@zereight/mcp-gitlab 2.1.0 → 2.1.2

package/build/test/mcp-oauth-tests.js

@@ -139,6 +139,55 @@ describe("MCP OAuth — Discovery Endpoints", () => {
         assert.ok(body.resource, "Should have resource field");
         console.log("  ✓ Protected resource metadata returned");
     });
+    test("path-prefixed MCP_SERVER_URL serves path-aware discovery metadata", async () => {
+        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + 25);
+        const prefixedMockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_OAUTH_TOKEN],
+        });
+        await prefixedMockGitLab.start();
+        const scopedServers = [];
+        try {
+            const mockGitLabUrl = prefixedMockGitLab.getUrl();
+            addOAuthEndpoints(prefixedMockGitLab, MOCK_OAUTH_TOKEN, MOCK_CLIENT_ID, mockGitLabUrl);
+            const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE + 25);
+            const mcpBaseUrl = `http://${HOST}:${mcpPort}`;
+            const issuerPath = "/gitlab-mcp";
+            const prefixedServerUrl = `${mcpBaseUrl}${issuerPath}`;
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    GITLAB_MCP_OAUTH: "true",
+                    GITLAB_OAUTH_APP_ID: "test-oauth-app-id",
+                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                    MCP_SERVER_URL: prefixedServerUrl,
+                    MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL: "true",
+                },
+            });
+            scopedServers.push(server);
+            const authMetadataRes = await fetch(`${mcpBaseUrl}/.well-known/oauth-authorization-server${issuerPath}`);
+            assert.strictEqual(authMetadataRes.status, 200, "Should return 200");
+            const authMetadata = (await authMetadataRes.json());
+            assert.strictEqual(authMetadata.issuer, prefixedServerUrl);
+            assert.strictEqual(authMetadata.authorization_endpoint, `${prefixedServerUrl}/authorize`);
+            assert.strictEqual(authMetadata.token_endpoint, `${prefixedServerUrl}/token`);
+            assert.strictEqual(authMetadata.registration_endpoint, `${prefixedServerUrl}/register`);
+            assert.strictEqual(authMetadata.revocation_endpoint, `${prefixedServerUrl}/revoke`);
+            const resourceMetadataRes = await fetch(`${mcpBaseUrl}/.well-known/oauth-protected-resource${issuerPath}/mcp`);
+            assert.strictEqual(resourceMetadataRes.status, 200, "Should return 200");
+            const resourceMetadata = (await resourceMetadataRes.json());
+            assert.strictEqual(resourceMetadata.resource, prefixedServerUrl);
+            assert.deepStrictEqual(resourceMetadata.authorization_servers, [prefixedServerUrl]);
+            console.log("  ✓ Path-prefixed discovery metadata returned at RFC well-known URLs");
+        }
+        finally {
+            cleanupServers(scopedServers);
+            await prefixedMockGitLab.stop();
+        }
+    });
 });
 // ---------------------------------------------------------------------------
 // Test suite: /mcp auth enforcement

package/build/test/schema-tests.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env ts-node
-import { GetFileContentsSchema, GitLabFileContentSchema, CreatePipelineSchema, CreateIssueNoteSchema } from '../schemas.js';
+import { GetFileContentsSchema, GitLabFileContentSchema, GitLabRepositorySchema, CreatePipelineSchema, CreateIssueNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateIssueEmojiReactionSchema, DeleteMergeRequestEmojiReactionSchema, DeleteIssueEmojiReactionSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, CreateIssueSchema, ListIssuesSchema, ListMergeRequestsSchema, GitLabTreeItemSchema } from '../schemas.js';
 function runGetFileContentsSchemaTests() {
     console.log('🧪 Testing GetFileContentsSchema...');
     const cases = [
@@ -371,13 +371,271 @@ function runCreateIssueNoteSchemaTests() {
     console.log(`\nResults: ${passed} passed, ${failed} failed`);
     return { passed, failed };
 }
+function runEmojiReactionSchemaTests() {
+    console.log('\n🧪 Testing Emoji Reaction Schemas...');
+    const cases = [
+        { name: 'schema:create_mr_emoji:valid', schema: CreateMergeRequestEmojiReactionSchema, input: { project_id: 'my/project', merge_request_iid: '42', name: 'thumbsup' }, expected: { project_id: 'my/project', merge_request_iid: '42', name: 'thumbsup' } },
+        { name: 'schema:create_mr_emoji:numeric-iid-coerced', schema: CreateMergeRequestEmojiReactionSchema, input: { project_id: 'my/project', merge_request_iid: 42, name: 'rocket' }, expected: { merge_request_iid: '42', name: 'rocket' } },
+        { name: 'schema:create_mr_emoji:reject-missing-name', schema: CreateMergeRequestEmojiReactionSchema, input: { project_id: 'my/project', merge_request_iid: '42' }, shouldFail: true },
+        { name: 'schema:delete_mr_emoji:valid', schema: DeleteMergeRequestEmojiReactionSchema, input: { project_id: 'my/project', merge_request_iid: '42', award_id: '123' }, expected: { merge_request_iid: '42', award_id: '123' } },
+        { name: 'schema:create_issue_emoji:valid', schema: CreateIssueEmojiReactionSchema, input: { project_id: 'my/project', issue_iid: '10', name: 'thumbsdown' }, expected: { issue_iid: '10', name: 'thumbsdown' } },
+        { name: 'schema:create_issue_emoji:reject-missing-name', schema: CreateIssueEmojiReactionSchema, input: { project_id: 'my/project', issue_iid: '10' }, shouldFail: true },
+        { name: 'schema:delete_issue_emoji:valid', schema: DeleteIssueEmojiReactionSchema, input: { project_id: 'my/project', issue_iid: '10', award_id: '99' }, expected: { issue_iid: '10', award_id: '99' } },
+        { name: 'schema:create_work_item_emoji:valid', schema: CreateWorkItemEmojiReactionSchema, input: { project_id: 'my/project', iid: 5, name: 'rocket' }, expected: { iid: 5, name: 'rocket' } },
+        { name: 'schema:create_work_item_emoji:reject-missing-name', schema: CreateWorkItemEmojiReactionSchema, input: { project_id: 'my/project', iid: 5 }, shouldFail: true },
+        { name: 'schema:create_work_item_note_emoji:valid', schema: CreateWorkItemNoteEmojiReactionSchema, input: { project_id: 'my/project', iid: 5, note_id: 'gid://gitlab/Note/123', name: 'thumbsup' }, expected: { iid: 5, note_id: 'gid://gitlab/Note/123', name: 'thumbsup' } },
+        { name: 'schema:create_work_item_note_emoji:reject-missing-note-id', schema: CreateWorkItemNoteEmojiReactionSchema, input: { project_id: 'my/project', iid: 5, name: 'thumbsup' }, shouldFail: true },
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = { name: testCase.name, status: 'failed' };
+        const parsed = testCase.schema.safeParse(testCase.input);
+        if (testCase.shouldFail) {
+            if (parsed.success) {
+                result.error = 'Expected schema validation to fail';
+            }
+            else {
+                result.status = 'passed';
+            }
+        }
+        else if (parsed.success) {
+            const expected = testCase.expected || {};
+            const matches = Object.entries(expected).every(([key, value]) => {
+                return parsed.data[key] === value;
+            });
+            if (matches) {
+                result.status = 'passed';
+            }
+            else {
+                result.error = `Unexpected parsed result: ${JSON.stringify(parsed.data)}`;
+            }
+        }
+        else {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
+function runGitLabRepositorySchemaTests() {
+    console.log('🧪 Testing GitLabRepositorySchema...');
+    const baseProject = {
+        id: '42',
+        name: 'my-project',
+        path_with_namespace: 'group/my-project',
+        description: null,
+    };
+    const cases = [
+        {
+            name: 'schema:repository:default_branch-null',
+            input: { ...baseProject, default_branch: null },
+            shouldFail: false,
+        },
+        {
+            name: 'schema:repository:default_branch-string',
+            input: { ...baseProject, default_branch: 'main' },
+            shouldFail: false,
+        },
+        {
+            name: 'schema:repository:default_branch-omitted',
+            input: { ...baseProject },
+            shouldFail: false,
+        },
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = { name: testCase.name, status: 'failed' };
+        const parsed = GitLabRepositorySchema.safeParse(testCase.input);
+        if (testCase.shouldFail) {
+            if (parsed.success) {
+                result.error = 'Expected schema validation to fail';
+            }
+            else {
+                result.status = 'passed';
+            }
+        }
+        else if (parsed.success) {
+            result.status = 'passed';
+        }
+        else {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
+function runLabelsCoercionSchemaTests() {
+    console.log('\n=== Labels Coercion Schema Tests ===');
+    const cases = [
+        {
+            name: 'schema:create_issue:labels-native-array',
+            schema: CreateIssueSchema,
+            input: { project_id: 'my/project', title: 'Test', labels: ['bug', 'enhancement'] },
+            expectedLabels: ['bug', 'enhancement'],
+        },
+        {
+            name: 'schema:create_issue:labels-stringified-array',
+            schema: CreateIssueSchema,
+            input: { project_id: 'my/project', title: 'Test', labels: '["bug","enhancement"]' },
+            expectedLabels: ['bug', 'enhancement'],
+        },
+        {
+            name: 'schema:create_issue:labels-omitted',
+            schema: CreateIssueSchema,
+            input: { project_id: 'my/project', title: 'Test' },
+            expectedLabels: undefined,
+        },
+        {
+            name: 'schema:list_issues:labels-native-array',
+            schema: ListIssuesSchema,
+            input: { project_id: 'my/project', labels: ['bug'] },
+            expectedLabels: ['bug'],
+        },
+        {
+            name: 'schema:list_issues:labels-stringified-array',
+            schema: ListIssuesSchema,
+            input: { project_id: 'my/project', labels: '["bug","enhancement"]' },
+            expectedLabels: ['bug', 'enhancement'],
+        },
+        {
+            name: 'schema:list_merge_requests:labels-native-array',
+            schema: ListMergeRequestsSchema,
+            input: { labels: ['feature'] },
+            expectedLabels: ['feature'],
+        },
+        {
+            name: 'schema:list_merge_requests:labels-stringified-array',
+            schema: ListMergeRequestsSchema,
+            input: { labels: '["feature","bugfix"]' },
+            expectedLabels: ['feature', 'bugfix'],
+        },
+    ];
+    let passed = 0;
+    let failed = 0;
+    function checkLabelResult(testCase, parsed) {
+        const result = { name: testCase.name, status: 'failed' };
+        if (!parsed.success) {
+            result.error = parsed.error?.message || 'Schema validation failed';
+            return result;
+        }
+        const actualLabels = parsed.data['labels'];
+        if (testCase.expectedLabels === undefined) {
+            result.status = actualLabels === undefined ? 'passed' : 'failed';
+            if (actualLabels !== undefined) {
+                result.error = `Expected labels to be undefined, got ${JSON.stringify(actualLabels)}`;
+            }
+            return result;
+        }
+        const match = Array.isArray(actualLabels) &&
+            actualLabels.length === testCase.expectedLabels.length &&
+            testCase.expectedLabels.every((v, i) => actualLabels[i] === v);
+        result.status = match ? 'passed' : 'failed';
+        if (!match) {
+            result.error = `Expected ${JSON.stringify(testCase.expectedLabels)}, got ${JSON.stringify(actualLabels)}`;
+        }
+        return result;
+    }
+    cases.forEach(testCase => {
+        const parsed = testCase.schema.safeParse(testCase.input);
+        let result;
+        if (testCase.shouldFail) {
+            result = { name: testCase.name, status: parsed.success ? 'failed' : 'passed' };
+            if (parsed.success)
+                result.error = 'Expected schema validation to fail';
+        }
+        else {
+            result = checkLabelResult(testCase, parsed);
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
+function runGitLabTreeItemSchemaTests() {
+    console.log('\n=== GitLabTreeItem Schema Tests ===');
+    const cases = [
+        {
+            name: 'schema:tree_item:type-blob',
+            input: { id: 'abc123', name: 'README.md', type: 'blob', path: 'README.md', mode: '100644' },
+        },
+        {
+            name: 'schema:tree_item:type-tree',
+            input: { id: 'def456', name: 'src', type: 'tree', path: 'src', mode: '040000' },
+        },
+        {
+            name: 'schema:tree_item:type-commit-submodule',
+            input: { id: 'ghi789', name: 'vendor', type: 'commit', path: 'vendor', mode: '160000' },
+        },
+        {
+            name: 'schema:tree_item:reject-unknown-type',
+            input: { id: 'xyz', name: 'foo', type: 'symlink', path: 'foo', mode: '120000' },
+            shouldFail: true,
+        },
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = { name: testCase.name, status: 'failed' };
+        const parsed = GitLabTreeItemSchema.safeParse(testCase.input);
+        if (testCase.shouldFail) {
+            result.status = parsed.success ? 'failed' : 'passed';
+            if (parsed.success)
+                result.error = 'Expected schema validation to fail';
+        }
+        else if (parsed.success) {
+            result.status = 'passed';
+        }
+        else {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
 if (import.meta.url === `file://${process.argv[1]}`) {
     const getFileContentsResult = runGetFileContentsSchemaTests();
     const fileContentResult = runGitLabFileContentSchemaTests();
     const createPipelineResult = runCreatePipelineSchemaTests();
     const createIssueNoteResult = runCreateIssueNoteSchemaTests();
-    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + createIssueNoteResult.passed;
-    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + createIssueNoteResult.failed;
+    const emojiReactionResult = runEmojiReactionSchemaTests();
+    const repositorySchemaResult = runGitLabRepositorySchemaTests();
+    const labelsCoercionResult = runLabelsCoercionSchemaTests();
+    const treeItemResult = runGitLabTreeItemSchemaTests();
+    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + createIssueNoteResult.passed + emojiReactionResult.passed + repositorySchemaResult.passed + labelsCoercionResult.passed + treeItemResult.passed;
+    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + createIssueNoteResult.failed + emojiReactionResult.failed + repositorySchemaResult.failed + labelsCoercionResult.failed + treeItemResult.failed;
     console.log(`\nTotal Results: ${totalPassed} passed, ${totalFailed} failed`);
     if (totalFailed > 0) {
         process.exit(1);

package/build/test/test-auth-retry.js

@@ -0,0 +1,188 @@
+/**
+ * Auth Retry Tests
+ * Unit tests for headersToPlainObject, isNonReplayableBody, and wrapWithAuthRetry.
+ *
+ * These are pure-function / DI-based tests — no env vars or external services needed.
+ */
+import { describe, test } from "node:test";
+import assert from "node:assert";
+import { Headers, Response } from "node-fetch";
+import { headersToPlainObject, isNonReplayableBody, wrapWithAuthRetry, } from "../auth-retry.js";
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function mockFetch(status) {
+    return (async () => new Response("", { status }));
+}
+function mockFetchThenRetry() {
+    let callCount = 0;
+    return (async () => {
+        callCount++;
+        return new Response("", { status: callCount === 1 ? 401 : 200 });
+    });
+}
+function makeConfig(overrides) {
+    return {
+        isOAuthEnabled: () => true,
+        refreshToken: async () => "new-token",
+        onTokenRefreshed: () => { },
+        buildAuthHeaders: () => ({ Authorization: "Bearer new-token" }),
+        ...overrides,
+    };
+}
+// ---------------------------------------------------------------------------
+// headersToPlainObject
+// ---------------------------------------------------------------------------
+describe("headersToPlainObject", () => {
+    test("null returns empty object", () => {
+        assert.deepStrictEqual(headersToPlainObject(null), {});
+    });
+    test("undefined returns empty object", () => {
+        assert.deepStrictEqual(headersToPlainObject(undefined), {});
+    });
+    test("plain object passed through", () => {
+        const obj = { "Content-Type": "application/json", Accept: "text/html" };
+        assert.deepStrictEqual(headersToPlainObject(obj), obj);
+    });
+    test("Headers instance normalized", () => {
+        const h = new Headers();
+        h.set("x-custom", "value1");
+        h.set("authorization", "Bearer tok");
+        const result = headersToPlainObject(h);
+        assert.strictEqual(result["x-custom"], "value1");
+        assert.strictEqual(result["authorization"], "Bearer tok");
+    });
+    test("array of tuples normalized", () => {
+        const arr = [
+            ["x-foo", "bar"],
+            ["x-baz", "qux"],
+        ];
+        assert.deepStrictEqual(headersToPlainObject(arr), {
+            "x-foo": "bar",
+            "x-baz": "qux",
+        });
+    });
+});
+// ---------------------------------------------------------------------------
+// isNonReplayableBody
+// ---------------------------------------------------------------------------
+describe("isNonReplayableBody", () => {
+    test("null returns false", () => {
+        assert.strictEqual(isNonReplayableBody(null), false);
+    });
+    test("undefined returns false", () => {
+        assert.strictEqual(isNonReplayableBody(undefined), false);
+    });
+    test("empty string returns false", () => {
+        assert.strictEqual(isNonReplayableBody(""), false);
+    });
+    test("plain string returns false", () => {
+        assert.strictEqual(isNonReplayableBody("hello"), false);
+    });
+    test("object with .pipe() returns true (stream-like)", () => {
+        assert.strictEqual(isNonReplayableBody({ pipe: () => { } }), true);
+    });
+    test("object with .read() returns true (stream-like)", () => {
+        assert.strictEqual(isNonReplayableBody({ read: () => { } }), true);
+    });
+    test("object with .getBuffer() and .getBoundary() returns true (FormData-like)", () => {
+        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { }, getBoundary: () => { } }), true);
+    });
+    test("object with only .getBuffer() (no .getBoundary()) returns false", () => {
+        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { } }), false);
+    });
+});
+// ---------------------------------------------------------------------------
+// wrapWithAuthRetry
+// ---------------------------------------------------------------------------
+describe("wrapWithAuthRetry", () => {
+    test("non-401 response passes through unchanged", async () => {
+        const wrapped = wrapWithAuthRetry(mockFetch(200), makeConfig());
+        const res = await wrapped("http://example.com");
+        assert.strictEqual(res.status, 200);
+    });
+    test("401 when OAuth disabled passes through unchanged", async () => {
+        const config = makeConfig({ isOAuthEnabled: () => false });
+        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
+        const res = await wrapped("http://example.com");
+        assert.strictEqual(res.status, 401);
+    });
+    test("401 with OAuth enabled triggers refresh and retry", async () => {
+        let refreshCalled = false;
+        let tokenSet = null;
+        const config = makeConfig({
+            refreshToken: async () => {
+                refreshCalled = true;
+                return "refreshed-token";
+            },
+            onTokenRefreshed: (token) => {
+                tokenSet = token;
+            },
+            buildAuthHeaders: () => ({ Authorization: "Bearer refreshed-token" }),
+        });
+        const base = mockFetchThenRetry();
+        const wrapped = wrapWithAuthRetry(base, config);
+        const res = await wrapped("http://example.com");
+        assert.strictEqual(res.status, 200);
+        assert.strictEqual(refreshCalled, true);
+        assert.strictEqual(tokenSet, "refreshed-token");
+    });
+    test("401 with non-replayable body skips retry", async () => {
+        let refreshCalled = false;
+        const config = makeConfig({
+            refreshToken: async () => {
+                refreshCalled = true;
+                return "tok";
+            },
+        });
+        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
+        const res = await wrapped("http://example.com", {
+            body: { pipe: () => { } }, // stream-like
+        });
+        assert.strictEqual(res.status, 401);
+        assert.strictEqual(refreshCalled, false);
+    });
+    test("concurrent 401s only trigger one refresh (stampede test)", async () => {
+        let refreshCount = 0;
+        let resolveRefresh = () => { };
+        const config = makeConfig({
+            refreshToken: () => {
+                refreshCount++;
+                return new Promise((resolve) => {
+                    resolveRefresh = resolve;
+                });
+            },
+            buildAuthHeaders: () => ({ Authorization: "Bearer stamped" }),
+        });
+        // Each call returns 401 first, then 200 on retry
+        let callCount = 0;
+        const base = (async () => {
+            callCount++;
+            // First two calls are the initial requests (both 401)
+            // Next two are the retries (both 200)
+            return new Response("", { status: callCount <= 2 ? 401 : 200 });
+        });
+        const wrapped = wrapWithAuthRetry(base, config);
+        // Fire two concurrent requests
+        const p1 = wrapped("http://example.com/a");
+        const p2 = wrapped("http://example.com/b");
+        // Wait a tick for both to hit the refresh path
+        await new Promise((r) => setTimeout(r, 10));
+        // Resolve the single pending refresh
+        resolveRefresh("stamped-token");
+        const [r1, r2] = await Promise.all([p1, p2]);
+        assert.strictEqual(r1.status, 200);
+        assert.strictEqual(r2.status, 200);
+        assert.strictEqual(refreshCount, 1, "refresh should be called exactly once");
+    });
+    test("token refresh failure returns original 401 response", async () => {
+        const config = makeConfig({
+            refreshToken: async () => {
+                throw new Error("refresh exploded");
+            },
+        });
+        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
+        const res = await wrapped("http://example.com");
+        assert.strictEqual(res.status, 401);
+    });
+});

package/build/test/test-search-code.js

@@ -71,8 +71,8 @@ describe("Search Code Tools", () => {
         if (mockGitLab)
             await mockGitLab.stop();
     });
-    // ---- 1. search toolset exposes exactly 3 tools ----
-    describe("search toolset exposes exactly 3 tools", () => {
+    // ---- 1. search toolset exposes exactly 4 tools ----
+    describe("search toolset exposes exactly 4 tools", () => {
         let server;
         let tools;
         before(async () => {
@@ -83,8 +83,8 @@ describe("Search Code Tools", () => {
             tools = await getToolNames(`http://${HOST}:${port}/mcp`);
         });
         after(() => cleanupServers([server]));
-        test("returns exactly 3 tools", () => {
-            assert.strictEqual(tools.length, 3, `Expected 3 tools but got ${tools.length}: ${tools.join(", ")}`);
+        test("returns exactly 4 tools", () => {
+            assert.strictEqual(tools.length, 4, `Expected 4 tools but got ${tools.length}: ${tools.join(", ")}`);
         });
         test("includes search_code", () => {
             assert.ok(tools.includes("search_code"), "Expected search_code to be present");
@@ -95,6 +95,9 @@ describe("Search Code Tools", () => {
         test("includes search_group_code", () => {
             assert.ok(tools.includes("search_group_code"), "Expected search_group_code to be present");
         });
+        test("includes discover_tools", () => {
+            assert.ok(tools.includes("discover_tools"), "Expected discover_tools to be present");
+        });
     });
     // ---- 2. search_code returns blob results ----
     describe("search_code returns blob results", () => {

package/build/test/test-token-optimizations.js

@@ -392,6 +392,9 @@ describe("Policy Edge Cases", { concurrency: 1 }, () => {
             "update_issue", "delete_issue", "create_issue_note", "update_issue_note",
             "list_issue_links", "list_issue_discussions", "get_issue_link",
             "create_issue_link", "delete_issue_link", "create_note",
+            "list_issue_emoji_reactions", "list_issue_note_emoji_reactions",
+            "create_issue_emoji_reaction", "delete_issue_emoji_reaction",
+            "create_issue_note_emoji_reaction", "delete_issue_note_emoji_reaction",
         ].join(",");
         const server = await launchMcp(mockGitLabUrl, {
             GITLAB_TOOLSETS: "issues",

package/build/test/test-toolset-filtering.js

@@ -16,8 +16,8 @@ const MOCK_PORT_BASE = 9200;
 const MCP_PORT_BASE = 3200;
 // Known tool counts per toolset (from TOOLSET_DEFINITIONS)
 const TOOLSET_TOOL_COUNTS = {
-    merge_requests: 34,
-    issues: 14,
+    merge_requests: 40,
+    issues: 20,
     repositories: 7,
     branches: 4,
     projects: 8,
@@ -28,7 +28,7 @@ const TOOLSET_TOOL_COUNTS = {
     releases: 7,
     users: 5,
     search: 3,
-    workitems: 12,
+    workitems: 18,
     webhooks: 3,
 };
 const DEFAULT_TOOLSETS = [
@@ -286,6 +286,8 @@ describe("Toolset Filtering", { concurrency: 1 }, () => {
             "list_issue_links",
             "list_issue_discussions",
             "get_issue_link",
+            "list_issue_emoji_reactions",
+            "list_issue_note_emoji_reactions",
         ];
         const writeIssueTools = [
             "create_issue",
@@ -296,6 +298,10 @@ describe("Toolset Filtering", { concurrency: 1 }, () => {
             "create_issue_link",
             "delete_issue_link",
             "create_note",
+            "create_issue_emoji_reaction",
+            "delete_issue_emoji_reaction",
+            "create_issue_note_emoji_reaction",
+            "delete_issue_note_emoji_reaction",
         ];
         before(async () => {
             const port = await nextMcpPort();