feat: add multi-provider source-control support

.github/workflows/semantic-pull-requests.yml

@@ -42,6 +42,7 @@ jobs:
  safety
  server
  shared
+ source-control
  test
  subjectPattern: ^(?![A-Z]).+$
  subjectPatternError: |

.skills/agent-zero-architecture/SKILL.md

@@ -12,7 +12,7 @@ Keep dependency direction explicit while changing the monorepo.
 - `shared`: stable contracts only, plus pure functions over them (evidence rendering, redaction, path predicates).
 - `config`: configuration, repository policy, and check discovery. Pure; the agent supplies what it read through the runner.
 - `models`: provider-independent model contracts and provider adapters.
-- `github`: GitHub-specific translation, event parsing, Checks API behavior, and issue-to-PR publication (branch and pull-request creation through the Git data API).
+- `source-control`: provider-neutral source-control contracts, webhook normalization, capability detection, and the GitHub, GitLab, Bitbucket, and Gitea adapters, including GitHub's issue-to-PR publication (branch and pull-request creation through the Git data API).
 - `runner`: command execution and checkout mutation boundary, plus the policy-to-boundary factory.
 - `agent`: orchestration, the lifecycle machine, and the validation policy.
 - `cli`: argument parsing and terminal presentation.
@@ -23,17 +23,17 @@ Keep dependency direction explicit while changing the monorepo.
 
 1. Read `AGENTS.md` and `docs/architecture.md`.
 2. Identify the narrowest package that owns the behavior.
-3. Check imports before adding a dependency. Core packages must not import CLI, HTTP, or GitHub adapters.
+3. Check imports before adding a dependency. Core packages must not import CLI, HTTP, or source-control adapters.
 4. Put a contract in `shared` only when at least two packages need a stable common type.
 5. Keep SDK-specific types inside their adapter.
 6. Add deterministic tests beside the changed source.
 7. Run the affected package checks, then the complete root checks.
 
 ## Reject these designs
 
-- Shell execution in a transport adapter, CLI presentation, GitHub adapter, model adapter, or agent state machine.
+- Shell execution in a transport adapter, CLI presentation, source-control adapter, model adapter, or agent state machine.
 - HTTP request/response types inside the runtime.
-- GitHub SDK objects passed through shared contracts.
+- Provider SDK or payload objects passed through shared contracts.
 - A generic `utils` package used to bypass ownership decisions.
 - Cross-package imports from another package's `src/` directory.
 - A capability package importing another capability package. When `runner` needs policy, it declares the fields it needs structurally instead of importing `config`.

AGENTS.md

@@ -24,7 +24,7 @@ These instructions apply to humans and coding agents working in this repository.
 - `packages/agent`: orchestration and state transitions only.
 - `packages/runner`: the only boundary allowed to execute repository commands or mutate a checkout.
 - `packages/models`: model-provider abstractions.
-- `packages/github`: GitHub event and API adapters.
+- `packages/source-control`: provider-neutral source-control contracts, with GitHub, GitLab, Bitbucket, and Gitea adapters underneath.
 - `packages/config`: configuration parsing and policy.
 - `packages/shared`: stable cross-package contracts.
 - `packages/cli`: argument parsing and terminal presentation.
@@ -33,7 +33,7 @@ These instructions apply to humans and coding agents working in this repository.
 - `apps/auth-server`: the only component that owns a persistence layer. Serves the Better Auth handler and nothing else.
 - `apps/dashboard`: frontend-only Nuxt operational dashboard. Presentation plus an authenticated client of `apps/auth-server`. No Nitro server routes, no persistence, no runtime-package imports.
 
-The runtime must remain independent from HTTP, GitHub, terminal UI, and specific model providers. Adapters depend on the runtime; the runtime must not depend on adapters. Authentication is an adapter concern: neither `packages/auth` nor `apps/auth-server` may import a runtime package, and neither may execute repository work.
+The runtime must remain independent from HTTP, source-control platforms, terminal UI, and specific model providers. Adapters depend on the runtime; the runtime must not depend on adapters. Authentication is an adapter concern: neither `packages/auth` nor `apps/auth-server` may import a runtime package, and neither may execute repository work.
 
 ## Safety and determinism
 

CONTRIBUTING.md

@@ -32,18 +32,18 @@ aube test
 
 ## Choose the right package
 
-| Change | Location |
-| -------------------------------- | ------------------ |
-| Agent lifecycle and decisions | `packages/agent` |
-| Commands and repository mutation | `packages/runner` |
-| LLM providers | `packages/models` |
-| GitHub adapters | `packages/github`  |
-| Configuration and policy | `packages/config` |
-| Shared contracts | `packages/shared` |
-| CLI parsing and presentation | `packages/cli` |
-| Authentication policy | `packages/auth` |
-| Authentication HTTP adapter | `apps/auth-server` |
-| Dashboard frontend | `apps/dashboard` |
+| Change | Location |
+| -------------------------------- | ------------------------- |
+| Agent lifecycle and decisions | `packages/agent` |
+| Commands and repository mutation | `packages/runner` |
+| LLM providers | `packages/models` |
+| Source-control provider adapters | `packages/source-control` |
+| Configuration and policy | `packages/config` |
+| Shared contracts | `packages/shared` |
+| CLI parsing and presentation | `packages/cli` |
+| Authentication policy | `packages/auth` |
+| Authentication HTTP adapter | `apps/auth-server` |
+| Dashboard frontend | `apps/dashboard` |
 
 Read [AGENTS.md](AGENTS.md) and the matching files in `.agents/skills/` before making architectural or safety-sensitive changes.
 

README.md

@@ -34,7 +34,7 @@ Feedback is never treated as truth merely because it came from a human or an AI
 ## Architecture
 
 ```text
-GitHub adapter / CLI
+Source-control adapters (GitHub, GitLab, Bitbucket, Gitea) / CLI
  │
  ▼
  Agent state machine
@@ -49,19 +49,19 @@ oRPC control plane ─── typed task API, persistence, and scheduling
 Nuxt dashboard ─── frontend-only operational interface ─── auth adapter ─── session store
 ```
 
-| Package | Responsibility |
-| ---------------------------------------- | --------------------------------------------------------------- |
-| [`packages/agent`](./packages/agent) | Orchestration and state transitions |
-| [`packages/runner`](./packages/runner) | The only boundary that executes commands or mutates a checkout |
-| [`packages/models`](./packages/models) | Model-provider abstractions |
-| [`packages/github`](./packages/github) | GitHub event and API adapters  |
-| [`packages/config`](./packages/config) | Configuration parsing and policy |
-| [`packages/shared`](./packages/shared) | Stable cross-package contracts |
-| [`packages/cli`](./packages/cli) | Argument parsing and terminal presentation |
-| [`packages/auth`](./packages/auth) | Authentication policy and the Better Auth instance |
-| [`apps/server`](./apps/server) | oRPC control-plane transport and composition root |
-| [`apps/auth-server`](./apps/auth-server) | Standalone auth adapter; the only component with a database |
-| [`apps/dashboard`](./apps/dashboard) | Nuxt operational dashboard, authenticated client of the adapter |
+| Package | Responsibility |
+| ------------------------------------------------------ | ----------------------------------------------------------------------------------------- |
+| [`packages/agent`](./packages/agent) | Orchestration and state transitions |
+| [`packages/runner`](./packages/runner) | The only boundary that executes commands or mutates a checkout |
+| [`packages/models`](./packages/models) | Model-provider abstractions |
+| [`packages/source-control`](./packages/source-control) | Provider-neutral source-control contracts and adapters (GitHub, GitLab, Bitbucket, Gitea) |
+| [`packages/config`](./packages/config) | Configuration parsing and policy |
+| [`packages/shared`](./packages/shared) | Stable cross-package contracts |
+| [`packages/cli`](./packages/cli) | Argument parsing and terminal presentation |
+| [`packages/auth`](./packages/auth) | Authentication policy and the Better Auth instance |
+| [`apps/server`](./apps/server) | oRPC control-plane transport and composition root |
+| [`apps/auth-server`](./apps/auth-server) | Standalone auth adapter; the only component with a database |
+| [`apps/dashboard`](./apps/dashboard) | Nuxt operational dashboard, authenticated client of the adapter |
 
 Adapters depend on the runtime; the runtime never depends on adapters. See [docs/architecture.md](./docs/architecture.md) for the full dependency rules.
 

apps/server/package.json

@@ -14,10 +14,10 @@
  "dependencies": {
  "@agent-zero/agent": "workspace:*",
  "@agent-zero/config": "workspace:*",
- "@agent-zero/github": "workspace:*",
  "@agent-zero/models": "workspace:*",
  "@agent-zero/runner": "workspace:*",
  "@agent-zero/shared": "workspace:*",
+ "@agent-zero/source-control": "workspace:*",
  "@orpc/server": "2.0.0-beta.26",
  "nitro": "^3.0.260610-beta",
  "vite-hub": "^0.0.3",

apps/server/server/routes/webhooks/github.post.ts

@@ -9,12 +9,13 @@ import { deliveryClaimStore, taskStore } from '../../utils/store.js';
 /**
  * The production GitHub webhook entry point at `POST /webhooks/github`.
  *
- * This route only adapts transport: it maps headers and body onto the webhook contract and
- * injects the deployment's durable stores. Signature verification, policy checks, delivery
- * claims, and everything that can execute repository work stay behind `ingestWebhook`, and the
- * durable `deliveryClaimStore` is what lets a redelivered issue event observe the recorded
- * outcome across restarts and other instances instead of starting a duplicate run. Without a
- * configured secret or checkout the route fails closed and ingests nothing.
+ * This route only adapts transport: it maps headers and body onto the provider-neutral webhook
+ * contract and injects the deployment's durable stores. Signature verification, provider
+ * routing, policy checks, delivery claims, and everything that can execute repository work stay
+ * behind `ingestWebhook`, and the durable `deliveryClaimStore` is what lets a redelivered issue
+ * event observe the recorded outcome across restarts and other instances instead of starting a
+ * duplicate run. Without a configured secret or checkout the route fails closed and ingests
+ * nothing.
  */
 const route: EventHandlerWithFetch = defineHandler(async (event) => {
  try {
@@ -23,16 +24,13 @@ const route: EventHandlerWithFetch = defineHandler(async (event) => {
  const checkoutPath = process.env.AGENT_ZERO_CHECKOUT_PATH;
  if (!checkoutPath) return json(503, { error: 'AGENT_ZERO_CHECKOUT_PATH is not configured' });
 
- const delivery = event.req.headers.get('x-github-delivery');
  const outcome = await ingestWebhook(
  {
- event: event.req.headers.get('x-github-event') ?? '',
  body: await event.req.text(),
- signature: event.req.headers.get('x-hub-signature-256') ?? undefined,
- ...(delivery ? { delivery } : {}),
+ headers: Object.fromEntries(event.req.headers.entries()),
  },
  {
- secret,
+providers: [{ kind: 'github', secret }],
  checkoutPath,
  store: taskStore,
  deliveryClaims: deliveryClaimStore,

apps/server/src/index.ts

@@ -12,11 +12,13 @@ export {
  publishEvidence,
  publishIssueValidation,
  runTask,
+ statusTokenFromEnvironment,
  taskInput,
  tasks,
  type IssuePullRequestOutcome,
  type IssueValidationOutcome,
  type OpenIssuePullRequestOptions,
+ type ProviderWebhookConfig,
  type PublishIssueValidationOptions,
  type PublishOptions,
  type RunTaskOptions,