feat(provider-review): add safe provider SDK boundaries

[iscekic]

No new behavior — this work prepares GitLab and Bitbucket reviews but does not add screens or actions.

---

Summary

GitLabInteractiveOperations and GitLabInteractiveScope add typed discovery and review calls confined to discovery or one authorized project.
GitLabInteractiveResponse preserves success statuses and safe headers; GitLabInteractiveError redacts failures, and mergeRequestRequestChanges accepts only server-built GraphQL.
The broker retains credential refresh and invalidation; the client fetches credentials for each request and leaves write retries to its caller.

Files

• apps/web/src/lib/integrations/platforms/gitlab/interactive-client.ts — source, added (+436 lines); adds Gitbeaker reads for identities, projects, branches, reviews, diffs/versions, reviewers, approvals, discussions, notes, drafts, reactions, files, pipelines, jobs, and commits/statuses. Adds branch deletion, approvals and withdrawal, discussion resolution, note/draft editing and publishing, reactions, merging, rebasing, and automatic-merge cancellation. Resolves numeric project identifiers through the authorized project before constructing the change-request mutation, and adds raw-diff access. Preserves native multipart encoding and validates JavaScript Object Notation (JSON) responses. Buffers response bodies before exposing text, blob, or stream results, and preserves 202/204 responses. Enforces project-exact credentials, rejects sudo, validates pagination/task headers, and limits calls to 100 requests, 100 items per page, and 10,485,760 aggregate response bytes.
• apps/web/src/lib/integrations/platforms/gitlab/interactive-client.test.ts — test, added (+714 lines); adds the GitLab interactive-client suite.

BitbucketInteractiveOperation, BitbucketInteractiveRequest, BitbucketInteractiveData, and BitbucketInteractiveResult derive typed review operations from the official Bitbucket OpenAPI schema.
BitbucketInteractiveScope and BitbucketInteractiveRequestSchema constrain calls to an authorized workspace or repository; each write makes one request without automatic retries.
Results distinguish completed, accepted, and empty responses, with bounded pagination and streams plus validated merge-task locations.

Files

• services/git-token-service/src/bitbucket-interactive-api.ts — source, added (+461 lines); adds a closed openapi-fetch operation list for repositories, branches, restrictions, pull requests, diffs/diffstat, files/metadata, commits, and statuses. Supports comment creation, editing, deletion, resolution, and reopening; approval/change-request submission or withdrawal; branch deletion; merging; and merge-task polling. Validates identities, exact path parameters, allowed query names, and body shapes; query credentials cannot replace the selected actor. Requires comment bodies, permits optional merge bodies, and rejects bodies for other operations. Forces metadata representation and corrects FileMetadata attribute arrays; ordinary file reads cannot override their representation. Buffers text before streaming and validates decoding and media types. Limits pagination to 50-item pages, 100 pages, 5,000 items, and 1,000,000 aggregate bytes; rejects repeated links and changed resources or filters. Preserves 200/201 data, requires a valid task location for 202, returns null for 204, and rejects provider error objects even with status 200.
• services/git-token-service/src/bitbucket-interactive-api.test.ts — test, added (+683 lines); adds the Bitbucket interactive API suite.
• services/git-token-service/src/bitbucket-openapi.source.json — generated schema, added (+32,076 lines); supplies the official Bitbucket OpenAPI schema.
• services/git-token-service/src/bitbucket-openapi.d.ts — generated types, added (+26,683 lines); supplies the Bitbucket OpenAPI type definitions.

BITBUCKET_INTERACTIVE_PATH and BITBUCKET_INTERACTIVE_AUDIENCE define the server-only Bitbucket review request contract; this level does not register its broker route.
BitbucketInteractiveServiceResultSchema validates status-tagged responses, and BitbucketInteractiveClientError exposes safe failure codes.
Requests carry actor and organization claims plus workspace and repository identities; the credential service owns provider tokens, and writes have no automatic retries.

Files

• apps/web/src/lib/integrations/platforms/bitbucket/interactive-client.ts — source, added (+168 lines); defines POST requests to /internal/bitbucket/interactive-review with audience git-token-service:bitbucket-interactive-review and five-minute service tokens. Uses the existing GIT_TOKEN_SERVICE_API_URL, the shared write serializer, a 30-second timeout, and a 1,000,000-byte response cap. Rejects redirects and invalid JSON/envelopes, validates success or failure results, and converts service, transport, and timeout failures to safe codes. The client neither receives provider tokens nor selects provider hosts.
• apps/web/src/lib/integrations/platforms/bitbucket/interactive-client.test.ts — test, added (+240 lines); adds the Bitbucket interactive-client suite.

GitLabTransportPolicy and BitbucketTransportOptions give shared transports explicit safety rules while preserving existing discovery callers' redirect and response contracts.
GitLabTransportError reports policy failures; BitbucketInteractiveError adds request-size and conflict failures without expanding BitbucketApiErrorCode.
Interactive calls use REVIEW_WRITE_REQUEST_MAX_BYTES or BITBUCKET_INTERACTIVE_REQUEST_MAX_BYTES; GitLab pins resolved addresses, while Bitbucket rejects all redirects.

Files

• apps/web/src/lib/integrations/platforms/gitlab/safe-transport.ts — source, added (+316 lines); extracts the address-pinned transport and retains legacy five-hop redirects, credential stripping, method/body handling, and downgrade protection. Adds instance/resource checks, request-size checks, a 30-second deadline, 10,485,760-byte response limits, and rejection of mutation redirects for policy-bound calls.
• apps/web/src/lib/integrations/platforms/gitlab/safe-transport.test.ts — test, added (+213 lines); adds the GitLab safe-transport suite.
• services/git-token-service/src/bitbucket-safe-transport.ts — source, added (+185 lines); shares fixed-origin fetching and bounded body reading across JSON, text, and stream consumers. Validates tokens and canonical addresses; keeps a 10-second default timeout and a 30-second maximum. Caps request bodies at 16,000 bytes by default or 256,000 bytes for interactive calls, and responses at 1,000,000 bytes. Cancels redirected, oversized, or timed-out reads and returns safe error codes without retaining provider error details.
• services/git-token-service/src/bitbucket-safe-transport.test.ts — test, added (+299 lines); adds the Bitbucket safe-transport suite.
• services/git-token-service/src/bitbucket-api.ts — source, modified (147 changed lines); reuses the transport and re-exports the existing error contracts. Preserves repository normalization, optional default branches, workspace checks, duplicate detection, pagination limits, response schemas, and status mapping.

GitLabProject.default_branch now permits missing or null values, and fetchGitLabProjects includes default_branch only when GitLab supplies a nonempty name.
This preserves legacy repository and cache records throughout the 30-day ledger window without guessing a default branch.
Existing discovery filters and pagination remain unchanged when the adapter switches to the shared transport.

Files

• apps/web/src/lib/integrations/platforms/gitlab/adapter.ts — source, modified (233 changed lines); accepts absent default branches and copies supplied names into discovery results. Replaces its embedded transport with the shared implementation while keeping legacy callers compatible.
• apps/web/src/lib/integrations/platforms/gitlab/adapter.test.ts — test, modified (68 changed lines); updates the GitLab adapter suite.

Tests: 6 files changed (5 added, 1 updated; 2,217 changed lines). GitLab: adapter.test.ts, interactive-client.test.ts, safe-transport.test.ts; Bitbucket: web interactive-client.test.ts, service bitbucket-interactive-api.test.ts, bitbucket-safe-transport.test.ts.
Generated: 2 files added—bitbucket-openapi.source.json (+32,076 lines) and bitbucket-openapi.d.ts (+26,683 lines), from the official Bitbucket OpenAPI schema.

---

Visual Changes

Visual Changes: N/A

Verification

• No live provider verification has run for this implementation.
• Manual verification remains pending for the cumulative stack because this level adds no broker route or visual surface.

Reviewer Notes

• Scope: level 3 only, mobile-provider-parity-1d93-s2...mobile-provider-parity-1d93-s3; GitHub behavior remains unchanged.
• Repository: Kilo-Org/cloud; worktree: /Users/igor/Projects/.worktrees/mobile-provider-parity-1d93.
• The handoff reports 143 passing GitLab tests and a clean bounded recheck.
• The handoff reports 152 passing Bitbucket tests, seven passing scoped checks, and a clean bounded recheck after recovery.

Human steps

• before merge: None.
• after merge: None.

Notes

Runtime verification is pending for the cumulative stack; this level adds no visual surface.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. mobile-provider-parity-1d93-s1 — feat(provider-review): add shared identity and stack checks #5663
2. mobile-provider-parity-1d93-s2 — feat(provider-review): define review contracts and vocabulary #5665
3. mobile-provider-parity-1d93-s3 — feat(provider-review): add safe provider SDK boundaries #5689 ← this PR
4. mobile-provider-parity-1d93-s4 — feat(git-token): authorize exact provider review resources #5692
5. mobile-provider-parity-1d93-s5 — feat(cloud-agent): preserve provider identity through checkout #5700
6. mobile-provider-parity-1d93-s6 — feat(provider-review): expose exact repositories and branches #5705
7. mobile-provider-parity-1d93-s7 — feat(mobile): preserve provider launch and recent identity #5711
8. mobile-provider-parity-1d93-s8 — feat(mobile): select exact provider repositories and branches #5729
9. mobile-provider-parity-1d93-s9 — feat(provider-review): add authorized GitLab review reads #5738
10. mobile-provider-parity-1d93-s10 — feat(provider-review): add authorized Bitbucket review reads #5745
11. mobile-provider-parity-1d93-s11 — feat(provider-review): add reconciled GitLab review actions #5748
12. mobile-provider-parity-1d93-s12 — feat(provider-review): add Bitbucket review actions and recovery #5756
13. mobile-provider-parity-1d93-s13 — feat(provider-review): expose the neutral review facade #5763 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

• services/git-token-service/src/bitbucket-interactive-api.ts

Previous Review Summaries (2 snapshots, latest commit 8b31005)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 8b31005)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• apps/web/src/lib/integrations/platforms/bitbucket/interactive-client.ts
• apps/web/src/lib/integrations/platforms/bitbucket/interactive-client.test.ts
• services/git-token-service/src/bitbucket-interactive-api.ts
• services/git-token-service/src/bitbucket-interactive-api.test.ts

Previous review (commit 87327e7)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (15 files)

• apps/web/src/lib/integrations/platforms/bitbucket/interactive-client.ts
• apps/web/src/lib/integrations/platforms/bitbucket/interactive-client.test.ts
• apps/web/src/lib/integrations/platforms/gitlab/adapter.ts
• apps/web/src/lib/integrations/platforms/gitlab/adapter.test.ts
• apps/web/src/lib/integrations/platforms/gitlab/interactive-client.ts
• apps/web/src/lib/integrations/platforms/gitlab/interactive-client.test.ts
• apps/web/src/lib/integrations/platforms/gitlab/safe-transport.ts
• apps/web/src/lib/integrations/platforms/gitlab/safe-transport.test.ts
• services/git-token-service/src/bitbucket-api.ts
• services/git-token-service/src/bitbucket-interactive-api.ts
• services/git-token-service/src/bitbucket-interactive-api.test.ts
• services/git-token-service/src/bitbucket-safe-transport.ts
• services/git-token-service/src/bitbucket-safe-transport.test.ts
• services/git-token-service/src/bitbucket-openapi.d.ts
• services/git-token-service/src/bitbucket-openapi.source.json

---

_{Reviewed by grok-4.6 · Input: 116.1K · Output: 6.3K · Cached: 249.9K}

_{Review guidance: REVIEW.md from base branch mobile-provider-parity-1d93-s2}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.