reviewflow 3.32.0 → 3.33.0

package/dist/tests/units/modules/platform-integration/controllers/gitlabProcessorProvenance.test.js

@@ -0,0 +1,69 @@
+import { vi } from 'vitest';
+vi.mock('@/config/loader.js', () => ({
+    loadConfig: vi.fn(() => ({ repositories: [] })),
+    findRepositoryByProjectPath: vi.fn(() => undefined),
+}));
+vi.mock('@/claude/invoker.js', () => ({
+    invokeClaudeReview: vi.fn(() => Promise.resolve({ success: true, stdout: '', durationMs: 1, exitCode: 0, cancelled: false, stderr: '' })),
+    sendNotification: vi.fn(),
+}));
+vi.mock('@/main/websocket.js', () => ({
+    startWatchingReviewContext: vi.fn(),
+    stopWatchingReviewContext: vi.fn(),
+}));
+vi.mock('@/config/projectConfig.js', () => ({
+    loadProjectConfig: vi.fn(() => null),
+    getProjectAgents: vi.fn(() => null),
+    getProjectAgentsOrFocusDefaults: vi.fn(() => null),
+    getFollowupAgents: vi.fn(() => null),
+    getProjectLanguage: vi.fn(() => 'en'),
+}));
+import { describe, it, expect } from 'vitest';
+import { buildGitLabReviewProcessor } from '../../../../../modules/platform-integration/interface-adapters/controllers/webhook/gitlab.controller.js';
+import { createStubLogger } from '../../../../../tests/stubs/logger.stub.js';
+class RecordingThreadFetch {
+    calls = [];
+    fetchThreads = (projectPath, mrNumber) => {
+        this.calls.push({ projectPath, mrNumber });
+        return [];
+    };
+}
+function buildJob() {
+    return {
+        id: 'gitlab-attacker/unknown-5',
+        platform: 'gitlab',
+        projectPath: 'attacker/unknown',
+        localPath: '/repo',
+        mrNumber: 5,
+        skill: 'review-front',
+        mrUrl: 'https://gitlab.com/attacker/unknown/-/merge_requests/5',
+        sourceBranch: 'feature',
+        targetBranch: 'main',
+        jobType: 'review',
+        language: 'en',
+    };
+}
+describe('GitLab review processor provenance pin (AC9)', () => {
+    it('AC9(1): an unconfigured projectPath never reaches fetchThreads (fail-closed)', async () => {
+        const threadFetch = new RecordingThreadFetch();
+        const processor = buildGitLabReviewProcessor({
+            reviewContextGateway: {
+                create: () => undefined,
+                read: () => null,
+                updateProgress: () => undefined,
+                setResult: () => undefined,
+                delete: () => ({ deleted: true }),
+            },
+            threadFetchGateway: threadFetch,
+            diffMetadataFetchGateway: { fetchDiffMetadata: () => undefined },
+            diffStatsFetchGateway: { fetchDiffStats: () => null },
+            recordCompletion: { execute: () => undefined },
+            claudeInvokerDeps: undefined,
+        }, createStubLogger());
+        const job = buildJob();
+        const run = processor(job);
+        await expect(run(job, new AbortController().signal)).rejects.toThrow();
+        expect(threadFetch.calls).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=gitlabProcessorProvenance.test.js.map

package/dist/tests/units/modules/platform-integration/controllers/gitlabProcessorProvenance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlabProcessorProvenance.test.js","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/platform-integration/controllers/gitlabProcessorProvenance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE3B,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,2BAA2B,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;CACpD,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAC7B,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACzG;IACD,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC1B,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,0BAA0B,EAAE,EAAE,CAAC,EAAE,EAAE;IACnC,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE;CACnC,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACpC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACnC,+BAA+B,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IAClD,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACpC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;CACtC,CAAC,CAAC,CAAA;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4FAA4F,CAAA;AACvI,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAG/D,MAAM,oBAAoB;IACR,KAAK,GAAqD,EAAE,CAAA;IAC5E,YAAY,GAAG,CAAC,WAAmB,EAAE,QAAgB,EAAE,EAAE;QACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC1C,OAAO,EAAE,CAAA;IACX,CAAC,CAAA;CACF;AAED,SAAS,QAAQ;IACf,OAAO;QACL,EAAE,EAAE,2BAA2B;QAC/B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,kBAAkB;QAC/B,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,wDAAwD;QAC/D,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;KACS,CAAA;AAC3B,CAAC;AAED,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,WAAW,GAAG,IAAI,oBAAoB,EAAE,CAAA;QAC9C,MAAM,SAAS,GAAG,0BAA0B,CAC1C;YACE,oBAAoB,EAAE;gBACpB,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;gBACvB,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI;gBAChB,cAAc,EAAE,GAAG,EAAE,CAAC,SAAS;gBAC/B,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;gBAC1B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aAClC;YACD,kBAAkB,EAAE,WAAW;YAC/B,wBAAwB,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE;YAChE,qBAAqB,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;YACrD,gBAAgB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE;YAC9C,iBAAiB,EAAE,SAAS;SACpB,EACV,gBAAgB,EAAE,CACnB,CAAA;QAED,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAE1B,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QACtE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/platform-integration/entities/executorCapability.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=executorCapability.test.d.ts.map

package/dist/tests/units/modules/platform-integration/entities/executorCapability.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executorCapability.test.d.ts","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/platform-integration/entities/executorCapability.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/platform-integration/entities/executorCapability.test.js

@@ -0,0 +1,28 @@
+import { describe, it, expect } from 'vitest';
+import { EXECUTOR_CAPABILITY_TABLE, AUTO_EXECUTOR_CAPABILITIES, } from '../../../../../modules/platform-integration/entities/executorToken/executorCapability.js';
+describe('executor capability table (AC5)', () => {
+    it('declares the minimal role per action in a single exported constant', () => {
+        expect(EXECUTOR_CAPABILITY_TABLE).toEqual({
+            readMr: { minRole: 'reporter', autoPath: true },
+            postComment: { minRole: 'reporter', autoPath: true },
+            threadResolve: { minRole: 'developer', autoPath: false },
+            revoke: { minRole: 'developer', autoPath: false },
+        });
+    });
+    it('exposes the auto-path capability set as exactly {readMr, postComment}', () => {
+        const sorted = [...AUTO_EXECUTOR_CAPABILITIES].sort();
+        expect(sorted).toEqual(['postComment', 'readMr']);
+    });
+    it('excludes every non-auto-path action from the auto capability set', () => {
+        expect(AUTO_EXECUTOR_CAPABILITIES.has('threadResolve')).toBe(false);
+        expect(AUTO_EXECUTOR_CAPABILITIES.has('revoke')).toBe(false);
+    });
+    it('derives the auto set strictly from the table autoPath flags', () => {
+        const derived = Object.entries(EXECUTOR_CAPABILITY_TABLE)
+            .filter(([, capability]) => capability.autoPath)
+            .map(([name]) => name)
+            .sort();
+        expect(derived).toEqual(['postComment', 'readMr']);
+    });
+});
+//# sourceMappingURL=executorCapability.test.js.map

package/dist/tests/units/modules/platform-integration/entities/executorCapability.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executorCapability.test.js","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/platform-integration/entities/executorCapability.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAE3B,MAAM,6EAA6E,CAAA;AAEpF,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC;YACxC,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC/C,WAAW,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;YACpD,aAAa,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;YACxD,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;SAClD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,MAAM,GAAG,CAAC,GAAG,0BAA0B,CAAC,CAAC,IAAI,EAAE,CAAA;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAuB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,0BAA0B,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnE,MAAM,CAAC,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC;aACtD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;aACrB,IAAI,EAAE,CAAA;QACT,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/platform-integration/entities/memberAccess/memberAccess.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=memberAccess.test.d.ts.map

package/dist/tests/units/modules/platform-integration/entities/memberAccess/memberAccess.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memberAccess.test.d.ts","sourceRoot":"","sources":["../../../../../../../src/tests/units/modules/platform-integration/entities/memberAccess/memberAccess.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/platform-integration/entities/memberAccess/memberAccess.test.js

@@ -0,0 +1,18 @@
+import { describe, it, expect } from 'vitest';
+import { MEMBER_ACCESS_LEVELS, isDeveloperOrAbove, } from '../../../../../../modules/platform-integration/entities/memberAccess/memberAccess.js';
+describe('isDeveloperOrAbove', () => {
+    it('treats Developer and above as trusted', () => {
+        expect(isDeveloperOrAbove(MEMBER_ACCESS_LEVELS.developer)).toBe(true);
+        expect(isDeveloperOrAbove(MEMBER_ACCESS_LEVELS.maintainer)).toBe(true);
+        expect(isDeveloperOrAbove(MEMBER_ACCESS_LEVELS.owner)).toBe(true);
+    });
+    it('treats below Developer as non-trusted', () => {
+        expect(isDeveloperOrAbove(MEMBER_ACCESS_LEVELS.reporter)).toBe(false);
+        expect(isDeveloperOrAbove(MEMBER_ACCESS_LEVELS.guest)).toBe(false);
+        expect(isDeveloperOrAbove(MEMBER_ACCESS_LEVELS.noAccess)).toBe(false);
+    });
+    it('treats an unresolved actor (null) as non-trusted', () => {
+        expect(isDeveloperOrAbove(null)).toBe(false);
+    });
+});
+//# sourceMappingURL=memberAccess.test.js.map

package/dist/tests/units/modules/platform-integration/entities/memberAccess/memberAccess.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memberAccess.test.js","sourceRoot":"","sources":["../../../../../../../src/tests/units/modules/platform-integration/entities/memberAccess/memberAccess.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,sEAAsE,CAAC;AAE9E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/units/modules/platform-integration/gateways/defaultGitLabExecutor.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=defaultGitLabExecutor.test.d.ts.map

package/dist/tests/units/modules/platform-integration/gateways/defaultGitLabExecutor.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultGitLabExecutor.test.d.ts","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/platform-integration/gateways/defaultGitLabExecutor.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/platform-integration/gateways/defaultGitLabExecutor.test.js

@@ -0,0 +1,13 @@
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { defaultGitLabExecutor } from '../../../../../modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.js';
+import { MissingExecutorTokenError } from '../../../../../modules/platform-integration/services/scopedExecutorEnvironment.js';
+describe('defaultGitLabExecutor fail-closed (AC1 production wiring)', () => {
+    afterEach(() => {
+        vi.unstubAllEnvs();
+    });
+    it('throws MissingExecutorTokenError when the service token is unset, never falling back to the ambient token', () => {
+        vi.stubEnv('REVIEWFLOW_EXECUTOR_TOKEN', '');
+        expect(() => defaultGitLabExecutor('glab api projects/x/merge_requests/1/discussions')).toThrow(MissingExecutorTokenError);
+    });
+});
+//# sourceMappingURL=defaultGitLabExecutor.test.js.map

package/dist/tests/units/modules/platform-integration/gateways/defaultGitLabExecutor.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultGitLabExecutor.test.js","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/platform-integration/gateways/defaultGitLabExecutor.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0FAA0F,CAAA;AAChI,OAAO,EAAE,yBAAyB,EAAE,MAAM,sEAAsE,CAAA;AAEhH,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACzE,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2GAA2G,EAAE,GAAG,EAAE;QACnH,EAAE,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,kDAAkD,CAAC,CAAC,CAAC,OAAO,CAC7F,yBAAyB,CAC1B,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/platform-integration/gateways/memberAccess.gitlab.cli.gateway.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=memberAccess.gitlab.cli.gateway.test.d.ts.map

package/dist/tests/units/modules/platform-integration/gateways/memberAccess.gitlab.cli.gateway.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memberAccess.gitlab.cli.gateway.test.d.ts","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/platform-integration/gateways/memberAccess.gitlab.cli.gateway.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/platform-integration/gateways/memberAccess.gitlab.cli.gateway.test.js

@@ -0,0 +1,105 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { GitLabMemberAccessCliGateway } from '../../../../../modules/platform-integration/interface-adapters/gateways/memberAccess.gitlab.cli.gateway.js';
+import { MEMBER_ACCESS_LEVELS } from '../../../../../modules/platform-integration/entities/memberAccess/memberAccess.js';
+class RecordingExecutor {
+    commands = [];
+    responses = new Map();
+    failures = new Set();
+    onMatch(fragment, response) {
+        this.responses.set(fragment, response);
+    }
+    failOnMatch(fragment) {
+        this.failures.add(fragment);
+    }
+    run = (command) => {
+        this.commands.push({ command });
+        for (const fragment of this.failures) {
+            if (command.includes(fragment)) {
+                throw new Error(`glab failed for ${fragment}`);
+            }
+        }
+        for (const [fragment, response] of this.responses) {
+            if (command.includes(fragment)) {
+                return response;
+            }
+        }
+        throw new Error(`No stubbed response for command: ${command}`);
+    };
+}
+describe('GitLabMemberAccessCliGateway', () => {
+    let executor;
+    let now;
+    const clock = () => now;
+    beforeEach(() => {
+        executor = new RecordingExecutor();
+        now = 1_000;
+    });
+    function buildGateway(ttlMs = 60_000) {
+        return new GitLabMemberAccessCliGateway(executor.run, { ttlMs, clock });
+    }
+    it('resolves username to id then membership access level', async () => {
+        executor.onMatch('users?username=alice', JSON.stringify([{ id: 7, username: 'alice' }]));
+        executor.onMatch('members/all/7', JSON.stringify({ id: 7, access_level: 30 }));
+        const accessLevel = await buildGateway().resolve('org/project', 'alice');
+        expect(accessLevel).toBe(MEMBER_ACCESS_LEVELS.developer);
+    });
+    it('caches per username and does not re-query within the TTL', async () => {
+        executor.onMatch('users?username=alice', JSON.stringify([{ id: 7, username: 'alice' }]));
+        executor.onMatch('members/all/7', JSON.stringify({ id: 7, access_level: 40 }));
+        const gateway = buildGateway();
+        await gateway.resolve('org/project', 'alice');
+        const commandsAfterFirst = executor.commands.length;
+        await gateway.resolve('org/project', 'alice');
+        expect(executor.commands.length).toBe(commandsAfterFirst);
+    });
+    it('does not apply a cached result for one username to another (AC5)', async () => {
+        executor.onMatch('users?username=alice', JSON.stringify([{ id: 7, username: 'alice' }]));
+        executor.onMatch('members/all/7', JSON.stringify({ id: 7, access_level: 30 }));
+        executor.failOnMatch('users?username=mallory');
+        const gateway = buildGateway();
+        await gateway.resolve('org/project', 'alice');
+        const mallory = await gateway.resolve('org/project', 'mallory');
+        expect(mallory).toBeNull();
+    });
+    it('re-queries after the TTL expires', async () => {
+        executor.onMatch('users?username=alice', JSON.stringify([{ id: 7, username: 'alice' }]));
+        executor.onMatch('members/all/7', JSON.stringify({ id: 7, access_level: 30 }));
+        const gateway = buildGateway(1_000);
+        await gateway.resolve('org/project', 'alice');
+        const commandsAfterFirst = executor.commands.length;
+        now += 2_000;
+        await gateway.resolve('org/project', 'alice');
+        expect(executor.commands.length).toBeGreaterThan(commandsAfterFirst);
+    });
+    it('returns null when the user lookup throws (fail-closed)', async () => {
+        executor.failOnMatch('users?username=alice');
+        const accessLevel = await buildGateway().resolve('org/project', 'alice');
+        expect(accessLevel).toBeNull();
+    });
+    it('returns null when the user lookup is ambiguous (more than one match)', async () => {
+        executor.onMatch('users?username=alice', JSON.stringify([
+            { id: 7, username: 'alice' },
+            { id: 8, username: 'alice' },
+        ]));
+        const accessLevel = await buildGateway().resolve('org/project', 'alice');
+        expect(accessLevel).toBeNull();
+    });
+    it('returns null when the username is unknown (empty user list)', async () => {
+        executor.onMatch('users?username=ghost', JSON.stringify([]));
+        const accessLevel = await buildGateway().resolve('org/project', 'ghost');
+        expect(accessLevel).toBeNull();
+    });
+    it('returns null when the membership lookup throws (non-member, fail-closed)', async () => {
+        executor.onMatch('users?username=alice', JSON.stringify([{ id: 7, username: 'alice' }]));
+        executor.failOnMatch('members/all/7');
+        const accessLevel = await buildGateway().resolve('org/project', 'alice');
+        expect(accessLevel).toBeNull();
+    });
+    it('returns null when membership access_level is below the known scale', async () => {
+        executor.onMatch('users?username=alice', JSON.stringify([{ id: 7, username: 'alice' }]));
+        executor.onMatch('members/all/7', JSON.stringify({ id: 7, access_level: 999 }));
+        const accessLevel = await buildGateway().resolve('org/project', 'alice');
+        expect(accessLevel).toBeNull();
+    });
+});
+//# sourceMappingURL=memberAccess.gitlab.cli.gateway.test.js.map

package/dist/tests/units/modules/platform-integration/gateways/memberAccess.gitlab.cli.gateway.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memberAccess.gitlab.cli.gateway.test.js","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/platform-integration/gateways/memberAccess.gitlab.cli.gateway.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,+FAA+F,CAAC;AAC7I,OAAO,EAAE,oBAAoB,EAAE,MAAM,sEAAsE,CAAC;AAM5G,MAAM,iBAAiB;IACL,QAAQ,GAAsB,EAAE,CAAC;IACzC,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,OAAO,CAAC,QAAgB,EAAE,QAAgB;QACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,GAAG,GAAG,CAAC,OAAe,EAAU,EAAE;QAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;CACH;AAED,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,IAAI,QAA2B,CAAC;IAChC,IAAI,GAAW,CAAC;IAChB,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,GAAG,CAAC;IAEhC,UAAU,CAAC,GAAG,EAAE;QACd,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACnC,GAAG,GAAG,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,SAAS,YAAY,CAAC,KAAK,GAAG,MAAM;QAClC,OAAO,IAAI,4BAA4B,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAE/E,MAAM,WAAW,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAEzE,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAE/E,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpD,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,QAAQ,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAEhE,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAE/E,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,QAAQ,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;QAE7C,MAAM,WAAW,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAEzE,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,QAAQ,CAAC,OAAO,CACd,sBAAsB,EACtB,IAAI,CAAC,SAAS,CAAC;YACb,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC5B,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;SAC7B,CAAC,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAEzE,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,WAAW,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAEzE,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,WAAW,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAEzE,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAEhF,MAAM,WAAW,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAEzE,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/units/modules/platform-integration/gateways/scopedGitLabExecutor.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scopedGitLabExecutor.test.d.ts.map

package/dist/tests/units/modules/platform-integration/gateways/scopedGitLabExecutor.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopedGitLabExecutor.test.d.ts","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/platform-integration/gateways/scopedGitLabExecutor.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/platform-integration/gateways/scopedGitLabExecutor.test.js

@@ -0,0 +1,85 @@
+import { describe, it, expect } from 'vitest';
+import { createScopedGitLabExecutor, } from '../../../../../modules/platform-integration/interface-adapters/gateways/scopedGitLabExecutor.js';
+import { MissingExecutorTokenError } from '../../../../../modules/platform-integration/services/scopedExecutorEnvironment.js';
+const TOKEN = 'glpat-scoped-exec-1';
+class RecordingFileWriter {
+    writes = [];
+    write(path, contents) {
+        this.writes.push({ path, contents });
+    }
+}
+class RecordingSpawn {
+    calls = [];
+    run = (command, env, cwd) => {
+        this.calls.push({ command, env, cwd });
+        return '[]';
+    };
+}
+describe('scoped gitlab executor factory (AC1-AC4 wiring)', () => {
+    it('AC1: throws fail-closed when the service token is absent, never spawning', () => {
+        const spawn = new RecordingSpawn();
+        const fileWriter = new RecordingFileWriter();
+        expect(() => createScopedGitLabExecutor({
+            parentEnv: { PATH: '/usr/bin' },
+            isolatedDir: '/tmp/iso',
+            fileWriter,
+            spawn: spawn.run,
+        })).toThrow(MissingExecutorTokenError);
+        expect(spawn.calls).toHaveLength(0);
+        expect(fileWriter.writes).toHaveLength(0);
+    });
+    it('AC1: returns a callable executor when the token is present', () => {
+        const spawn = new RecordingSpawn();
+        const fileWriter = new RecordingFileWriter();
+        const executor = createScopedGitLabExecutor({
+            parentEnv: { REVIEWFLOW_EXECUTOR_TOKEN: TOKEN, PATH: '/usr/bin' },
+            isolatedDir: '/tmp/iso',
+            fileWriter,
+            spawn: spawn.run,
+        });
+        expect(typeof executor).toBe('function');
+    });
+    it('AC3: the spawned env never carries the token value', () => {
+        const spawn = new RecordingSpawn();
+        const fileWriter = new RecordingFileWriter();
+        const executor = createScopedGitLabExecutor({
+            parentEnv: { REVIEWFLOW_EXECUTOR_TOKEN: TOKEN, PATH: '/usr/bin', AMBIENT_ADMIN_TOKEN: 'canary' },
+            isolatedDir: '/tmp/iso',
+            fileWriter,
+            spawn: spawn.run,
+        });
+        executor('glab api projects/x/merge_requests/1/discussions');
+        expect(spawn.calls).toHaveLength(1);
+        for (const value of Object.values(spawn.calls[0].env)) {
+            expect(value).not.toBe(TOKEN);
+        }
+        expect(spawn.calls[0].env.AMBIENT_ADMIN_TOKEN).toBeUndefined();
+    });
+    it('AC4: spawns with HOME and GLAB_CONFIG_DIR under the isolated dir', () => {
+        const spawn = new RecordingSpawn();
+        const fileWriter = new RecordingFileWriter();
+        const executor = createScopedGitLabExecutor({
+            parentEnv: { REVIEWFLOW_EXECUTOR_TOKEN: TOKEN, PATH: '/usr/bin' },
+            isolatedDir: '/tmp/iso',
+            fileWriter,
+            spawn: spawn.run,
+        });
+        executor('glab api projects/x/merge_requests/1/discussions');
+        expect(spawn.calls[0].env.HOME?.startsWith('/tmp/iso')).toBe(true);
+        expect(spawn.calls[0].env.GLAB_CONFIG_DIR?.startsWith('/tmp/iso')).toBe(true);
+    });
+    it('AC4: writes the token only into the isolated glab config file', () => {
+        const spawn = new RecordingSpawn();
+        const fileWriter = new RecordingFileWriter();
+        createScopedGitLabExecutor({
+            parentEnv: { REVIEWFLOW_EXECUTOR_TOKEN: TOKEN, PATH: '/usr/bin' },
+            isolatedDir: '/tmp/iso',
+            fileWriter,
+            spawn: spawn.run,
+        });
+        expect(fileWriter.writes).toHaveLength(1);
+        expect(fileWriter.writes[0].path.startsWith('/tmp/iso')).toBe(true);
+        expect(fileWriter.writes[0].contents).toContain(TOKEN);
+    });
+});
+//# sourceMappingURL=scopedGitLabExecutor.test.js.map

package/dist/tests/units/modules/platform-integration/gateways/scopedGitLabExecutor.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopedGitLabExecutor.test.js","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/platform-integration/gateways/scopedGitLabExecutor.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,0BAA0B,GAC3B,MAAM,oFAAoF,CAAA;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,sEAAsE,CAAA;AAEhH,MAAM,KAAK,GAAG,qBAAqB,CAAA;AAEnC,MAAM,mBAAmB;IACP,MAAM,GAA8C,EAAE,CAAA;IACtE,KAAK,CAAC,IAAY,EAAE,QAAgB;QAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtC,CAAC;CACF;AAED,MAAM,cAAc;IACF,KAAK,GAAqF,EAAE,CAAA;IAC5G,GAAG,GAAG,CAAC,OAAe,EAAE,GAAuC,EAAE,GAAW,EAAU,EAAE;QACtF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;CACF;AAED,QAAQ,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC/D,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,KAAK,GAAG,IAAI,cAAc,EAAE,CAAA;QAClC,MAAM,UAAU,GAAG,IAAI,mBAAmB,EAAE,CAAA;QAC5C,MAAM,CAAC,GAAG,EAAE,CACV,0BAA0B,CAAC;YACzB,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;YAC/B,WAAW,EAAE,UAAU;YACvB,UAAU;YACV,KAAK,EAAE,KAAK,CAAC,GAAG;SACjB,CAAC,CACH,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG,IAAI,cAAc,EAAE,CAAA;QAClC,MAAM,UAAU,GAAG,IAAI,mBAAmB,EAAE,CAAA;QAC5C,MAAM,QAAQ,GAAG,0BAA0B,CAAC;YAC1C,SAAS,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;YACjE,WAAW,EAAE,UAAU;YACvB,UAAU;YACV,KAAK,EAAE,KAAK,CAAC,GAAG;SACjB,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG,IAAI,cAAc,EAAE,CAAA;QAClC,MAAM,UAAU,GAAG,IAAI,mBAAmB,EAAE,CAAA;QAC5C,MAAM,QAAQ,GAAG,0BAA0B,CAAC;YAC1C,SAAS,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,QAAQ,EAAE;YAChG,WAAW,EAAE,UAAU;YACvB,UAAU;YACV,KAAK,EAAE,KAAK,CAAC,GAAG;SACjB,CAAC,CAAA;QACF,QAAQ,CAAC,kDAAkD,CAAC,CAAA;QAC5D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,aAAa,EAAE,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,IAAI,cAAc,EAAE,CAAA;QAClC,MAAM,UAAU,GAAG,IAAI,mBAAmB,EAAE,CAAA;QAC5C,MAAM,QAAQ,GAAG,0BAA0B,CAAC;YAC1C,SAAS,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;YACjE,WAAW,EAAE,UAAU;YACvB,UAAU;YACV,KAAK,EAAE,KAAK,CAAC,GAAG;SACjB,CAAC,CAAA;QACF,QAAQ,CAAC,kDAAkD,CAAC,CAAA;QAC5D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,KAAK,GAAG,IAAI,cAAc,EAAE,CAAA;QAClC,MAAM,UAAU,GAAG,IAAI,mBAAmB,EAAE,CAAA;QAC5C,0BAA0B,CAAC;YACzB,SAAS,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;YACjE,WAAW,EAAE,UAAU;YACvB,UAAU;YACV,KAAK,EAAE,KAAK,CAAC,GAAG;SACjB,CAAC,CAAA;QACF,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/platform-integration/interface-adapters/controllers/webhook/gitlabIdempotency.controller.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gitlabIdempotency.controller.test.d.ts.map

package/dist/tests/units/modules/platform-integration/interface-adapters/controllers/webhook/gitlabIdempotency.controller.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlabIdempotency.controller.test.d.ts","sourceRoot":"","sources":["../../../../../../../../src/tests/units/modules/platform-integration/interface-adapters/controllers/webhook/gitlabIdempotency.controller.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/platform-integration/interface-adapters/controllers/webhook/gitlabIdempotency.controller.test.js

@@ -0,0 +1,216 @@
+import { vi } from 'vitest';
+const mockConfig = {
+    server: { port: 3000 },
+    user: { gitlabUsername: 'claude-bot', githubUsername: 'claude-bot' },
+    queue: { maxConcurrent: 1, deduplicationWindowMs: 60000 },
+    repositories: [],
+};
+const mockRepoConfig = {
+    name: 'test-project',
+    platform: 'gitlab',
+    localPath: '/home/user/projects/test-project',
+    remoteUrl: 'https://gitlab.com/test-org/test-project.git',
+    skill: 'review-front',
+    enabled: true,
+};
+vi.mock('@/config/loader.js', () => ({
+    loadConfig: vi.fn(() => mockConfig),
+    findRepositoryByProjectPath: vi.fn(() => mockRepoConfig),
+}));
+vi.mock('@/security/verifier.js', () => ({
+    verifyGitLabSignature: vi.fn(() => ({ valid: true })),
+    getGitLabEventType: vi.fn(() => 'Merge Request Hook'),
+    getGitLabEventUuid: vi.fn((request) => request.headers['x-gitlab-event-uuid']),
+}));
+vi.mock('@/frameworks/queue/pQueueAdapter.js', () => ({
+    createJobId: vi.fn(() => 'gitlab-test-org/test-project-42'),
+    enqueueReview: vi.fn(() => Promise.resolve(true)),
+    updateJobProgress: vi.fn(),
+    cancelJob: vi.fn(),
+}));
+vi.mock('@/claude/invoker.js', () => ({
+    invokeClaudeReview: vi.fn(),
+    sendNotification: vi.fn(),
+}));
+vi.mock('@/main/websocket.js', () => ({
+    startWatchingReviewContext: vi.fn(),
+    stopWatchingReviewContext: vi.fn(),
+}));
+vi.mock('@/config/projectConfig.js', () => ({
+    loadProjectConfig: vi.fn(() => null),
+    getProjectAgents: vi.fn(() => null),
+    getProjectAgentsOrFocusDefaults: vi.fn(() => null),
+    getFollowupAgents: vi.fn(() => null),
+    getProjectLanguage: vi.fn(() => 'en'),
+}));
+import { describe, it, expect, beforeEach } from 'vitest';
+import { handleGitLabWebhook } from '../../../../../../../modules/platform-integration/interface-adapters/controllers/webhook/gitlab.controller.js';
+import { GitLabEventFactory } from '../../../../../../../tests/factories/gitLabEvent.factory.js';
+import { createStubLogger } from '../../../../../../../tests/stubs/logger.stub.js';
+import { TrackedMrFactory } from '../../../../../../../tests/factories/trackedMr.factory.js';
+import { TrackAssignmentUseCase } from '../../../../../../../modules/tracking/usecases/tracking/trackAssignment.usecase.js';
+import { RecordReviewCompletionUseCase } from '../../../../../../../modules/tracking/usecases/tracking/recordReviewCompletion.usecase.js';
+import { RecordPushUseCase } from '../../../../../../../modules/tracking/usecases/tracking/recordPush.usecase.js';
+import { TransitionStateUseCase } from '../../../../../../../modules/tracking/usecases/tracking/transitionState.usecase.js';
+import { CheckFollowupNeededUseCase } from '../../../../../../../modules/tracking/usecases/tracking/checkFollowupNeeded.usecase.js';
+import { SyncThreadsUseCase } from '../../../../../../../modules/tracking/usecases/tracking/syncThreads.usecase.js';
+import { RecordBypassUseCase } from '../../../../../../../modules/tracking/usecases/tracking/recordBypass.usecase.js';
+import { HandlePlatformApprovalUseCase } from '../../../../../../../modules/tracking/usecases/tracking/handlePlatformApproval.usecase.js';
+import { StubNoteCommentPostGateway } from '../../../../../../../tests/stubs/noteCommentPost.stub.js';
+import { StubApprovalRevocationGateway } from '../../../../../../../tests/stubs/approvalRevocation.stub.js';
+import { StubIdempotencyStore } from '../../../../../../../tests/stubs/idempotencyStore.stub.js';
+import { InMemoryIdempotencyStore } from '../../../../../../../modules/platform-integration/interface-adapters/gateways/inMemoryIdempotencyStore.gateway.js';
+class StubGateClaudeInvocation {
+    invocationCount = 0;
+    result;
+    constructor(result = { status: 'enqueued', jobId: 'gitlab-test-org/test-project-42' }) {
+        this.result = result;
+    }
+    async execute(_input) {
+        this.invocationCount += 1;
+        return this.result;
+    }
+}
+function createMockTrackingGateway() {
+    const basicMr = TrackedMrFactory.create({
+        id: 'gitlab-test-org/test-project-42',
+        mrNumber: 42,
+        platform: 'gitlab',
+        project: 'test-org/test-project',
+    });
+    return {
+        getById: vi.fn(() => basicMr),
+        getByNumber: vi.fn(() => null),
+        create: vi.fn(),
+        update: vi.fn(),
+        getByState: vi.fn(() => []),
+        getActiveMrs: vi.fn(() => []),
+        remove: vi.fn(() => true),
+        archive: vi.fn(() => true),
+        recordReviewEvent: vi.fn(),
+        recordPush: vi.fn(() => null),
+        loadTracking: vi.fn(() => null),
+        saveTracking: vi.fn(),
+    };
+}
+function createStubContextGateway() {
+    return {
+        create: vi.fn(() => ({ success: true, filePath: '' })),
+        read: vi.fn(() => null),
+        delete: vi.fn(() => ({ success: true, deleted: true })),
+        exists: vi.fn(() => false),
+        getFilePath: vi.fn(() => ''),
+        appendAction: vi.fn(() => ({ success: true })),
+        updateProgress: vi.fn(() => ({ success: true })),
+        setResult: vi.fn(() => ({ success: true })),
+        listAll: vi.fn(() => []),
+    };
+}
+function createAcceptAllEnforceBudget() {
+    return {
+        execute: vi.fn(async () => ({
+            accepted: true,
+            status: {
+                limitUsd: 200,
+                consumedUsd: 0,
+                remainingUsd: 200,
+                percentUsed: 0,
+                exceeded: false,
+                periodStart: '2026-05-01T00:00:00.000Z',
+            },
+        })),
+    };
+}
+function createDeps(trackingGateway, overrides = {}) {
+    const threadFetchGateway = { fetchThreads: vi.fn(() => []) };
+    return {
+        reviewContextGateway: createStubContextGateway(),
+        threadFetchGateway,
+        diffMetadataFetchGateway: { fetchDiffMetadata: vi.fn(() => ({ baseSha: 'abc', headSha: 'def', startSha: 'ghi' })) },
+        diffStatsFetchGateway: { fetchDiffStats: vi.fn(() => null) },
+        trackAssignment: new TrackAssignmentUseCase(trackingGateway),
+        recordCompletion: new RecordReviewCompletionUseCase(trackingGateway),
+        recordPush: new RecordPushUseCase(trackingGateway),
+        transitionState: new TransitionStateUseCase(trackingGateway),
+        checkFollowupNeeded: new CheckFollowupNeededUseCase(trackingGateway),
+        syncThreads: new SyncThreadsUseCase(trackingGateway, threadFetchGateway),
+        enforceBudget: createAcceptAllEnforceBudget(),
+        broadcastBudgetExceeded: vi.fn(),
+        getRepositories: vi.fn(() => []),
+        removeWorktree: vi.fn(async () => ({ status: 'removed' })),
+        recordBypass: new RecordBypassUseCase(trackingGateway),
+        noteCommentPostGateway: new StubNoteCommentPostGateway(),
+        handlePlatformApproval: new HandlePlatformApprovalUseCase(trackingGateway),
+        approvalRevocationGateway: new StubApprovalRevocationGateway(),
+        getQualityThreshold: () => null,
+        now: () => '2026-05-26T12:00:00.000Z',
+        ...overrides,
+    };
+}
+function requestWith(uuid) {
+    const headers = {};
+    if (uuid !== undefined) {
+        headers['x-gitlab-event-uuid'] = uuid;
+    }
+    return {
+        body: GitLabEventFactory.createWithReviewerAdded('claude-bot'),
+        headers,
+    };
+}
+describe('handleGitLabWebhook idempotency guard', () => {
+    let mockReply;
+    let mockGateway;
+    const logger = createStubLogger();
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockReply = {
+            status: vi.fn().mockReturnThis(),
+            send: vi.fn().mockReturnThis(),
+        };
+        mockGateway = createMockTrackingGateway();
+        mockGateway.getById.mockReturnValue(null);
+    });
+    it('AC4: a duplicate UUID returns 200 no-op with a single invocation and pristine output stubs', async () => {
+        const idempotencyStore = new InMemoryIdempotencyStore({ ttlMs: 60_000, clock: () => 0 });
+        const gateClaudeInvocation = new StubGateClaudeInvocation();
+        const noteCommentPostGateway = new StubNoteCommentPostGateway();
+        const approvalRevocationGateway = new StubApprovalRevocationGateway();
+        const trackAssignment = new TrackAssignmentUseCase(mockGateway);
+        const trackSpy = vi.spyOn(trackAssignment, 'execute');
+        const deps = createDeps(mockGateway, {
+            idempotencyStore,
+            gateClaudeInvocation,
+            noteCommentPostGateway,
+            approvalRevocationGateway,
+            trackAssignment,
+        });
+        await handleGitLabWebhook(requestWith('uuid-A'), mockReply, logger, mockGateway, deps);
+        const trackCallsAfterFirst = trackSpy.mock.calls.length;
+        await handleGitLabWebhook(requestWith('uuid-A'), mockReply, logger, mockGateway, deps);
+        expect(gateClaudeInvocation.invocationCount).toBe(1);
+        expect(trackSpy.mock.calls.length).toBe(trackCallsAfterFirst);
+        expect(noteCommentPostGateway.calls).toHaveLength(0);
+        expect(approvalRevocationGateway.calls).toHaveLength(0);
+        expect(mockReply.status).toHaveBeenLastCalledWith(200);
+    });
+    it('AC5: two distinct UUIDs each proceed to the chokepoint (two invocations)', async () => {
+        const idempotencyStore = new InMemoryIdempotencyStore({ ttlMs: 60_000, clock: () => 0 });
+        const gateClaudeInvocation = new StubGateClaudeInvocation();
+        const deps = createDeps(mockGateway, { idempotencyStore, gateClaudeInvocation });
+        await handleGitLabWebhook(requestWith('uuid-A'), mockReply, logger, mockGateway, deps);
+        await handleGitLabWebhook(requestWith('uuid-B'), mockReply, logger, mockGateway, deps);
+        expect(gateClaudeInvocation.invocationCount).toBe(2);
+    });
+    it('AC6: a missing UUID reaches the chokepoint once and records no dedup entry', async () => {
+        const idempotencyStore = new StubIdempotencyStore();
+        const gateClaudeInvocation = new StubGateClaudeInvocation();
+        const deps = createDeps(mockGateway, { idempotencyStore, gateClaudeInvocation });
+        await handleGitLabWebhook(requestWith(undefined), mockReply, logger, mockGateway, deps);
+        expect(gateClaudeInvocation.invocationCount).toBe(1);
+        expect(idempotencyStore.recordedKeys).toHaveLength(0);
+        expect(idempotencyStore.entryCount).toBe(0);
+        expect(mockReply.status).not.toHaveBeenCalledWith(400);
+        expect(mockReply.status).not.toHaveBeenCalledWith(409);
+    });
+});
+//# sourceMappingURL=gitlabIdempotency.controller.test.js.map