@zereight/mcp-gitlab 2.1.49 → 2.1.51

package/build/test/schema-tests.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env ts-node
-import { GetFileContentsSchema, GitLabFileContentSchema, GitLabRepositorySchema, CreatePipelineSchema, CreateCommitStatusSchema, ListCommitStatusesSchema, CreateIssueNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateIssueEmojiReactionSchema, DeleteMergeRequestEmojiReactionSchema, DeleteIssueEmojiReactionSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, CreateIssueSchema, ListIssuesSchema, ListMergeRequestsSchema, ListLabelsSchema, GitLabMergeRequestSchema, GitLabTreeItemSchema, GetMergeRequestSchema, ListMergeRequestPipelinesSchema, GetRepositoryTreeSchema, GitLabUserFullSchema, GitLabMarkdownUploadSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, } from '../schemas.js';
+import { GetFileContentsSchema, GitLabFileContentSchema, GitLabRepositorySchema, CreatePipelineSchema, CreateCommitStatusSchema, ListCommitStatusesSchema, CreateIssueNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateIssueEmojiReactionSchema, DeleteMergeRequestEmojiReactionSchema, DeleteIssueEmojiReactionSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, CreateIssueSchema, ListIssuesSchema, ListMergeRequestsSchema, ListLabelsSchema, GitLabMergeRequestSchema, GitLabTreeItemSchema, GetMergeRequestSchema, ListMergeRequestPipelinesSchema, GetRepositoryTreeSchema, GitLabUserFullSchema, GitLabMarkdownUploadSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, PushFilesSchema, CreateOrUpdateFileSchema, } from '../schemas.js';
 function runGetFileContentsSchemaTests() {
     console.log('🧪 Testing GetFileContentsSchema...');
     const cases = [
@@ -822,6 +822,21 @@ function runGitLabMergeRequestSchemaTests() {
             },
             validate: (data) => data.merge_user === undefined && data.merged_by === undefined,
         },
+        {
+            name: 'schema:gitlab_merge_request:preserves-sha',
+            input: {
+                ...baseMergeRequest,
+                sha: 'e82eb4a098e32c796079ca3915e07487fc4db24c',
+            },
+            validate: (data) => data.sha === 'e82eb4a098e32c796079ca3915e07487fc4db24c',
+        },
+        {
+            name: 'schema:gitlab_merge_request:allows-omitted-sha',
+            input: {
+                ...baseMergeRequest,
+            },
+            validate: (data) => data.sha === undefined,
+        },
     ];
     let passed = 0;
     let failed = 0;
@@ -1536,6 +1551,104 @@ function runGitLabDependencyProxyBlobSchemaTests() {
     console.log(`\nResults: ${passed} passed, ${failed} failed`);
     return { passed, failed };
 }
+function runPushFilesSchemaTests() {
+    console.log('🧪 Testing PushFilesSchema / CreateOrUpdateFileSchema (per-file action + encoding)...');
+    const base = { project_id: '1', branch: 'main', commit_message: 'm' };
+    function record(name, ok, error) {
+        const result = { name, status: ok ? 'passed' : 'failed', error };
+        if (result.status === 'passed') {
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+        return result;
+    }
+    const results = [];
+    {
+        const parsed = PushFilesSchema.safeParse({ ...base, files: [{ file_path: 'a.txt', content: 'hi' }] });
+        results.push(record('schema:push_files:plain-text-default', parsed.success &&
+            parsed.data.files[0]?.action === undefined &&
+            parsed.data.files[0]?.encoding === undefined, parsed.success ? undefined : parsed.error.message));
+    }
+    {
+        const parsed = PushFilesSchema.safeParse({
+            ...base,
+            files: [{ file_path: 'logo.png', content: 'aGk=', encoding: 'base64' }],
+        });
+        results.push(record('schema:push_files:binary-base64', parsed.success && parsed.data.files[0]?.encoding === 'base64', parsed.success ? undefined : parsed.error.message));
+    }
+    {
+        const parsed = PushFilesSchema.safeParse({
+            ...base,
+            files: [{ file_path: 'a.txt', content: 'new', action: 'update' }],
+        });
+        results.push(record('schema:push_files:action-update', parsed.success && parsed.data.files[0]?.action === 'update', parsed.success ? undefined : parsed.error.message));
+    }
+    {
+        const parsed = PushFilesSchema.safeParse({
+            ...base,
+            files: [{ file_path: 'a.txt', action: 'delete' }],
+        });
+        results.push(record('schema:push_files:action-delete-content-optional', parsed.success &&
+            parsed.data.files[0]?.action === 'delete' &&
+            parsed.data.files[0]?.content === undefined, parsed.success ? undefined : parsed.error.message));
+    }
+    {
+        const parsed = PushFilesSchema.safeParse({
+            ...base,
+            files: [{ file_path: 'b.txt', action: 'move', previous_path: 'a.txt' }],
+        });
+        results.push(record('schema:push_files:action-move-previous-path', parsed.success &&
+            parsed.data.files[0]?.action === 'move' &&
+            parsed.data.files[0]?.previous_path === 'a.txt', parsed.success ? undefined : parsed.error.message));
+    }
+    {
+        const parsed = PushFilesSchema.safeParse({
+            ...base,
+            files: [{ file_path: 'a.txt', content: 'hi', encoding: 'text' }],
+        });
+        results.push(record('schema:push_files:explicit-text-encoding', parsed.success && parsed.data.files[0]?.encoding === 'text', parsed.success ? undefined : parsed.error.message));
+    }
+    results.push(record('schema:push_files:reject-create-without-content', !PushFilesSchema.safeParse({ ...base, files: [{ file_path: 'a.txt' }] }).success, 'Expected schema validation to fail'));
+    results.push(record('schema:push_files:reject-update-without-content', !PushFilesSchema.safeParse({ ...base, files: [{ file_path: 'a.txt', action: 'update' }] }).success, 'Expected schema validation to fail'));
+    results.push(record('schema:push_files:reject-move-without-previous-path', !PushFilesSchema.safeParse({ ...base, files: [{ file_path: 'b.txt', action: 'move' }] }).success, 'Expected schema validation to fail'));
+    results.push(record('schema:push_files:reject-invalid-action', !PushFilesSchema.safeParse({
+        ...base,
+        files: [{ file_path: 'a.txt', content: 'hi', action: 'copy' }],
+    }).success, 'Expected schema validation to fail'));
+    results.push(record('schema:push_files:reject-invalid-encoding', !PushFilesSchema.safeParse({
+        ...base,
+        files: [{ file_path: 'a.txt', content: 'hi', encoding: 'utf16' }],
+    }).success, 'Expected schema validation to fail'));
+    {
+        const parsed = CreateOrUpdateFileSchema.safeParse({
+            ...base,
+            file_path: 'a.txt',
+            content: 'hi',
+        });
+        results.push(record('schema:create_or_update_file:plain-text-default', parsed.success && parsed.data.encoding === undefined, parsed.success ? undefined : parsed.error.message));
+    }
+    {
+        const parsed = CreateOrUpdateFileSchema.safeParse({
+            ...base,
+            file_path: 'logo.png',
+            content: 'aGk=',
+            encoding: 'base64',
+        });
+        results.push(record('schema:create_or_update_file:encoding-base64', parsed.success && parsed.data.encoding === 'base64', parsed.success ? undefined : parsed.error.message));
+    }
+    results.push(record('schema:create_or_update_file:reject-invalid-encoding', !CreateOrUpdateFileSchema.safeParse({
+        ...base,
+        file_path: 'a.txt',
+        content: 'hi',
+        encoding: 'utf16',
+    }).success, 'Expected schema validation to fail'));
+    const passed = results.filter(result => result.status === 'passed').length;
+    const failed = results.filter(result => result.status === 'failed').length;
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
 if (import.meta.url === `file://${process.argv[1]}`) {
     const getFileContentsResult = runGetFileContentsSchemaTests();
     const fileContentResult = runGitLabFileContentSchemaTests();
@@ -1556,8 +1669,9 @@ if (import.meta.url === `file://${process.argv[1]}`) {
     const gitLabMarkdownUploadResult = runGitLabMarkdownUploadSchemaTests();
     const dependencyProxyResult = runGitLabDependencyProxySchemaTests();
     const dependencyProxyBlobResult = runGitLabDependencyProxyBlobSchemaTests();
-    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + commitStatusResult.passed + createIssueNoteResult.passed + getMergeRequestResult.passed + listMergeRequestPipelinesResult.passed + gitLabMergeRequestResult.passed + emojiReactionResult.passed + repositorySchemaResult.passed + labelsCoercionResult.passed + approvedByUsernamesResult.passed + listLabelsResult.passed + treeItemResult.passed + repositoryTreeResult.passed + gitLabUserFullResult.passed + gitLabMarkdownUploadResult.passed + dependencyProxyResult.passed + dependencyProxyBlobResult.passed;
-    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + commitStatusResult.failed + createIssueNoteResult.failed + getMergeRequestResult.failed + listMergeRequestPipelinesResult.failed + gitLabMergeRequestResult.failed + emojiReactionResult.failed + repositorySchemaResult.failed + labelsCoercionResult.failed + approvedByUsernamesResult.failed + listLabelsResult.failed + treeItemResult.failed + repositoryTreeResult.failed + gitLabUserFullResult.failed + gitLabMarkdownUploadResult.failed + dependencyProxyResult.failed + dependencyProxyBlobResult.failed;
+    const pushFilesResult = runPushFilesSchemaTests();
+    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + commitStatusResult.passed + createIssueNoteResult.passed + getMergeRequestResult.passed + listMergeRequestPipelinesResult.passed + gitLabMergeRequestResult.passed + emojiReactionResult.passed + repositorySchemaResult.passed + labelsCoercionResult.passed + approvedByUsernamesResult.passed + listLabelsResult.passed + treeItemResult.passed + repositoryTreeResult.passed + gitLabUserFullResult.passed + gitLabMarkdownUploadResult.passed + dependencyProxyResult.passed + dependencyProxyBlobResult.passed + pushFilesResult.passed;
+    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + commitStatusResult.failed + createIssueNoteResult.failed + getMergeRequestResult.failed + listMergeRequestPipelinesResult.failed + gitLabMergeRequestResult.failed + emojiReactionResult.failed + repositorySchemaResult.failed + labelsCoercionResult.failed + approvedByUsernamesResult.failed + listLabelsResult.failed + treeItemResult.failed + repositoryTreeResult.failed + gitLabUserFullResult.failed + gitLabMarkdownUploadResult.failed + dependencyProxyResult.failed + dependencyProxyBlobResult.failed + pushFilesResult.failed;
     console.log(`\nTotal Results: ${totalPassed} passed, ${totalFailed} failed`);
     if (totalFailed > 0) {
         process.exit(1);

package/build/test/test-job-artifacts.js

@@ -8,6 +8,7 @@ import os from 'node:os';
 const MOCK_TOKEN = 'glpat-mock-token-12345';
 const TEST_PROJECT_ID = '123';
 const TEST_JOB_ID = '456';
+const NULL_MODE_JOB_ID = '457';
 const TEST_ENCODED_ARTIFACT_PATH = 'reports/report#1.txt';
 // Helper to run an MCP tool via the built server
 async function callTool(toolName, args, env) {
@@ -117,6 +118,25 @@ describe('job artifacts tools', () => {
             res.set('Content-Type', 'text/plain');
             res.send('encoded artifact content');
         });
+        // GitLab.com can return mode/size as null on artifacts/tree entries (#661)
+        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/jobs/${NULL_MODE_JOB_ID}/artifacts/tree`, (req, res) => {
+            res.json([
+                {
+                    name: 'report.xml',
+                    path: 'report.xml',
+                    type: 'file',
+                    size: 1024,
+                    mode: null,
+                },
+                {
+                    name: 'logs',
+                    path: 'logs',
+                    type: 'directory',
+                    size: null,
+                    mode: '040755',
+                },
+            ]);
+        });
         // Add mock handler for 404 on non-existent artifact
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/jobs/999/artifacts/tree`, (req, res) => {
             res.status(404).json({ message: 'Not Found' });
@@ -147,6 +167,16 @@ describe('job artifacts tools', () => {
         assert.strictEqual(result[1].name, 'logs');
         assert.strictEqual(result[1].type, 'directory');
     });
+    test('list_job_artifacts returns artifact entries when mode is null', async () => {
+        const result = await callTool('list_job_artifacts', { project_id: TEST_PROJECT_ID, job_id: NULL_MODE_JOB_ID }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        });
+        assert.ok(Array.isArray(result), 'Response should be an array');
+        assert.strictEqual(result.length, 2);
+        assert.strictEqual(result[0].mode, null);
+        assert.strictEqual(result[1].size, null);
+    });
     test('download_job_artifacts saves archive to disk', async () => {
         const result = await callTool('download_job_artifacts', { project_id: TEST_PROJECT_ID, job_id: TEST_JOB_ID, local_path: tmpDir }, {
             GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,

package/build/test/test-permission-mode.js

@@ -140,6 +140,34 @@ describe("Permission Mode", { concurrency: 1 }, () => {
                 await client.disconnect();
             }
         });
+        test("rejects push_files delete actions", async () => {
+            const client = await connectClient(server);
+            try {
+                await assert.rejects(() => client.callTool("push_files", {
+                    project_id: "1",
+                    branch: "main",
+                    commit_message: "m",
+                    files: [{ file_path: "a.txt", action: "delete" }],
+                }), (error) => error.message.includes("delete or move actions in modify mode"), "push_files delete should be rejected in modify mode");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("rejects push_files move actions", async () => {
+            const client = await connectClient(server);
+            try {
+                await assert.rejects(() => client.callTool("push_files", {
+                    project_id: "1",
+                    branch: "main",
+                    commit_message: "m",
+                    files: [{ file_path: "b.txt", action: "move", previous_path: "a.txt" }],
+                }), (error) => error.message.includes("delete or move actions in modify mode"), "push_files move should be rejected in modify mode");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
         test("does not apply the modify-mode guard to non-delete mutations", async () => {
             const client = await connectClient(server);
             try {

package/build/tools/tool-descriptions.js

@@ -1,12 +1,12 @@
 const TOOL_GUIDANCE = {
-    merge_merge_request: "Use this only after checking the merge request approval, conflict, and pipeline state; use `approve_merge_request` to approve rather than merge. The operation changes repository state and may squash commits, schedule auto-merge, or delete the source branch, so it requires merge permission and returns GitLab's merge result or a mergeability error.",
+    merge_merge_request: "Use this only after checking the merge request approval, conflict, and pipeline state; use `approve_merge_request` to approve rather than merge. The operation changes repository state and may squash commits, schedule auto-merge, or delete the source branch, so it requires merge permission and returns GitLab's merge result or a mergeability error. Pass `sha` from `get_merge_request` (`sha` or `diff_refs.head_sha`); GitLab 19.2+ groups may reject merges without it.",
     approve_merge_request: "Use this to record an approval on an existing merge request; it does not merge the request or change its source branch. The operation changes review state, may require re-authentication or approval permission, and returns the updated approval result or a permission/state error.",
     unapprove_merge_request: "Use this to remove the current user's approval from an existing merge request; use `merge_merge_request` only when you intend to merge. The operation changes review state and requires approval permission, and GitLab returns the updated result or an error when the request or approval is unavailable.",
     get_merge_request_approval_state: "Use this to inspect approval rules and approvers before deciding whether a merge request can be merged; use `approve_merge_request` to change approval state. It is read-only and returns the approval-state response, while missing requests, unsupported GitLab versions, and permission failures are reported as errors.",
     get_merge_request_conflicts: "Use this to inspect merge conflicts before attempting `merge_merge_request`; it reports conflicts and does not resolve them. It is read-only, requires access to the project and merge request, and returns GitLab's conflict data or an error when the request cannot be evaluated.",
     list_merge_request_pipelines: "Use this to inspect pipelines associated with one merge request; use `list_pipelines` for project-wide pipeline filtering. It is read-only and paginated, requires project access, and returns pipeline records or GitLab errors for invalid identifiers, missing resources, or rate limits.",
-    create_or_update_file: "Use this for a single repository file when you know whether the target path is new or already exists; use `push_files` for a multi-file commit. The operation creates or updates remote content in a commit, requires repository write permission, and returns the commit result or a conflict/validation error.",
-    push_files: "Use this to commit several file changes atomically; use `create_or_update_file` when only one path is involved. The operation writes repository history on the selected branch, requires repository write permission, and returns the commit result or a validation, conflict, or protected-branch error.",
+    create_or_update_file: "Use this for a single repository file when you know whether the target path is new or already exists; use `push_files` for a multi-file commit. Optional `encoding` (`text` or `base64`) defaults to `GITLAB_REPO_FILE_ENCODING` so existing callers stay unchanged. The operation creates or updates remote content in a commit, requires repository write permission, and returns the commit result or a conflict/validation error.",
+    push_files: "Use this to commit several file changes atomically; use `create_or_update_file` when only one path is involved. Each file defaults to action `create`; optional per-file `action` (create/update/delete/move) and `encoding` (text/base64) are additive. `GITLAB_PERMISSION_MODE=modify` rejects `delete` and `move`. The operation writes repository history on the selected branch, requires repository write permission, and returns the commit result or a validation, conflict, or protected-branch error.",
     create_issue: "Use this to open a new issue; use `update_issue` for an existing issue and `create_issue_note` to add discussion without changing issue fields. The operation creates remote project data, requires issue creation permission, and returns the new issue or a validation, permission, or duplicate-related error.",
     create_merge_request: "Use this to open a new merge request from an existing source branch to a target branch; use `update_merge_request` after it exists. The operation creates remote review state, requires project access, and returns the new merge request or a validation, permission, branch, or duplicate-related error.",
     fork_repository: "Use this to create a copy of an existing project in the current user's namespace or a permitted namespace; use `search_repositories` or `get_project` to inspect projects without copying them. The operation creates a new project, requires fork permission, and returns the forked project or a namespace/permission error.",

package/build/utils/gitlab-commit-actions.js

@@ -0,0 +1,42 @@
+export function fileOperationsIncludeDeleteOrMove(files) {
+    return files.some(file => file.action === "delete" || file.action === "move");
+}
+export function encodeRepoFilePayloadContent(content, globalEncoding) {
+    if (globalEncoding === "base64") {
+        return Buffer.from(content).toString("base64");
+    }
+    return content;
+}
+function applyContentAndEncoding(entry, content, encoding, globalEncoding) {
+    if (encoding !== undefined) {
+        entry.content = content;
+        entry.encoding = encoding;
+        return;
+    }
+    entry.content = encodeRepoFilePayloadContent(content, globalEncoding);
+    entry.encoding = globalEncoding;
+}
+export function toGitLabCommitActions(actions, globalEncoding) {
+    return actions.map(action => {
+        const act = action.action ?? "create";
+        const entry = { action: act, file_path: action.path };
+        if (act === "delete") {
+            return entry;
+        }
+        if (act === "move") {
+            if (action.previous_path) {
+                entry.previous_path = action.previous_path;
+            }
+            if (action.content === undefined) {
+                return entry;
+            }
+            applyContentAndEncoding(entry, action.content, action.encoding, globalEncoding);
+            return entry;
+        }
+        if (action.content === undefined) {
+            throw new Error(`content is required when action is '${act}'`);
+        }
+        applyContentAndEncoding(entry, action.content, action.encoding, globalEncoding);
+        return entry;
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.49",
+  "version": "2.1.51",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -58,8 +58,8 @@
     "test:live": "node test/validate-api.js",
     "test:consumer-smoke": "bash scripts/consumer-install-smoke.sh",
     "test:remote-auth": "npm run build && node --import tsx/esm --test --experimental-test-isolation=none test/remote-auth-simple-test.ts",
-    "test:schema": "tsx test/schema-tests.ts && tsx test/test-json-schema.ts",
-    "test:oauth": "tsx test/oauth-tests.ts",
+    "test:schema": "tsx test/schema-tests.ts && tsx test/test-json-schema.ts && node --import tsx/esm --test --experimental-test-isolation=none --test-concurrency=1 test/*-schema.test.ts",
+    "test:oauth": "tsx test/oauth-tests.ts && node --import tsx/esm --test --experimental-test-isolation=none test/oauth-device-flow-tests.ts",
     "test:list-merge-requests": "npm run build && tsx test/test-list-merge-requests.ts",
     "test:approvals": "npm run build && tsx test/test-merge-request-approvals.ts",
     "lint": "eslint . --ext .ts",