@zereight/mcp-gitlab 2.1.0 → 2.1.2

package/build/auth-retry.js

@@ -0,0 +1,81 @@
+/**
+ * Pure helper functions for OAuth 401 auto-retry logic.
+ *
+ * Extracted into a separate module so they can be unit-tested without
+ * importing index.ts (which has heavy side effects: starts the MCP server,
+ * reads env vars, etc.).
+ */
+import { Headers } from "node-fetch";
+/**
+ * Convert various header representations to a plain Record<string, string>.
+ */
+export function headersToPlainObject(headers) {
+    if (!headers)
+        return {};
+    if (headers instanceof Headers) {
+        const obj = {};
+        headers.forEach((value, key) => { obj[key] = value; });
+        return obj;
+    }
+    if (Array.isArray(headers)) {
+        return Object.fromEntries(headers);
+    }
+    return headers;
+}
+/**
+ * Detect request bodies that cannot be replayed (streams, FormData).
+ */
+export function isNonReplayableBody(body) {
+    if (!body)
+        return false;
+    // Stream-like objects (has .pipe or .read)
+    if (typeof body.pipe === "function" || typeof body.read === "function")
+        return true;
+    // form-data instances (duck-type check since FormData is dynamically imported)
+    if (typeof body.getBuffer === "function" && typeof body.getBoundary === "function")
+        return true;
+    return false;
+}
+/**
+ * Wrap a fetch function with automatic OAuth token refresh on 401 responses.
+ * On a 401, force-refreshes the OAuth token and retries the request once.
+ * The retry calls baseFetch directly (not the wrapper), so infinite loops are impossible.
+ * In non-OAuth mode, the wrapper is a transparent pass-through.
+ *
+ * When called without `config`, falls back to module globals in index.ts.
+ * When called with `config` (tests), uses injected dependencies.
+ */
+export function wrapWithAuthRetry(baseFetch, config) {
+    let refreshLock = null;
+    const log = config.logger ?? { info: () => { }, error: () => { } };
+    return (async (url, options) => {
+        const response = await baseFetch(url, options);
+        if (response.status === 401 && config.isOAuthEnabled()) {
+            // Skip retry for non-replayable bodies (streams, FormData) since the first request consumed them
+            if (isNonReplayableBody(options?.body)) {
+                log.info("Received 401 but request body is not replayable (stream/FormData), skipping retry.");
+                return response;
+            }
+            log.info("Received 401, force-refreshing OAuth token and retrying...");
+            try {
+                // Mutex: coalesce concurrent refresh attempts into a single in-flight request
+                if (!refreshLock) {
+                    refreshLock = config.refreshToken(true).finally(() => {
+                        refreshLock = null;
+                    });
+                }
+                const token = await refreshLock;
+                config.onTokenRefreshed(token);
+                const retryOptions = {
+                    ...options,
+                    headers: { ...headersToPlainObject(options?.headers), ...config.buildAuthHeaders() },
+                };
+                return await baseFetch(url, retryOptions);
+            }
+            catch (refreshError) {
+                log.error("OAuth token refresh failed, returning original 401 response:", refreshError);
+            }
+        }
+        return response;
+    });
+}

package/build/index.js

@@ -23,8 +23,8 @@ import { estimateMergeCommitCount, filterDiffsByPatterns, summarizeWebhookEvents
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { GitLabClientPool } from "./gitlab-client-pool.js";
 import { allTools, readOnlyTools, destructiveTools, parseEnabledToolsets, parseIndividualTools, buildFeatureFlagOverrides, isToolInEnabledToolset, TOOLSET_DEFINITIONS, ALL_TOOLSET_IDS, } from "./tools/registry.js";
-import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateLabelSchema, // Added
-CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, 
+import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, // Added
+CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, 
 // pipeline job schemas
 GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
 // Discussion Schemas
@@ -32,7 +32,7 @@ GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
 GitLabDraftNoteSchema, GitLabForkSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
-GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, } from "./schemas.js";
+GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, } from "./schemas.js";
 import { randomUUID } from "node:crypto";
 import { pino } from "pino";
 const logger = pino({
@@ -546,9 +546,22 @@ const createCookieJar = async () => {
     }
     return jar;
 };
+// Auth retry helpers — extracted to auth-retry.ts for testability (no side effects)
+export { headersToPlainObject, isNonReplayableBody, wrapWithAuthRetry, } from "./auth-retry.js";
+import { wrapWithAuthRetry } from "./auth-retry.js";
+/** Build AuthRetryConfig from module globals (lazy — reads globals at call time). */
+function defaultAuthRetryConfig() {
+    return {
+        isOAuthEnabled: () => USE_OAUTH && oauthClient != null,
+        refreshToken: (force) => oauthClient.getAccessToken(force),
+        onTokenRefreshed: (token) => { OAUTH_ACCESS_TOKEN = token; },
+        buildAuthHeaders,
+        logger,
+    };
+}
 // Cookie jar and fetch - reloaded when cookie file changes
 let cookieJar = null;
-let fetch = nodeFetch;
+let fetch = wrapWithAuthRetry(nodeFetch, defaultAuthRetryConfig());
 let lastCookieMtime = 0;
 let cookieReloadLock = null; // Mutex to prevent parallel reloads
 // Auth proxies may redirect and set cookies on the first request. We make a throwaway
@@ -568,7 +581,7 @@ async function reloadCookiesIfChanged() {
                 lastCookieMtime = mtime;
                 const newJar = await createCookieJar();
                 cookieJar = newJar;
-                fetch = newJar ? fetchCookie(nodeFetch, newJar) : nodeFetch;
+                fetch = wrapWithAuthRetry(newJar ? fetchCookie(nodeFetch, newJar) : nodeFetch, defaultAuthRetryConfig());
                 initialSessionRequestMade = false;
             }
         }
@@ -577,7 +590,7 @@ async function reloadCookiesIfChanged() {
             if (cookieJar) {
                 logger.info("Cookie file removed, clearing cached cookies");
                 cookieJar = null;
-                fetch = nodeFetch;
+                fetch = wrapWithAuthRetry(nodeFetch, defaultAuthRetryConfig());
                 lastCookieMtime = 0;
                 initialSessionRequestMade = false;
             }
@@ -1477,6 +1490,39 @@ async function createWorkItemNote(projectId, iid, body, options = {}) {
     }
     return data.createNote.note;
 }
+// --- Emoji Reactions (GraphQL) ---
+async function addGraphQLAwardEmoji(awardableId, name) {
+    const data = await executeGraphQL(`mutation($awardableId: AwardableID!, $name: String!) {
+      awardEmojiAdd(input: { awardableId: $awardableId, name: $name }) {
+        awardEmoji { name user { username } }
+        errors
+      }
+    }`, { awardableId, name });
+    if (data.awardEmojiAdd.errors?.length > 0) {
+        throw new Error(`Failed to add emoji reaction: ${data.awardEmojiAdd.errors.join(", ")}`);
+    }
+    return data.awardEmojiAdd.awardEmoji;
+}
+async function listGraphQLAwardEmoji(awardableId) {
+    const data = await executeGraphQL(`query($id: AwardableID!) {
+      awardable(id: $id) {
+        awardEmoji { nodes { name user { username } } }
+      }
+    }`, { id: awardableId });
+    return data.awardable?.awardEmoji?.nodes ?? [];
+}
+async function removeGraphQLAwardEmoji(awardableId, name) {
+    const data = await executeGraphQL(`mutation($awardableId: AwardableID!, $name: String!) {
+      awardEmojiRemove(input: { awardableId: $awardableId, name: $name }) {
+        awardEmoji { name }
+        errors
+      }
+    }`, { awardableId, name });
+    if (data.awardEmojiRemove.errors?.length > 0) {
+        throw new Error(`Failed to remove emoji reaction: ${data.awardEmojiRemove.errors.join(", ")}`);
+    }
+    return data.awardEmojiRemove.awardEmoji;
+}
 // --- Incident Timeline Events ---
 /**
  * List timeline events for an incident.
@@ -2695,6 +2741,42 @@ async function deleteMergeRequestNote(projectId, mergeRequestIid, noteId) {
         throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
 }
+// --- Emoji Reactions (REST) ---
+function buildAwardEmojiPath(entity, projectId, entityIid, opts) {
+    projectId = decodeURIComponent(projectId);
+    const pp = encodeURIComponent(getEffectiveProjectId(projectId));
+    let path = `${getEffectiveApiUrl()}/projects/${pp}/${entity}/${entityIid}`;
+    if (opts?.noteId) {
+        path = opts.discussionId
+            ? `${path}/discussions/${opts.discussionId}/notes/${opts.noteId}`
+            : `${path}/notes/${opts.noteId}`;
+    }
+    path += "/award_emoji";
+    if (opts?.awardId)
+        path += `/${opts.awardId}`;
+    return path;
+}
+async function createRestAwardEmoji(path, name) {
+    const response = await fetch(path, {
+        ...getFetchConfig(),
+        method: "POST",
+        body: JSON.stringify({ name }),
+    });
+    await handleGitLabError(response);
+    return response.json();
+}
+async function listRestAwardEmoji(path) {
+    const response = await fetch(path, getFetchConfig());
+    await handleGitLabError(response);
+    return response.json();
+}
+async function deleteRestAwardEmoji(path) {
+    const response = await fetch(path, {
+        ...getFetchConfig(),
+        method: "DELETE",
+    });
+    await handleGitLabError(response);
+}
 async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes/${noteId}`);
@@ -4081,6 +4163,8 @@ async function listGroupProjects(options) {
         url.searchParams.append("with_custom_attributes", options.with_custom_attributes.toString());
     if (options.with_security_reports !== undefined)
         url.searchParams.append("with_security_reports", options.with_security_reports.toString());
+    if (options.topic)
+        url.searchParams.append("topic", options.topic);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5773,6 +5857,42 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
                 };
             }
+            case "list_merge_request_emoji_reactions": {
+                const args = ListMergeRequestEmojiReactionsSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid);
+                const result = await listRestAwardEmoji(path);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "list_merge_request_note_emoji_reactions": {
+                const args = ListMergeRequestNoteEmojiReactionsSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const result = await listRestAwardEmoji(path);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "create_merge_request_emoji_reaction": {
+                const args = CreateMergeRequestEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid);
+                const result = await createRestAwardEmoji(path, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_merge_request_emoji_reaction": {
+                const args = DeleteMergeRequestEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { awardId: args.award_id });
+                await deleteRestAwardEmoji(path);
+                return { content: [{ type: "text", text: "Merge request emoji reaction deleted successfully" }] };
+            }
+            case "create_merge_request_note_emoji_reaction": {
+                const args = CreateMergeRequestNoteEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const result = await createRestAwardEmoji(path, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_merge_request_note_emoji_reaction": {
+                const args = DeleteMergeRequestNoteEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { noteId: args.note_id, discussionId: args.discussion_id, awardId: args.award_id });
+                await deleteRestAwardEmoji(path);
+                return { content: [{ type: "text", text: "Merge request note emoji reaction deleted successfully" }] };
+            }
             case "update_issue_note": {
                 const args = UpdateIssueNoteSchema.parse(params.arguments);
                 const note = await updateIssueNote(args.project_id, args.issue_iid, args.discussion_id, args.note_id, args.body, args.resolved);
@@ -5787,6 +5907,42 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
                 };
             }
+            case "list_issue_emoji_reactions": {
+                const args = ListIssueEmojiReactionsSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid);
+                const result = await listRestAwardEmoji(path);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "list_issue_note_emoji_reactions": {
+                const args = ListIssueNoteEmojiReactionsSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const result = await listRestAwardEmoji(path);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "create_issue_emoji_reaction": {
+                const args = CreateIssueEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid);
+                const result = await createRestAwardEmoji(path, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_issue_emoji_reaction": {
+                const args = DeleteIssueEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { awardId: args.award_id });
+                await deleteRestAwardEmoji(path);
+                return { content: [{ type: "text", text: "Issue emoji reaction deleted successfully" }] };
+            }
+            case "create_issue_note_emoji_reaction": {
+                const args = CreateIssueNoteEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const result = await createRestAwardEmoji(path, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_issue_note_emoji_reaction": {
+                const args = DeleteIssueNoteEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { noteId: args.note_id, discussionId: args.discussion_id, awardId: args.award_id });
+                await deleteRestAwardEmoji(path);
+                return { content: [{ type: "text", text: "Issue note emoji reaction deleted successfully" }] };
+            }
             case "get_merge_request": {
                 const args = GetMergeRequestSchema.parse(params.arguments);
                 const mergeRequest = await getMergeRequest(args.project_id, args.merge_request_iid, args.source_branch);
@@ -6236,6 +6392,39 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
                 };
             }
+            case "list_work_item_emoji_reactions": {
+                const args = ListWorkItemEmojiReactionsSchema.parse(params.arguments);
+                const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
+                const result = await listGraphQLAwardEmoji(workItemGID);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "list_work_item_note_emoji_reactions": {
+                const args = ListWorkItemNoteEmojiReactionsSchema.parse(params.arguments);
+                const result = await listGraphQLAwardEmoji(args.note_id);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "create_work_item_emoji_reaction": {
+                const args = CreateWorkItemEmojiReactionSchema.parse(params.arguments);
+                const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
+                const result = await addGraphQLAwardEmoji(workItemGID, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_work_item_emoji_reaction": {
+                const args = DeleteWorkItemEmojiReactionSchema.parse(params.arguments);
+                const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
+                const result = await removeGraphQLAwardEmoji(workItemGID, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item emoji reaction removed" }, null, 2) }] };
+            }
+            case "create_work_item_note_emoji_reaction": {
+                const args = CreateWorkItemNoteEmojiReactionSchema.parse(params.arguments);
+                const result = await addGraphQLAwardEmoji(args.note_id, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_work_item_note_emoji_reaction": {
+                const args = DeleteWorkItemNoteEmojiReactionSchema.parse(params.arguments);
+                const result = await removeGraphQLAwardEmoji(args.note_id, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item note emoji reaction removed" }, null, 2) }] };
+            }
             case "get_timeline_events": {
                 const args = GetTimelineEventsSchema.parse(params.arguments);
                 const result = await getTimelineEvents(args.project_id, args.incident_iid);
@@ -7171,14 +7360,54 @@ async function startStreamableHTTPServer() {
         const gitlabBaseUrl = GITLAB_API_URL.replace(/\/api\/v4\/?$/, "").replace(/\/$/, "");
         const issuerUrl = new URL(MCP_SERVER_URL);
         const oauthProvider = createGitLabOAuthProvider(gitlabBaseUrl, GITLAB_OAUTH_APP_ID, "GitLab MCP Server", GITLAB_READ_ONLY_MODE, GITLAB_OAUTH_SCOPES);
-        // Mounts /.well-known/oauth-authorization-server,
-        //        /.well-known/oauth-protected-resource,
-        //        /authorize, /token, /register, /revoke
+        const scopesSupported = GITLAB_OAUTH_SCOPES ?? ["api", "read_api", "read_user"];
+        // When server URL has a path (e.g. behind Kong), the SDK's well-known metadata
+        // advertises root-level endpoints. Override to use path-prefixed endpoints.
+        const issuerPath = issuerUrl.pathname.replace(/\/$/, "");
+        if (issuerPath) {
+            const routedBaseUrl = `${issuerUrl.origin}${issuerPath}`;
+            const authorizationServerMetadata = {
+                issuer: issuerUrl.href,
+                authorization_endpoint: `${routedBaseUrl}/authorize`,
+                token_endpoint: `${routedBaseUrl}/token`,
+                registration_endpoint: `${routedBaseUrl}/register`,
+                revocation_endpoint: `${routedBaseUrl}/revoke`,
+                response_types_supported: ["code"],
+                code_challenge_methods_supported: ["S256"],
+                token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
+                grant_types_supported: ["authorization_code", "refresh_token"],
+                scopes_supported: scopesSupported,
+                revocation_endpoint_auth_methods_supported: ["client_secret_post"],
+            };
+            const protectedResourceMetadata = {
+                resource: issuerUrl.href,
+                authorization_servers: [issuerUrl.href],
+                scopes_supported: scopesSupported,
+                resource_name: "GitLab MCP Server",
+            };
+            const authorizationMetadataRoutes = [
+                "/.well-known/oauth-authorization-server",
+                "/.well-known/oauth-authorization-server/*path",
+            ];
+            const protectedResourceRoutes = [
+                "/.well-known/oauth-protected-resource",
+                "/.well-known/oauth-protected-resource/*path",
+            ];
+            app.get(authorizationMetadataRoutes, (_req, res) => {
+                res.json(authorizationServerMetadata);
+            });
+            app.get(protectedResourceRoutes, (_req, res) => {
+                res.json(protectedResourceMetadata);
+            });
+            logger.info({ issuerPath }, "Serving path-aware OAuth metadata for reverse-proxy deployments");
+        }
+        // Mounts /.well-known/oauth-authorization-server (shadowed above when basePath set),
+        //        /.well-known/oauth-protected-resource, /authorize, /token, /register, /revoke
         app.use(mcpAuthRouter({
             provider: oauthProvider,
             issuerUrl,
             baseUrl: issuerUrl,
-            scopesSupported: GITLAB_OAUTH_SCOPES ?? ["api", "read_api", "read_user"],
+            scopesSupported,
             resourceName: "GitLab MCP Server",
         }));
         // Expose provider so the /mcp route middleware can reference it

package/build/oauth.js

@@ -459,15 +459,15 @@ export class GitLabOAuth {
     /**
      * Get a valid access token, refreshing if necessary
      */
-    async getAccessToken() {
+    async getAccessToken(force = false) {
         let tokenData = this.loadToken();
-        // If no token or expired, start OAuth flow or refresh
+        // If no token or expired (or forced), start OAuth flow or refresh
         if (!tokenData) {
             logger.info("No stored token found. Starting OAuth flow...");
             tokenData = await this.startOAuthFlow();
         }
-        else if (this.isTokenExpired(tokenData)) {
-            logger.info("Token expired. Refreshing...");
+        else if (force || this.isTokenExpired(tokenData)) {
+            logger.info(force && !this.isTokenExpired(tokenData) ? "Force-refreshing OAuth token..." : "Token expired. Refreshing...");
             if (tokenData.refresh_token) {
                 try {
                     tokenData = await this.refreshAccessToken(tokenData.refresh_token);

package/build/schemas.js

@@ -527,7 +527,7 @@ export const GitLabRepositorySchema = z.object({
     http_url_to_repo: z.string().optional(),
     created_at: z.string().optional(),
     last_activity_at: z.string().optional(),
-    default_branch: z.string().optional(),
+    default_branch: z.string().nullable().optional(),
     namespace: z
         .object({
         id: z.coerce.string(),
@@ -621,7 +621,7 @@ export const FileOperationSchema = z.object({
 export const GitLabTreeItemSchema = z.object({
     id: z.string(),
     name: z.string(),
-    type: z.enum(["tree", "blob"]),
+    type: z.enum(["tree", "blob", "commit"]),
     path: z.string(),
     mode: z.string(),
 });
@@ -1219,7 +1219,7 @@ export const CreateIssueSchema = ProjectParamsSchema.extend({
     title: z.string().describe("Issue title"),
     description: z.string().optional().describe("Issue description"),
     assignee_ids: z.array(z.coerce.number()).optional().describe("Array of user IDs to assign"),
-    labels: z.array(z.string()).optional().describe("Array of label names"),
+    labels: coerceStringArray.optional().describe("Array of label names"),
     milestone_id: z.coerce.string().optional().describe("Milestone ID to assign"),
     issue_type: z
         .enum(["issue", "incident", "test_case", "task"])
@@ -1239,7 +1239,7 @@ const MergeRequestOptionsSchema = {
         .array(z.coerce.number())
         .optional()
         .describe("The ID of the users to assign as reviewers of the MR"),
-    labels: z.array(z.string()).optional().describe("Labels for the MR"),
+    labels: coerceStringArray.optional().describe("Labels for the MR"),
     draft: z.coerce.boolean().optional().describe("Create as draft merge request"),
     allow_collaboration: z.coerce.boolean().optional().describe("Allow commits from upstream members"),
     remove_source_branch: z
@@ -1288,7 +1288,7 @@ export const UpdateMergeRequestSchema = GetMergeRequestSchema.extend({
         .array(z.coerce.number())
         .optional()
         .describe("The ID of the users to assign as reviewers of the MR"),
-    labels: z.array(z.string()).optional().describe("Labels for the MR"),
+    labels: coerceStringArray.optional().describe("Labels for the MR"),
     state_event: z
         .enum(["close", "reopen"])
         .optional()
@@ -1475,7 +1475,7 @@ export const ListIssuesSchema = z
     created_after: z.string().optional().describe("Return issues created after the given time"),
     created_before: z.string().optional().describe("Return issues created before the given time"),
     due_date: z.string().optional().describe("Return issues that have the due date"),
-    labels: z.array(z.string()).optional().describe("Array of label names"),
+    labels: coerceStringArray.optional().describe("Array of label names"),
     milestone: z.string().optional().describe("Milestone title"),
     issue_type: z
         .enum(["issue", "incident", "test_case", "task"])
@@ -1546,7 +1546,7 @@ export const ListMergeRequestsSchema = z
         .string()
         .optional()
         .describe("Return merge requests updated before the given time"),
-    labels: z.array(z.string()).optional().describe("Array of label names"),
+    labels: coerceStringArray.optional().describe("Array of label names"),
     milestone: z.string().optional().describe("Milestone title"),
     scope: z
         .enum(["created_by_me", "assigned_to_me", "all"])
@@ -1689,6 +1689,7 @@ export const ListProjectsSchema = z
         .optional()
         .describe("Filter projects with merge requests feature enabled"),
     min_access_level: z.coerce.number().optional().describe("Filter by minimum access level"),
+    topic: z.string().optional().describe("Filter by topic (projects tagged with this topic)"),
 })
     .merge(PaginationOptionsSchema);
 // Label operation schemas
@@ -1760,6 +1761,7 @@ export const ListGroupProjectsSchema = z
     statistics: z.coerce.boolean().optional().describe("Include project statistics"),
     with_custom_attributes: z.coerce.boolean().optional().describe("Include custom attributes"),
     with_security_reports: z.coerce.boolean().optional().describe("Include security reports"),
+    topic: z.string().optional().describe("Filter by topic (projects tagged with this topic)"),
 })
     .merge(PaginationOptionsSchema);
 // Add wiki operation schemas
@@ -2134,7 +2136,7 @@ export const MyIssuesSchema = z.object({
         .enum(["opened", "closed", "all"])
         .optional()
         .describe("Return issues with a specific state (default: opened)"),
-    labels: z.array(z.string()).optional().describe("Array of label names to filter by"),
+    labels: coerceStringArray.optional().describe("Array of label names to filter by"),
     milestone: z.string().optional().describe("Milestone title to filter by"),
     search: z.string().optional().describe("Search for specific terms in title and description"),
     created_after: z
@@ -2273,8 +2275,8 @@ export const GitLabEventSchema = z
     created_at: z.string(),
     author: GitLabEventAuthorSchema,
     author_username: z.string(),
-    imported: z.coerce.boolean(),
-    imported_from: z.string(),
+    imported: z.coerce.boolean().optional(),
+    imported_from: z.string().nullable().optional(),
 })
     .passthrough(); // Allow additional fields
 // List events schema
@@ -2711,6 +2713,98 @@ export const ListCustomFieldDefinitionsSchema = z.object({
         .default("issue")
         .describe("The work item type to list custom field definitions for. Defaults to 'issue'."),
 });
+// --- Emoji Reaction schemas (REST: MRs and Issues) ---
+const emojiNameField = z.string().describe("Name of the emoji without colons (e.g. 'thumbsup', 'rocket', 'eyes')");
+const awardIdField = z.coerce.string().describe("The ID of the emoji reaction to delete");
+const noteEmojiDiscussionField = z.coerce.string().optional().describe("The ID of a discussion thread. Required for notes that are discussion replies; omit for top-level notes.");
+export const CreateMergeRequestEmojiReactionSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    name: emojiNameField,
+});
+export const DeleteMergeRequestEmojiReactionSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    award_id: awardIdField,
+});
+export const CreateMergeRequestNoteEmojiReactionSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+    name: emojiNameField,
+});
+export const DeleteMergeRequestNoteEmojiReactionSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+    award_id: awardIdField,
+});
+export const CreateIssueEmojiReactionSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    name: emojiNameField,
+});
+export const DeleteIssueEmojiReactionSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    award_id: awardIdField,
+});
+export const CreateIssueNoteEmojiReactionSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+    name: emojiNameField,
+});
+export const DeleteIssueNoteEmojiReactionSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+    award_id: awardIdField,
+});
+// --- Emoji Reaction schemas (GraphQL: Work Items) ---
+export const CreateWorkItemEmojiReactionSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    name: emojiNameField,
+});
+export const DeleteWorkItemEmojiReactionSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    name: emojiNameField,
+});
+export const CreateWorkItemNoteEmojiReactionSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
+    name: emojiNameField,
+});
+export const DeleteWorkItemNoteEmojiReactionSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
+    name: emojiNameField,
+});
+export const ListMergeRequestEmojiReactionsSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+});
+export const ListMergeRequestNoteEmojiReactionsSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+});
+export const ListIssueEmojiReactionsSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+});
+export const ListIssueNoteEmojiReactionsSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+});
+export const ListWorkItemEmojiReactionsSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+});
+export const ListWorkItemNoteEmojiReactionsSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
+});
 // --- Incident Timeline Event schemas ---
 export const GetTimelineEventsSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),