wsClient,
+          controller,
+          event.requestID,
+          mapped.toolName,
+          mappedArgs,
+          toolExecutor
+        ).catch(() => {
+        });
+        break;
+      }
+      case "completed": {
+        if (ss.activeTextBlockId) {
+          controller.enqueue({ type: "text-end", id: ss.activeTextBlockId });
+          ss.activeTextBlockId = null;
+        }
+        const doCompleteClose = () => {
+          if (ss.streamClosed) return;
+          const inputTokens = Math.ceil(ss.streamedInputChars / 4);
+          const outputTokens = Math.ceil(ss.streamedOutputChars / 4);
+          controller.enqueue({
+            type: "finish",
+            finishReason: "stop",
+            usage: { inputTokens, outputTokens, totalTokens: inputTokens + outputTokens }
+          });
+          ss.streamClosed = true;
+          controller.close();
+          this.cleanupClient(ss);
+        };
+        if (ss.pendingToolCount > 0) {
+          ss.deferredClose = doCompleteClose;
+        } else {
+          ss.deferredClose = null;
+          doCompleteClose();
+        }
+        break;
+      }
+      case "failed": {
+        if (ss.activeTextBlockId) {
+          controller.enqueue({ type: "text-end", id: ss.activeTextBlockId });
+          ss.activeTextBlockId = null;
+        }
+        controller.enqueue({
+          type: "error",
+          error: new GitLabError({
+            message: `Workflow failed: ${sanitizeErrorMessage(event.error.message)}`,
+            cause: event.error
+          })
+        });
+        ss.streamClosed = true;
+        controller.close();
+        this.cleanupClient(ss, true);
+        break;
+      }
+      case "closed": {
+        if (ss.streamClosed) {
+          break;
+        }
+        if (ss.activeTextBlockId) {
+          controller.enqueue({ type: "text-end", id: ss.activeTextBlockId });
+          ss.activeTextBlockId = null;
+        }
+        const doClose = () => {
+          if (ss.streamClosed) return;
+          if (event.code !== 1e3) {
+            controller.enqueue({
+              type: "error",
+              error: new GitLabError({
+                message: `WebSocket closed unexpectedly: code=${event.code} reason=${sanitizeErrorMessage(event.reason)}`,
+                statusCode: event.code
+              })
+            });
+            ss.streamClosed = true;
+            controller.close();
+            this.cleanupClient(ss, true);
+          } else {
+            const inTok = Math.ceil(ss.streamedInputChars / 4);
+            const outTok = Math.ceil(ss.streamedOutputChars / 4);
+            controller.enqueue({
+              type: "finish",
+              finishReason: "stop",
+              usage: { inputTokens: inTok, outputTokens: outTok, totalTokens: inTok + outTok }
+            });
+            ss.streamClosed = true;
+            controller.close();
+            this.cleanupClient(ss);
+          }
+        };
+        if (ss.pendingToolCount > 0) {
+          ss.deferredClose = doClose;
+        } else {
+          ss.deferredClose = null;
+          doClose();
+        }
+        break;
+      }
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Checkpoint content extraction
+  // ---------------------------------------------------------------------------
+  processCheckpoint(ss, checkpoint, controller, nextTextId) {
+    if (!checkpoint.checkpoint) {
+      if (checkpoint.content) {
+        if (!ss.activeTextBlockId) {
+          ss.activeTextBlockId = nextTextId();
+          controller.enqueue({ type: "text-start", id: ss.activeTextBlockId });
+        }
+        controller.enqueue({
+          type: "text-delta",
+          id: ss.activeTextBlockId,
+          delta: checkpoint.content
+        });
+        ss.streamedOutputChars += checkpoint.content.length;
+      }
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(checkpoint.checkpoint);
+    } catch (e) {
+      return;
+    }
+    const chatLog = parsed.channel_values?.ui_chat_log;
+    if (!chatLog || !Array.isArray(chatLog) || chatLog.length === 0) {
+      return;
+    }
+    if (checkpoint.status !== "RUNNING" && checkpoint.status !== "INPUT_REQUIRED" && checkpoint.status !== "FINISHED" && checkpoint.status !== "COMPLETED") {
+      return;
+    }
+    for (let i = 0; i < chatLog.length; i++) {
+      const entry = chatLog[i];
+      if (entry.message_type !== "agent") continue;
+      const content = entry.content || "";
+      const msgId = entry.message_id || `idx-${i}`;
+      const emittedLen = ss.agentMessageEmitted.get(msgId) ?? 0;
+      if (content.length <= emittedLen) continue;
+      const delta = content.slice(emittedLen);
+      const isSameMsg = msgId === ss.currentAgentMessageId;
+      if (!isSameMsg && ss.activeTextBlockId) {
+        controller.enqueue({ type: "text-end", id: ss.activeTextBlockId });
+        ss.activeTextBlockId = null;
+      }
+      if (!ss.activeTextBlockId) {
+        ss.activeTextBlockId = nextTextId();
+        controller.enqueue({ type: "text-start", id: ss.activeTextBlockId });
+      }
+      controller.enqueue({
+        type: "text-delta",
+        id: ss.activeTextBlockId,
+        delta
+      });
+      ss.streamedOutputChars += delta.length;
+      ss.agentMessageEmitted.set(msgId, content.length);
+      this.persistedAgentEmitted.set(msgId, content.length);
+      ss.currentAgentMessageId = msgId;
+    }
+  }
+  async executeToolAndRespond(ss, wsClient, controller, requestID, toolName, argsJson, toolExecutor) {
+    ss.pendingToolCount++;
+    const safeEnqueue = (part) => {
+      if (ss.streamClosed) {
+        return;
+      }
+      try {
+        controller.enqueue(part);
+      } catch {
+      }
+    };
+    try {
+      if (toolExecutor) {
+        const result = await toolExecutor(toolName, argsJson, requestID);
+        wsClient.sendActionResponse(requestID, result.result, result.error);
+        ss.streamedInputChars += argsJson.length;
+        ss.streamedOutputChars += result.result.length;
+        let toolOutput = result.result;
+        let toolTitle = `${toolName} result`;
+        let toolMetadata = { output: result.result };
+        try {
+          const parsed = JSON.parse(result.result);
+          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            if (typeof parsed.output === "string") {
+              toolOutput = parsed.output;
+            } else if (parsed.output != null) {
+              toolOutput = JSON.stringify(parsed.output);
+            }
+            if (typeof parsed.title === "string") toolTitle = parsed.title;
+            if (parsed.metadata && typeof parsed.metadata === "object") {
+              toolMetadata = {};
+              for (const [k, v] of Object.entries(parsed.metadata)) {
+                toolMetadata[k] = typeof v === "string" ? v : JSON.stringify(v);
+              }
+              if (!("output" in toolMetadata)) {
+                toolMetadata.output = toolOutput;
+              }
+            }
+          } else if (Array.isArray(parsed)) {
+            toolOutput = JSON.stringify(parsed);
+            toolMetadata = { output: toolOutput };
+          }
+        } catch {
+        }
+        if (result.error) {
+          let errorText;
+          if (typeof result.error === "string") {
+            errorText = result.error;
+          } else if (result.error && typeof result.error === "object") {
+            errorText = JSON.stringify(result.error);
+          } else {
+            errorText = String(result.error);
+          }
+          const errorOutput = toolOutput || errorText;
+          safeEnqueue({
+            type: "tool-result",
+            toolCallId: requestID,
+            toolName,
+            result: {
+              output: errorOutput,
+              title: toolTitle,
+              metadata: { ...toolMetadata, error: errorText }
+            },
+            isError: true,
+            providerExecuted: true
+          });
+        } else {
+          safeEnqueue({
+            type: "tool-result",
+            toolCallId: requestID,
+            toolName,
+            result: {
+              output: toolOutput,
+              title: toolTitle,
+              metadata: toolMetadata
+            },
+            isError: false,
+            providerExecuted: true
+          });
+        }
+      } else {
+        const errorMsg = `Tool executor not configured for tool: ${toolName}`;
+        wsClient.sendActionResponse(requestID, "", errorMsg);
+        safeEnqueue({
+          type: "tool-result",
+          toolCallId: requestID,
+          toolName,
+          result: {
+            output: errorMsg,
+            title: `${toolName} error`,
+            metadata: { output: errorMsg }
+          },
+          isError: true,
+          providerExecuted: true
+        });
+      }
+    } catch (error) {
+      const rawMsg = error instanceof Error ? error.message : String(error);
+      const errorMsg = sanitizeErrorMessage(rawMsg);
+      wsClient.sendActionResponse(requestID, "", errorMsg);
+      safeEnqueue({
+        type: "tool-result",
+        toolCallId: requestID,
+        toolName,
+        result: {
+          output: errorMsg,
+          title: `${toolName} error`,
+          metadata: { output: errorMsg }
+        },
+        isError: true,
+        providerExecuted: true
+      });
+    } finally {
+      ss.pendingToolCount--;
+      if (this.onUsageUpdate) {
+        try {
+          this.onUsageUpdate({
+            inputTokens: Math.ceil(ss.streamedInputChars / 4),
+            outputTokens: Math.ceil(ss.streamedOutputChars / 4)
+          });
+        } catch {
+        }
+      }
+      if (ss.pendingToolCount <= 0 && ss.deferredClose) {
+        const close = ss.deferredClose;
+        ss.deferredClose = null;
+        close();
+      }
+    }
+  }
+  cleanupClient(ss, clearWorkflow = false) {
+    if (ss.activeClient) {
+      ss.activeClient.close();
+      this.activeClients.delete(ss.activeClient);
+      ss.activeClient = null;
+    }
+    if (clearWorkflow) {
+      this.currentWorkflowId = null;
+      this.persistedAgentEmitted.clear();
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Workflow metadata
+  // ---------------------------------------------------------------------------
+  async buildWorkflowMetadata() {
+    const metadata = {
+      extended_logging: false
+    };
+    try {
+      const workDir = this.workflowOptions.workingDirectory ?? process.cwd();
+      const gitInfo = await this.getGitInfo(workDir);
+      if (gitInfo.url) metadata.git_url = gitInfo.url;
+      if (gitInfo.sha) metadata.git_sha = gitInfo.sha;
+      if (gitInfo.branch) metadata.git_branch = gitInfo.branch;
+    } catch {
+    }
+    return metadata;
+  }
+  async getGitInfo(workDir) {
+    const { execFile } = await import("child_process");
+    const { promisify } = await import("util");
+    const execFileAsync = promisify(execFile);
+    const opts = { cwd: workDir, timeout: 3e3 };
+    const run = async (cmd, args) => {
+      try {
+        const { stdout } = await execFileAsync(cmd, args, opts);
+        return stdout.trim() || void 0;
+      } catch {
+        return void 0;
+      }
+    };
+    const [url, sha, branch] = await Promise.all([
+      run("git", ["remote", "get-url", "origin"]),
+      run("git", ["rev-parse", "HEAD"]),
+      run("git", ["rev-parse", "--abbrev-ref", "HEAD"])
+    ]);
+    return { url, sha, branch };
+  }
+  // ---------------------------------------------------------------------------
+  // Prompt / tool extraction helpers
+  // ---------------------------------------------------------------------------
+  /**
+   * Extract the user's goal (last user message) from the AI SDK prompt.
+   */
+  extractGoalFromPrompt(prompt) {
+    for (let i = prompt.length - 1; i >= 0; i--) {
+      const message = prompt[i];
+      if (message.role === "user") {
+        const textParts = message.content.filter((part) => part.type === "text").map((part) => part.text);
+        if (textParts.length > 0) {
+          return textParts.join("\n");
+        }
+      }
+    }
+    return "";
+  }
+  /**
+   * Convert AI SDK tools to DWS McpToolDefinition format.
+   */
+  extractMcpTools(options) {
+    if (this.workflowOptions.mcpTools && this.workflowOptions.mcpTools.length > 0) {
+      return this.workflowOptions.mcpTools;
+    }
+    if (!options.tools || options.tools.length === 0) {
+      return [];
+    }
+    return options.tools.filter((tool) => tool.type === "function").map((tool) => ({
+      name: tool.name,
+      description: tool.description || "",
+      inputSchema: JSON.stringify(tool.inputSchema || { type: "object", properties: {} })
+    }));
+  }
+  // ---------------------------------------------------------------------------
+  // Payload size management
+  // ---------------------------------------------------------------------------
+  static MAX_START_REQUEST_BYTES = 4 * 1024 * 1024;
+  /**
+   * Trim mcpTools and additionalContext to fit within the DWS 4MB gRPC
+   * message size limit (`MAX_MESSAGE_SIZE` in duo_workflow_service/server.py).
+   *
+   * DWS has no per-field limits on tool descriptions, schemas, or context items.
+   * The only hard constraint is the total serialized message size.
+   *
+   * Strategy (progressive, only if over budget):
+   * 1. Send everything as-is
+   * 2. Simplify tool input schemas (strip descriptions from properties)
+   * 3. Strip schemas to minimal form (type + property names only)
+   * 4. Drop tools from the end until it fits
+   */
+  trimPayload(mcpTools, additionalContext, basePayloadSize) {
+    const budget = _GitLabWorkflowLanguageModel.MAX_START_REQUEST_BYTES - basePayloadSize;
+    const contextJson = JSON.stringify(additionalContext);
+    const toolsJson = JSON.stringify(mcpTools);
+    const totalSize = toolsJson.length + contextJson.length;
+    if (totalSize <= budget) {
+      return { mcpTools, additionalContext };
+    }
+    const simplifiedTools = mcpTools.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: simplifySchema(tool.inputSchema)
+    }));
+    const simpSize = JSON.stringify(simplifiedTools).length + contextJson.length;
+    if (simpSize <= budget) {
+      return { mcpTools: simplifiedTools, additionalContext };
+    }
+    const minTools = simplifiedTools.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: minimalSchema(tool.inputSchema)
+    }));
+    const minSize = JSON.stringify(minTools).length + contextJson.length;
+    if (minSize <= budget) {
+      return { mcpTools: minTools, additionalContext };
+    }
+    const keptTools = [...minTools];
+    while (keptTools.length > 0) {
+      const currentSize = JSON.stringify(keptTools).length + contextJson.length;
+      if (currentSize <= budget) break;
+      keptTools.pop();
+    }
+    return { mcpTools: keptTools, additionalContext };
+  }
+  buildAdditionalContext(prompt) {
+    const context = [];
+    if (this.workflowOptions.additionalContext) {
+      context.push(...this.workflowOptions.additionalContext);
+    }
+    for (const message of prompt) {
+      if (message.role === "system") {
+        context.push({
+          category: "system_prompt",
+          content: message.content,
+          metadata: JSON.stringify({ role: "system" })
+        });
+      } else if (message.role === "assistant") {
+        const textContent = message.content.filter((part) => part.type === "text").map((part) => part.text).join("\n");
+        if (textContent) {
+          context.push({
+            category: "conversation",
+            content: textContent,
+            metadata: JSON.stringify({ role: "assistant" })
+          });
+        }
+      }
+    }
+    return context;
+  }
+};
+
+// src/gitlab-oauth-types.ts
+var OPENCODE_GITLAB_AUTH_CLIENT_ID = "1d89f9fdb23ee96d4e603201f6861dab6e143c5c3c00469a018a2d94bdc03d4e";
+var BUNDLED_CLIENT_ID = "36f2a70cddeb5a0889d4fd8295c241b7e9848e89cf9e599d0eed2d8e5350fbf5";
+var GITLAB_COM_URL = "https://gitlab.com";
+var TOKEN_EXPIRY_SKEW_MS = 5 * 60 * 1e3;
+var OAUTH_SCOPES = ["api"];
+
+// src/gitlab-oauth-manager.ts
+var GitLabOAuthManager = class {
+  fetch;
+  constructor(fetchImpl = fetch) {
+    this.fetch = fetchImpl;
+  }
+  /**
+   * Check if a token is expired
+   */
+  isTokenExpired(expiresAt) {
+    return Date.now() >= expiresAt;
+  }
+  /**
+   * Check if a token needs refresh (within skew window)
+   */
+  needsRefresh(expiresAt) {
+    return Date.now() >= expiresAt - TOKEN_EXPIRY_SKEW_MS;
+  }
+  /**
+   * Refresh tokens if needed
+   * Returns the same tokens if refresh is not needed, or new tokens if refreshed
+   */
+  async refreshIfNeeded(tokens, clientId) {
+    if (!this.needsRefresh(tokens.expiresAt)) {
+      return tokens;
+    }
+    if (this.isTokenExpired(tokens.expiresAt)) {
+      throw new GitLabError({
+        message: "OAuth token has expired and cannot be used"
+      });
+    }
+    return this.exchangeRefreshToken({
+      instanceUrl: tokens.instanceUrl,
+      refreshToken: tokens.refreshToken,
+      clientId
+    });
+  }
+  /**
+   * Exchange authorization code for tokens
+   * Based on gitlab-vscode-extension createOAuthAccountFromCode
+   */
+  async exchangeAuthorizationCode(params) {
+    const { instanceUrl, code, codeVerifier, clientId, redirectUri } = params;
+    const tokenResponse = await this.exchangeToken({
+      instanceUrl,
+      grantType: "authorization_code",
+      code,
+      codeVerifier,
+      clientId: clientId || this.getClientId(instanceUrl),
+      redirectUri
+    });
+    return this.createTokensFromResponse(tokenResponse, instanceUrl);
+  }
+  /**
+   * Exchange refresh token for new tokens
+   * Based on gitlab-vscode-extension TokenExchangeService
+   */
+  async exchangeRefreshToken(params) {
+    const { instanceUrl, refreshToken, clientId } = params;
+    const tokenResponse = await this.exchangeToken({
+      instanceUrl,
+      grantType: "refresh_token",
+      refreshToken,
+      clientId: clientId || this.getClientId(instanceUrl)
+    });
+    return this.createTokensFromResponse(tokenResponse, instanceUrl);
+  }
+  /**
+   * Get the OAuth client ID for an instance.
+   * Priority: env var > opencode-gitlab-auth default (for GitLab.com).
+   * Note: callers (e.g. exchangeRefreshToken) may pass an explicit clientId
+   * that bypasses this method entirely.
+   */
+  getClientId(instanceUrl) {
+    const envClientId = process.env["GITLAB_OAUTH_CLIENT_ID"];
+    if (envClientId) {
+      return envClientId;
+    }
+    if (instanceUrl === GITLAB_COM_URL) {
+      return OPENCODE_GITLAB_AUTH_CLIENT_ID;
+    }
+    throw new GitLabError({
+      message: `No OAuth client ID configured for instance ${instanceUrl}. Please provide a clientId parameter or set GITLAB_OAUTH_CLIENT_ID environment variable.`
+    });
+  }
+  /**
+   * Exchange token with GitLab OAuth endpoint
+   * Based on gitlab-vscode-extension GitLabService.exchangeToken
+   */
+  async exchangeToken(params) {
+    const { instanceUrl, grantType, code, codeVerifier, refreshToken, clientId, redirectUri } = params;
+    const body = {
+      client_id: clientId,
+      grant_type: grantType
+    };
+    if (grantType === "authorization_code") {
+      if (!code || !codeVerifier || !redirectUri) {
+        throw new GitLabError({
+          message: "Authorization code, code verifier, and redirect URI are required for authorization_code grant"
+        });
+      }
+      body.code = code;
+      body.code_verifier = codeVerifier;
+      body.redirect_uri = redirectUri;
+    } else if (grantType === "refresh_token") {
+      if (!refreshToken) {
+        throw new GitLabError({
+          message: "Refresh token is required for refresh_token grant"
+        });
+      }
+      body.refresh_token = refreshToken;
+    }
+    const url = `${instanceUrl}/oauth/token`;
+    try {
+      const response = await this.fetch(url, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams(body).toString()
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        throw new GitLabError({
+          message: `OAuth token exchange failed: ${response.status} ${response.statusText}`,
+          cause: new Error(errorText)
+        });
+      }
+      const data = await response.json();
+      return data;
+    } catch (error) {
+      if (error instanceof GitLabError) {
+        throw error;
+      }
+      throw new GitLabError({
+        message: `Failed to exchange OAuth token: ${error instanceof Error ? error.message : String(error)}`,
+        cause: error instanceof Error ? error : void 0
+      });
+    }
+  }
+  /**
+   * Create GitLabOAuthTokens from token response
+   */
+  createTokensFromResponse(response, instanceUrl) {
+    const expiresAt = this.createExpiresTimestamp(response);
+    return {
+      accessToken: response.access_token,
+      refreshToken: response.refresh_token || "",
+      expiresAt,
+      instanceUrl
+    };
+  }
+  /**
+   * Create expiry timestamp from token response
+   * Based on gitlab-vscode-extension createExpiresTimestamp
+   */
+  createExpiresTimestamp(response) {
+    const createdAt = response.created_at * 1e3;
+    const expiresIn = response.expires_in * 1e3;
+    return createdAt + expiresIn;
+  }
+};
+
+// src/gitlab-provider.ts
+import * as fs2 from "fs";
+import * as path3 from "path";
+import * as os2 from "os";
+function getOpenCodeAuthPath() {
+  const homeDir = os2.homedir();
+  const xdgDataHome = process.env.XDG_DATA_HOME;
+  if (xdgDataHome) {
+    return path3.join(xdgDataHome, "opencode", "auth.json");
+  }
+  if (process.platform !== "win32") {
+    return path3.join(homeDir, ".local", "share", "opencode", "auth.json");
+  }
+  return path3.join(homeDir, ".opencode", "auth.json");
+}
+async function loadOpenCodeAuth(instanceUrl) {
+  try {
+    const authPath = getOpenCodeAuthPath();
+    if (!fs2.existsSync(authPath)) {
+      return void 0;
+    }
+    const authData = JSON.parse(fs2.readFileSync(authPath, "utf-8"));
+    if (authData.gitlab?.type === "oauth") {
+      const gitlabAuth = authData.gitlab;
+      if (gitlabAuth.enterpriseUrl === instanceUrl || gitlabAuth.enterpriseUrl === instanceUrl.replace(/\/$/, "")) {
+        return gitlabAuth;
+      }
+    }
+    const normalizedUrl = instanceUrl.replace(/\/$/, "");
+    const auth = authData[normalizedUrl] || authData[`${normalizedUrl}/`];
+    return auth;
+  } catch (error) {
+    throw new Error(`Failed to load auth.json: ${error instanceof Error ? error.message : error}`);
+  }
+}
+async function loadApiKey(options, instanceUrl, clientId) {
+  if (options.apiKey) {
+    return options.apiKey;
+  }
+  const auth = await loadOpenCodeAuth(instanceUrl);
+  if (auth?.type === "oauth") {
+    const oauthManager = new GitLabOAuthManager();
+    if (oauthManager.needsRefresh(auth.expires)) {
+      try {
+        const refreshed = await oauthManager.exchangeRefreshToken({
+          instanceUrl,
+          refreshToken: auth.refresh,
+          clientId
+        });
+        const authPath = getOpenCodeAuthPath();
+        const authData = JSON.parse(fs2.readFileSync(authPath, "utf-8"));
+        authData.gitlab = {
+          type: "oauth",
+          refresh: refreshed.refreshToken,
+          access: refreshed.accessToken,
+          expires: refreshed.expiresAt,
+          enterpriseUrl: instanceUrl
+          // Use enterpriseUrl to match auth plugin format
+        };
+        fs2.writeFileSync(authPath, JSON.stringify(authData, null, 2), { mode: 384 });
+        return refreshed.accessToken;
+      } catch (error) {
+        const refreshErrorMsg = error instanceof Error ? error.message : String(error);
+        const envApiKey = process.env[options.environmentVariableName];
+        if (envApiKey) {
+          return envApiKey;
+        }
+        throw new GitLabError({
+          message: `OAuth token refresh failed and no fallback ${options.environmentVariableName} environment variable is set. Refresh error: ${refreshErrorMsg}. Re-authenticate with 'opencode auth login gitlab' or set ${options.environmentVariableName}.`
+        });
+      }
+    } else {
+      return auth.access;
+    }
+  }
+  const apiKey = process.env[options.environmentVariableName];
+  if (!apiKey) {
+    throw new GitLabError({
+      message: `${options.description} API key is missing. Pass it as the 'apiKey' parameter, set the ${options.environmentVariableName} environment variable, or authenticate with 'opencode auth login gitlab'.`
+    });
+  }
+  return apiKey;
+}
+function withUserAgentSuffix(headers, suffix) {
+  const userAgent = headers["User-Agent"];
+  return {
+    ...headers,
+    "User-Agent": userAgent ? `${userAgent} ${suffix}` : suffix
+  };
+}
+function createGitLab(options = {}) {
+  const instanceUrl = options.instanceUrl ?? process.env["GITLAB_INSTANCE_URL"] ?? "https://gitlab.com";
+  const providerName = options.name ?? "gitlab";
+  let cachedApiKey;
+  let apiKeyPromise;
+  const getApiKey = async () => {
+    if (cachedApiKey) {
+      return cachedApiKey;
+    }
+    if (apiKeyPromise) {
+      return apiKeyPromise;
+    }
+    apiKeyPromise = loadApiKey(
+      {
+        apiKey: options.apiKey,
+        environmentVariableName: "GITLAB_TOKEN",
+        description: "GitLab"
+      },
+      instanceUrl,
+      options.clientId
+    );
+    cachedApiKey = await apiKeyPromise;
+    apiKeyPromise = void 0;
+    return cachedApiKey;
+  };
+  const refreshApiKey = async () => {
+    cachedApiKey = void 0;
+    apiKeyPromise = void 0;
+    cachedApiKey = await loadApiKey(
+      {
+        apiKey: void 0,
+        // Bypass stale options.apiKey to force auth.json read
+        environmentVariableName: "GITLAB_TOKEN",
+        description: "GitLab"
+      },
+      instanceUrl,
+      options.clientId
+    );
+  };
+  const getHeaders = () => {
+    const apiKey = cachedApiKey || options.apiKey || process.env["GITLAB_TOKEN"] || "";
+    if (!apiKey) {
+      throw new GitLabError({
+        message: "GitLab API key is missing. Pass it as the 'apiKey' parameter, set the GITLAB_TOKEN environment variable, or authenticate with 'opencode auth login gitlab'."
+      });
+    }
+    return withUserAgentSuffix(
+      {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+        ...options.headers
+      },
+      `ai-sdk-gitlab/${VERSION}`
+    );
+  };
+  getApiKey().catch(() => {
+  });
+  const createAgenticChatModel = (modelId, agenticOptions) => {
+    const mapping = getModelMapping(modelId);
+    if (!mapping) {
+      throw new GitLabError({
+        message: `Unknown model ID: ${modelId}. Model must be registered in MODEL_MAPPINGS.`
+      });
+    }
+    if (agenticOptions?.providerModel) {
+      const validModels = getValidModelsForProvider(mapping.provider);
+      if (!validModels.includes(agenticOptions.providerModel)) {
+        throw new GitLabError({
+          message: `Invalid providerModel '${agenticOptions.providerModel}' for provider '${mapping.provider}'. Valid models: ${validModels.join(", ")}`
+        });
+      }
+    }
+    const featureFlags = {
+      DuoAgentPlatformNext: true,
+      ...options.featureFlags,
+      ...agenticOptions?.featureFlags
+    };
+    const defaultAiGatewayHeaders = {
+      "User-Agent": `gitlab-ai-provider/${VERSION}`
+    };
+    const aiGatewayHeaders = {
+      ...defaultAiGatewayHeaders,
+      ...options.aiGatewayHeaders,
+      ...agenticOptions?.aiGatewayHeaders
+    };
+    const baseConfig = {
+      provider: `${providerName}.agentic`,
+      instanceUrl,
+      getHeaders,
+      refreshApiKey,
+      fetch: options.fetch,
+      maxTokens: agenticOptions?.maxTokens,
+      featureFlags,
+      aiGatewayUrl: options.aiGatewayUrl,
+      aiGatewayHeaders
+    };
+    if (mapping.provider === "openai") {
+      return new GitLabOpenAILanguageModel(modelId, {
+        ...baseConfig,
+        openaiModel: agenticOptions?.providerModel ?? mapping.model
+      });
+    }
+    return new GitLabAnthropicLanguageModel(modelId, {
+      ...baseConfig,
+      anthropicModel: agenticOptions?.providerModel ?? mapping.model
+    });
+  };
+  const createWorkflowChatModel = (modelId, workflowOptions) => {
+    const mapping = getModelMapping(modelId);
+    if (!mapping || mapping.provider !== "workflow") {
+      throw new GitLabError({
+        message: `Unknown workflow model ID: ${modelId}. Use 'duo-workflow' or a 'duo-workflow-*' model ID.`
+      });
+    }
+    return new GitLabWorkflowLanguageModel(
+      modelId,
+      {
+        provider: `${providerName}.workflow`,
+        instanceUrl,
+        getHeaders,
+        refreshApiKey,
+        fetch: options.fetch,
+        featureFlags: {
+          ...options.featureFlags,
+          ...workflowOptions?.featureFlags
+        },
+        aiGatewayUrl: options.aiGatewayUrl
+      },
+      workflowOptions
+    );
+  };
+  const createDefaultModel = (modelId) => {
+    if (isWorkflowModel(modelId)) {
+      return createWorkflowChatModel(modelId);
+    }
+    return createAgenticChatModel(modelId);
+  };
+  const provider = Object.assign((modelId) => createDefaultModel(modelId), {
+    specificationVersion: "v2",
+    languageModel: createDefaultModel,
+    chat: createDefaultModel,
+    agenticChat: createAgenticChatModel,
+    workflowChat: createWorkflowChatModel
+  });
+  provider.textEmbeddingModel = (modelId) => {
+    throw new GitLabError({
+      message: `GitLab provider does not support text embedding models. Model ID: ${modelId}`
+    });
+  };
+  provider.imageModel = (modelId) => {
+    throw new GitLabError({
+      message: `GitLab provider does not support image models. Model ID: ${modelId}`
+    });
+  };
+  return provider;
+}
+var gitlab = createGitLab();
+export {
+  AGENT_PRIVILEGES,
+  BUNDLED_CLIENT_ID,
+  CLIENT_VERSION,
+  DEFAULT_AGENT_PRIVILEGES,
+  DEFAULT_AI_GATEWAY_URL,
+  DEFAULT_CLIENT_CAPABILITIES,
+  DEFAULT_WORKFLOW_DEFINITION,
+  GITLAB_COM_URL,
+  GitLabAnthropicLanguageModel,
+  GitLabDirectAccessClient,
+  GitLabError,
+  GitLabModelCache,
+  GitLabModelDiscovery,
+  GitLabOAuthManager,
+  GitLabOpenAILanguageModel,
+  GitLabProjectCache,
+  GitLabProjectDetector,
+  GitLabWorkflowClient,
+  GitLabWorkflowLanguageModel,
+  GitLabWorkflowTokenClient,
+  MODEL_ID_TO_ANTHROPIC_MODEL,
+  MODEL_MAPPINGS,
+  OAUTH_SCOPES,
+  OPENCODE_GITLAB_AUTH_CLIENT_ID,
+  TOKEN_EXPIRY_SKEW_MS,
+  VERSION,
+  WORKFLOW_ENVIRONMENT,
+  WS_HEARTBEAT_INTERVAL_MS,
+  WS_KEEPALIVE_PING_INTERVAL_MS,
+  WorkflowType,
+  createGitLab,
+  getAnthropicModelForModelId,
+  getModelMapping,
+  getOpenAIApiType,
+  getOpenAIModelForModelId,
+  getProviderForModelId,
+  getValidModelsForProvider,
+  getWorkflowModelRef,
+  gitlab,
+  isResponsesApiModel,
+  isWorkflowModel
+};
+//# sourceMappingURL=index.mjs.map