From 499f892c205b98f26e546683ec189c8b836ad6a4 Mon Sep 17 00:00:00 2001
From: Lex <sunsan05@Gmail.com>
Date: Mon, 17 Aug 2026 12:12:53 +0800
Subject: [PATCH] fix(core): encode GitLab version-endpoint auth requirement in
 dag-init probe

GitLab's /api/v4/version requires authentication by API design, so a
healthy self-hosted instance answers a bare curl with 401. The probe text
listed the authenticated call as an alternative, so agents following it
verbatim burned a failed round before discovering this (hit live against
git.ycgame.com). Encode both facts: a 401 is positive evidence that the
endpoint exists and answers, and glab api version is the re-verification
step after auth passes.
---
 packages/core/src/plugin/command/dag-init.txt | 17 +++++++++++------
 packages/core/test/plugin/command.test.ts     |  2 ++
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/packages/core/src/plugin/command/dag-init.txt b/packages/core/src/plugin/command/dag-init.txt
index 0055b49a6..46e58de17 100644
--- a/packages/core/src/plugin/command/dag-init.txt
+++ b/packages/core/src/plugin/command/dag-init.txt
@@ -15,12 +15,17 @@ Arguments (optional): $ARGUMENTS
    - Not a git repo, or no `origin` → STOP: "`/dag-*` requires a git remote."
    - Host is `github.com` → platform `github`, CLI `gh`.
    - Host is `gitlab.com` → platform `gitlab`, CLI `glab`.
-   - Any other host → probe whether it is a self-hosted GitLab:
-     `curl -sSf https://<host>/api/v4/version` (or `glab api version` against
-     that host once authed). Responds as GitLab → platform `gitlab`
-     (self-hosted), CLI `glab` pinned to that host. Otherwise → STOP:
-     "unsupported platform: only GitHub and GitLab (self-hosted included)
-     are supported." Bitbucket/Gitea/other remotes are rejected here.
+   - Any other host → decide whether it is a self-hosted GitLab. GitLab's
+     `/api/v4/version` endpoint REQUIRES authentication by API design, so a
+     healthy instance answers a bare request with 401 — that 401 is POSITIVE
+     evidence (the endpoint exists and answers), not a failure. Probe order:
+     `curl -sSf https://<host>/api/v4/version`; a version JSON response OR a
+     401/GitLab-shaped error → classify as GitLab; connection refused or a
+     non-GitLab answer → STOP: "unsupported platform: only GitHub and GitLab
+     (self-hosted included) are supported." Bitbucket/Gitea/other remotes are
+     rejected here. Once classified, re-verify with `glab api version` after
+     step 2 auth passes. Platform `gitlab` (self-hosted), CLI `glab` pinned
+     to that host.
    - When `origin` and a different `upstream` exist and point at different
      repositories, ask the user ONCE which remote `/dag-auto` should bind to
      and record the choice; otherwise bind `origin`.
diff --git a/packages/core/test/plugin/command.test.ts b/packages/core/test/plugin/command.test.ts
index eb33b78df..cfd96f32d 100644
--- a/packages/core/test/plugin/command.test.ts
+++ b/packages/core/test/plugin/command.test.ts
@@ -61,6 +61,8 @@ describe("CommandPlugin.Plugin", () => {
       })
       expect(CommandPlugin.DagInitContent).toContain("$ARGUMENTS")
       expect(CommandPlugin.DagInitContent).toContain("unsupported platform: only GitHub and GitLab")
+      expect(CommandPlugin.DagInitContent).toContain("401 is POSITIVE")
+      expect(CommandPlugin.DagInitContent).toContain("re-verify with `glab api version`")
       expect(CommandPlugin.DagInitContent).toContain(".opencode/dag-init.json")
       expect(CommandPlugin.DagInitContent).toContain("merge_policy")
       expect(yield* command.get("dag-auto")).toMatchObject({