feat(forge): pluggable forge abstraction + GitLab and Gitea/Forgejo/Codeberg (#1913)

* refactor(forge): forge-neutral foundation (GitHub-only)

Decouple git-hosting from GitHub behind a neutral abstraction (issue #1616), GitHub-only for now; existing GitHub behaviour is unchanged.

- Forge manifest, neutral ForgeService contract, forge registry + resolver, and a client forge-module registry.
- GitHub code renamed to the neutral shape; PR/Issue attachment wording preserved.
- forge.search.response enums parse tolerantly (unknown kind/auth state degrade instead of breaking the client).
- createPullRequest reports typed CLI/auth errors instead of a generic message.
- forge-resolver host/remote caches are LRU-bounded.
- Forge host trust is explicit: only a known cloud host or a CLI-authenticated host is ever talked to; an unauthenticated GitHub Enterprise host fails resolution instead of routing to github.com.
- Docs: forge-providers guide, glossary and i18n forge-copy conventions, architecture and rpc-namespacing terminology.
- Vitest React Native mocks (unistyles, svg, linking, lucide) consolidated into shared aliased test-stubs.

* feat(forge): GitLab adapter, forge-aware UI, pipelines and approvals

GitLab adapter over the glab CLI on the neutral contracts: MR status, forge-aware UI, pipeline tree, and N-of-M approvals.

- threadIsResolved is part of the neutral timeline item.
- Pipeline load failures show an error instead of an empty section.
- Manual pipeline jobs render as pending.
- Fork/detached MR head pipelines are fetched by MR iid (glab ci get --merge-request).

* feat(forge): Gitea family adapter (Gitea, Forgejo, Codeberg)

One adapter over the tea CLI serving Gitea, Forgejo, and Codeberg on the neutral contracts.

- CI status aggregates commit statuses and Actions runs together.
- Gitea's terminal "warning" state maps to failure on server and client.
- Gitea Actions check details are reachable from the PR pane by workflowRunId.

* refactor(forge): localize compatibility handling

* test(forge): expect normalized GitLab facts

---------

Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>

packages/app/src/utils/open-external-url.ts

@@ -2,6 +2,16 @@ import * as Linking from "expo-linking";
 import { getDesktopHost } from "@/desktop/host";
 import { isWeb } from "@/constants/platform";
 
+const ALLOWED_EXTERNAL_URL_PROTOCOLS = new Set(["http:", "https:"]);
+
+function isAllowedExternalUrl(url: string): boolean {
+  try {
+    return ALLOWED_EXTERNAL_URL_PROTOCOLS.has(new URL(url).protocol);
+  } catch {
+    return false;
+  }
+}
+
 export async function openExternalUrl(url: string): Promise<void> {
   if (isWeb) {
     const opener = getDesktopHost()?.opener?.openUrl;
@@ -10,9 +20,20 @@ export async function openExternalUrl(url: string): Promise<void> {
       return;
     }
 
+    // Mirror the Electron opener's scheme allowlist: forge-supplied URLs
+    // (check target_url, job links) reach this sink, so refuse anything that
+    // is not plain http(s) instead of handing it to window.open.
+    if (!isAllowedExternalUrl(url)) {
+      return;
+    }
+
     window.open(url, "_blank", "noopener,noreferrer");
     return;
   }
 
+  if (!isAllowedExternalUrl(url)) {
+    return;
+  }
+
   await Linking.openURL(url);
 }

packages/app/src/utils/review-attachments.test.ts

@@ -1,11 +1,68 @@
 import { describe, expect, it } from "vitest";
 
-import { buildGitHubAttachmentFromSearchItem } from "./review-attachments";
+import {
+  buildGitHubAttachmentFromSearchItem,
+  buildLegacyGitHubAttachmentFromSearchItem,
+} from "./review-attachments";
 
 describe("buildGitHubAttachmentFromSearchItem", () => {
-  it("builds a github_pr attachment for pull requests", () => {
+  it("builds a forge change request attachment for pull requests", () => {
     const attachment = buildGitHubAttachmentFromSearchItem({
-      kind: "pr",
+      kind: "change_request",
+      number: 123,
+      title: "Fix race in worktree setup",
+      url: "https://github.com/getpaseo/paseo/pull/123",
+      state: "OPEN",
+      body: "PR body",
+      labels: ["bug"],
+      baseRefName: "main",
+      headRefName: "fix/worktree-race",
+    });
+
+    expect(attachment).toEqual({
+      type: "forge_change_request",
+      mimeType: "application/paseo-forge-change-request",
+      forge: "github",
+      number: 123,
+      title: "Fix race in worktree setup",
+      url: "https://github.com/getpaseo/paseo/pull/123",
+      body: "PR body",
+      baseRefName: "main",
+      headRefName: "fix/worktree-race",
+    });
+  });
+
+  it("builds a forge issue attachment for issues", () => {
+    const attachment = buildGitHubAttachmentFromSearchItem({
+      kind: "issue",
+      number: 55,
+      title: "Improve startup error details",
+      url: "https://github.com/getpaseo/paseo/issues/55",
+      state: "OPEN",
+      body: "Issue body",
+      labels: ["bug"],
+    });
+
+    expect(attachment).toEqual({
+      type: "forge_issue",
+      mimeType: "application/paseo-forge-issue",
+      forge: "github",
+      number: 55,
+      title: "Improve startup error details",
+      url: "https://github.com/getpaseo/paseo/issues/55",
+      body: "Issue body",
+    });
+  });
+
+  it("returns null when no item is selected", () => {
+    expect(buildGitHubAttachmentFromSearchItem(null)).toBeNull();
+  });
+});
+
+describe("buildLegacyGitHubAttachmentFromSearchItem", () => {
+  it("builds a legacy GitHub PR attachment for old daemons", () => {
+    const attachment = buildLegacyGitHubAttachmentFromSearchItem({
+      kind: "change_request",
       number: 123,
       title: "Fix race in worktree setup",
       url: "https://github.com/getpaseo/paseo/pull/123",
@@ -27,29 +84,4 @@ describe("buildGitHubAttachmentFromSearchItem", () => {
       headRefName: "fix/worktree-race",
     });
   });
-
-  it("builds a github_issue attachment for issues", () => {
-    const attachment = buildGitHubAttachmentFromSearchItem({
-      kind: "issue",
-      number: 55,
-      title: "Improve startup error details",
-      url: "https://github.com/getpaseo/paseo/issues/55",
-      state: "OPEN",
-      body: "Issue body",
-      labels: ["bug"],
-    });
-
-    expect(attachment).toEqual({
-      type: "github_issue",
-      mimeType: "application/github-issue",
-      number: 55,
-      title: "Improve startup error details",
-      url: "https://github.com/getpaseo/paseo/issues/55",
-      body: "Issue body",
-    });
-  });
-
-  it("returns null when no item is selected", () => {
-    expect(buildGitHubAttachmentFromSearchItem(null)).toBeNull();
-  });
 });

packages/app/src/utils/review-attachments.ts

@@ -1,13 +1,49 @@
-import type { AgentAttachment, GitHubSearchItem } from "@getpaseo/protocol/messages";
+import type { AgentAttachment, ForgeSearchItem } from "@getpaseo/protocol/messages";
 
-export function buildGitHubAttachmentFromSearchItem(
-  item: GitHubSearchItem | null,
+export function buildForgeAttachmentFromSearchItem(
+  item: ForgeSearchItem | null,
 ): AgentAttachment | null {
   if (!item) {
     return null;
   }
 
-  if (item.kind === "pr") {
+  if (item.kind === "change_request") {
+    return {
+      type: "forge_change_request",
+      mimeType: "application/paseo-forge-change-request",
+      forge: item.forge ?? "github",
+      number: item.number,
+      title: item.title,
+      url: item.url,
+      ...(item.body ? { body: item.body } : {}),
+      ...(item.projectPath ? { projectPath: item.projectPath } : {}),
+      ...(item.baseRefName ? { baseRefName: item.baseRefName } : {}),
+      ...(item.headRefName ? { headRefName: item.headRefName } : {}),
+    };
+  }
+
+  return {
+    type: "forge_issue",
+    mimeType: "application/paseo-forge-issue",
+    forge: item.forge ?? "github",
+    number: item.number,
+    title: item.title,
+    url: item.url,
+    ...(item.body ? { body: item.body } : {}),
+    ...(item.projectPath ? { projectPath: item.projectPath } : {}),
+  };
+}
+
+export const buildGitHubAttachmentFromSearchItem = buildForgeAttachmentFromSearchItem;
+
+export function buildLegacyGitHubAttachmentFromSearchItem(
+  item: ForgeSearchItem | null,
+): AgentAttachment | null {
+  if (!item) {
+    return null;
+  }
+
+  if (item.kind === "change_request") {
     return {
       type: "github_pr",
       mimeType: "application/github-pr",