@zereight/mcp-gitlab 2.1.29 → 2.1.38

package/build/test/test-remote-downloads.js

@@ -49,7 +49,7 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
     let server;
     let serverPort;
     before(async () => {
-        const mockPort = await findMockServerPort(9300);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN, LARGE_FILE_TOKEN],
@@ -222,7 +222,7 @@ describe('Remote Downloads - Tool Behavior via MCP Protocol', { timeout: 60_000
     let serverPort;
     let sessionId;
     before(async () => {
-        const mockPort = await findMockServerPort(9310);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-search-code.js

@@ -58,7 +58,7 @@ let mockGitLab;
 let mockGitLabUrl;
 describe("Search Code Tools", () => {
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-tags.js

@@ -88,7 +88,7 @@ describe("tag tools", () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(20000, 50);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-todos.js

@@ -105,7 +105,7 @@ describe("GitLab todos tools", () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(9250);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-token-optimizations.js

@@ -129,7 +129,7 @@ describe("Tool Policy (Proposal F)", { concurrency: 1 }, () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],
@@ -277,7 +277,7 @@ describe("Policy Edge Cases", { concurrency: 1 }, () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_PORT_BASE + 50);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],
@@ -557,7 +557,7 @@ describe("Dynamic Discovery (Proposal H)", { concurrency: 1 }, () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_PORT_BASE + 100);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-toolset-filtering.js

@@ -24,7 +24,7 @@ const TOOLSET_TOOL_COUNTS = {
     labels: 5,
     ci: 4,
     pipelines: 19,
-    milestones: 9,
+    milestones: 17,
     wiki: 10,
     releases: 7,
     tags: 5,
@@ -75,7 +75,7 @@ const TOOLSET_SAMPLE_TOOLS = {
     labels: ["list_labels", "create_label"],
     ci: ["validate_ci_lint", "validate_project_ci_lint", "list_ci_catalog_resources", "get_ci_catalog_resource"],
     pipelines: ["list_pipelines", "create_pipeline", "cancel_pipeline_job", "list_deployments", "list_job_artifacts"],
-    milestones: ["list_milestones", "create_milestone", "get_milestone_burndown_events"],
+    milestones: ["list_milestones", "create_milestone", "list_group_milestones", "get_group_milestone_burndown_events"],
     wiki: ["list_wiki_pages", "create_wiki_page", "list_group_wiki_pages", "create_group_wiki_page"],
     releases: ["list_releases", "create_release", "download_release_asset"],
     tags: ["list_tags", "create_tag", "get_tag_signature"],
@@ -128,7 +128,7 @@ async function nextMcpPort() {
 }
 describe("Toolset Filtering", { concurrency: 1 }, () => {
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-update-issue-slim.js

@@ -0,0 +1,141 @@
+/**
+ * Tests for the update_issue slim response (issue #563).
+ * By default update_issue returns a slim confirmation; full_response=true
+ * returns the complete updated issue object.
+ */
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST, } from "./utils/server-launcher.js";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+import { CustomHeaderClient } from "./clients/custom-header-client.js";
+const MOCK_TOKEN = "glpat-slim-update-test-token";
+describe("update_issue slim response", () => {
+    let mockGitLab;
+    let server;
+    let client;
+    const MOCK_PORT_BASE = 9650;
+    const MCP_PORT_BASE = 3650;
+    before(async () => {
+        const mockPort = await findMockServerPort();
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN],
+        });
+        await mockGitLab.start();
+        server = await launchServer({
+            mode: TransportMode.STREAMABLE_HTTP,
+            port: await findAvailablePort(MCP_PORT_BASE),
+            timeout: 10000,
+            env: {
+                STREAMABLE_HTTP: "true",
+                REMOTE_AUTHORIZATION: "true",
+                GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                GITLAB_ACCESS_TOKEN: MOCK_TOKEN,
+                GITLAB_TOOLSETS: "issues",
+            },
+        });
+        client = new CustomHeaderClient({
+            headers: {
+                authorization: `Bearer ${MOCK_TOKEN}`,
+            },
+        });
+        await client.connect(`http://${HOST}:${server.port ?? 0}/mcp`);
+    });
+    after(async () => {
+        await client?.disconnect();
+        cleanupServers([server]);
+        await mockGitLab?.stop();
+    });
+    test("default response is slim: no description echo", async () => {
+        const result = await client.callTool("update_issue", {
+            project_id: "test/project",
+            issue_iid: "1",
+            description: "A very long description that should not be echoed back",
+        });
+        const data = JSON.parse(result.content[0]?.text || "{}");
+        assert.strictEqual(data.iid, "1");
+        assert.strictEqual(data.state, "opened");
+        assert.ok(data.title, "title should be present");
+        assert.ok(data.web_url, "web_url should be present");
+        assert.ok(data.updated_at, "updated_at should be present");
+        assert.strictEqual(data.description, undefined, "description must not be echoed");
+        assert.strictEqual(data.author, undefined, "author must not be included");
+        assert.strictEqual(data.milestone, undefined, "milestone must not be included");
+    });
+    test("slim response reflects state changes", async () => {
+        const result = await client.callTool("update_issue", {
+            project_id: "test/project",
+            issue_iid: "2",
+            state_event: "close",
+        });
+        const data = JSON.parse(result.content[0]?.text || "{}");
+        assert.strictEqual(data.state, "closed");
+        assert.strictEqual(data.description, undefined);
+    });
+    test('full_response="false" string keeps the response slim', async () => {
+        const result = await client.callTool("update_issue", {
+            project_id: "test/project",
+            issue_iid: "3",
+            description: "A long description that should still not be echoed",
+            full_response: "false",
+        });
+        const data = JSON.parse(result.content[0]?.text || "{}");
+        assert.strictEqual(data.description, undefined);
+        assert.strictEqual(data.author, undefined);
+        assert.strictEqual(data.iid, "3");
+    });
+    test("full_response=true returns the complete issue object", async () => {
+        const result = await client.callTool("update_issue", {
+            project_id: "test/project",
+            issue_iid: "4",
+            description: "Full description expected in response",
+            full_response: true,
+        });
+        const data = JSON.parse(result.content[0]?.text || "{}");
+        assert.strictEqual(data.description, "Full description expected in response");
+        assert.ok(data.author, "author should be present in full response");
+        assert.strictEqual(data.iid, "4");
+    });
+    test("full_response is not forwarded to the GitLab API", async () => {
+        const result = await client.callTool("update_issue", {
+            project_id: "test/project",
+            issue_iid: "5",
+            title: "Updated title",
+            full_response: true,
+        });
+        const data = JSON.parse(result.content[0]?.text || "{}");
+        assert.strictEqual(data.title, "Updated title");
+        assert.strictEqual(data.full_response, undefined, "full_response must not leak into the issue");
+    });
+    test("get_issue slims the milestone by default", async () => {
+        const result = await client.callTool("get_issue", {
+            project_id: "test/project",
+            issue_iid: "100",
+        });
+        const data = JSON.parse(result.content[0]?.text || "{}");
+        assert.ok(data.milestone, "milestone should be present");
+        assert.strictEqual(data.milestone.title, "Sprint 42");
+        assert.ok(data.milestone.web_url, "milestone web_url should be present");
+        assert.strictEqual(data.milestone.description, undefined, "milestone description must not be echoed by default");
+        assert.ok(data.description, "issue description should still be present");
+    });
+    test("get_issue full_response=true returns the full milestone", async () => {
+        const result = await client.callTool("get_issue", {
+            project_id: "test/project",
+            issue_iid: "100",
+            full_response: true,
+        });
+        const data = JSON.parse(result.content[0]?.text || "{}");
+        assert.ok(data.milestone, "milestone should be present");
+        assert.ok(typeof data.milestone.description === "string" && data.milestone.description.length > 0, "milestone description should be included with full_response");
+    });
+    test("get_issue without milestone is unaffected", async () => {
+        const result = await client.callTool("get_issue", {
+            project_id: "test/project",
+            issue_iid: "6",
+        });
+        const data = JSON.parse(result.content[0]?.text || "{}");
+        assert.strictEqual(data.milestone, null);
+        assert.strictEqual(data.iid, "6");
+    });
+});

package/build/test/test-upload-markdown.js

@@ -68,7 +68,7 @@ describe('upload_markdown', () => {
         lastRawBody = undefined;
     });
     before(async () => {
-        const port = await findMockServerPort(9200);
+        const port = await findMockServerPort();
         mockGitLab = new MockGitLabServer({ port, validTokens: [MOCK_TOKEN] });
         await mockGitLab.start();
         env = {

package/build/test/utils/download-token.test.js

@@ -0,0 +1,35 @@
+import { describe, test } from "node:test";
+import assert from "node:assert";
+import { createDownloadToken, decryptDownloadToken } from "../../utils/download-token.js";
+describe("download token helpers", () => {
+    test("round-trips auth, api URL, and resource binding", () => {
+        const token = createDownloadToken("Authorization", "Bearer glpat-example-token", "https://gitlab.example.com/api/v4", {
+            type: "attachment",
+            params: { project_id: "group/project", secret: "abc", filename: "file.txt" },
+        });
+        const decrypted = decryptDownloadToken(token);
+        assert.deepStrictEqual(decrypted, {
+            header: "Authorization",
+            token: "Bearer glpat-example-token",
+            apiUrl: "https://gitlab.example.com/api/v4",
+            resourceType: "attachment",
+            resourceParams: { project_id: "group/project", secret: "abc", filename: "file.txt" },
+        });
+    });
+    test("returns null for invalid tokens", () => {
+        assert.strictEqual(decryptDownloadToken("not-a-valid-token"), null);
+    });
+    test("returns null for expired tokens", () => {
+        const originalNow = Date.now;
+        const issuedAt = 1_700_000_000_000;
+        try {
+            Date.now = () => issuedAt;
+            const token = createDownloadToken("Private-Token", "glpat-example-token");
+            Date.now = () => issuedAt + 301_000;
+            assert.strictEqual(decryptDownloadToken(token), null);
+        }
+        finally {
+            Date.now = originalNow;
+        }
+    });
+});

package/build/test/utils/forwarded-public-base-url.test.js

@@ -1,6 +1,6 @@
 import { describe, test } from "node:test";
 import assert from "node:assert";
-import { getForwardedPublicBaseUrl } from "../../utils/forwarded-public-base-url.js";
+import { getForwardedPublicBaseUrl, getForwardedRequestHost } from "../../utils/forwarded-public-base-url.js";
 function req(headers) {
     return { headers };
 }
@@ -36,3 +36,11 @@ describe("getForwardedPublicBaseUrl", () => {
         }), true), "https://mcp.example.com");
     });
 });
+describe("getForwardedRequestHost", () => {
+    test("returns undefined unless proxy headers are trusted", () => {
+        assert.strictEqual(getForwardedRequestHost(req({ "x-forwarded-host": "mcp.example.com" }), false), undefined);
+    });
+    test("returns the forwarded host when proxy headers are trusted", () => {
+        assert.strictEqual(getForwardedRequestHost(req({ "x-forwarded-host": "mcp.example.com" }), true), "mcp.example.com");
+    });
+});

package/build/test/utils/graphql-query.test.js

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { describe, test } from "node:test";
-import { graphqlQueryContainsWriteOperation } from "../../utils/graphql-query.js";
+import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "../../utils/graphql-query.js";
 describe("When graphqlQueryContainsWriteOperation runs", () => {
     describe("with read-only GraphQL documents", () => {
         test("should allow explicit query operations", () => {
@@ -15,6 +15,18 @@ describe("When graphqlQueryContainsWriteOperation runs", () => {
         test("should ignore mutation text inside string literals", () => {
             assert.equal(graphqlQueryContainsWriteOperation('query { search(query: "mutation") { nodes { id } } }'), false);
         });
+        test("should ignore escaped triple quotes inside block strings", () => {
+            assert.equal(graphqlQueryContainsWriteOperation('query { project(fullPath: """contains \\""" not a mutation""") { id } }'), false);
+        });
+        test("should not treat subscription field names as write operations", () => {
+            assert.equal(graphqlQueryContainsWriteOperation("query { project { id }, subscription { count } }"), false);
+        });
+        test("should allow query with operation name 'mutation'", () => {
+            assert.equal(graphqlQueryContainsWriteOperation("query mutation { project { id } }"), false);
+        });
+        test("should allow query with operation name 'subscription'", () => {
+            assert.equal(graphqlQueryContainsWriteOperation("query subscription { project { id } }"), false);
+        });
     });
     describe("with write GraphQL documents", () => {
         test("should detect mutation operations", () => {
@@ -29,5 +41,56 @@ describe("When graphqlQueryContainsWriteOperation runs", () => {
         test("should detect semicolon-separated write operations", () => {
             assert.equal(graphqlQueryContainsWriteOperation("query A { a }; mutation B { b }"), true);
         });
+        test("should detect comma-prefixed write operations", () => {
+            assert.equal(graphqlQueryContainsWriteOperation(",mutation { destroyProject(input: { projectId: 1 }) { errors } }"), true);
+        });
+        test("should detect comma-separated write operations", () => {
+            assert.equal(graphqlQueryContainsWriteOperation("query A { a }, mutation B { b }"), true);
+        });
+    });
+});
+describe("When graphqlQueryContainsDeleteOperation runs", () => {
+    describe("with non-delete documents", () => {
+        test("should allow plain queries even when they mention delete words", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("query { project { removeSourceBranchAfterMerge } }"), false);
+        });
+        test("should allow non-delete mutations", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation('mutation { issueSetSeverity(input: { severity: HIGH }) { errors } }'), false);
+        });
+        test("should not count delete-like argument names inside parentheses", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { mergeRequestUpdate(input: { removeSourceBranch: true }) { errors } }"), false);
+        });
+        test("should not count delete-like fields nested below the mutation root", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { issueSetLabels(input: {}) { issue { canBeDeleted } } }"), false);
+        });
+        test("should ignore delete text inside comments", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("# issueDelete\nmutation { issueSetLabels { errors } }"), false);
+        });
+        test("should ignore delete text inside string literals", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation('mutation { createNote(input: { body: "projectDelete" }) { errors } }'), false);
+        });
+    });
+    describe("with delete documents", () => {
+        test("should detect delete mutation fields", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation('mutation { issueDelete(input: { projectPath: "g/p", iid: "1" }) { errors } }'), true);
+        });
+        test("should detect destroy mutation fields", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation('mutation { destroyBoard(input: { id: "gid://gitlab/Board/1" }) { errors } }'), true);
+        });
+        test("should detect remove mutation fields", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { awardEmojiRemove(input: {}) { errors } }"), true);
+        });
+        test("should detect aliased delete mutation fields", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { a: issueDelete(input: {}) { errors } }"), true);
+        });
+        test("should detect delete mutations in multi-operation documents", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("query A { project { id } } mutation B { labelDelete(input: {}) { errors } }"), true);
+        });
+        test("should detect delete mutations with variable definitions", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation DeleteIssue($id: IssueID!) { issueDelete(input: { id: $id }) { errors } }"), true);
+        });
+        test("should conservatively block top-level fragment spreads in mutations", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { ...f } fragment f on Mutation { issueDelete(input: {}) { errors } }"), true);
+        });
     });
 });

package/build/test/utils/mock-gitlab-server.js

@@ -342,7 +342,16 @@ export class MockGitLabServer {
                 },
                 assignees: [],
                 labels: [],
-                milestone: null,
+                milestone: issueIid === 100
+                    ? {
+                        id: 42,
+                        iid: 7,
+                        title: "Sprint 42",
+                        description: "A very long milestone description ".repeat(50),
+                        state: "active",
+                        web_url: `https://gitlab.mock/project/${projectId}/milestones/7`,
+                    }
+                    : null,
             });
         });
         // PUT /api/v4/projects/:projectId/issues/:issue_iid - Update issue
@@ -545,11 +554,16 @@ export class MockGitLabServer {
         });
     }
     async start() {
-        return new Promise(resolve => {
+        return new Promise((resolve, reject) => {
             this.server = this.app.listen(this.config.port, "127.0.0.1", () => {
+                const address = this.server?.address();
+                if (typeof address === "object" && address) {
+                    this.config.port = address.port;
+                }
                 console.log(`Mock GitLab API listening on http://127.0.0.1:${this.config.port}`);
                 resolve();
             });
+            this.server.once("error", reject);
         });
     }
     async stop() {
@@ -572,38 +586,17 @@ export class MockGitLabServer {
     getUrl() {
         return `http://127.0.0.1:${this.config.port}`;
     }
+    getPort() {
+        return this.config.port;
+    }
 }
 /**
- * Helper to find available port for mock server
+ * Helper to find available port for mock server (OS-assigned ephemeral port).
+ * Returns 0 to signal MockGitLabServer.start() to use OS-assigned port,
+ * avoiding TOCTOU race where another test grabs the port before binding.
  */
-export async function findMockServerPort(basePort = 9000, maxAttempts = 10) {
-    const net = await import("net");
-    const tryPort = async (port, attemptsLeft) => {
-        if (attemptsLeft === 0) {
-            throw new Error(`Could not find available port after ${maxAttempts} attempts starting from ${basePort}`);
-        }
-        return new Promise((resolve, reject) => {
-            const server = net.createServer();
-            server.unref();
-            server.on("error", async () => {
-                try {
-                    const nextPort = await tryPort(port + 1, attemptsLeft - 1);
-                    resolve(nextPort);
-                }
-                catch (err) {
-                    reject(err);
-                }
-            });
-            server.listen(port, "127.0.0.1", () => {
-                const addr = server.address();
-                const actualPort = typeof addr === "object" && addr ? addr.port : port;
-                server.close(() => {
-                    resolve(actualPort);
-                });
-            });
-        });
-    };
-    return tryPort(basePort, maxAttempts);
+export async function findMockServerPort() {
+    return 0;
 }
 /**
  * Reset request counter (useful for rate limit testing)

package/build/test/utils/server-launcher.js

@@ -58,8 +58,7 @@ export async function launchServer(config) {
             throw new Error(`${TransportMode.STDIO} mode is not supported for server testing, because it uses process communication.`);
     }
     const serverPath = path.resolve(process.cwd(), "build/index.js");
-    console.log("Launcher: Spawning server process with env:", serverEnv);
-    console.log("Launcher: Spawning server process with env:", serverEnv);
+    console.log("Launcher: Spawning server process", { mode, port });
     const serverProcess = spawn("node", [serverPath], {
         env: serverEnv,
         stdio: ["pipe", "pipe", "pipe"],

package/build/test/utils/version-check.test.js

@@ -0,0 +1,52 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { checkForNewVersion, isNewerVersion } from "../../utils/version-check.js";
+function fetchReturning(status, body) {
+    return (async () => new Response(JSON.stringify(body), { status }));
+}
+describe("When isNewerVersion compares versions", () => {
+    test("should detect newer patch, minor, and major versions", () => {
+        assert.equal(isNewerVersion("2.1.30", "2.1.29"), true);
+        assert.equal(isNewerVersion("2.2.0", "2.1.29"), true);
+        assert.equal(isNewerVersion("3.0.0", "2.1.29"), true);
+    });
+    test("should return false for equal or older versions", () => {
+        assert.equal(isNewerVersion("2.1.29", "2.1.29"), false);
+        assert.equal(isNewerVersion("2.1.28", "2.1.29"), false);
+        assert.equal(isNewerVersion("1.9.9", "2.0.0"), false);
+    });
+    test("should return false for malformed versions", () => {
+        assert.equal(isNewerVersion("unknown", "2.1.29"), false);
+        assert.equal(isNewerVersion("2.1.30", "unknown"), false);
+    });
+});
+describe("When checkForNewVersion runs", () => {
+    test("should return the latest version when the registry has a newer one", async () => {
+        const latest = await checkForNewVersion("2.1.29", fetchReturning(200, { version: "2.1.31" }));
+        assert.equal(latest, "2.1.31");
+    });
+    test("should return null when already on the latest version", async () => {
+        const latest = await checkForNewVersion("2.1.31", fetchReturning(200, { version: "2.1.31" }));
+        assert.equal(latest, null);
+    });
+    test("should return null without fetching when current version is unknown", async () => {
+        let called = false;
+        const spyFetch = (async () => {
+            called = true;
+            return new Response("{}", { status: 200 });
+        });
+        assert.equal(await checkForNewVersion("unknown", spyFetch), null);
+        assert.equal(called, false);
+    });
+    test("should return null on registry errors instead of throwing", async () => {
+        const failingFetch = (async () => {
+            throw new Error("network down");
+        });
+        assert.equal(await checkForNewVersion("2.1.29", failingFetch), null);
+        assert.equal(await checkForNewVersion("2.1.29", fetchReturning(500, {})), null);
+    });
+    test("should return null when the registry returns a non-release version", async () => {
+        const latest = await checkForNewVersion("2.1.29", fetchReturning(200, { version: "2.2.0-beta.1" }));
+        assert.equal(latest, null);
+    });
+});