@zereight/mcp-gitlab 2.1.50 → 2.1.52

package/build/test/test-permission-mode.js

@@ -140,6 +140,34 @@ describe("Permission Mode", { concurrency: 1 }, () => {
                 await client.disconnect();
             }
         });
+        test("rejects push_files delete actions", async () => {
+            const client = await connectClient(server);
+            try {
+                await assert.rejects(() => client.callTool("push_files", {
+                    project_id: "1",
+                    branch: "main",
+                    commit_message: "m",
+                    files: [{ file_path: "a.txt", action: "delete" }],
+                }), (error) => error.message.includes("delete or move actions in modify mode"), "push_files delete should be rejected in modify mode");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("rejects push_files move actions", async () => {
+            const client = await connectClient(server);
+            try {
+                await assert.rejects(() => client.callTool("push_files", {
+                    project_id: "1",
+                    branch: "main",
+                    commit_message: "m",
+                    files: [{ file_path: "b.txt", action: "move", previous_path: "a.txt" }],
+                }), (error) => error.message.includes("delete or move actions in modify mode"), "push_files move should be rejected in modify mode");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
         test("does not apply the modify-mode guard to non-delete mutations", async () => {
             const client = await connectClient(server);
             try {

package/build/tools/tool-descriptions.js

@@ -5,8 +5,8 @@ const TOOL_GUIDANCE = {
     get_merge_request_approval_state: "Use this to inspect approval rules and approvers before deciding whether a merge request can be merged; use `approve_merge_request` to change approval state. It is read-only and returns the approval-state response, while missing requests, unsupported GitLab versions, and permission failures are reported as errors.",
     get_merge_request_conflicts: "Use this to inspect merge conflicts before attempting `merge_merge_request`; it reports conflicts and does not resolve them. It is read-only, requires access to the project and merge request, and returns GitLab's conflict data or an error when the request cannot be evaluated.",
     list_merge_request_pipelines: "Use this to inspect pipelines associated with one merge request; use `list_pipelines` for project-wide pipeline filtering. It is read-only and paginated, requires project access, and returns pipeline records or GitLab errors for invalid identifiers, missing resources, or rate limits.",
-    create_or_update_file: "Use this for a single repository file when you know whether the target path is new or already exists; use `push_files` for a multi-file commit. The operation creates or updates remote content in a commit, requires repository write permission, and returns the commit result or a conflict/validation error.",
-    push_files: "Use this to commit several file changes atomically; use `create_or_update_file` when only one path is involved. The operation writes repository history on the selected branch, requires repository write permission, and returns the commit result or a validation, conflict, or protected-branch error.",
+    create_or_update_file: "Use this for a single repository file when you know whether the target path is new or already exists; use `push_files` for a multi-file commit. Optional `encoding` (`text` or `base64`) defaults to `GITLAB_REPO_FILE_ENCODING` so existing callers stay unchanged. The operation creates or updates remote content in a commit, requires repository write permission, and returns the commit result or a conflict/validation error.",
+    push_files: "Use this to commit several file changes atomically; use `create_or_update_file` when only one path is involved. Each file defaults to action `create`; optional per-file `action` (create/update/delete/move) and `encoding` (text/base64) are additive. `GITLAB_PERMISSION_MODE=modify` rejects `delete` and `move`. The operation writes repository history on the selected branch, requires repository write permission, and returns the commit result or a validation, conflict, or protected-branch error.",
     create_issue: "Use this to open a new issue; use `update_issue` for an existing issue and `create_issue_note` to add discussion without changing issue fields. The operation creates remote project data, requires issue creation permission, and returns the new issue or a validation, permission, or duplicate-related error.",
     create_merge_request: "Use this to open a new merge request from an existing source branch to a target branch; use `update_merge_request` after it exists. The operation creates remote review state, requires project access, and returns the new merge request or a validation, permission, branch, or duplicate-related error.",
     fork_repository: "Use this to create a copy of an existing project in the current user's namespace or a permitted namespace; use `search_repositories` or `get_project` to inspect projects without copying them. The operation creates a new project, requires fork permission, and returns the forked project or a namespace/permission error.",

package/build/utils/gitlab-commit-actions.js

@@ -0,0 +1,42 @@
+export function fileOperationsIncludeDeleteOrMove(files) {
+    return files.some(file => file.action === "delete" || file.action === "move");
+}
+export function encodeRepoFilePayloadContent(content, globalEncoding) {
+    if (globalEncoding === "base64") {
+        return Buffer.from(content).toString("base64");
+    }
+    return content;
+}
+function applyContentAndEncoding(entry, content, encoding, globalEncoding) {
+    if (encoding !== undefined) {
+        entry.content = content;
+        entry.encoding = encoding;
+        return;
+    }
+    entry.content = encodeRepoFilePayloadContent(content, globalEncoding);
+    entry.encoding = globalEncoding;
+}
+export function toGitLabCommitActions(actions, globalEncoding) {
+    return actions.map(action => {
+        const act = action.action ?? "create";
+        const entry = { action: act, file_path: action.path };
+        if (act === "delete") {
+            return entry;
+        }
+        if (act === "move") {
+            if (action.previous_path) {
+                entry.previous_path = action.previous_path;
+            }
+            if (action.content === undefined) {
+                return entry;
+            }
+            applyContentAndEncoding(entry, action.content, action.encoding, globalEncoding);
+            return entry;
+        }
+        if (action.content === undefined) {
+            throw new Error(`content is required when action is '${act}'`);
+        }
+        applyContentAndEncoding(entry, action.content, action.encoding, globalEncoding);
+        return entry;
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.50",
+  "version": "2.1.52",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -58,8 +58,8 @@
     "test:live": "node test/validate-api.js",
     "test:consumer-smoke": "bash scripts/consumer-install-smoke.sh",
     "test:remote-auth": "npm run build && node --import tsx/esm --test --experimental-test-isolation=none test/remote-auth-simple-test.ts",
-    "test:schema": "tsx test/schema-tests.ts && tsx test/test-json-schema.ts",
-    "test:oauth": "tsx test/oauth-tests.ts",
+    "test:schema": "tsx test/schema-tests.ts && tsx test/test-json-schema.ts && node --import tsx/esm --test --experimental-test-isolation=none --test-concurrency=1 test/*-schema.test.ts",
+    "test:oauth": "tsx test/oauth-tests.ts && node --import tsx/esm --test --experimental-test-isolation=none test/oauth-device-flow-tests.ts",
     "test:list-merge-requests": "npm run build && tsx test/test-list-merge-requests.ts",
     "test:approvals": "npm run build && tsx test/test-merge-request-approvals.ts",
     "lint": "eslint . --ext .ts",
@@ -68,6 +68,7 @@
     "lint:fix": "eslint . --ext .ts --fix",
     "release": "bash scripts/release.sh",
     "release:mcp-registry": "bash scripts/publish_mcp_registry.sh",
+    "sync:alias-package": "node scripts/sync-alias-package-version.mjs",
     "format": "prettier --write \"**/*.{js,ts,json,md}\"",
     "format:check": "prettier --check \"**/*.{js,ts,json,md}\""
   },