@zereight/mcp-gitlab 2.0.22 → 2.0.24

package/build/index.js

@@ -1,28 +1,46 @@
 #!/usr/bin/env node
+// Parse CLI arguments
+const args = process.argv.slice(2);
+const cliArgs = {};
+for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg.startsWith('--')) {
+        const [key, value] = arg.slice(2).split('=');
+        if (value) {
+            cliArgs[key] = value;
+        }
+        else if (i + 1 < args.length && !args[i + 1].startsWith('--')) {
+            cliArgs[key] = args[++i];
+        }
+    }
+}
+function getConfig(cliKey, envKey, defaultValue) {
+    return cliArgs[cliKey] || process.env[envKey] || defaultValue;
+}
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage } from "node:async_hooks";
 import express from "express";
 import fetchCookie from "fetch-cookie";
-import fs from "fs";
+import fs from "node:fs";
+import os from "node:os";
 import { HttpProxyAgent } from "http-proxy-agent";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import nodeFetch from "node-fetch";
-import path, { dirname } from "path";
+import path, { dirname } from "node:path";
 import { SocksProxyAgent } from "socks-proxy-agent";
 import { CookieJar, parse as parseCookie } from "tough-cookie";
-import { fileURLToPath } from "url";
+import { fileURLToPath, URL } from "node:url";
 import { z } from "zod";
 import { zodToJsonSchema } from "zod-to-json-schema";
 import { initializeOAuth } from "./oauth.js";
 import { GitLabClientPool } from "./gitlab-client-pool.js";
 // Add type imports for proxy agents
-import { Agent } from "http";
-import { Agent as HttpsAgent } from "https";
-import { URL } from "url";
+import { Agent } from "node:http";
+import { Agent as HttpsAgent } from "node:https";
 import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateLabelSchema, // Added
 CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateWikiPageSchema, DeleteDraftNoteSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, 
 // pipeline job schemas
@@ -32,8 +50,8 @@ GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
 GitLabDraftNoteSchema, GitLabForkSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabTreeSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
-ListMergeRequestDiscussionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListPipelineTriggerJobsSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, MarkdownUploadSchema, DownloadAttachmentSchema, MergeMergeRequestSchema, MyIssuesSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema } from "./schemas.js";
-import { randomUUID } from "crypto";
+ListMergeRequestDiscussionsSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListPipelineTriggerJobsSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, MarkdownUploadSchema, DownloadAttachmentSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, } from "./schemas.js";
+import { randomUUID } from "node:crypto";
 import { pino } from "pino";
 const logger = pino({
     level: process.env.LOG_LEVEL || "info",
@@ -68,8 +86,8 @@ try {
         SERVER_VERSION = packageJson.version || SERVER_VERSION;
     }
 }
-catch (error) {
-    // Warning: Could not read version from package.json - silently continue
+catch {
+    // Intentionally ignored: version read failure is non-critical
 }
 const server = new Server({
     name: "better-gitlab-mcp-server",
@@ -87,9 +105,9 @@ function validateConfiguration() {
     // Validate SESSION_TIMEOUT_SECONDS
     const timeoutStr = process.env.SESSION_TIMEOUT_SECONDS;
     if (timeoutStr) {
-        const timeout = parseInt(timeoutStr);
+        const timeout = Number.parseInt(timeoutStr, 10);
         // Allow values >=1 for testing purposes, but recommend 60-86400 for production
-        if (isNaN(timeout) || timeout < 1 || timeout > 86400) {
+        if (Number.isNaN(timeout) || timeout < 1 || timeout > 86400) {
             errors.push(`SESSION_TIMEOUT_SECONDS must be between 1 and 86400 seconds, got: ${timeoutStr}`);
         }
         if (timeout < 60) {
@@ -99,80 +117,85 @@ function validateConfiguration() {
     // Validate MAX_SESSIONS
     const maxSessionsStr = process.env.MAX_SESSIONS;
     if (maxSessionsStr) {
-        const maxSessions = parseInt(maxSessionsStr);
-        if (isNaN(maxSessions) || maxSessions < 1 || maxSessions > 10000) {
+        const maxSessions = Number.parseInt(maxSessionsStr, 10);
+        if (Number.isNaN(maxSessions) || maxSessions < 1 || maxSessions > 10000) {
             errors.push(`MAX_SESSIONS must be between 1 and 10000, got: ${maxSessionsStr}`);
         }
     }
     // Validate MAX_REQUESTS_PER_MINUTE
     const maxReqStr = process.env.MAX_REQUESTS_PER_MINUTE;
     if (maxReqStr) {
-        const maxReq = parseInt(maxReqStr);
-        if (isNaN(maxReq) || maxReq < 1 || maxReq > 1000) {
+        const maxReq = Number.parseInt(maxReqStr, 10);
+        if (Number.isNaN(maxReq) || maxReq < 1 || maxReq > 1000) {
             errors.push(`MAX_REQUESTS_PER_MINUTE must be between 1 and 1000, got: ${maxReqStr}`);
         }
     }
     // Validate PORT
-    const portStr = process.env.PORT;
+    const portStr = getConfig('port', 'PORT');
     if (portStr) {
-        const port = parseInt(portStr);
-        if (isNaN(port) || port < 1 || port > 65535) {
+        const port = Number.parseInt(portStr, 10);
+        if (Number.isNaN(port) || port < 1 || port > 65535) {
             errors.push(`PORT must be between 1 and 65535, got: ${portStr}`);
         }
     }
     // Validate GITLAB_API_URL format
-    const apiUrls = process.env.GITLAB_API_URL?.split(',') || [];
+    const apiUrls = getConfig('api-url', 'GITLAB_API_URL')?.split(",") || [];
     if (apiUrls.length > 0) {
         for (const url of apiUrls) {
             try {
                 new URL(url.trim());
             }
-            catch (error) {
+            catch {
                 errors.push(`GITLAB_API_URL contains an invalid URL: ${url.trim()}`);
             }
         }
     }
     // Validate auth configuration
-    const remoteAuth = process.env.REMOTE_AUTHORIZATION === "true";
-    const useOAuth = process.env.GITLAB_USE_OAUTH === "true";
-    const hasToken = !!process.env.GITLAB_PERSONAL_ACCESS_TOKEN;
-    const hasCookie = !!process.env.GITLAB_AUTH_COOKIE_PATH;
+    const remoteAuth = getConfig('remote-auth', 'REMOTE_AUTHORIZATION') === "true";
+    const useOAuth = getConfig('use-oauth', 'GITLAB_USE_OAUTH') === "true";
+    const hasToken = !!getConfig('token', 'GITLAB_PERSONAL_ACCESS_TOKEN');
+    const hasCookie = !!getConfig('cookie-path', 'GITLAB_AUTH_COOKIE_PATH');
     if (!remoteAuth && !useOAuth && !hasToken && !hasCookie) {
-        errors.push('Either GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_AUTH_COOKIE_PATH, GITLAB_USE_OAUTH=true, or REMOTE_AUTHORIZATION=true must be set');
+        errors.push('Either --token, --cookie-path, --use-oauth=true, or --remote-auth=true must be set (or use environment variables)');
     }
-    if (ENABLE_DYNAMIC_API_URL && !REMOTE_AUTHORIZATION) {
-        errors.push('ENABLE_DYNAMIC_API_URL=true requires REMOTE_AUTHORIZATION=true');
+    const enableDynamicApiUrl = getConfig('enable-dynamic-api-url', 'ENABLE_DYNAMIC_API_URL') === "true";
+    if (enableDynamicApiUrl && !remoteAuth) {
+        errors.push("ENABLE_DYNAMIC_API_URL=true requires REMOTE_AUTHORIZATION=true");
     }
     if (errors.length > 0) {
-        logger.error('Configuration validation failed:');
+        logger.error("Configuration validation failed:");
         errors.forEach(err => logger.error(`  - ${err}`));
         process.exit(1);
     }
-    logger.info('Configuration validation passed');
+    logger.info("Configuration validation passed");
 }
-const GITLAB_PERSONAL_ACCESS_TOKEN = process.env.GITLAB_PERSONAL_ACCESS_TOKEN;
+const GITLAB_PERSONAL_ACCESS_TOKEN = getConfig('token', 'GITLAB_PERSONAL_ACCESS_TOKEN');
 let OAUTH_ACCESS_TOKEN = null;
-const GITLAB_AUTH_COOKIE_PATH = process.env.GITLAB_AUTH_COOKIE_PATH;
-const USE_OAUTH = process.env.GITLAB_USE_OAUTH === "true";
-const IS_OLD = process.env.GITLAB_IS_OLD === "true";
-const GITLAB_READ_ONLY_MODE = process.env.GITLAB_READ_ONLY_MODE === "true";
-const GITLAB_DENIED_TOOLS_REGEX = process.env.GITLAB_DENIED_TOOLS_REGEX ? new RegExp(process.env.GITLAB_DENIED_TOOLS_REGEX) : undefined;
-const USE_GITLAB_WIKI = process.env.USE_GITLAB_WIKI === "true";
-const USE_MILESTONE = process.env.USE_MILESTONE === "true";
-const USE_PIPELINE = process.env.USE_PIPELINE === "true";
-const SSE = process.env.SSE === "true";
-const STREAMABLE_HTTP = process.env.STREAMABLE_HTTP === "true";
-const REMOTE_AUTHORIZATION = process.env.REMOTE_AUTHORIZATION === "true";
-const ENABLE_DYNAMIC_API_URL = process.env.ENABLE_DYNAMIC_API_URL === "true";
-const SESSION_TIMEOUT_SECONDS = process.env.SESSION_TIMEOUT_SECONDS ? parseInt(process.env.SESSION_TIMEOUT_SECONDS) : 3600;
-const HOST = process.env.HOST || "127.0.0.1";
-const PORT = process.env.PORT || 3002;
+const GITLAB_AUTH_COOKIE_PATH = getConfig('cookie-path', 'GITLAB_AUTH_COOKIE_PATH');
+const USE_OAUTH = getConfig('use-oauth', 'GITLAB_USE_OAUTH') === "true";
+const IS_OLD = getConfig('is-old', 'GITLAB_IS_OLD') === "true";
+const GITLAB_READ_ONLY_MODE = getConfig('read-only', 'GITLAB_READ_ONLY_MODE') === "true";
+const GITLAB_DENIED_TOOLS_REGEX = getConfig('denied-tools-regex', 'GITLAB_DENIED_TOOLS_REGEX')
+    ? new RegExp(getConfig('denied-tools-regex', 'GITLAB_DENIED_TOOLS_REGEX'))
+    : undefined;
+const USE_GITLAB_WIKI = getConfig('use-wiki', 'USE_GITLAB_WIKI') === "true";
+const USE_MILESTONE = getConfig('use-milestone', 'USE_MILESTONE') === "true";
+const USE_PIPELINE = getConfig('use-pipeline', 'USE_PIPELINE') === "true";
+const SSE = getConfig('sse', 'SSE') === "true";
+const STREAMABLE_HTTP = getConfig('streamable-http', 'STREAMABLE_HTTP') === "true";
+const REMOTE_AUTHORIZATION = getConfig('remote-auth', 'REMOTE_AUTHORIZATION') === "true";
+const ENABLE_DYNAMIC_API_URL = getConfig('enable-dynamic-api-url', 'ENABLE_DYNAMIC_API_URL') === "true";
+const SESSION_TIMEOUT_SECONDS = Number.parseInt(getConfig('session-timeout', 'SESSION_TIMEOUT_SECONDS', '3600'), 10);
+const HOST = getConfig('host', 'HOST') || '127.0.0.1';
+const PORT = Number.parseInt(getConfig('port', 'PORT', '3002'), 10);
 // Add proxy configuration
-const HTTP_PROXY = process.env.HTTP_PROXY;
-const HTTPS_PROXY = process.env.HTTPS_PROXY;
-const NODE_TLS_REJECT_UNAUTHORIZED = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-const GITLAB_CA_CERT_PATH = process.env.GITLAB_CA_CERT_PATH;
-const GITLAB_POOL_MAX_SIZE = process.env.GITLAB_POOL_MAX_SIZE ? parseInt(process.env.GITLAB_POOL_MAX_SIZE) : 100;
+const HTTP_PROXY = getConfig('http-proxy', 'HTTP_PROXY');
+const HTTPS_PROXY = getConfig('https-proxy', 'HTTPS_PROXY');
+const NODE_TLS_REJECT_UNAUTHORIZED = getConfig('tls-reject-unauthorized', 'NODE_TLS_REJECT_UNAUTHORIZED');
+const GITLAB_CA_CERT_PATH = getConfig('ca-cert-path', 'GITLAB_CA_CERT_PATH');
+const GITLAB_POOL_MAX_SIZE = getConfig('pool-max-size', 'GITLAB_POOL_MAX_SIZE')
+    ? Number.parseInt(getConfig('pool-max-size', 'GITLAB_POOL_MAX_SIZE'), 10)
+    : 100;
 let sslOptions = undefined;
 if (NODE_TLS_REJECT_UNAUTHORIZED === "0") {
     sslOptions = { rejectUnauthorized: false };
@@ -204,7 +227,9 @@ httpsAgent = httpsAgent || new HttpsAgent(sslOptions);
 httpAgent = httpAgent || new Agent();
 // Initialize the client pool for managing multiple GitLab instances
 const clientPool = new GitLabClientPool({
-    apiUrls: (process.env.GITLAB_API_URL || "https://gitlab.com").split(',').map(normalizeGitLabApiUrl),
+    apiUrls: (process.env.GITLAB_API_URL || "https://gitlab.com")
+        .split(",")
+        .map(normalizeGitLabApiUrl),
     httpProxy: HTTP_PROXY,
     httpsProxy: HTTPS_PROXY,
     rejectUnauthorized: NODE_TLS_REJECT_UNAUTHORIZED !== "0",
@@ -212,73 +237,113 @@ const clientPool = new GitLabClientPool({
     poolMaxSize: GITLAB_POOL_MAX_SIZE,
 });
 // Create cookie jar with clean Netscape file parsing
-const createCookieJar = () => {
-    if (!GITLAB_AUTH_COOKIE_PATH)
+// Resolve cookie path once using os.homedir() for cross-platform support
+const resolvedCookiePath = GITLAB_AUTH_COOKIE_PATH
+    ? GITLAB_AUTH_COOKIE_PATH.startsWith("~/")
+        ? path.join(os.homedir(), GITLAB_AUTH_COOKIE_PATH.slice(2))
+        : GITLAB_AUTH_COOKIE_PATH
+    : null;
+const createCookieJar = async () => {
+    if (!resolvedCookiePath)
         return null;
+    let cookieContent;
     try {
-        const cookiePath = GITLAB_AUTH_COOKIE_PATH.startsWith("~/")
-            ? path.join(process.env.HOME || "", GITLAB_AUTH_COOKIE_PATH.slice(2))
-            : GITLAB_AUTH_COOKIE_PATH;
-        const jar = new CookieJar();
-        const cookieContent = fs.readFileSync(cookiePath, "utf8");
-        cookieContent.split("\n").forEach(line => {
-            // Handle #HttpOnly_ prefix
-            if (line.startsWith("#HttpOnly_")) {
-                line = line.slice(10);
-            }
-            // Skip comments and empty lines
-            if (line.startsWith("#") || !line.trim()) {
-                return;
-            }
-            // Parse Netscape format: domain, flag, path, secure, expires, name, value
-            const parts = line.split("\t");
-            if (parts.length >= 7) {
-                const [domain, , path, secure, expires, name, value] = parts;
-                // Build cookie string in standard format
-                const cookieStr = `${name}=${value}; Domain=${domain}; Path=${path}${secure === "TRUE" ? "; Secure" : ""}${expires !== "0" ? `; Expires=${new Date(parseInt(expires) * 1000).toUTCString()}` : ""}`;
-                // Use tough-cookie's parse function for robust parsing
-                const cookie = parseCookie(cookieStr);
-                if (cookie) {
-                    const url = `${secure === "TRUE" ? "https" : "http"}://${domain.startsWith(".") ? domain.slice(1) : domain}`;
-                    jar.setCookieSync(cookie, url);
-                }
-            }
-        });
-        return jar;
+        cookieContent = await fs.promises.readFile(resolvedCookiePath, "utf8");
     }
     catch (error) {
-        logger.error("Error loading cookie file:", error);
+        logger.error({ error, path: resolvedCookiePath }, "Failed to read cookie file");
         return null;
     }
+    const jar = new CookieJar();
+    for (let line of cookieContent.split("\n")) {
+        // Handle #HttpOnly_ prefix
+        if (line.startsWith("#HttpOnly_")) {
+            line = line.slice(10);
+        }
+        // Skip comments and empty lines
+        if (line.startsWith("#") || !line.trim()) {
+            continue;
+        }
+        // Parse Netscape format: domain, flag, path, secure, expires, name, value
+        const parts = line.split("\t");
+        if (parts.length >= 7) {
+            const [domain, , cookiePath, secure, expires, name, value] = parts;
+            // Build cookie string in standard format
+            const secureFlag = secure === "TRUE" ? "; Secure" : "";
+            const expiresFlag = expires === "0"
+                ? ""
+                : `; Expires=${new Date(Number.parseInt(expires, 10) * 1000).toUTCString()}`;
+            const cookieStr = `${name}=${value}; Domain=${domain}; Path=${cookiePath}${secureFlag}${expiresFlag}`;
+            // Use tough-cookie's parse function for robust parsing
+            const cookie = parseCookie(cookieStr);
+            if (cookie) {
+                const url = `${secure === "TRUE" ? "https" : "http"}://${domain.startsWith(".") ? domain.slice(1) : domain}`;
+                jar.setCookieSync(cookie, url);
+            }
+        }
+    }
+    return jar;
 };
-// Initialize cookie jar and fetch
-const cookieJar = createCookieJar();
-const fetch = cookieJar ? fetchCookie(nodeFetch, cookieJar) : nodeFetch;
-// Ensure session is established for the current request
-async function ensureSessionForRequest() {
-    if (!cookieJar || !GITLAB_AUTH_COOKIE_PATH)
+// Cookie jar and fetch - reloaded when cookie file changes
+let cookieJar = null;
+let fetch = nodeFetch;
+let lastCookieMtime = 0;
+let cookieReloadLock = null; // Mutex to prevent parallel reloads
+// Auth proxies may redirect and set cookies on the first request. We make a throwaway
+// request so subsequent requests have the correct cookies. Reset when cookies reload.
+let initialSessionRequestMade = false;
+// Cookie jar is loaded on first request via reloadCookiesIfChanged (lastCookieMtime=0 triggers load)
+async function reloadCookiesIfChanged() {
+    if (!resolvedCookiePath)
         return;
-    // Extract the base URL from GITLAB_API_URL
-    const apiUrl = new URL(GITLAB_API_URL);
-    const baseUrl = `${apiUrl.protocol}//${apiUrl.hostname}`;
-    // Check if we already have GitLab session cookies
-    const gitlabCookies = cookieJar.getCookiesSync(baseUrl);
-    const hasSessionCookie = gitlabCookies.some(cookie => cookie.key === "_gitlab_session" || cookie.key === "remember_user_token");
-    if (!hasSessionCookie) {
+    if (cookieReloadLock)
+        return cookieReloadLock;
+    cookieReloadLock = (async () => {
         try {
-            // Establish session with a lightweight request
-            await fetch(`${GITLAB_API_URL}/user`, {
-                ...getFetchConfig(),
-                redirect: "follow",
-            }).catch(() => {
-                // Ignore errors - the important thing is that cookies get set during redirects
-            });
-            // Small delay to ensure cookies are fully processed
-            await new Promise(resolve => setTimeout(resolve, 100));
+            const mtime = (await fs.promises.stat(resolvedCookiePath)).mtimeMs;
+            if (mtime !== lastCookieMtime) {
+                logger.info({ oldMtime: lastCookieMtime, newMtime: mtime }, lastCookieMtime === 0 ? "Loading cookie file" : "Cookie file changed, reloading");
+                lastCookieMtime = mtime;
+                const newJar = await createCookieJar();
+                cookieJar = newJar;
+                fetch = newJar ? fetchCookie(nodeFetch, newJar) : nodeFetch;
+                initialSessionRequestMade = false;
+            }
         }
-        catch (error) {
-            // Ignore session establishment errors
+        catch {
+            // File deleted or inaccessible - clear cached cookies
+            if (cookieJar) {
+                logger.info("Cookie file removed, clearing cached cookies");
+                cookieJar = null;
+                fetch = nodeFetch;
+                lastCookieMtime = 0;
+                initialSessionRequestMade = false;
+            }
         }
+    })();
+    try {
+        await cookieReloadLock;
+    }
+    finally {
+        cookieReloadLock = null;
+    }
+}
+async function ensureSessionForRequest() {
+    if (!resolvedCookiePath)
+        return;
+    await reloadCookiesIfChanged();
+    if (!cookieJar || initialSessionRequestMade)
+        return;
+    try {
+        const response = await fetch(`${getEffectiveApiUrl()}/user`, {
+            ...getFetchConfig(),
+            redirect: "follow",
+        });
+        // 401 means auth failed but the request completed - cookies were still exchanged
+        initialSessionRequestMade = response.ok || response.status === 401;
+    }
+    catch {
+        logger.debug("Session warmup request failed, will retry on next request");
     }
 }
 const sessionAuthStore = new AsyncLocalStorage();
@@ -299,9 +364,9 @@ function buildAuthHeaders() {
     if (REMOTE_AUTHORIZATION) {
         const ctx = sessionAuthStore.getStore();
         logger.debug({ context: ctx }, "buildAuthHeaders: session context");
-        if (ctx && ctx.token) {
+        if (ctx?.token) {
             return {
-                [ctx.header]: ctx.header === 'Authorization' ? `Bearer ${ctx.token}` : ctx.token
+                [ctx.header]: ctx.header === "Authorization" ? `Bearer ${ctx.token}` : ctx.token,
             };
         }
         return {}; // No auth headers if no session context
@@ -309,7 +374,7 @@ function buildAuthHeaders() {
     // Standard mode: prioritize OAuth token, then fall back to environment token
     const token = OAUTH_ACCESS_TOKEN || GITLAB_PERSONAL_ACCESS_TOKEN;
     if (IS_OLD && token) {
-        return { 'Private-Token': String(token) };
+        return { "Private-Token": String(token) };
     }
     if (token) {
         return { Authorization: `Bearer ${token}` };
@@ -324,7 +389,7 @@ function buildAuthHeaders() {
 function getEffectiveApiUrl() {
     if (ENABLE_DYNAMIC_API_URL) {
         const ctx = sessionAuthStore.getStore();
-        if (ctx && ctx.apiUrl) {
+        if (ctx?.apiUrl) {
             return ctx.apiUrl;
         }
         logger.warn({ ctx }, "getEffectiveApiUrl: No context or apiUrl found, falling back to default");
@@ -349,7 +414,46 @@ const getFetchConfig = () => {
         agent: agent,
     };
 };
-const toJSONSchema = (schema) => zodToJsonSchema(schema, { $refStrategy: 'none' });
+const toJSONSchema = (schema) => {
+    const jsonSchema = zodToJsonSchema(schema, { $refStrategy: 'none' });
+    // Post-process to fix nullable/optional fields that should truly be optional
+    function fixNullableOptional(obj) {
+        if (obj && typeof obj === 'object') {
+            // If this object has properties, process them
+            if (obj.properties) {
+                const requiredSet = new Set(obj.required || []);
+                Object.keys(obj.properties).forEach(key => {
+                    const prop = obj.properties[key];
+                    // Handle fields that can be null or omitted
+                    // If a property has type: ["object", "null"] or anyOf with null, it should not be required
+                    if (prop.anyOf && prop.anyOf.some((t) => t.type === 'null')) {
+                        requiredSet.delete(key);
+                    }
+                    else if (Array.isArray(prop.type) && prop.type.includes('null')) {
+                        requiredSet.delete(key);
+                    }
+                    // Recursively process nested objects
+                    obj.properties[key] = fixNullableOptional(prop);
+                });
+                // Normalize the required array after processing all properties
+                if (requiredSet.size > 0) {
+                    obj.required = Array.from(requiredSet);
+                }
+                else if (Object.prototype.hasOwnProperty.call(obj, 'required')) {
+                    delete obj.required;
+                }
+            }
+            // Process anyOf/allOf/oneOf
+            ['anyOf', 'allOf', 'oneOf'].forEach(combiner => {
+                if (obj[combiner]) {
+                    obj[combiner] = obj[combiner].map(fixNullableOptional);
+                }
+            });
+        }
+        return obj;
+    }
+    return fixNullableOptional(jsonSchema);
+};
 // Define all available tools
 const allTools = [
     {
@@ -357,6 +461,21 @@ const allTools = [
         description: "Merge a merge request in a GitLab project",
         inputSchema: toJSONSchema(MergeMergeRequestSchema),
     },
+    {
+        name: "approve_merge_request",
+        description: "Approve a merge request. Requires appropriate permissions.",
+        inputSchema: toJSONSchema(ApproveMergeRequestSchema),
+    },
+    {
+        name: "unapprove_merge_request",
+        description: "Unapprove a previously approved merge request. Requires appropriate permissions.",
+        inputSchema: toJSONSchema(UnapproveMergeRequestSchema),
+    },
+    {
+        name: "get_merge_request_approval_state",
+        description: "Get the approval state of a merge request including approval rules and who has approved",
+        inputSchema: toJSONSchema(GetMergeRequestApprovalStateSchema),
+    },
     {
         name: "execute_graphql",
         description: "Execute a GitLab GraphQL query",
@@ -422,6 +541,16 @@ const allTools = [
         description: "List merge request diffs with pagination support (Either mergeRequestIid or branchName must be provided)",
         inputSchema: toJSONSchema(ListMergeRequestDiffsSchema),
     },
+    {
+        name: "list_merge_request_versions",
+        description: "List all versions of a merge request",
+        inputSchema: toJSONSchema(ListMergeRequestVersionsSchema),
+    },
+    {
+        name: "get_merge_request_version",
+        description: "Get a specific version of a merge request",
+        inputSchema: toJSONSchema(GetMergeRequestVersionSchema),
+    },
     {
         name: "get_branch_diffs",
         description: "Get the changes/diffs between two branches or commits in a GitLab project",
@@ -443,7 +572,7 @@ const allTools = [
         inputSchema: toJSONSchema(CreateMergeRequestThreadSchema),
     },
     {
-        name: 'resolve_merge_request_thread',
+        name: "resolve_merge_request_thread",
         description: "Resolve a thread on a merge request",
         inputSchema: toJSONSchema(ResolveMergeRequestThreadSchema),
     },
@@ -483,7 +612,7 @@ const allTools = [
         inputSchema: toJSONSchema(GetMergeRequestNoteSchema),
     },
     {
-        name: 'get_merge_request_notes',
+        name: "get_merge_request_notes",
         description: "List notes for a merge request",
         inputSchema: toJSONSchema(GetMergeRequestNotesSchema),
     },
@@ -869,12 +998,14 @@ const allTools = [
     },
 ];
 // Define which tools are read-only
-const readOnlyTools = [
+const readOnlyTools = new Set([
     "search_repositories",
     "execute_graphql",
     "get_file_contents",
     "get_merge_request",
     "get_merge_request_diffs",
+    "list_merge_request_versions",
+    "get_merge_request_version",
     "get_branch_diffs",
     "mr_discussions",
     "list_issues",
@@ -919,18 +1050,19 @@ const readOnlyTools = [
     "list_releases",
     "get_release",
     "download_release_asset",
-];
+    "get_merge_request_approval_state",
+]);
 // Define which tools are related to wiki and can be toggled by USE_GITLAB_WIKI
-const wikiToolNames = [
+const wikiToolNames = new Set([
     "list_wiki_pages",
     "get_wiki_page",
     "create_wiki_page",
     "update_wiki_page",
     "delete_wiki_page",
     "upload_wiki_attachment",
-];
+]);
 // Define which tools are related to milestones and can be toggled by USE_MILESTONE
-const milestoneToolNames = [
+const milestoneToolNames = new Set([
     "list_milestones",
     "get_milestone",
     "create_milestone",
@@ -940,9 +1072,9 @@ const milestoneToolNames = [
     "get_milestone_merge_requests",
     "promote_milestone",
     "get_milestone_burndown_events",
-];
+]);
 // Define which tools are related to pipelines and can be toggled by USE_PIPELINE
-const pipelineToolNames = [
+const pipelineToolNames = new Set([
     "list_pipelines",
     "get_pipeline",
     "list_pipeline_jobs",
@@ -955,7 +1087,7 @@ const pipelineToolNames = [
     "play_pipeline_job",
     "retry_pipeline_job",
     "cancel_pipeline_job",
-];
+]);
 /**
  * Smart URL handling for GitLab API
  *
@@ -976,11 +1108,17 @@ function normalizeGitLabApiUrl(url) {
     return normalizedUrl;
 }
 // Use the normalizeGitLabApiUrl function to handle various URL formats
-const GITLAB_API_URLS = (process.env.GITLAB_API_URL || "https://gitlab.com").split(',').map(normalizeGitLabApiUrl);
+const GITLAB_API_URLS = (process.env.GITLAB_API_URL || "https://gitlab.com")
+    .split(",")
+    .map(normalizeGitLabApiUrl);
 const GITLAB_API_URL = GITLAB_API_URLS[0];
 const GITLAB_PROJECT_ID = process.env.GITLAB_PROJECT_ID;
-const GITLAB_ALLOWED_PROJECT_IDS = process.env.GITLAB_ALLOWED_PROJECT_IDS?.split(',').map(id => id.trim()).filter(Boolean) || [];
-const GITLAB_COMMIT_FILES_PER_PAGE = process.env.GITLAB_COMMIT_FILES_PER_PAGE ? parseInt(process.env.GITLAB_COMMIT_FILES_PER_PAGE) : 20;
+const GITLAB_ALLOWED_PROJECT_IDS = process.env.GITLAB_ALLOWED_PROJECT_IDS?.split(",")
+    .map(id => id.trim())
+    .filter(Boolean) || [];
+const GITLAB_COMMIT_FILES_PER_PAGE = process.env.GITLAB_COMMIT_FILES_PER_PAGE
+    ? Number.parseInt(process.env.GITLAB_COMMIT_FILES_PER_PAGE, 10)
+    : 20;
 // Validate authentication configuration
 if (REMOTE_AUTHORIZATION) {
     // Remote authorization mode: token comes from HTTP headers
@@ -1037,11 +1175,11 @@ function getEffectiveProjectId(projectId) {
         }
         // If a project ID is provided, check if it's in the whitelist
         if (projectId && !GITLAB_ALLOWED_PROJECT_IDS.includes(projectId)) {
-            throw new Error(`Access denied: Project ${projectId} is not in the allowed project list: ${GITLAB_ALLOWED_PROJECT_IDS.join(', ')}`);
+            throw new Error(`Access denied: Project ${projectId} is not in the allowed project list: ${GITLAB_ALLOWED_PROJECT_IDS.join(", ")}`);
         }
         // If no project ID provided but we have multiple allowed projects, require an explicit choice
         if (!projectId && GITLAB_ALLOWED_PROJECT_IDS.length > 1) {
-            throw new Error(`Multiple projects allowed (${GITLAB_ALLOWED_PROJECT_IDS.join(', ')}). Please specify a project ID.`);
+            throw new Error(`Multiple projects allowed (${GITLAB_ALLOWED_PROJECT_IDS.join(", ")}). Please specify a project ID.`);
         }
         return projectId || GITLAB_ALLOWED_PROJECT_IDS[0];
     }
@@ -1473,18 +1611,22 @@ async function listDiscussions(projectId, resourceType, resourceIid, options = {
     // Extract pagination headers
     const pagination = {
         x_next_page: response.headers.get("x-next-page")
-            ? parseInt(response.headers.get("x-next-page"))
+            ? Number.parseInt(response.headers.get("x-next-page"), 10)
             : null,
-        x_page: response.headers.get("x-page") ? parseInt(response.headers.get("x-page")) : undefined,
+        x_page: response.headers.get("x-page")
+            ? Number.parseInt(response.headers.get("x-page"), 10)
+            : undefined,
         x_per_page: response.headers.get("x-per-page")
-            ? parseInt(response.headers.get("x-per-page"))
+            ? Number.parseInt(response.headers.get("x-per-page"), 10)
             : undefined,
         x_prev_page: response.headers.get("x-prev-page")
-            ? parseInt(response.headers.get("x-prev-page"))
+            ? Number.parseInt(response.headers.get("x-prev-page"), 10)
+            : null,
+        x_total: response.headers.get("x-total")
+            ? Number.parseInt(response.headers.get("x-total"), 10)
             : null,
-        x_total: response.headers.get("x-total") ? parseInt(response.headers.get("x-total")) : null,
         x_total_pages: response.headers.get("x-total-pages")
-            ? parseInt(response.headers.get("x-total-pages"))
+            ? Number.parseInt(response.headers.get("x-total-pages"), 10)
             : null,
     };
     return PaginatedDiscussionsResponseSchema.parse({
@@ -1881,10 +2023,10 @@ async function searchProjects(query, page = 1, perPage = 20) {
     const totalCount = response.headers.get("x-total");
     const totalPages = response.headers.get("x-total-pages");
     // GitLab API doesn't return these headers for results > 10,000
-    const count = totalCount ? parseInt(totalCount) : projects.length;
+    const count = totalCount ? Number.parseInt(totalCount, 10) : projects.length;
     return GitLabSearchResponseSchema.parse({
         count,
-        total_pages: totalPages ? parseInt(totalPages) : Math.ceil(count / perPage),
+        total_pages: totalPages ? Number.parseInt(totalPages, 10) : Math.ceil(count / perPage),
         current_page: page,
         items: projects,
     });
@@ -1906,7 +2048,7 @@ async function createRepository(options) {
             visibility: options.visibility,
             initialize_with_readme: options.initialize_with_readme,
             default_branch: "main",
-            path: options.name.toLowerCase().replace(/\s+/g, "-"),
+            path: options.name.toLowerCase().replaceAll(/\s+/g, "-"),
         }),
     });
     if (!response.ok) {
@@ -2088,6 +2230,68 @@ async function mergeMergeRequest(projectId, options, mergeRequestIid) {
     await handleGitLabError(response);
     return GitLabMergeRequestSchema.parse(await response.json());
 }
+/**
+ * Approve a merge request
+ *
+ * @param {string} projectId - The ID or URL-encoded path of the project
+ * @param {string | number} mergeRequestIid - The internal ID of the merge request
+ * @param {string} sha - Optional SHA to approve (for validation that MR hasn't changed)
+ * @param {string} approvalPassword - Optional password for approvals requiring re-authentication
+ * @returns {Promise<GitLabMergeRequestApprovalState>} The approval state after approving
+ */
+async function approveMergeRequest(projectId, mergeRequestIid, sha, approvalPassword) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/approve`);
+    const body = {};
+    if (sha) {
+        body.sha = sha;
+    }
+    if (approvalPassword) {
+        body.approval_password = approvalPassword;
+    }
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "POST",
+        body: JSON.stringify(body),
+    });
+    await handleGitLabError(response);
+    return GitLabMergeRequestApprovalStateSchema.parse(await response.json());
+}
+/**
+ * Unapprove a previously approved merge request
+ *
+ * @param {string} projectId - The ID or URL-encoded path of the project
+ * @param {string | number} mergeRequestIid - The internal ID of the merge request
+ * @returns {Promise<GitLabMergeRequestApprovalState>} The approval state after unapproving
+ */
+async function unapproveMergeRequest(projectId, mergeRequestIid) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/unapprove`);
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "POST",
+        body: JSON.stringify({}),
+    });
+    await handleGitLabError(response);
+    return GitLabMergeRequestApprovalStateSchema.parse(await response.json());
+}
+/**
+ * Get the approval state of a merge request
+ *
+ * @param {string} projectId - The ID or URL-encoded path of the project
+ * @param {string | number} mergeRequestIid - The internal ID of the merge request
+ * @returns {Promise<GitLabMergeRequestApprovalState>} The approval state
+ */
+async function getMergeRequestApprovalState(projectId, mergeRequestIid) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/approval_state`);
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "GET",
+    });
+    await handleGitLabError(response);
+    return GitLabMergeRequestApprovalStateSchema.parse(await response.json());
+}
 /**
  * Create a new note (comment) on an issue or merge request
  * 📦 새로운 함수: createNote - 이슈 또는 병합 요청에 노트(댓글)를 추가하는 함수
@@ -2250,7 +2454,7 @@ async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
     }
     // Handle empty response (204 No Content) or successful response
     const responseText = await response.text();
-    if (!responseText || responseText.trim() === '') {
+    if (!responseText || responseText.trim() === "") {
         // Return a success indicator for empty responses
         return {
             id: draftNoteId.toString(),
@@ -2260,7 +2464,7 @@ async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
             updated_at: new Date().toISOString(),
             system: false,
             noteable_id: mergeRequestIid.toString(),
-            noteable_type: "MergeRequest"
+            noteable_type: "MergeRequest",
         };
     }
     try {
@@ -2279,7 +2483,7 @@ async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
             updated_at: new Date().toISOString(),
             system: false,
             noteable_id: mergeRequestIid.toString(),
-            noteable_type: "MergeRequest"
+            noteable_type: "MergeRequest",
         };
     }
 }
@@ -2303,7 +2507,7 @@ async function bulkPublishDraftNotes(projectId, mergeRequestIid) {
     }
     // Handle empty response (204 No Content) or successful response
     const responseText = await response.text();
-    if (!responseText || responseText.trim() === '') {
+    if (!responseText || responseText.trim() === "") {
         // Return empty array for successful bulk publish with no content
         return [];
     }
@@ -2354,7 +2558,6 @@ async function createMergeRequestThread(projectId, mergeRequestIid, body, positi
     projectId = decodeURIComponent(projectId); // Decode project ID
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions`);
     const payload = { body };
-    // Add optional parameters if provided
     if (position) {
         payload.position = position;
     }
@@ -2370,6 +2573,46 @@ async function createMergeRequestThread(projectId, mergeRequestIid, body, positi
     const data = await response.json();
     return GitLabDiscussionSchema.parse(data);
 }
+/**
+ * List all versions of a merge request
+ * 병합 요청의 모든 버전 목록 조회
+ *
+ * @param {string} projectId - The ID or URL-encoded path of the project
+ * @param {number} mergeRequestIid - The internal ID of the merge request
+ * @returns {Promise<GitLabMergeRequestVersion[]>} List of merge request versions
+ */
+async function listMergeRequestVersions(projectId, mergeRequestIid) {
+    projectId = decodeURIComponent(projectId); // Decode project ID
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/versions`);
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return z.array(GitLabMergeRequestVersionSchema).parse(data);
+}
+/**
+ * Get a specific version of a merge request
+ * 병합 요청의 특정 버전 상세 정보 조회
+ *
+ * @param {string} projectId - The ID or URL-encoded path of the project
+ * @param {number} mergeRequestIid - The internal ID of the merge request
+ * @param {number} versionId - The ID of the version
+ * @returns {Promise<GitLabMergeRequestVersionDetail>} The merge request version details
+ */
+async function getMergeRequestVersion(projectId, mergeRequestIid, versionId, unidiff) {
+    projectId = decodeURIComponent(projectId); // Decode project ID
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/versions/${versionId}`);
+    if (unidiff !== undefined) {
+        url.searchParams.append("unidiff", String(unidiff));
+    }
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabMergeRequestVersionDetailSchema.parse(data);
+}
 /**
  * List all namespaces
  * 사용 가능한 모든 네임스페이스 목록 조회
@@ -3027,7 +3270,7 @@ async function cancelPipelineJob(projectId, jobId, force) {
     projectId = decodeURIComponent(projectId);
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${jobId}/cancel`);
     if (force !== undefined) {
-        url.searchParams.append('force', force.toString());
+        url.searchParams.append("force", force.toString());
     }
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -3444,7 +3687,8 @@ async function myIssues(options = {}) {
 async function listProjectMembers(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/members`);
+    const membersPath = options.include_inheritance ? "members/all" : "members";
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/${membersPath}`);
     // Add query parameters
     if (options.query)
         url.searchParams.append("query", options.query);
@@ -3744,24 +3988,19 @@ async function downloadReleaseAsset(projectId, tagName, directAssetPath) {
     return await response.text();
 }
 server.setRequestHandler(ListToolsRequestSchema, async () => {
-    // In remote auth mode, retrieve session context from AsyncLocalStorage
-    // This ensures the context is available even when called from SDK's async chains
-    const sessionContext = REMOTE_AUTHORIZATION ? sessionAuthStore.getStore() : null;
     // Apply read-only filter first
     const tools0 = GITLAB_READ_ONLY_MODE
-        ? allTools.filter(tool => readOnlyTools.includes(tool.name))
+        ? allTools.filter(tool => readOnlyTools.has(tool.name))
         : allTools;
     // Toggle wiki tools by USE_GITLAB_WIKI flag
-    const tools1 = USE_GITLAB_WIKI
-        ? tools0
-        : tools0.filter(tool => !wikiToolNames.includes(tool.name));
+    const tools1 = USE_GITLAB_WIKI ? tools0 : tools0.filter(tool => !wikiToolNames.has(tool.name));
     // Toggle milestone tools by USE_MILESTONE flag
-    const tools2 = USE_MILESTONE
-        ? tools1
-        : tools1.filter(tool => !milestoneToolNames.includes(tool.name));
+    const tools2 = USE_MILESTONE ? tools1 : tools1.filter(tool => !milestoneToolNames.has(tool.name));
     // Toggle pipeline tools by USE_PIPELINE flag
-    let tools = USE_PIPELINE ? tools2 : tools2.filter(tool => !pipelineToolNames.includes(tool.name));
-    tools = GITLAB_DENIED_TOOLS_REGEX ? tools.filter(tool => !GITLAB_DENIED_TOOLS_REGEX.test(tool.name)) : tools;
+    let tools = USE_PIPELINE ? tools2 : tools2.filter(tool => !pipelineToolNames.has(tool.name));
+    tools = GITLAB_DENIED_TOOLS_REGEX
+        ? tools.filter(tool => !GITLAB_DENIED_TOOLS_REGEX.test(tool.name))
+        : tools;
     // <<< START: Gemini 호환성을 위해 $schema 제거 >>>
     tools = tools.map(tool => {
         // inputSchema가 존재하고 객체인지 확인
@@ -3801,6 +4040,37 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     // Fallback for non-remote-auth mode or if session is not found
     return handleToolCall(request.params);
 });
+/**
+ * Filter diffs by excluded file patterns
+ * Safely handles invalid regex patterns by logging and ignoring them
+ *
+ * @param diffs - Array of diff objects with new_path property
+ * @param excludedFilePatterns - Array of regex patterns to exclude
+ * @returns Filtered array of diffs
+ */
+function filterDiffsByPatterns(diffs, excludedFilePatterns) {
+    if (!excludedFilePatterns?.length)
+        return diffs;
+    const regexPatterns = excludedFilePatterns
+        .map((pattern) => {
+        try {
+            return new RegExp(pattern);
+        }
+        catch (e) {
+            console.warn(`Invalid regex pattern ignored: ${pattern}`);
+            return null;
+        }
+    })
+        .filter((regex) => regex !== null);
+    if (regexPatterns.length === 0)
+        return diffs;
+    const matchesAnyPattern = (path) => {
+        if (!path)
+            return false;
+        return regexPatterns.some((regex) => regex.test(path));
+    };
+    return diffs.filter((diff) => !matchesAnyPattern(diff.new_path));
+}
 async function handleToolCall(params) {
     try {
         if (!params.arguments) {
@@ -3903,17 +4173,7 @@ async function handleToolCall(params) {
             case "get_branch_diffs": {
                 const args = GetBranchDiffsSchema.parse(params.arguments);
                 const diffResp = await getBranchDiffs(args.project_id, args.from, args.to, args.straight);
-                if (args.excluded_file_patterns?.length) {
-                    const regexPatterns = args.excluded_file_patterns.map(pattern => new RegExp(pattern));
-                    // Helper function to check if a path matches any regex pattern
-                    const matchesAnyPattern = (path) => {
-                        if (!path)
-                            return false;
-                        return regexPatterns.some(regex => regex.test(path));
-                    };
-                    // Filter out files that match any of the regex patterns on new files
-                    diffResp.diffs = diffResp.diffs.filter(diff => !matchesAnyPattern(diff.new_path));
-                }
+                diffResp.diffs = filterDiffsByPatterns(diffResp.diffs, args.excluded_file_patterns);
                 return {
                     content: [{ type: "text", text: JSON.stringify(diffResp, null, 2) }],
                 };
@@ -4010,21 +4270,21 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: "Merge request note deleted successfully" }],
                 };
             }
-            case 'get_merge_request_note': {
+            case "get_merge_request_note": {
                 const args = GetMergeRequestNoteSchema.parse(params.arguments);
                 const note = await getMergeRequestNote(args.project_id, args.merge_request_iid, args.note_id);
                 return {
                     content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
                 };
             }
-            case 'get_merge_request_notes': {
+            case "get_merge_request_notes": {
                 const args = GetMergeRequestNotesSchema.parse(params.arguments);
                 const notes = await getMergeRequestNotes(args.project_id, args.merge_request_iid, args.sort, args.order_by);
                 return {
                     content: [{ type: "text", text: JSON.stringify(notes, null, 2) }],
                 };
             }
-            case 'update_merge_request_note': {
+            case "update_merge_request_note": {
                 const args = UpdateMergeRequestNoteSchema.parse(params.arguments);
                 const note = await updateMergeRequestNote(args.project_id, args.merge_request_iid, args.note_id, args.body);
                 return {
@@ -4055,8 +4315,9 @@ async function handleToolCall(params) {
             case "get_merge_request_diffs": {
                 const args = GetMergeRequestDiffsSchema.parse(params.arguments);
                 const diffs = await getMergeRequestDiffs(args.project_id, args.merge_request_iid, args.source_branch, args.view);
+                const filteredDiffs = filterDiffsByPatterns(diffs, args.excluded_file_patterns);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(diffs, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(filteredDiffs, null, 2) }],
                 };
             }
             case "list_merge_request_diffs": {
@@ -4066,6 +4327,20 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(changes, null, 2) }],
                 };
             }
+            case "list_merge_request_versions": {
+                const args = ListMergeRequestVersionsSchema.parse(params.arguments);
+                const versions = await listMergeRequestVersions(args.project_id, args.merge_request_iid);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(versions, null, 2) }],
+                };
+            }
+            case "get_merge_request_version": {
+                const args = GetMergeRequestVersionSchema.parse(params.arguments);
+                const version = await getMergeRequestVersion(args.project_id, args.merge_request_iid, args.version_id, args.unidiff);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(version, null, 2) }],
+                };
+            }
             case "update_merge_request": {
                 const args = UpdateMergeRequestSchema.parse(params.arguments);
                 const { project_id, merge_request_iid, source_branch, ...options } = args;
@@ -4082,6 +4357,27 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(mergeRequest, null, 2) }],
                 };
             }
+            case "approve_merge_request": {
+                const args = ApproveMergeRequestSchema.parse(params.arguments);
+                const approvalState = await approveMergeRequest(args.project_id, args.merge_request_iid, args.sha, args.approval_password);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(approvalState, null, 2) }],
+                };
+            }
+            case "unapprove_merge_request": {
+                const args = UnapproveMergeRequestSchema.parse(params.arguments);
+                const approvalState = await unapproveMergeRequest(args.project_id, args.merge_request_iid);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(approvalState, null, 2) }],
+                };
+            }
+            case "get_merge_request_approval_state": {
+                const args = GetMergeRequestApprovalStateSchema.parse(params.arguments);
+                const approvalState = await getMergeRequestApprovalState(args.project_id, args.merge_request_iid);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(approvalState, null, 2) }],
+                };
+            }
             case "mr_discussions": {
                 const args = ListMergeRequestDiscussionsSchema.parse(params.arguments);
                 const { project_id, merge_request_iid, ...options } = args;
@@ -4749,7 +5045,9 @@ async function handleToolCall(params) {
                 const args = DownloadAttachmentSchema.parse(params.arguments);
                 const filePath = await downloadAttachment(args.project_id, args.secret, args.filename, args.local_path);
                 return {
-                    content: [{ type: "text", text: JSON.stringify({ success: true, file_path: filePath }, null, 2) }],
+                    content: [
+                        { type: "text", text: JSON.stringify({ success: true, file_path: filePath }, null, 2) },
+                    ],
                 };
             }
             case "list_events": {
@@ -4921,8 +5219,8 @@ async function startStreamableHTTPServer() {
     const streamableTransports = {};
     const authTimeouts = {};
     // Configuration and limits
-    const MAX_SESSIONS = parseInt(process.env.MAX_SESSIONS || '1000');
-    const MAX_REQUESTS_PER_MINUTE = parseInt(process.env.MAX_REQUESTS_PER_MINUTE || '60');
+    const MAX_SESSIONS = Number.parseInt(process.env.MAX_SESSIONS || "1000", 10);
+    const MAX_REQUESTS_PER_MINUTE = Number.parseInt(process.env.MAX_REQUESTS_PER_MINUTE || "60", 10);
     // Metrics tracking
     const metrics = {
         activeSessions: 0,
@@ -4942,7 +5240,7 @@ async function startStreamableHTTPServer() {
         // GitLab PAT format: glpat-xxxxx (min 20 chars)
         if (token.length < 20)
             return false;
-        if (!/^[a-zA-Z0-9_\.-]+$/.test(token))
+        if (!/^[-a-zA-Z0-9_.]+$/.test(token))
             return false;
         return true;
     };
@@ -4967,9 +5265,9 @@ async function startStreamableHTTPServer() {
      * Returns null if no auth found or invalid format
      */
     const parseAuthHeaders = (req) => {
-        const authHeader = req.headers['authorization'] || '';
-        const privateToken = req.headers['private-token'] || '';
-        const dynamicApiUrl = req.headers['x-gitlab-api-url']?.trim();
+        const authHeader = req.headers["authorization"] || "";
+        const privateToken = req.headers["private-token"] || "";
+        const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
         let apiUrl = GITLAB_API_URL; // Default API URL
         // Only process dynamic URL if the feature is enabled
         if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
@@ -4977,7 +5275,7 @@ async function startStreamableHTTPServer() {
                 new URL(dynamicApiUrl); // Ensure it's a valid URL format
                 apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);
             }
-            catch (e) {
+            catch {
                 logger.warn(`Invalid X-GitLab-API-URL provided: ${dynamicApiUrl}. Auth will fail.`);
                 return null; // Reject if URL is malformed
             }
@@ -4987,13 +5285,16 @@ async function startStreamableHTTPServer() {
         let header = null;
         if (privateToken) {
             token = privateToken.trim();
-            header = 'Private-Token';
+            header = "Private-Token";
         }
         else if (authHeader) {
-            const match = authHeader.match(/^Bearer\s+(.+)$/i);
+            // Use \S+ instead of .+ to prevent ReDoS attacks
+            // \S+ only matches non-whitespace, so trim() is technically unnecessary,
+            // but we keep it for defensive coding and backward compatibility
+            const match = /^Bearer\s+(\S+)$/i.exec(authHeader);
             if (match) {
                 token = match[1].trim();
-                header = 'Authorization';
+                header = "Authorization";
             }
         }
         // Validate token and return AuthData object
@@ -5048,8 +5349,8 @@ async function startStreamableHTTPServer() {
         if (REMOTE_AUTHORIZATION && sessionId && !checkRateLimit(sessionId)) {
             metrics.rejectedByRateLimit++;
             res.status(429).json({
-                error: 'Rate limit exceeded',
-                message: `Maximum ${MAX_REQUESTS_PER_MINUTE} requests per minute allowed`
+                error: "Rate limit exceeded",
+                message: `Maximum ${MAX_REQUESTS_PER_MINUTE} requests per minute allowed`,
             });
             return;
         }
@@ -5057,8 +5358,8 @@ async function startStreamableHTTPServer() {
         if (!sessionId && Object.keys(streamableTransports).length >= MAX_SESSIONS) {
             metrics.rejectedByCapacity++;
             res.status(503).json({
-                error: 'Server capacity reached',
-                message: `Maximum ${MAX_SESSIONS} concurrent sessions allowed. Please try again later.`
+                error: "Server capacity reached",
+                message: `Maximum ${MAX_SESSIONS} concurrent sessions allowed. Please try again later.`,
             });
             return;
         }
@@ -5070,8 +5371,8 @@ async function startStreamableHTTPServer() {
                 if (!authData) {
                     metrics.authFailures++;
                     res.status(401).json({
-                        error: 'Missing Authorization or Private-Token header',
-                        message: 'Remote authorization is enabled. Please provide Authorization or Private-Token header.'
+                        error: "Missing Authorization or Private-Token header",
+                        message: "Remote authorization is enabled. Please provide Authorization or Private-Token header.",
                     });
                     return;
                 }
@@ -5160,7 +5461,7 @@ async function startStreamableHTTPServer() {
                 header: authData.header,
                 token: authData.token,
                 lastUsed: authData.lastUsed,
-                apiUrl: authData.apiUrl
+                apiUrl: authData.apiUrl,
             };
             // Run the entire request handling within AsyncLocalStorage context
             await sessionAuthStore.run(ctx, handleRequest);
@@ -5175,7 +5476,7 @@ async function startStreamableHTTPServer() {
         res.setHeader("Allow", "POST, DELETE");
         res.status(405).json({
             error: "Method Not Allowed",
-            message: "GET /mcp is not supported when STREAMABLE_HTTP is enabled. Use POST to communicate with the MCP server."
+            message: "GET /mcp is not supported when STREAMABLE_HTTP is enabled. Use POST to communicate with the MCP server.",
         });
     });
     // Metrics endpoint
@@ -5191,14 +5492,14 @@ async function startStreamableHTTPServer() {
                 maxRequestsPerMinute: MAX_REQUESTS_PER_MINUTE,
                 sessionTimeoutSeconds: SESSION_TIMEOUT_SECONDS,
                 remoteAuthEnabled: REMOTE_AUTHORIZATION,
-            }
+            },
         });
     });
     // Health check endpoint
     app.get("/health", (_req, res) => {
         const isHealthy = Object.keys(streamableTransports).length < MAX_SESSIONS;
         res.status(isHealthy ? 200 : 503).json({
-            status: isHealthy ? 'healthy' : 'degraded',
+            status: isHealthy ? "healthy" : "degraded",
             activeSessions: Object.keys(streamableTransports).length,
             maxSessions: MAX_SESSIONS,
             uptime: process.uptime(),
@@ -5242,7 +5543,7 @@ async function startStreamableHTTPServer() {
         logger.info(`${signal} received, starting graceful shutdown...`);
         // Stop accepting new connections
         httpServer.close(() => {
-            logger.info('HTTP server closed');
+            logger.info("HTTP server closed");
         });
         // Close all active sessions
         const sessionIds = Object.keys(streamableTransports);
@@ -5267,12 +5568,12 @@ async function startStreamableHTTPServer() {
         Object.keys(authTimeouts).forEach(sessionId => {
             clearAuthTimeout(sessionId);
         });
-        logger.info('Graceful shutdown complete');
+        logger.info("Graceful shutdown complete");
         process.exit(0);
     };
     // Register signal handlers
-    process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
-    process.on('SIGINT', () => gracefulShutdown('SIGINT'));
+    process.on("SIGTERM", () => gracefulShutdown("SIGTERM"));
+    process.on("SIGINT", () => gracefulShutdown("SIGINT"));
 }
 /**
  * Initialize server with specific transport mode
@@ -5293,10 +5594,11 @@ async function initializeServerByTransportMode(mode) {
             logger.warn("Starting GitLab MCP Server with Streamable HTTP transport");
             await startStreamableHTTPServer();
             break;
-        default:
+        default: {
             // This should never happen with proper enum usage, but TypeScript requires it
             const exhaustiveCheck = mode;
             throw new Error(`Unknown transport mode: ${exhaustiveCheck}`);
+        }
     }
 }
 /**