opencode-gitlab-duo-agentic-custom-tools 0.3.0

package/dist/index.js

@@ -0,0 +1,1981 @@
+// src/plugin/hooks.ts
+import { tool } from "@opencode-ai/plugin";
+
+// src/constants.ts
+var PROVIDER_ID = "gitlab";
+var DEFAULT_MODEL_ID = "duo-chat-sonnet-4-5";
+var DEFAULT_INSTANCE_URL = "https://gitlab.com";
+var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var WORKFLOW_DEFINITION = "chat";
+var WORKFLOW_CLIENT_VERSION = "1.0";
+var WORKFLOW_ENVIRONMENT = "ide";
+var WORKFLOW_CONNECT_TIMEOUT_MS = 15e3;
+var WORKFLOW_HEARTBEAT_INTERVAL_MS = 6e4;
+var WORKFLOW_KEEPALIVE_INTERVAL_MS = 45e3;
+var WORKFLOW_TOKEN_EXPIRY_BUFFER_MS = 3e4;
+
+// src/gitlab/models.ts
+import crypto from "crypto";
+import fs2 from "fs/promises";
+import os from "os";
+import path2 from "path";
+import { z } from "zod";
+
+// src/gitlab/client.ts
+var GitLabApiError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "GitLabApiError";
+  }
+};
+async function request(options, path3, init) {
+  const url = `${options.instanceUrl}/api/v4/${path3}`;
+  const headers = new Headers(init.headers);
+  headers.set("authorization", `Bearer ${options.token}`);
+  const response = await fetch(url, {
+    ...init,
+    headers
+  });
+  return response;
+}
+async function get(options, path3) {
+  const response = await request(options, path3, { method: "GET" });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    throw new GitLabApiError(response.status, `GET ${path3} failed (${response.status}): ${text2}`);
+  }
+  return response.json();
+}
+async function post(options, path3, body) {
+  const response = await request(options, path3, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    throw new GitLabApiError(response.status, `POST ${path3} failed (${response.status}): ${text2}`);
+  }
+  return response.json();
+}
+async function graphql(options, query, variables) {
+  const url = `${options.instanceUrl}/api/graphql`;
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${options.token}`
+    },
+    body: JSON.stringify({ query, variables })
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    throw new GitLabApiError(response.status, `GraphQL request failed (${response.status}): ${text2}`);
+  }
+  const result = await response.json();
+  if (result.errors?.length) {
+    throw new GitLabApiError(0, result.errors.map((e) => e.message).join("; "));
+  }
+  if (!result.data) {
+    throw new GitLabApiError(0, "GraphQL response missing data");
+  }
+  return result.data;
+}
+
+// src/gitlab/project.ts
+import fs from "fs/promises";
+import path from "path";
+async function detectProjectPath(cwd, instanceUrl) {
+  const instance = new URL(instanceUrl);
+  const instanceHost = instance.host;
+  const instanceBasePath = instance.pathname.replace(/\/$/, "");
+  let current = cwd;
+  for (; ; ) {
+    try {
+      const config = await readGitConfig(current);
+      const url = extractOriginUrl(config);
+      if (!url) return void 0;
+      const remote = parseRemoteUrl(url);
+      if (!remote || remote.host !== instanceHost) return void 0;
+      return normalizeProjectPath(remote.path, instanceBasePath);
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) return void 0;
+      current = parent;
+    }
+  }
+}
+async function fetchProjectDetails(client, projectPath) {
+  const encoded = encodeURIComponent(projectPath);
+  const data = await get(client, `projects/${encoded}`);
+  if (!data.id || !data.namespace?.id) {
+    throw new Error(`Project ${projectPath}: missing id or namespace`);
+  }
+  return {
+    projectId: String(data.id),
+    namespaceId: String(data.namespace.id)
+  };
+}
+async function resolveRootNamespaceId(client, namespaceId) {
+  let currentId = namespaceId;
+  for (let depth = 0; depth < 20; depth++) {
+    let ns;
+    try {
+      ns = await get(client, `namespaces/${currentId}`);
+    } catch {
+      break;
+    }
+    if (!ns.parent_id) {
+      currentId = String(ns.id ?? currentId);
+      break;
+    }
+    currentId = String(ns.parent_id);
+  }
+  return `gid://gitlab/Group/${currentId}`;
+}
+async function readGitConfig(cwd) {
+  const gitPath = path.join(cwd, ".git");
+  const stat = await fs.stat(gitPath);
+  if (stat.isDirectory()) {
+    return fs.readFile(path.join(gitPath, "config"), "utf8");
+  }
+  const content = await fs.readFile(gitPath, "utf8");
+  const match = /^gitdir:\s*(.+)$/m.exec(content);
+  if (!match) throw new Error("Invalid .git file");
+  const gitdir = match[1].trim();
+  const resolved = path.isAbsolute(gitdir) ? gitdir : path.join(cwd, gitdir);
+  return fs.readFile(path.join(resolved, "config"), "utf8");
+}
+function extractOriginUrl(config) {
+  const lines = config.split("\n");
+  let inOrigin = false;
+  let originUrl;
+  let firstUrl;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const section = /^\[remote\s+"([^"]+)"\]$/.exec(trimmed);
+    if (section) {
+      inOrigin = section[1] === "origin";
+      continue;
+    }
+    const urlMatch = /^url\s*=\s*(.+)$/.exec(trimmed);
+    if (urlMatch) {
+      const value = urlMatch[1].trim();
+      if (!firstUrl) firstUrl = value;
+      if (inOrigin) originUrl = value;
+    }
+  }
+  return originUrl ?? firstUrl;
+}
+function parseRemoteUrl(url) {
+  if (url.startsWith("git@")) {
+    const match = /^git@([^:]+):(.+)$/.exec(url);
+    return match ? { host: match[1], path: match[2] } : void 0;
+  }
+  try {
+    const parsed = new URL(url);
+    return { host: parsed.host, path: parsed.pathname.replace(/^\//, "") };
+  } catch {
+    return void 0;
+  }
+}
+function normalizeProjectPath(remotePath, instanceBasePath) {
+  let p = remotePath;
+  if (instanceBasePath && instanceBasePath !== "/") {
+    const base = instanceBasePath.replace(/^\//, "") + "/";
+    if (p.startsWith(base)) p = p.slice(base.length);
+  }
+  if (p.endsWith(".git")) p = p.slice(0, -4);
+  return p.length > 0 ? p : void 0;
+}
+
+// src/gitlab/models.ts
+var CachePayloadSchema = z.object({
+  cachedAt: z.string(),
+  instanceUrl: z.string(),
+  models: z.array(
+    z.object({
+      id: z.string(),
+      name: z.string()
+    })
+  ).min(1)
+});
+var QUERY = `query lsp_aiChatAvailableModels($rootNamespaceId: GroupID!) {
+  aiChatAvailableModels(rootNamespaceId: $rootNamespaceId) {
+    defaultModel { name ref }
+    selectableModels { name ref }
+    pinnedModel { name ref }
+  }
+}`;
+async function loadAvailableModels(instanceUrl, token, cwd) {
+  const cachePath = getCachePath(instanceUrl, cwd);
+  const cached = await readCache(cachePath);
+  if (cached && !isStale(cached)) {
+    return cached.models;
+  }
+  if (token) {
+    try {
+      const models = await fetchModelsFromApi({ instanceUrl, token }, cwd);
+      if (models.length > 0) {
+        await writeCache(cachePath, { cachedAt: (/* @__PURE__ */ new Date()).toISOString(), instanceUrl, models });
+        return models;
+      }
+    } catch {
+    }
+  }
+  if (cached) {
+    return cached.models;
+  }
+  return [{ id: DEFAULT_MODEL_ID, name: DEFAULT_MODEL_ID }];
+}
+async function fetchModelsFromApi(client, cwd) {
+  const projectPath = await detectProjectPath(cwd, client.instanceUrl);
+  if (!projectPath) return [];
+  const project = await fetchProjectDetails(client, projectPath);
+  const rootNamespaceId = await resolveRootNamespaceId(client, project.namespaceId);
+  const data = await graphql(client, QUERY, { rootNamespaceId });
+  const available = data.aiChatAvailableModels;
+  if (!available) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const models = [];
+  function add(entry2) {
+    if (!entry2?.ref || seen.has(entry2.ref)) return;
+    seen.add(entry2.ref);
+    models.push({ id: entry2.ref, name: entry2.name || entry2.ref });
+  }
+  add(available.defaultModel);
+  add(available.pinnedModel);
+  for (const m of available.selectableModels ?? []) add(m);
+  return models;
+}
+function getCachePath(instanceUrl, cwd) {
+  const key = `${instanceUrl}::${cwd}`;
+  const hash = crypto.createHash("sha256").update(key).digest("hex").slice(0, 12);
+  const dir = process.env.XDG_CACHE_HOME?.trim() ? path2.join(process.env.XDG_CACHE_HOME, "opencode") : path2.join(os.homedir(), ".cache", "opencode");
+  return path2.join(dir, `gitlab-duo-models-${hash}.json`);
+}
+function isStale(payload) {
+  const age = Date.now() - Date.parse(payload.cachedAt);
+  return age > CACHE_TTL_MS;
+}
+async function readCache(cachePath) {
+  try {
+    const raw = await fs2.readFile(cachePath, "utf8");
+    const parsed = CachePayloadSchema.parse(JSON.parse(raw));
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function writeCache(cachePath, payload) {
+  try {
+    await fs2.mkdir(path2.dirname(cachePath), { recursive: true });
+    await fs2.writeFile(cachePath, JSON.stringify(payload, null, 2), "utf8");
+  } catch {
+  }
+}
+
+// src/utils/url.ts
+function text(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function envInstanceUrl() {
+  return process.env.GITLAB_INSTANCE_URL ?? process.env.GITLAB_URL ?? process.env.GITLAB_BASE_URL;
+}
+function normalizeInstanceUrl(value) {
+  const raw = text(value) ?? DEFAULT_INSTANCE_URL;
+  const withProtocol = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+  try {
+    const url = new URL(withProtocol);
+    return `${url.protocol}//${url.host}`;
+  } catch {
+    return DEFAULT_INSTANCE_URL;
+  }
+}
+
+// src/gitlab/resolve-credentials.ts
+function resolveCredentials(options = {}) {
+  const instanceUrl = normalizeInstanceUrl(options.instanceUrl ?? envInstanceUrl());
+  const token = firstNonEmptyString(options.apiKey, options.token) ?? envToken() ?? "";
+  return { instanceUrl, token };
+}
+function envToken() {
+  return process.env.GITLAB_TOKEN ?? process.env.GITLAB_OAUTH_TOKEN;
+}
+function firstNonEmptyString(...values) {
+  for (const v of values) {
+    if (typeof v === "string" && v.trim().length > 0) return v.trim();
+  }
+  return void 0;
+}
+
+// src/plugin/config.ts
+async function applyRuntimeConfig(config, directory) {
+  config.provider ??= {};
+  const current = config.provider[PROVIDER_ID] ?? {};
+  const options = current.options ?? {};
+  const { instanceUrl, token } = resolveCredentials(options);
+  const available = await loadAvailableModels(instanceUrl, token, directory);
+  const modelIds = available.map((m) => m.id);
+  const models = toModelsConfig(available);
+  config.provider[PROVIDER_ID] = {
+    ...current,
+    npm: "opencode-gitlab-duo-agentic-custom-tools",
+    whitelist: modelIds,
+    options: {
+      ...options,
+      instanceUrl
+    },
+    models: {
+      ...current.models ?? {},
+      ...models
+    }
+  };
+}
+function toModelsConfig(available) {
+  const out = {};
+  for (const m of available) {
+    out[m.id] = { id: m.id, name: m.name };
+  }
+  return out;
+}
+
+// src/plugin/hooks.ts
+async function createPluginHooks(input) {
+  return {
+    tool: {
+      todoread: tool({
+        description: "Use this tool to read your todo list",
+        args: {},
+        async execute(_args, ctx) {
+          await ctx.ask({
+            permission: "todoread",
+            patterns: ["*"],
+            always: ["*"],
+            metadata: {}
+          });
+          const url = new URL(`/session/${encodeURIComponent(ctx.sessionID)}/todo`, input.serverUrl);
+          const response = await fetch(url);
+          if (!response.ok) {
+            throw new Error(`Failed to read todos: ${response.status} ${response.statusText}`);
+          }
+          const payload = await response.json();
+          if (Array.isArray(payload)) {
+            return JSON.stringify(payload, null, 2);
+          }
+          return "[]";
+        }
+      })
+    },
+    config: async (config) => applyRuntimeConfig(config, input.directory),
+    "chat.message": async ({ sessionID }, { parts }) => {
+      const text2 = parts.filter((p) => p.type === "text" && !("synthetic" in p && p.synthetic)).map((p) => "text" in p ? p.text : "").join(" ").trim();
+      if (!text2) return;
+      const title = text2.length > 100 ? text2.slice(0, 97) + "..." : text2;
+      const url = new URL(`/session/${encodeURIComponent(sessionID)}`, input.serverUrl);
+      await fetch(url, {
+        method: "PATCH",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title })
+      }).catch(() => {
+      });
+    },
+    "chat.params": async (context, output) => {
+      if (!isGitLabProvider(context.model)) return;
+      if (isUtilityAgent(context.agent)) return;
+      output.options = {
+        ...output.options,
+        workflowSessionID: context.sessionID
+      };
+    },
+    "chat.headers": async (context, output) => {
+      if (!isGitLabProvider(context.model)) return;
+      if (isUtilityAgent(context.agent)) return;
+      output.headers = {
+        ...output.headers,
+        "x-opencode-session": context.sessionID
+      };
+    }
+  };
+}
+var UTILITY_AGENTS = /* @__PURE__ */ new Set(["title", "compaction"]);
+function isUtilityAgent(agent) {
+  const name = typeof agent === "string" ? agent : agent.name;
+  return UTILITY_AGENTS.has(name);
+}
+function isGitLabProvider(model) {
+  if (model.api?.npm === "opencode-gitlab-duo-agentic-custom-tools") return true;
+  if (model.providerID === "gitlab" && model.api?.npm !== "@gitlab/gitlab-ai-provider") return true;
+  return model.providerID.toLowerCase().includes("gitlab-duo");
+}
+
+// src/provider/index.ts
+import { NoSuchModelError } from "@ai-sdk/provider";
+
+// src/provider/duo-workflow-model.ts
+import { randomUUID as randomUUID3 } from "crypto";
+
+// src/workflow/session.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/utils/async-queue.ts
+var AsyncQueue = class {
+  #values = [];
+  #waiters = [];
+  #closed = false;
+  push(value) {
+    if (this.#closed) return;
+    const waiter = this.#waiters.shift();
+    if (waiter) {
+      waiter(value);
+      return;
+    }
+    this.#values.push(value);
+  }
+  /** Returns null when closed and no buffered values remain. */
+  shift() {
+    const value = this.#values.shift();
+    if (value !== void 0) return Promise.resolve(value);
+    if (this.#closed) return Promise.resolve(null);
+    return new Promise((resolve) => this.#waiters.push(resolve));
+  }
+  close() {
+    this.#closed = true;
+    for (const waiter of this.#waiters) {
+      waiter(null);
+    }
+    this.#waiters = [];
+  }
+};
+
+// src/workflow/checkpoint.ts
+import { randomUUID } from "crypto";
+function createCheckpointState() {
+  return {
+    uiChatLog: [],
+    processedRequestIndices: /* @__PURE__ */ new Set()
+  };
+}
+function extractAgentTextDeltas(checkpoint, state) {
+  const next = parseCheckpoint(checkpoint);
+  const out = [];
+  for (let i = 0; i < next.length; i++) {
+    const item = next[i];
+    if (item.message_type !== "agent") continue;
+    const previous = state.uiChatLog[i];
+    if (!previous || previous.message_type !== "agent") {
+      if (item.content) out.push(item.content);
+      continue;
+    }
+    if (item.content === previous.content) continue;
+    if (item.content.startsWith(previous.content)) {
+      const delta = item.content.slice(previous.content.length);
+      if (delta) out.push(delta);
+      continue;
+    }
+    if (item.content) out.push(item.content);
+  }
+  state.uiChatLog = next;
+  return out;
+}
+function parseCheckpoint(raw) {
+  if (!raw) return [];
+  try {
+    const parsed = JSON.parse(raw);
+    const log = parsed.channel_values?.ui_chat_log;
+    if (!Array.isArray(log)) return [];
+    return log.filter(isUiChatLogEntry);
+  } catch {
+    return [];
+  }
+}
+function isUiChatLogEntry(value) {
+  if (!value || typeof value !== "object") return false;
+  const item = value;
+  if (typeof item.message_type !== "string") return false;
+  if (typeof item.content !== "string") return false;
+  return item.message_type === "user" || item.message_type === "agent" || item.message_type === "tool" || item.message_type === "request";
+}
+
+// src/workflow/token-service.ts
+var WorkflowTokenService = class {
+  #client;
+  #cache = /* @__PURE__ */ new Map();
+  constructor(client) {
+    this.#client = client;
+  }
+  clear() {
+    this.#cache.clear();
+  }
+  async get(rootNamespaceId) {
+    const key = rootNamespaceId ?? "";
+    const cached = this.#cache.get(key);
+    if (cached && cached.expiresAt > Date.now()) return cached.value;
+    try {
+      const value = await post(
+        this.#client,
+        "ai/duo_workflows/direct_access",
+        rootNamespaceId ? {
+          workflow_definition: WORKFLOW_DEFINITION,
+          root_namespace_id: rootNamespaceId
+        } : {
+          workflow_definition: WORKFLOW_DEFINITION
+        }
+      );
+      const expiresAt = readExpiry(value);
+      this.#cache.set(key, { value, expiresAt });
+      return value;
+    } catch {
+      return null;
+    }
+  }
+};
+function readExpiry(value) {
+  const workflowExpiry = typeof value.duo_workflow_service?.token_expires_at === "number" ? value.duo_workflow_service.token_expires_at * 1e3 : Number.POSITIVE_INFINITY;
+  const railsExpiry = typeof value.gitlab_rails?.token_expires_at === "string" ? Date.parse(value.gitlab_rails.token_expires_at) : Number.POSITIVE_INFINITY;
+  const expiry = Math.min(workflowExpiry, railsExpiry);
+  if (!Number.isFinite(expiry)) return Date.now() + 5 * 60 * 1e3;
+  return Math.max(Date.now() + 1e3, expiry - WORKFLOW_TOKEN_EXPIRY_BUFFER_MS);
+}
+
+// src/workflow/types.ts
+var WORKFLOW_STATUS = {
+  CREATED: "CREATED",
+  RUNNING: "RUNNING",
+  FINISHED: "FINISHED",
+  FAILED: "FAILED",
+  STOPPED: "STOPPED",
+  INPUT_REQUIRED: "INPUT_REQUIRED",
+  PLAN_APPROVAL_REQUIRED: "PLAN_APPROVAL_REQUIRED",
+  TOOL_CALL_APPROVAL_REQUIRED: "TOOL_CALL_APPROVAL_REQUIRED"
+};
+function isCheckpointAction(action) {
+  return "newCheckpoint" in action && action.newCheckpoint != null;
+}
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+  WORKFLOW_STATUS.FINISHED,
+  WORKFLOW_STATUS.FAILED,
+  WORKFLOW_STATUS.STOPPED
+]);
+function isTerminal(status) {
+  return TERMINAL_STATUSES.has(status);
+}
+var TURN_BOUNDARY_STATUSES = /* @__PURE__ */ new Set([
+  WORKFLOW_STATUS.INPUT_REQUIRED,
+  WORKFLOW_STATUS.PLAN_APPROVAL_REQUIRED
+]);
+function isTurnBoundary(status) {
+  return TURN_BOUNDARY_STATUSES.has(status);
+}
+function isToolApproval(status) {
+  return status === WORKFLOW_STATUS.TOOL_CALL_APPROVAL_REQUIRED;
+}
+function isTurnComplete(status) {
+  return isTerminal(status) || isTurnBoundary(status);
+}
+
+// src/workflow/websocket-client.ts
+import WebSocket from "isomorphic-ws";
+var WorkflowWebSocketClient = class {
+  #socket = null;
+  #heartbeat;
+  #keepalive;
+  #callbacks;
+  constructor(callbacks) {
+    this.#callbacks = callbacks;
+  }
+  async connect(url, headers) {
+    const socket = new WebSocket(url, { headers });
+    this.#socket = socket;
+    await new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        cleanup();
+        socket.close(1e3);
+        reject(new Error(`WebSocket connection timeout after ${WORKFLOW_CONNECT_TIMEOUT_MS}ms`));
+      }, WORKFLOW_CONNECT_TIMEOUT_MS);
+      const cleanup = () => {
+        clearTimeout(timeout);
+        socket.off("open", onOpen);
+        socket.off("error", onError);
+      };
+      const onOpen = () => {
+        cleanup();
+        resolve();
+      };
+      const onError = (error) => {
+        cleanup();
+        reject(error);
+      };
+      socket.once("open", onOpen);
+      socket.once("error", onError);
+    });
+    socket.on("message", (data) => {
+      try {
+        const payload = decodeSocketMessage(data);
+        if (!payload) return;
+        const parsed = JSON.parse(payload);
+        this.#callbacks.action(parsed);
+      } catch (error) {
+        const next = error instanceof Error ? error : new Error(String(error));
+        this.#callbacks.error(next);
+      }
+    });
+    socket.on("error", (error) => {
+      this.#callbacks.error(error instanceof Error ? error : new Error(String(error)));
+    });
+    socket.on("close", (code, reason) => {
+      this.#stopIntervals();
+      this.#callbacks.close(code, reason?.toString("utf8") ?? "");
+    });
+    this.#heartbeat = setInterval(() => {
+      this.send({ heartbeat: { timestamp: Date.now() } });
+    }, WORKFLOW_HEARTBEAT_INTERVAL_MS);
+    this.#keepalive = setInterval(() => {
+      if (!this.#socket || this.#socket.readyState !== WebSocket.OPEN) return;
+      this.#socket.ping(Buffer.from(String(Date.now())));
+    }, WORKFLOW_KEEPALIVE_INTERVAL_MS);
+  }
+  send(event) {
+    if (!this.#socket || this.#socket.readyState !== WebSocket.OPEN) return false;
+    this.#socket.send(JSON.stringify(event));
+    return true;
+  }
+  close() {
+    this.#stopIntervals();
+    if (!this.#socket) return;
+    this.#socket.close(1e3);
+    this.#socket = null;
+  }
+  #stopIntervals() {
+    if (this.#heartbeat) {
+      clearInterval(this.#heartbeat);
+      this.#heartbeat = void 0;
+    }
+    if (this.#keepalive) {
+      clearInterval(this.#keepalive);
+      this.#keepalive = void 0;
+    }
+  }
+};
+function decodeSocketMessage(data) {
+  if (typeof data === "string") return data;
+  if (Buffer.isBuffer(data)) return data.toString("utf8");
+  if (data instanceof ArrayBuffer) return Buffer.from(data).toString("utf8");
+  if (Array.isArray(data)) return Buffer.concat(data).toString("utf8");
+  return void 0;
+}
+
+// src/workflow/action-mapper.ts
+function mapActionToToolRequest(action) {
+  const requestId = action.requestID;
+  if (!requestId) return null;
+  if (action.runMCPTool) {
+    let parsedArgs;
+    if (typeof action.runMCPTool.args === "string") {
+      try {
+        parsedArgs = JSON.parse(action.runMCPTool.args);
+      } catch {
+        parsedArgs = {};
+      }
+    } else {
+      parsedArgs = {};
+    }
+    return { requestId, toolName: action.runMCPTool.name, args: parsedArgs };
+  }
+  if (action.runReadFile) {
+    return {
+      requestId,
+      toolName: "read_file",
+      args: {
+        file_path: action.runReadFile.filepath,
+        offset: action.runReadFile.offset,
+        limit: action.runReadFile.limit
+      }
+    };
+  }
+  if (action.runReadFiles) {
+    return {
+      requestId,
+      toolName: "read_files",
+      args: { file_paths: action.runReadFiles.filepaths ?? [] }
+    };
+  }
+  if (action.runWriteFile) {
+    return {
+      requestId,
+      toolName: "create_file_with_contents",
+      args: {
+        file_path: action.runWriteFile.filepath,
+        contents: action.runWriteFile.contents
+      }
+    };
+  }
+  if (action.runEditFile) {
+    return {
+      requestId,
+      toolName: "edit_file",
+      args: {
+        file_path: action.runEditFile.filepath,
+        old_str: action.runEditFile.oldString,
+        new_str: action.runEditFile.newString
+      }
+    };
+  }
+  if (action.findFiles) {
+    return {
+      requestId,
+      toolName: "find_files",
+      args: { name_pattern: action.findFiles.name_pattern }
+    };
+  }
+  if (action.listDirectory) {
+    return {
+      requestId,
+      toolName: "list_dir",
+      args: { directory: action.listDirectory.directory }
+    };
+  }
+  if (action.grep) {
+    const args = { pattern: action.grep.pattern };
+    if (action.grep.search_directory) args.search_directory = action.grep.search_directory;
+    if (action.grep.case_insensitive !== void 0) args.case_insensitive = action.grep.case_insensitive;
+    return { requestId, toolName: "grep", args };
+  }
+  if (action.mkdir) {
+    return {
+      requestId,
+      toolName: "mkdir",
+      args: { directory_path: action.mkdir.directory_path }
+    };
+  }
+  if (action.runShellCommand) {
+    return {
+      requestId,
+      toolName: "shell_command",
+      args: { command: action.runShellCommand.command }
+    };
+  }
+  if (action.runCommand) {
+    return {
+      requestId,
+      toolName: "run_command",
+      args: {
+        program: action.runCommand.program,
+        flags: action.runCommand.flags,
+        arguments: action.runCommand.arguments
+      }
+    };
+  }
+  if (action.runGitCommand) {
+    return {
+      requestId,
+      toolName: "run_git_command",
+      args: {
+        repository_url: action.runGitCommand.repository_url ?? "",
+        command: action.runGitCommand.command,
+        args: action.runGitCommand.arguments
+      }
+    };
+  }
+  if (action.runHTTPRequest) {
+    return {
+      requestId,
+      toolName: "gitlab_api_request",
+      args: {
+        method: action.runHTTPRequest.method,
+        path: action.runHTTPRequest.path,
+        body: action.runHTTPRequest.body
+      }
+    };
+  }
+  return null;
+}
+
+// src/utils/debug-log.ts
+import { appendFileSync } from "fs";
+var LOG_FILE = "/tmp/duo-workflow-debug.log";
+function dlog(msg) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  appendFileSync(LOG_FILE, `[${ts}] ${msg}
+`);
+}
+
+// src/workflow/session.ts
+var BLOCKED_HTTP_REQUEST_ERROR = "gitlab_api_request is disabled by client policy";
+var BLOCKED_GIT_COMMAND_ERROR = "run_git_command is disabled by client policy";
+var WorkflowSession = class {
+  #client;
+  #tokenService;
+  #modelId;
+  #cwd;
+  #workflowId;
+  #projectPath;
+  #rootNamespaceId;
+  #checkpoint = createCheckpointState();
+  #toolsConfig;
+  #socket;
+  #queue;
+  #startRequestSent = false;
+  #pendingApproval = false;
+  #resumed = false;
+  #onWorkflowCreated;
+  constructor(client, modelId, cwd, options) {
+    this.#client = client;
+    this.#tokenService = new WorkflowTokenService(client);
+    this.#modelId = modelId;
+    this.#cwd = cwd;
+    if (options?.existingWorkflowId) {
+      this.#workflowId = options.existingWorkflowId;
+      this.#resumed = true;
+    }
+    this.#onWorkflowCreated = options?.onWorkflowCreated;
+  }
+  /**
+   * Opt-in: override the server-side system prompt and/or register MCP tools.
+   */
+  setToolsConfig(config) {
+    this.#toolsConfig = config;
+  }
+  get workflowId() {
+    return this.#workflowId;
+  }
+  get hasStarted() {
+    return this.#startRequestSent;
+  }
+  reset() {
+    this.#workflowId = void 0;
+    this.#checkpoint = createCheckpointState();
+    this.#tokenService.clear();
+    this.#closeConnection();
+    this.#pendingApproval = false;
+    this.#resumed = false;
+    this.#startRequestSent = false;
+  }
+  // ---------------------------------------------------------------------------
+  // Connection lifecycle (persistent)
+  // ---------------------------------------------------------------------------
+  async ensureConnected(goal) {
+    if (this.#socket && this.#queue) return;
+    if (!this.#workflowId) {
+      this.#workflowId = await this.#createWorkflow(goal);
+    }
+    const queue = new AsyncQueue();
+    this.#queue = queue;
+    await this.#connectSocket(queue);
+  }
+  /**
+   * Open a WebSocket and wire its callbacks to the given queue.
+   * Replaces any existing socket but does NOT create a new queue.
+   */
+  async #connectSocket(queue) {
+    await this.#tokenService.get(this.#rootNamespaceId);
+    const socket = new WorkflowWebSocketClient({
+      action: (action) => this.#handleAction(action, queue),
+      error: (error) => queue.push({ type: "error", message: error.message }),
+      close: (code, reason) => {
+        dlog(`ws-close: code=${code} reason=${reason} pendingApproval=${this.#pendingApproval}`);
+        this.#socket = void 0;
+        if (this.#pendingApproval) {
+          this.#pendingApproval = false;
+          this.#reconnectWithApproval(queue);
+        } else {
+          this.#queue = void 0;
+          queue.close();
+        }
+      }
+    });
+    const url = buildWebSocketUrl(this.#client.instanceUrl, this.#modelId);
+    await socket.connect(url, {
+      authorization: `Bearer ${this.#client.token}`,
+      origin: new URL(this.#client.instanceUrl).origin,
+      "x-request-id": randomUUID2(),
+      "x-gitlab-client-type": "node-websocket"
+    });
+    this.#socket = socket;
+  }
+  // ---------------------------------------------------------------------------
+  // Messaging
+  // ---------------------------------------------------------------------------
+  sendStartRequest(goal, additionalContext = []) {
+    if (!this.#socket || !this.#workflowId) throw new Error("Not connected");
+    const mcpTools = this.#toolsConfig?.mcpTools ?? [];
+    const preapprovedTools = mcpTools.map((t) => t.name);
+    this.#socket.send({
+      startRequest: {
+        workflowID: this.#workflowId,
+        clientVersion: WORKFLOW_CLIENT_VERSION,
+        workflowDefinition: WORKFLOW_DEFINITION,
+        goal,
+        workflowMetadata: JSON.stringify({
+          extended_logging: false
+        }),
+        clientCapabilities: ["shell_command"],
+        mcpTools,
+        additional_context: additionalContext,
+        preapproved_tools: preapprovedTools,
+        ...this.#toolsConfig?.flowConfig ? {
+          flowConfig: this.#toolsConfig.flowConfig,
+          flowConfigSchemaVersion: this.#toolsConfig.flowConfigSchemaVersion ?? "v1"
+        } : {}
+      }
+    });
+    this.#startRequestSent = true;
+  }
+  /**
+   * Send a tool result back to DWS on the existing connection.
+   */
+  sendToolResult(requestId, output, error) {
+    dlog(`sendToolResult: reqId=${requestId} output=${output.length}b error=${error ?? "none"} socket=${!!this.#socket}`);
+    if (!this.#socket) throw new Error("Not connected");
+    this.#socket.send({
+      actionResponse: {
+        requestID: requestId,
+        plainTextResponse: {
+          response: output,
+          error: error ?? ""
+        }
+      }
+    });
+  }
+  /**
+   * Send an HTTP response back to DWS on the existing connection.
+   * Used for gitlab_api_request which requires httpResponse (not plainTextResponse).
+   */
+  sendHttpResult(requestId, statusCode, headers, body, error) {
+    dlog(`sendHttpResult: reqId=${requestId} status=${statusCode} body=${body.length}b error=${error ?? "none"} socket=${!!this.#socket}`);
+    if (!this.#socket) throw new Error("Not connected");
+    this.#socket.send({
+      actionResponse: {
+        requestID: requestId,
+        httpResponse: {
+          statusCode,
+          headers,
+          body,
+          error: error ?? ""
+        }
+      }
+    });
+  }
+  /**
+   * Wait for the next event from the session.
+   * Returns null when the stream is closed (turn complete or connection lost).
+   */
+  async waitForEvent() {
+    if (!this.#queue) return null;
+    return this.#queue.shift();
+  }
+  /**
+   * Send an abort signal to DWS and close the connection.
+   */
+  abort() {
+    this.#socket?.send({ stopWorkflow: { reason: "ABORTED" } });
+    this.#closeConnection();
+  }
+  // ---------------------------------------------------------------------------
+  // Private: action handling
+  // ---------------------------------------------------------------------------
+  #handleAction(action, queue) {
+    if (isCheckpointAction(action)) {
+      const ckpt = action.newCheckpoint.checkpoint;
+      const status = action.newCheckpoint.status;
+      dlog(`checkpoint: status=${status} ckptLen=${ckpt.length}`);
+      const deltas = extractAgentTextDeltas(ckpt, this.#checkpoint);
+      if (this.#resumed) {
+        dlog(`checkpoint: RESUMED \u2014 discarding ${deltas.length} old deltas, fast-forwarding state`);
+        this.#resumed = false;
+      } else {
+        for (const delta of deltas) {
+          queue.push({ type: "text-delta", value: delta });
+        }
+        if (deltas.length > 0) {
+          dlog(`checkpoint: ${deltas.length} text deltas`);
+        }
+      }
+      if (isToolApproval(status)) {
+        dlog(`checkpoint: TOOL_APPROVAL \u2192 pendingApproval=true (waiting for DWS close)`);
+        this.#pendingApproval = true;
+        return;
+      }
+      if (isTurnComplete(status)) {
+        dlog(`checkpoint: turnComplete \u2192 close queue+connection`);
+        queue.close();
+        this.#closeConnection();
+      }
+      return;
+    }
+    const toolAction = action;
+    if (toolAction.runHTTPRequest && toolAction.requestID) {
+      dlog(`standalone: BLOCKED httpRequest ${toolAction.runHTTPRequest.method} ${toolAction.runHTTPRequest.path} reqId=${toolAction.requestID}`);
+      this.sendHttpResult(toolAction.requestID, 403, {}, "", BLOCKED_HTTP_REQUEST_ERROR);
+      return;
+    }
+    if (toolAction.runGitCommand && toolAction.requestID) {
+      dlog(`standalone: BLOCKED runGitCommand ${toolAction.runGitCommand.command} reqId=${toolAction.requestID}`);
+      this.sendToolResult(toolAction.requestID, "", BLOCKED_GIT_COMMAND_ERROR);
+      return;
+    }
+    const mapped = mapActionToToolRequest(toolAction);
+    if (mapped) {
+      dlog(`standalone: ${mapped.toolName} reqId=${mapped.requestId} args=${JSON.stringify(mapped.args).slice(0, 200)}`);
+      queue.push({
+        type: "tool-request",
+        requestId: mapped.requestId,
+        toolName: mapped.toolName,
+        args: mapped.args
+      });
+    } else {
+      dlog(`standalone: UNMAPPED action keys=${Object.keys(action).join(",")}`);
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Private: connection management
+  // ---------------------------------------------------------------------------
+  /**
+   * Auto-approve at DWS protocol level and reconnect.
+   *
+   * DWS closed the stream after TOOL_CALL_APPROVAL_REQUIRED. We open a new
+   * WebSocket, send startRequest with approval, and wire it to the SAME queue
+   * so Phase 3 in the model continues consuming events seamlessly.
+   *
+   * The actual tool execution still goes through OpenCode's permission system
+   * when the standalone action arrives on the new stream.
+   */
+  #reconnectWithApproval(queue) {
+    dlog(`reconnectWithApproval: starting (workflowId=${this.#workflowId})`);
+    this.#connectSocket(queue).then(() => {
+      if (!this.#socket || !this.#workflowId) {
+        dlog(`reconnectWithApproval: FAILED no socket/workflowId`);
+        queue.close();
+        return;
+      }
+      const mcpTools = this.#toolsConfig?.mcpTools ?? [];
+      dlog(`reconnectWithApproval: sending startRequest with approval (mcpTools=${mcpTools.length})`);
+      this.#socket.send({
+        startRequest: {
+          workflowID: this.#workflowId,
+          clientVersion: WORKFLOW_CLIENT_VERSION,
+          workflowDefinition: WORKFLOW_DEFINITION,
+          goal: "",
+          workflowMetadata: JSON.stringify({ extended_logging: false }),
+          clientCapabilities: ["shell_command"],
+          mcpTools,
+          additional_context: [],
+          preapproved_tools: mcpTools.map((t) => t.name),
+          approval: { approval: {} },
+          ...this.#toolsConfig?.flowConfig ? {
+            flowConfig: this.#toolsConfig.flowConfig,
+            flowConfigSchemaVersion: this.#toolsConfig.flowConfigSchemaVersion ?? "v1"
+          } : {}
+        }
+      });
+      this.#startRequestSent = true;
+      dlog(`reconnectWithApproval: approval sent, waiting for standalone actions`);
+    }).catch((err) => {
+      dlog(`reconnectWithApproval: ERROR ${err instanceof Error ? err.message : String(err)}`);
+      this.#queue = void 0;
+      queue.close();
+    });
+  }
+  #closeConnection() {
+    this.#pendingApproval = false;
+    this.#socket?.close();
+    this.#socket = void 0;
+    this.#queue = void 0;
+    this.#startRequestSent = false;
+  }
+  async #createWorkflow(goal) {
+    await this.#loadProjectContext();
+    const body = {
+      goal,
+      workflow_definition: WORKFLOW_DEFINITION,
+      environment: WORKFLOW_ENVIRONMENT,
+      allow_agent_to_request_user: true,
+      ...this.#projectPath ? { project_id: this.#projectPath } : {}
+    };
+    const created = await post(this.#client, "ai/duo_workflows/workflows", body);
+    if (created.id === void 0 || created.id === null) {
+      const details = [created.message, created.error].filter(Boolean).join("; ");
+      throw new Error(`failed to create workflow${details ? `: ${details}` : ""}`);
+    }
+    const workflowId = String(created.id);
+    this.#onWorkflowCreated?.(workflowId);
+    return workflowId;
+  }
+  async #loadProjectContext() {
+    if (this.#projectPath !== void 0) return;
+    const projectPath = await detectProjectPath(this.#cwd, this.#client.instanceUrl);
+    this.#projectPath = projectPath;
+    if (!projectPath) return;
+    try {
+      const project = await fetchProjectDetails(this.#client, projectPath);
+      this.#rootNamespaceId = await resolveRootNamespaceId(this.#client, project.namespaceId);
+    } catch {
+      this.#rootNamespaceId = void 0;
+    }
+  }
+};
+function buildWebSocketUrl(instanceUrl, modelId) {
+  const base = new URL(instanceUrl.endsWith("/") ? instanceUrl : `${instanceUrl}/`);
+  const url = new URL("api/v4/ai/duo_workflows/ws", base);
+  if (base.protocol === "https:") url.protocol = "wss:";
+  if (base.protocol === "http:") url.protocol = "ws:";
+  if (modelId) url.searchParams.set("user_selected_model_identifier", modelId);
+  return url.toString();
+}
+
+// src/provider/prompt.ts
+var SYSTEM_REMINDER_RE = /<system-reminder>[\s\S]*?<\/system-reminder>/g;
+var WRAPPED_USER_RE = /^<system-reminder>\s*The user sent the following message:\s*\n([\s\S]*?)\n\s*Please address this message and continue with your tasks\.\s*<\/system-reminder>$/;
+function extractGoal(prompt) {
+  for (let i = prompt.length - 1; i >= 0; i--) {
+    const message = prompt[i];
+    if (message.role !== "user") continue;
+    const content = Array.isArray(message.content) ? message.content : [];
+    const text2 = content.filter((part) => part.type === "text").map((part) => stripSystemReminders(part.text)).filter(Boolean).join("\n").trim();
+    if (text2) return text2;
+  }
+  return "";
+}
+function stripSystemReminders(value) {
+  return value.replace(SYSTEM_REMINDER_RE, (block) => {
+    const wrapped = WRAPPED_USER_RE.exec(block);
+    return wrapped?.[1]?.trim() ?? "";
+  }).trim();
+}
+
+// src/provider/prompt-utils.ts
+function extractToolResults(prompt) {
+  if (!Array.isArray(prompt)) return [];
+  const results = [];
+  for (const message of prompt) {
+    const content = message.content;
+    if (!Array.isArray(content)) continue;
+    for (const part of content) {
+      const p = part;
+      if (p.type === "tool-result") {
+        const toolCallId = String(p.toolCallId ?? "");
+        const toolName = String(p.toolName ?? "");
+        if (!toolCallId) continue;
+        const { output, error } = parseToolResultOutput(p);
+        const finalError = error ?? asString(p.error) ?? asString(p.errorText);
+        results.push({ toolCallId, toolName, output, error: finalError });
+      }
+      if (p.type === "tool-error") {
+        const toolCallId = String(p.toolCallId ?? "");
+        const toolName = String(p.toolName ?? "");
+        const errorValue = p.error ?? p.errorText ?? p.message;
+        const error = asString(errorValue) ?? String(errorValue ?? "");
+        results.push({ toolCallId, toolName, output: "", error });
+      }
+    }
+  }
+  return results;
+}
+function asString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function parseToolResultOutput(part) {
+  const outputField = part.output;
+  const resultField = part.result;
+  if (isPlainObject(outputField) && "type" in outputField) {
+    const outputType = String(outputField.type);
+    const outputValue = outputField.value;
+    if (outputType === "text" || outputType === "json") {
+      return { output: typeof outputValue === "string" ? outputValue : JSON.stringify(outputValue ?? "") };
+    }
+    if (outputType === "error-text" || outputType === "error-json") {
+      return { output: "", error: typeof outputValue === "string" ? outputValue : JSON.stringify(outputValue ?? "") };
+    }
+    if (outputType === "content" && Array.isArray(outputValue)) {
+      const text2 = outputValue.filter((v) => v.type === "text").map((v) => String(v.text ?? "")).join("\n");
+      return { output: text2 };
+    }
+  }
+  if (outputField !== void 0) {
+    return { output: typeof outputField === "string" ? outputField : JSON.stringify(outputField) };
+  }
+  if (resultField !== void 0) {
+    const output = typeof resultField === "string" ? resultField : JSON.stringify(resultField);
+    const error = isPlainObject(resultField) ? asString(resultField.error) : void 0;
+    return { output, error };
+  }
+  return { output: "" };
+}
+function extractSystemPrompt(prompt) {
+  if (!Array.isArray(prompt)) return null;
+  const parts = [];
+  for (const message of prompt) {
+    const msg = message;
+    if (msg.role === "system" && typeof msg.content === "string" && msg.content.trim()) {
+      parts.push(msg.content);
+    }
+  }
+  return parts.length > 0 ? parts.join("\n") : null;
+}
+function sanitizeSystemPrompt(prompt) {
+  let result = prompt;
+  result = result.replace(/^You are [Oo]pen[Cc]ode[,.].*$/gm, "");
+  result = result.replace(/^Your name is opencode\s*$/gm, "");
+  result = result.replace(
+    /If the user asks for help or wants to give feedback[\s\S]*?https:\/\/github\.com\/anomalyco\/opencode\s*/g,
+    ""
+  );
+  result = result.replace(
+    /When the user directly asks about OpenCode[\s\S]*?https:\/\/opencode\.ai\/docs\s*/g,
+    ""
+  );
+  result = result.replace(/https:\/\/github\.com\/anomalyco\/opencode\S*/g, "");
+  result = result.replace(/https:\/\/opencode\.ai\S*/g, "");
+  result = result.replace(/\bOpenCode\b/g, "GitLab Duo");
+  result = result.replace(/\bopencode\b/g, "GitLab Duo");
+  result = result.replace(/The exact model ID is GitLab Duo\//g, "The exact model ID is ");
+  result = result.replace(/\n{3,}/g, "\n\n");
+  return result.trim();
+}
+function extractAgentReminders(prompt) {
+  if (!Array.isArray(prompt)) return [];
+  let textParts = [];
+  for (let i = prompt.length - 1; i >= 0; i--) {
+    const message = prompt[i];
+    if (message?.role !== "user" || !Array.isArray(message.content)) continue;
+    textParts = message.content.filter((p) => p.type === "text");
+    if (textParts.length > 0) break;
+  }
+  if (textParts.length === 0) return [];
+  const reminders = [];
+  for (const part of textParts) {
+    if (!part.text) continue;
+    const text2 = String(part.text);
+    if (part.synthetic) {
+      const trimmed = text2.trim();
+      if (trimmed.length > 0) reminders.push(trimmed);
+      continue;
+    }
+    const matches = text2.match(/<system-reminder>[\s\S]*?<\/system-reminder>/g);
+    if (matches) reminders.push(...matches);
+  }
+  return reminders;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/provider/tool-mapping.ts
+var TODO_WRITE_PROGRAM = "__todo_write__";
+var TODO_READ_PROGRAM = "__todo_read__";
+var TODO_STATUSES = /* @__PURE__ */ new Set(["pending", "in_progress", "completed", "cancelled"]);
+var TODO_PRIORITIES = /* @__PURE__ */ new Set(["high", "medium", "low"]);
+function mapDuoToolRequest(toolName, args) {
+  switch (toolName) {
+    case "list_dir": {
+      const directory = asString2(args.directory) ?? ".";
+      return { toolName: "read", args: { filePath: directory } };
+    }
+    case "read_file": {
+      const filePath = asString2(args.file_path) ?? asString2(args.filepath) ?? asString2(args.filePath) ?? asString2(args.path);
+      if (!filePath) return { toolName, args };
+      const mapped = { filePath };
+      if (typeof args.offset === "number") mapped.offset = args.offset;
+      if (typeof args.limit === "number") mapped.limit = args.limit;
+      return { toolName: "read", args: mapped };
+    }
+    case "read_files": {
+      const filePaths = asStringArray(args.file_paths);
+      if (filePaths.length === 0) return { toolName, args };
+      return filePaths.map((fp) => ({ toolName: "read", args: { filePath: fp } }));
+    }
+    case "create_file_with_contents": {
+      const filePath = asString2(args.file_path);
+      const content = asString2(args.contents);
+      if (!filePath || content === void 0) return { toolName, args };
+      return { toolName: "write", args: { filePath, content } };
+    }
+    case "edit_file": {
+      const filePath = asString2(args.file_path);
+      const oldString = asString2(args.old_str);
+      const newString = asString2(args.new_str);
+      if (!filePath || oldString === void 0 || newString === void 0) return { toolName, args };
+      return { toolName: "edit", args: { filePath, oldString, newString } };
+    }
+    case "find_files": {
+      const pattern = asString2(args.name_pattern);
+      if (!pattern) return { toolName, args };
+      return { toolName: "glob", args: { pattern } };
+    }
+    case "grep": {
+      const pattern = asString2(args.pattern);
+      if (!pattern) return { toolName, args };
+      const searchDir = asString2(args.search_directory);
+      const caseInsensitive = Boolean(args.case_insensitive);
+      const normalizedPattern = caseInsensitive && !pattern.startsWith("(?i)") ? `(?i)${pattern}` : pattern;
+      const mapped = { pattern: normalizedPattern };
+      if (searchDir) mapped.path = searchDir;
+      return { toolName: "grep", args: mapped };
+    }
+    case "mkdir": {
+      const directory = asString2(args.directory_path);
+      if (!directory) return { toolName, args };
+      return { toolName: "bash", args: { command: `mkdir -p ${shellQuote(directory)}`, description: "Create directory", workdir: "." } };
+    }
+    case "shell_command": {
+      const command = asString2(args.command);
+      if (!command) return { toolName, args };
+      return { toolName: "bash", args: { command, description: "Run shell command", workdir: "." } };
+    }
+    case "run_command": {
+      const program = asString2(args.program);
+      if (program === TODO_READ_PROGRAM) {
+        return { toolName: "todoread", args: {} };
+      }
+      if (program === TODO_WRITE_PROGRAM) {
+        return mapTodoWriteCall(args.arguments);
+      }
+      if (program) {
+        const parts = [shellQuote(program)];
+        if (Array.isArray(args.flags)) parts.push(...args.flags.map((f) => shellQuote(String(f))));
+        if (Array.isArray(args.arguments)) parts.push(...args.arguments.map((a) => shellQuote(String(a))));
+        return { toolName: "bash", args: { command: parts.join(" "), description: "Run command", workdir: "." } };
+      }
+      const command = asString2(args.command);
+      if (!command) return { toolName, args };
+      return { toolName: "bash", args: { command, description: "Run command", workdir: "." } };
+    }
+    case "run_git_command": {
+      const command = asString2(args.command);
+      if (!command) return { toolName, args };
+      const rawArgs = args.args;
+      const extraArgs = Array.isArray(rawArgs) ? rawArgs.map((v) => shellQuote(String(v))).join(" ") : asString2(rawArgs);
+      const gitCmd = extraArgs ? `git ${shellQuote(command)} ${extraArgs}` : `git ${shellQuote(command)}`;
+      return { toolName: "bash", args: { command: gitCmd, description: "Run git command", workdir: "." } };
+    }
+    case "gitlab_api_request": {
+      const method = asString2(args.method) ?? "GET";
+      const apiPath = asString2(args.path);
+      if (!apiPath) return { toolName, args };
+      const body = asString2(args.body);
+      const curlParts = [
+        "curl",
+        "-s",
+        "-X",
+        method,
+        "-H",
+        "'Authorization: Bearer $GITLAB_TOKEN'",
+        "-H",
+        "'Content-Type: application/json'"
+      ];
+      if (body) {
+        curlParts.push("-d", shellQuote(body));
+      }
+      curlParts.push(shellQuote(`$GITLAB_INSTANCE_URL/api/v4/${apiPath}`));
+      return {
+        toolName: "bash",
+        args: { command: curlParts.join(" "), description: `GitLab API: ${method} ${apiPath}`, workdir: "." }
+      };
+    }
+    default:
+      return { toolName, args };
+  }
+}
+function asString2(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function mapTodoWriteCall(rawArguments) {
+  const payloadResult = parseTodoPayload(rawArguments);
+  if ("error" in payloadResult) return invalidTool("todowrite", payloadResult.error);
+  const todosResult = parseTodos(payloadResult.payload);
+  if ("error" in todosResult) return invalidTool("todowrite", todosResult.error);
+  return {
+    toolName: "todowrite",
+    args: {
+      todos: todosResult.todos
+    }
+  };
+}
+function parseTodoPayload(rawArguments) {
+  if (!Array.isArray(rawArguments) || rawArguments.length === 0) {
+    return {
+      error: `${TODO_WRITE_PROGRAM} expects JSON payload in arguments[0]`
+    };
+  }
+  const rawPayload = rawArguments[0];
+  if (typeof rawPayload !== "string") {
+    return {
+      error: `${TODO_WRITE_PROGRAM} expects arguments[0] to be a JSON string`
+    };
+  }
+  try {
+    const parsed = JSON.parse(rawPayload);
+    if (!isRecord(parsed)) {
+      return {
+        error: `${TODO_WRITE_PROGRAM} payload must be a JSON object`
+      };
+    }
+    return { payload: parsed };
+  } catch {
+    return {
+      error: `${TODO_WRITE_PROGRAM} payload is not valid JSON`
+    };
+  }
+}
+function parseTodos(payload) {
+  const rawTodos = payload.todos;
+  if (!Array.isArray(rawTodos)) {
+    return {
+      error: `${TODO_WRITE_PROGRAM} payload must include a todos array`
+    };
+  }
+  const todos = [];
+  for (let index = 0; index < rawTodos.length; index += 1) {
+    const rawTodo = rawTodos[index];
+    if (!isRecord(rawTodo)) {
+      return {
+        error: `${TODO_WRITE_PROGRAM} todos[${index}] must be an object`
+      };
+    }
+    const content = asString2(rawTodo.content);
+    if (content === void 0) {
+      return {
+        error: `${TODO_WRITE_PROGRAM} todos[${index}].content must be a string`
+      };
+    }
+    const status = asString2(rawTodo.status);
+    if (!status || !TODO_STATUSES.has(status)) {
+      return {
+        error: `${TODO_WRITE_PROGRAM} todos[${index}].status must be one of: pending, in_progress, completed, cancelled`
+      };
+    }
+    const priority = asString2(rawTodo.priority);
+    if (!priority || !TODO_PRIORITIES.has(priority)) {
+      return {
+        error: `${TODO_WRITE_PROGRAM} todos[${index}].priority must be one of: high, medium, low`
+      };
+    }
+    todos.push({
+      content,
+      status,
+      priority
+    });
+  }
+  return { todos };
+}
+function invalidTool(tool2, error) {
+  return {
+    toolName: "invalid",
+    args: {
+      tool: tool2,
+      error
+    }
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asStringArray(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((v) => typeof v === "string");
+}
+function shellQuote(s) {
+  if (/^[a-zA-Z0-9_\-./=:@]+$/.test(s)) return s;
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+
+// src/provider/session-context.ts
+function readSessionID(options) {
+  const providerBlock = readProviderBlock(options);
+  if (typeof providerBlock?.workflowSessionID === "string" && providerBlock.workflowSessionID.trim()) {
+    return providerBlock.workflowSessionID.trim();
+  }
+  const headers = options.headers ?? {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === "x-opencode-session" && value?.trim()) return value.trim();
+  }
+  return void 0;
+}
+function readProviderBlock(options) {
+  const block = options.providerOptions?.[PROVIDER_ID];
+  if (block && typeof block === "object" && !Array.isArray(block)) {
+    return block;
+  }
+  return void 0;
+}
+
+// src/provider/system-context.ts
+import os2 from "os";
+function buildSystemContext() {
+  const platform = os2.platform();
+  const arch = os2.arch();
+  return [
+    {
+      category: "os_information",
+      content: `<os><platform>${platform}</platform><architecture>${arch}</architecture></os>`,
+      id: "os_information",
+      metadata: JSON.stringify({
+        title: "Operating System",
+        enabled: true,
+        subType: "os"
+      })
+    },
+    {
+      category: "user_rule",
+      content: SYSTEM_RULES,
+      id: "user_rules",
+      metadata: JSON.stringify({
+        title: "System Rules",
+        enabled: true,
+        subType: "user_rule"
+      })
+    }
+  ];
+}
+var SYSTEM_RULES = `<system-reminder>
+You MUST follow ALL the rules in this block strictly.
+
+<tool_orchestration>
+PARALLEL EXECUTION:
+- When gathering information, plan all needed searches upfront and execute
+  them together using multiple tool calls in the same turn where possible.
+- Read multiple related files together rather than one at a time.
+- Patterns: grep + find_files together, read_file for multiple files together.
+
+SEQUENTIAL EXECUTION (only when output depends on previous step):
+- Read a file BEFORE editing it (always).
+- Check dependencies BEFORE importing them.
+- Run tests AFTER making changes.
+
+READ BEFORE WRITE:
+- Always read existing files before modifying them to understand context.
+- Check for existing patterns (naming, imports, error handling) and match them.
+- Verify the exact content to replace when using edit_file.
+
+ERROR HANDLING:
+- If a tool fails, analyze the error before retrying.
+- If a shell command fails, check the error output and adapt.
+- Do not repeat the same failing operation without changes.
+</tool_orchestration>
+
+<development_workflow>
+For software development tasks, follow this workflow:
+
+1. UNDERSTAND: Read relevant files, explore the codebase structure
+2. PLAN: Break down the task into clear steps
+3. IMPLEMENT: Make changes methodically, one step at a time
+4. VERIFY: Run tests, type-checking, or build to validate changes
+5. COMPLETE: Summarize what was accomplished
+
+CODE QUALITY:
+- Match existing code style and patterns in the project
+- Write immediately executable code (no TODOs or placeholders)
+- Prefer editing existing files over creating new ones
+- Use the project's established error handling patterns
+</development_workflow>
+
+<communication>
+- Be concise and direct. Responses appear in a chat panel.
+- Focus on practical solutions over theoretical discussion.
+- When unable to complete a request, explain the limitation briefly and
+  provide alternatives.
+- Use active language: "Analyzing...", "Searching..." instead of "Let me..."
+</communication>
+</system-reminder>`;
+
+// src/workflow/session-store.ts
+import { readFileSync, writeFileSync, mkdirSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+function getStorePath() {
+  const dir = process.env.XDG_CACHE_HOME?.trim() ? join(process.env.XDG_CACHE_HOME, "opencode") : join(homedir(), ".cache", "opencode");
+  return join(dir, "duo-workflow-sessions.json");
+}
+function readStore() {
+  try {
+    return JSON.parse(readFileSync(getStorePath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeStore(store) {
+  try {
+    const storePath = getStorePath();
+    mkdirSync(join(storePath, ".."), { recursive: true });
+    writeFileSync(storePath, JSON.stringify(store, null, 2), "utf8");
+  } catch {
+  }
+}
+function saveWorkflowId(key, workflowId) {
+  const store = readStore();
+  store[key] = workflowId;
+  writeStore(store);
+}
+function loadWorkflowId(key) {
+  const store = readStore();
+  return store[key];
+}
+
+// src/workflow/flow-config.ts
+var TOOL_ALLOWLIST = [
+  "read_file",
+  "read_files",
+  "create_file_with_contents",
+  "edit_file",
+  "list_dir",
+  "find_files",
+  "grep",
+  "mkdir",
+  "run_command"
+];
+function buildFlowConfig(systemPrompt) {
+  return {
+    version: "v1",
+    environment: "chat-partial",
+    components: [
+      {
+        // Keep "chat" for behavior parity with GitLab Duo CLI flow metadata.
+        name: "chat",
+        type: "AgentComponent",
+        prompt_id: "chat/agent",
+        toolset: [...TOOL_ALLOWLIST]
+      }
+    ],
+    prompts: [
+      {
+        name: "chat",
+        prompt_id: "chat/agent",
+        unit_primitives: ["duo_chat"],
+        prompt_template: {
+          system: systemPrompt
+        }
+      }
+    ]
+  };
+}
+
+// src/provider/duo-workflow-model.ts
+var sessions = /* @__PURE__ */ new Map();
+var UNKNOWN_USAGE = {
+  inputTokens: void 0,
+  outputTokens: void 0,
+  totalTokens: void 0
+};
+var DuoWorkflowModel = class {
+  specificationVersion = "v2";
+  provider = PROVIDER_ID;
+  modelId;
+  supportedUrls = {};
+  #client;
+  #cwd;
+  #toolsConfig;
+  // Tool tracking state (per model instance, reset on session change)
+  #pendingToolRequests = /* @__PURE__ */ new Map();
+  #multiCallGroups = /* @__PURE__ */ new Map();
+  #sentToolCallIds = /* @__PURE__ */ new Set();
+  #lastSentGoal = null;
+  #stateSessionId;
+  constructor(modelId, client, cwd) {
+    this.modelId = modelId;
+    this.#client = client;
+    this.#cwd = cwd ?? process.cwd();
+  }
+  /**
+   * Opt-in: override the server-side system prompt and/or register MCP tools.
+   */
+  setToolsConfig(config) {
+    this.#toolsConfig = config;
+    for (const session of sessions.values()) {
+      session.setToolsConfig(config);
+    }
+  }
+  async doGenerate(options) {
+    let text2 = "";
+    const { stream } = await this.doStream(options);
+    for await (const part of stream) {
+      if (part.type === "text-delta") text2 += part.delta;
+    }
+    return {
+      content: [{ type: "text", text: text2 }],
+      finishReason: "stop",
+      usage: UNKNOWN_USAGE,
+      warnings: []
+    };
+  }
+  async doStream(options) {
+    const sessionID = readSessionID(options);
+    if (!sessionID) throw new Error("missing workflow session ID");
+    const goal = extractGoal(options.prompt);
+    const toolResults = extractToolResults(options.prompt);
+    const session = this.#resolveSession(sessionID);
+    const textId = randomUUID3();
+    dlog(`doStream: goal=${goal?.length ?? 0}ch toolResults=${toolResults.length} hasStarted=${session.hasStarted} pending=${this.#pendingToolRequests.size} sent=${this.#sentToolCallIds.size}`);
+    if (sessionID !== this.#stateSessionId) {
+      this.#pendingToolRequests.clear();
+      this.#multiCallGroups.clear();
+      this.#sentToolCallIds.clear();
+      this.#lastSentGoal = null;
+      this.#stateSessionId = sessionID;
+    }
+    const model = this;
+    return {
+      stream: new ReadableStream({
+        start: async (controller) => {
+          controller.enqueue({ type: "stream-start", warnings: [] });
+          const onAbort = () => session.abort();
+          options.abortSignal?.addEventListener("abort", onAbort, { once: true });
+          try {
+            if (!session.hasStarted) {
+              model.#sentToolCallIds.clear();
+              for (const r of toolResults) {
+                if (!model.#pendingToolRequests.has(r.toolCallId)) {
+                  model.#sentToolCallIds.add(r.toolCallId);
+                }
+              }
+              model.#lastSentGoal = null;
+            }
+            await session.ensureConnected(goal || "");
+            const freshResults = toolResults.filter(
+              (r) => !model.#sentToolCallIds.has(r.toolCallId)
+            );
+            dlog(`phase1: ${toolResults.length} total, ${freshResults.length} fresh`);
+            let sentToolResults = false;
+            for (const result of freshResults) {
+              const subIdx = result.toolCallId.indexOf("_sub_");
+              if (subIdx !== -1) {
+                const originalId = result.toolCallId.substring(0, subIdx);
+                const group = model.#multiCallGroups.get(originalId);
+                if (!group) {
+                  model.#sentToolCallIds.add(result.toolCallId);
+                  continue;
+                }
+                group.collected.set(result.toolCallId, result.error ?? result.output);
+                model.#sentToolCallIds.add(result.toolCallId);
+                model.#pendingToolRequests.delete(result.toolCallId);
+                if (group.collected.size === group.subIds.length) {
+                  const result2 = {};
+                  for (let i = 0; i < group.subIds.length; i++) {
+                    const label = group.labels[i] || `file_${i}`;
+                    const value = group.collected.get(group.subIds[i]) ?? "";
+                    result2[label] = { content: value };
+                  }
+                  session.sendToolResult(originalId, JSON.stringify(result2));
+                  model.#multiCallGroups.delete(originalId);
+                  model.#pendingToolRequests.delete(originalId);
+                  sentToolResults = true;
+                }
+                continue;
+              }
+              const pending = model.#pendingToolRequests.get(result.toolCallId);
+              if (!pending) {
+                dlog(`phase1: SKIP ${result.toolCallId} (not pending)`);
+                model.#sentToolCallIds.add(result.toolCallId);
+                continue;
+              }
+              dlog(`phase1: SEND ${result.toolCallId} output=${result.output.length}b`);
+              session.sendToolResult(result.toolCallId, result.output, result.error);
+              sentToolResults = true;
+              model.#sentToolCallIds.add(result.toolCallId);
+              model.#pendingToolRequests.delete(result.toolCallId);
+            }
+            const isNewGoal = goal && goal !== model.#lastSentGoal;
+            if (!sentToolResults && isNewGoal) {
+              await session.ensureConnected(goal);
+              if (!session.hasStarted) {
+                const extraContext = [];
+                const extractedSystemPrompt = extractSystemPrompt(options.prompt);
+                const sanitizedSystemPrompt = sanitizeSystemPrompt(
+                  extractedSystemPrompt ?? "You are GitLab Duo, an AI coding assistant."
+                );
+                session.setToolsConfig({
+                  mcpTools: [],
+                  flowConfig: buildFlowConfig(sanitizedSystemPrompt),
+                  flowConfigSchemaVersion: "v1"
+                });
+                extraContext.push(...buildSystemContext());
+                const agentReminders = extractAgentReminders(options.prompt);
+                if (agentReminders.length > 0) {
+                  extraContext.push({
+                    category: "agent_context",
+                    content: sanitizeSystemPrompt(
+                      `[context-id:${Date.now()}]
+${agentReminders.join("\n\n")}`
+                    ),
+                    id: "agent_reminders",
+                    metadata: JSON.stringify({
+                      title: "Agent Reminders",
+                      enabled: true,
+                      subType: "agent_reminders"
+                    })
+                  });
+                }
+                session.sendStartRequest(goal, extraContext);
+              }
+              model.#lastSentGoal = goal;
+            }
+            let hasText = false;
+            while (true) {
+              const event = await session.waitForEvent();
+              if (!event) break;
+              if (event.type === "text-delta") {
+                if (!event.value) continue;
+                if (!hasText) {
+                  hasText = true;
+                  controller.enqueue({ type: "text-start", id: textId });
+                }
+                controller.enqueue({ type: "text-delta", id: textId, delta: event.value });
+                continue;
+              }
+              if (event.type === "tool-request") {
+                let mapped;
+                try {
+                  mapped = mapDuoToolRequest(event.toolName, event.args);
+                } catch {
+                  dlog(`phase3: MAPPING FAILED ${event.toolName}`);
+                  continue;
+                }
+                const mName = Array.isArray(mapped) ? mapped.map((m) => m.toolName).join(",") : mapped.toolName;
+                dlog(`phase3: tool-request ${event.toolName} \u2192 ${mName} reqId=${event.requestId}`);
+                if (hasText) {
+                  controller.enqueue({ type: "text-end", id: textId });
+                }
+                if (Array.isArray(mapped)) {
+                  const subIds = mapped.map((_, i) => `${event.requestId}_sub_${i}`);
+                  model.#multiCallGroups.set(event.requestId, {
+                    subIds,
+                    labels: mapped.map((m) => String(m.args.filePath ?? m.args.path ?? "")),
+                    collected: /* @__PURE__ */ new Map()
+                  });
+                  model.#pendingToolRequests.set(event.requestId, {});
+                  for (const subId of subIds) {
+                    model.#pendingToolRequests.set(subId, {});
+                  }
+                  for (let i = 0; i < mapped.length; i++) {
+                    const inputJson = JSON.stringify(mapped[i].args);
+                    controller.enqueue({ type: "tool-input-start", id: subIds[i], toolName: mapped[i].toolName });
+                    controller.enqueue({ type: "tool-input-delta", id: subIds[i], delta: inputJson });
+                    controller.enqueue({ type: "tool-input-end", id: subIds[i] });
+                    controller.enqueue({
+                      type: "tool-call",
+                      toolCallId: subIds[i],
+                      toolName: mapped[i].toolName,
+                      input: inputJson
+                    });
+                  }
+                } else {
+                  model.#pendingToolRequests.set(event.requestId, {});
+                  const inputJson = JSON.stringify(mapped.args);
+                  controller.enqueue({ type: "tool-input-start", id: event.requestId, toolName: mapped.toolName });
+                  controller.enqueue({ type: "tool-input-delta", id: event.requestId, delta: inputJson });
+                  controller.enqueue({ type: "tool-input-end", id: event.requestId });
+                  controller.enqueue({
+                    type: "tool-call",
+                    toolCallId: event.requestId,
+                    toolName: mapped.toolName,
+                    input: inputJson
+                  });
+                }
+                controller.enqueue({
+                  type: "finish",
+                  finishReason: "tool-calls",
+                  usage: UNKNOWN_USAGE
+                });
+                controller.close();
+                return;
+              }
+              if (event.type === "error") {
+                controller.enqueue({ type: "error", error: new Error(event.message) });
+                controller.enqueue({ type: "finish", finishReason: "error", usage: UNKNOWN_USAGE });
+                controller.close();
+                return;
+              }
+            }
+            if (hasText) {
+              controller.enqueue({ type: "text-end", id: textId });
+            }
+            controller.enqueue({ type: "finish", finishReason: "stop", usage: UNKNOWN_USAGE });
+            controller.close();
+          } catch (error) {
+            controller.enqueue({ type: "error", error });
+            controller.enqueue({ type: "finish", finishReason: "error", usage: UNKNOWN_USAGE });
+            controller.close();
+          } finally {
+            options.abortSignal?.removeEventListener("abort", onAbort);
+          }
+        }
+      }),
+      request: {
+        body: {
+          goal,
+          workflowID: session.workflowId
+        }
+      }
+    };
+  }
+  /** Remove a cached session, freeing its resources. */
+  disposeSession(sessionID) {
+    return sessions.delete(sessionKey(this.#client.instanceUrl, this.modelId, sessionID));
+  }
+  #resolveSession(sessionID) {
+    const key = sessionKey(this.#client.instanceUrl, this.modelId, sessionID);
+    const existing = sessions.get(key);
+    if (existing) return existing;
+    const existingWorkflowId = loadWorkflowId(key);
+    if (existingWorkflowId) {
+      dlog(`resolveSession: restored workflowId=${existingWorkflowId} from disk for ${sessionID}`);
+    }
+    const created = new WorkflowSession(this.#client, this.modelId, this.#cwd, {
+      existingWorkflowId,
+      onWorkflowCreated: (workflowId) => {
+        dlog(`resolveSession: saving workflowId=${workflowId} for ${sessionID}`);
+        saveWorkflowId(key, workflowId);
+      }
+    });
+    if (this.#toolsConfig) created.setToolsConfig(this.#toolsConfig);
+    sessions.set(key, created);
+    return created;
+  }
+};
+function sessionKey(instanceUrl, modelId, sessionID) {
+  return `${instanceUrl}::${modelId}::${sessionID}`;
+}
+
+// src/provider/index.ts
+function createFallbackProvider(input = {}) {
+  const client = resolveCredentials(input);
+  return {
+    languageModel(modelId) {
+      return new DuoWorkflowModel(modelId, client);
+    },
+    agenticChat(modelId, _options) {
+      return new DuoWorkflowModel(modelId, client);
+    },
+    textEmbeddingModel(modelId) {
+      throw new NoSuchModelError({ modelId, modelType: "textEmbeddingModel" });
+    },
+    imageModel(modelId) {
+      throw new NoSuchModelError({ modelId, modelType: "imageModel" });
+    }
+  };
+}
+
+// src/index.ts
+function isPluginInput(value) {
+  if (!value || typeof value !== "object") return false;
+  const input = value;
+  return "client" in input && "project" in input && "directory" in input && "worktree" in input && "serverUrl" in input;
+}
+var entry = (input) => {
+  if (isPluginInput(input)) {
+    return createPluginHooks(input);
+  }
+  return createFallbackProvider(input);
+};
+var createGitLabDuoAgentic = entry;
+var GitLabDuoAgenticPlugin = entry;
+var src_default = GitLabDuoAgenticPlugin;
+export {
+  GitLabDuoAgenticPlugin,
+  createGitLabDuoAgentic,
+  src_default as default
+};