@zereight/mcp-gitlab 2.1.56 → 2.1.57

package/README.ko.md

@@ -17,7 +17,7 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 
 ### 왜 이 GitLab MCP를 사용하나요?
 
-- **217개 도구 + `discover_tools`** — 작은 toolset으로 시작하고, 런타임에 카테고리 활성화
+- **232개 도구 + `discover_tools`** — 작은 toolset으로 시작하고, 런타임에 카테고리 활성화
 - **MR 2단계 리뷰** — `list_merge_request_changed_files` → 배치 `get_merge_request_file_diff`
 - **Agent Skill 내장** — `skills/gitlab-mcp/` 워크플로우 가이드
 - **유연한 인증** — Personal Access Token, 로컬 OAuth2 브라우저 플로우, MCP OAuth 프록시, 요청별 원격 인증
@@ -30,9 +30,9 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 | | @zereight/mcp-gitlab | GitLab MCP A (커뮤니티 CQRS형) |
 |---|----------------------|--------------------------------|
 | **적합한 경우** | AI 에이전트 워크플로우 | 엔터프라이즈 멀티 인스턴스 / 그룹형 도구 |
-| **도구 모델** | ~217개 세분화 도구 + `discover_tools` | ~50–60개 `browse_*` / `manage_*` 그룹 도구 |
+| **도구 모델** | ~232개 세분화 도구 + `discover_tools` | ~50–60개 `browse_*` / `manage_*` 그룹 도구 |
 | **MR 리뷰** | 2단계 배치 diff | 서버마다 다름 |
-| **Node.js** | >=18 | 보통 >=24 |
+| **Node.js** | >=18.17 | 보통 >=24 |
 | **라이선스** | MIT | 서버마다 다름 |
 
 [전체 비교 →](./docs/comparison/community-gitlab-mcp-a.md)
@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.55`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.56`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### CLI 인자 사용하기(환경 변수 문제가 있는 클라이언트용)
 

package/README.md

@@ -22,7 +22,7 @@ Supports PAT, OAuth, read-only mode, dynamic API URLs, and remote authorization
 
 ### Why use this GitLab MCP?
 
-- **229 tools + `discover_tools`** — start with a small toolset; activate more at runtime without CQRS-style grouping
+- **232 tools + `discover_tools`** — start with a small toolset; activate more at runtime without CQRS-style grouping
 - **MR 2-step review** — `list_merge_request_changed_files` → batched `get_merge_request_file_diff`
 - **Agent Skill built in** — workflow guidance in `skills/gitlab-mcp/`
 - **Flexible auth** — Personal Access Token, local OAuth2 browser flow, MCP OAuth proxy, and per-request remote authorization
@@ -35,9 +35,9 @@ Supports PAT, OAuth, read-only mode, dynamic API URLs, and remote authorization
 | | @zereight/mcp-gitlab | GitLab MCP A (community CQRS-style) |
 |---|----------------------|-------------------------------------|
 | **Best for** | AI agent workflows | Enterprise multi-instance / grouped tools |
-| **Tool model** | ~229 granular tools + `discover_tools` | ~50–60 grouped `browse_*` / `manage_*` tools |
+| **Tool model** | ~232 granular tools + `discover_tools` | ~50–60 grouped `browse_*` / `manage_*` tools |
 | **MR review** | 2-step batched diff | Varies |
-| **Node.js** | >=18 | Often >=24 |
+| **Node.js** | >=18.17 | Often >=24 |
 | **License** | MIT | Varies |
 
 [Full comparison →](./docs/comparison/community-gitlab-mcp-a.md)
@@ -103,7 +103,7 @@ npm install -g @zereight/mcp-gitlab
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.55`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.56`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Using CLI Arguments (for clients with env var issues)
 
@@ -777,30 +777,33 @@ Register the skill directory in your AI client to get optimal tool usage guidanc
 204. `get_timeline_events` - List timeline events for an incident. Returns chronological events with notes, timestamps, and tags
 205. `create_timeline_event` - Create a timeline event on an incident. Supports tags: 'Start time', 'End time', 'Impact detected', 'Response initiated', 'Impact mitigated', 'Cause identified'
 206. `list_webhooks` - List all configured webhooks for a GitLab project or group. Provide either project_id or group_id
-207. `list_webhook_events` - List recent webhook events (past 7 days) for a project or group webhook. Use summary mode for overview, then get_webhook_event for full details
-208. `get_webhook_event` - Get full details of a specific webhook event by ID, including request/response payloads
-209. `search_code` - Search for code across all projects on the GitLab instance (requires advanced search or exact code search to be enabled)
-210. `search_project_code` - Search for code within a specific GitLab project (requires advanced search or exact code search to be enabled)
-211. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
-212. `list_project_variables` - List CI/CD variables for a project with optional environment scope filter
-213. `get_project_variable` - Get a single CI/CD variable from a project by key, with optional environment scope filter
-214. `create_project_variable` - Create a new CI/CD variable in a project
-215. `update_project_variable` - Update an existing CI/CD variable in a project, with optional filter to disambiguate by environment scope
-216. `delete_project_variable` - Delete a CI/CD variable from a project, with optional filter to disambiguate by environment scope
-217. `list_group_variables` - List CI/CD variables for a group with optional environment scope filter
-218. `get_group_variable` - Get a single CI/CD variable from a group by key, with optional environment scope filter
-219. `create_group_variable` - Create a new CI/CD variable in a group
-220. `update_group_variable` - Update an existing CI/CD variable in a group, with optional filter to disambiguate by environment scope
-221. `delete_group_variable` - Delete a CI/CD variable from a group, with optional filter to disambiguate by environment scope
-222. `get_dependency_proxy_settings` - Get dependency proxy settings for a group (enabled status, blob count, total size, image prefix, TTL policy)
-223. `update_dependency_proxy_settings` - Update dependency proxy settings for a group (enable/disable, credentials for authenticated Docker Hub pulls)
-224. `list_dependency_proxy_blobs` - List cached dependency proxy blobs for a group with cursor-based pagination
-225. `purge_dependency_proxy_cache` - Schedule purge of all cached dependency proxy blobs for a group
-226. `list_project_vulnerabilities` - List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)
-227. `get_vulnerability` - Get full details of a specific vulnerability
-228. `dismiss_vulnerability` - Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment
-229. `confirm_vulnerability` - Confirm a vulnerability as a real finding requiring remediation
-230. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, users, workitems, webhooks, search, variables, dependency_proxy, vulnerabilities. Already-active categories are listed in the response.
+207. `create_webhook` - Create a webhook on a GitLab project or group
+208. `update_webhook` - Update an existing project or group webhook
+209. `delete_webhook` - Delete a project or group webhook
+210. `list_webhook_events` - List recent webhook events (past 7 days) for a project or group webhook. Use summary mode for overview, then get_webhook_event for full details
+211. `get_webhook_event` - Get full details of a specific webhook event by ID, including request/response payloads
+212. `search_code` - Search for code across all projects on the GitLab instance (requires advanced search or exact code search to be enabled)
+213. `search_project_code` - Search for code within a specific GitLab project (requires advanced search or exact code search to be enabled)
+214. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
+215. `list_project_variables` - List CI/CD variables for a project with optional environment scope filter
+216. `get_project_variable` - Get a single CI/CD variable from a project by key, with optional environment scope filter
+217. `create_project_variable` - Create a new CI/CD variable in a project
+218. `update_project_variable` - Update an existing CI/CD variable in a project, with optional filter to disambiguate by environment scope
+219. `delete_project_variable` - Delete a CI/CD variable from a project, with optional filter to disambiguate by environment scope
+220. `list_group_variables` - List CI/CD variables for a group with optional environment scope filter
+221. `get_group_variable` - Get a single CI/CD variable from a group by key, with optional environment scope filter
+222. `create_group_variable` - Create a new CI/CD variable in a group
+223. `update_group_variable` - Update an existing CI/CD variable in a group, with optional filter to disambiguate by environment scope
+224. `delete_group_variable` - Delete a CI/CD variable from a group, with optional filter to disambiguate by environment scope
+225. `get_dependency_proxy_settings` - Get dependency proxy settings for a group (enabled status, blob count, total size, image prefix, TTL policy)
+226. `update_dependency_proxy_settings` - Update dependency proxy settings for a group (enable/disable, credentials for authenticated Docker Hub pulls)
+227. `list_dependency_proxy_blobs` - List cached dependency proxy blobs for a group with cursor-based pagination
+228. `purge_dependency_proxy_cache` - Schedule purge of all cached dependency proxy blobs for a group
+229. `list_project_vulnerabilities` - List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)
+230. `get_vulnerability` - Get full details of a specific vulnerability
+231. `dismiss_vulnerability` - Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment
+232. `confirm_vulnerability` - Confirm a vulnerability as a real finding requiring remediation
+233. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, users, workitems, webhooks, search, variables, dependency_proxy, vulnerabilities. Already-active categories are listed in the response.
 
 <!-- TOOLS-END -->
 

package/README.zh-CN.md

@@ -17,7 +17,7 @@
 
 ### 为什么使用这个 GitLab MCP？
 
-- **217 个工具 + `discover_tools`** — 从小型 toolset 开始，运行时按需激活类别
+- **232 个工具 + `discover_tools`** — 从小型 toolset 开始，运行时按需激活类别
 - **MR 两步审查** — `list_merge_request_changed_files` → 批量 `get_merge_request_file_diff`
 - **内置 Agent Skill** — `skills/gitlab-mcp/` 工作流指南
 - **认证灵活** — Personal Access Token、本地 OAuth2 浏览器流程、MCP OAuth 代理、按请求远程授权
@@ -30,9 +30,9 @@
 | | @zereight/mcp-gitlab | GitLab MCP A（社区 CQRS 型） |
 |---|----------------------|------------------------------|
 | **更适合** | AI 代理工作流 | 企业多实例 / 分组工具 |
-| **工具模型** | ~217 个细粒度工具 + `discover_tools` | ~50–60 个 `browse_*` / `manage_*` 分组工具 |
+| **工具模型** | ~232 个细粒度工具 + `discover_tools` | ~50–60 个 `browse_*` / `manage_*` 分组工具 |
 | **MR 审查** | 两步批量 diff | 因服务器而异 |
-| **Node.js** | >=18 | 通常 >=24 |
+| **Node.js** | >=18.17 | 通常 >=24 |
 | **许可证** | MIT | 因服务器而异 |
 
 [完整对比 →](./docs/comparison/community-gitlab-mcp-a.md)
@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.55`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.56`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### 使用 CLI 参数（适用于环境变量有问题的客户端）
 

package/build/auth-retry.js

@@ -5,34 +5,55 @@
  * importing index.ts (which has heavy side effects: starts the MCP server,
  * reads env vars, etc.).
  */
-import { Headers } from "node-fetch";
+function isTupleArray(headers) {
+    if (!Array.isArray(headers))
+        return false;
+    return headers.every(entry => Array.isArray(entry) &&
+        entry.length >= 2 &&
+        typeof entry[0] === "string" &&
+        typeof entry[1] === "string");
+}
+function hasForEach(headers) {
+    return "forEach" in headers && typeof headers.forEach === "function";
+}
+function isPlainStringHeaders(headers) {
+    return Object.values(headers).every(value => typeof value === "string");
+}
 /**
  * Convert various header representations to a plain Record<string, string>.
  */
 export function headersToPlainObject(headers) {
-    if (!headers)
+    if (!headers || typeof headers !== "object")
         return {};
-    if (headers instanceof Headers) {
+    if (isTupleArray(headers)) {
+        return Object.fromEntries(headers);
+    }
+    if (hasForEach(headers)) {
         const obj = {};
-        headers.forEach((value, key) => { obj[key] = value; });
+        headers.forEach((value, key) => {
+            obj[key] = value;
+        });
         return obj;
     }
-    if (Array.isArray(headers)) {
-        return Object.fromEntries(headers);
+    if (isPlainStringHeaders(headers)) {
+        return headers;
     }
-    return headers;
+    return {};
 }
 /**
- * Detect request bodies that cannot be replayed (streams, FormData).
+ * Detect request bodies that cannot be replayed (streams).
  */
+function hasCallableMethod(body, name) {
+    return name in body && typeof Reflect.get(body, name) === "function";
+}
 export function isNonReplayableBody(body) {
-    if (!body)
+    if (!body || typeof body !== "object")
         return false;
-    // Stream-like objects (has .pipe or .read)
-    if (typeof body.pipe === "function" || typeof body.read === "function")
+    if (hasCallableMethod(body, "pipe"))
         return true;
-    // form-data instances (duck-type check since FormData is dynamically imported)
-    if (typeof body.getBuffer === "function" && typeof body.getBoundary === "function")
+    if (hasCallableMethod(body, "read"))
+        return true;
+    if (hasCallableMethod(body, "getReader"))
         return true;
     return false;
 }
@@ -41,24 +62,19 @@ export function isNonReplayableBody(body) {
  * On a 401, force-refreshes the OAuth token and retries the request once.
  * The retry calls baseFetch directly (not the wrapper), so infinite loops are impossible.
  * In non-OAuth mode, the wrapper is a transparent pass-through.
- *
- * When called without `config`, falls back to module globals in index.ts.
- * When called with `config` (tests), uses injected dependencies.
  */
 export function wrapWithAuthRetry(baseFetch, config) {
     let refreshLock = null;
     const log = config.logger ?? { info: () => { }, error: () => { } };
-    return (async (url, options) => {
+    const wrapped = async (url, options) => {
         const response = await baseFetch(url, options);
         if (response.status === 401 && config.isOAuthEnabled()) {
-            // Skip retry for non-replayable bodies (streams, FormData) since the first request consumed them
             if (isNonReplayableBody(options?.body)) {
                 log.info("Received 401 but request body is not replayable (stream/FormData), skipping retry.");
                 return response;
             }
             log.info("Received 401, force-refreshing OAuth token and retrying...");
             try {
-                // Mutex: coalesce concurrent refresh attempts into a single in-flight request
                 if (!refreshLock) {
                     refreshLock = config.refreshToken(true).finally(() => {
                         refreshLock = null;
@@ -77,5 +93,6 @@ export function wrapWithAuthRetry(baseFetch, config) {
             }
         }
         return response;
-    });
+    };
+    return wrapped;
 }

package/build/downloads/proxy.js

@@ -1,3 +1,5 @@
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { decryptDownloadToken } from "../utils/download-token.js";
 const DEFAULT_DOWNLOAD_TIMEOUT_MS = 120_000;
 function canonicalizeQueryParams(params) {
@@ -156,10 +158,9 @@ export function registerDownloadProxy(app, deps) {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), downloadTimeoutMs);
         try {
-            const agent = deps.getAgentFunctionForUrl(apiUrl);
             const gitlabResponse = await deps.fetch(gitlabUrl, {
                 headers,
-                agent,
+                dispatcher: deps.getDispatcherForUrl(apiUrl),
                 signal: controller.signal,
             });
             if (!gitlabResponse.ok) {
@@ -177,12 +178,11 @@ export function registerDownloadProxy(app, deps) {
                 res.setHeader("Content-Disposition", contentDisposition);
             if (contentLength)
                 res.setHeader("Content-Length", contentLength);
-            if (gitlabResponse.body) {
-                gitlabResponse.body.pipe(res);
-            }
-            else {
+            if (!gitlabResponse.body) {
                 res.status(502).json({ error: "No response body from GitLab" });
+                return;
             }
+            await pipeline(Readable.fromWeb(gitlabResponse.body), res);
         }
         catch (error) {
             deps.logger.error({ err: error }, "Download proxy error");

package/build/gitlab-client-pool.js

@@ -1,9 +1,7 @@
-import { Agent } from "http";
-import { Agent as HttpsAgent } from "https";
-import { HttpProxyAgent } from "http-proxy-agent";
-import { HttpsProxyAgent } from "https-proxy-agent";
+import fs from "node:fs";
+import http from "node:http";
 import { SocksProxyAgent } from "socks-proxy-agent";
-import fs from "fs";
+import { Agent, Dispatcher, ProxyAgent } from "undici";
 /**
  * Checks if a URL should bypass the proxy based on NO_PROXY patterns.
  * Supports:
@@ -21,7 +19,6 @@ function shouldBypassProxy(url, noProxy) {
     if (!noProxy) {
         return false;
     }
-    // Parse URL to get hostname and port
     let hostname;
     let port;
     let protocol;
@@ -29,185 +26,224 @@ function shouldBypassProxy(url, noProxy) {
         const parsedUrl = new URL(url);
         hostname = parsedUrl.hostname.toLowerCase();
         protocol = parsedUrl.protocol;
-        // Use explicit port if provided, otherwise use default port based on protocol
-        port = parsedUrl.port || (protocol === 'https:' ? '443' : '80');
+        port = parsedUrl.port || (protocol === "https:" ? "443" : "80");
     }
     catch {
         return false;
     }
-    // Split NO_PROXY into patterns and trim whitespace
-    const patterns = noProxy.split(',').map(p => p.trim().toLowerCase()).filter(p => p.length > 0);
+    const patterns = noProxy
+        .split(",")
+        .map(p => p.trim().toLowerCase())
+        .filter(p => p.length > 0);
     for (const pattern of patterns) {
-        // Wildcard matches everything
-        if (pattern === '*') {
+        if (pattern === "*") {
             return true;
         }
-        // Handle port-specific patterns (e.g., "example.com:8080")
-        const [patternHost, patternPort] = pattern.split(':');
-        // If pattern specifies a port, check if it matches
+        const [patternHost, patternPort] = pattern.split(":");
         if (patternPort && port !== patternPort) {
             continue;
         }
-        // Check for domain suffix match (e.g., ".example.com")
-        if (patternHost.startsWith('.')) {
+        if (patternHost.startsWith(".")) {
             const suffix = patternHost.substring(1);
-            if (hostname === suffix || hostname.endsWith('.' + suffix)) {
+            if (hostname === suffix || hostname.endsWith("." + suffix)) {
                 return true;
             }
         }
-        // Check for exact hostname match
         else if (hostname === patternHost) {
             return true;
         }
     }
     return false;
 }
+class ProtocolDispatcher extends Dispatcher {
+    httpDirect;
+    httpsDirect;
+    httpProxyDispatcher;
+    httpsProxyDispatcher;
+    noProxy;
+    constructor(httpDirect, httpsDirect, httpProxyDispatcher, httpsProxyDispatcher, noProxy) {
+        super();
+        this.httpDirect = httpDirect;
+        this.httpsDirect = httpsDirect;
+        this.httpProxyDispatcher = httpProxyDispatcher;
+        this.httpsProxyDispatcher = httpsProxyDispatcher;
+        this.noProxy = noProxy;
+    }
+    dispatcherForOrigin(originText) {
+        const useHttps = originText.startsWith("https:");
+        const bypass = shouldBypassProxy(originText, this.noProxy);
+        if (bypass) {
+            return useHttps ? this.httpsDirect : this.httpDirect;
+        }
+        return useHttps ? this.httpsProxyDispatcher : this.httpProxyDispatcher;
+    }
+    dispatch(options, handler) {
+        const origin = options.origin;
+        const originText = origin instanceof URL ? origin.href : String(origin ?? "");
+        return this.dispatcherForOrigin(originText).dispatch(options, handler);
+    }
+}
+function createSocksConnect(proxyUrl, tls) {
+    const socksAgent = new SocksProxyAgent(proxyUrl);
+    return (options, callback) => {
+        const port = Number(options.port);
+        const host = options.hostname;
+        const dummyReq = http.request({
+            hostname: "127.0.0.1",
+            port: 9,
+            path: "/",
+            method: "HEAD",
+            agent: false,
+        });
+        dummyReq.on("error", () => undefined);
+        dummyReq.destroy();
+        const connectThroughSocks = (connectOpts) => {
+            void socksAgent
+                .connect(dummyReq, connectOpts)
+                .then(socket => {
+                callback(null, socket);
+            })
+                .catch((error) => {
+                const err = error instanceof Error ? error : new Error("SOCKS connect failed");
+                callback(err, null);
+            });
+        };
+        if (options.protocol === "https:") {
+            connectThroughSocks({
+                secureEndpoint: true,
+                host,
+                port,
+                servername: options.servername,
+                rejectUnauthorized: tls.rejectUnauthorized,
+                ca: tls.ca,
+            });
+            return;
+        }
+        connectThroughSocks({
+            secureEndpoint: false,
+            host,
+            port,
+        });
+    };
+}
+function createDispatcher(proxyUrl, tls) {
+    const hasTls = tls.rejectUnauthorized === false || tls.ca !== undefined;
+    if (proxyUrl?.startsWith("socks")) {
+        return new Agent({ connect: createSocksConnect(proxyUrl, tls) });
+    }
+    if (proxyUrl) {
+        if (hasTls) {
+            return new ProxyAgent({ uri: proxyUrl, requestTls: tls });
+        }
+        return new ProxyAgent(proxyUrl);
+    }
+    if (hasTls) {
+        return new Agent({ connect: tls });
+    }
+    return new Agent();
+}
 /**
- * Manages a pool of HTTP/HTTPS agents for different GitLab API URLs.
+ * Manages a pool of undici dispatchers for different GitLab API URLs.
  * This allows the server to efficiently handle requests to multiple GitLab instances
- * by reusing agents and their underlying TCP connections.
+ * by reusing dispatchers and their underlying TCP connections.
  */
 export class GitLabClientPool {
     clients = new Map();
     options;
     constructor(options) {
         this.options = options;
-        // Initialization is now done on-demand
     }
-    /**
-     * Creates a pair of HTTP and HTTPS agents for a specific API URL,
-     * considering proxy and SSL/TLS settings.
-     * @param apiUrl The base URL for which to create the agents.
-     * @returns A `ClientAgents` object containing the configured agents.
-     */
-    createAgentsForUrl(apiUrl) {
+    createDispatchersForUrl(apiUrl) {
         const { httpProxy, httpsProxy, noProxy, rejectUnauthorized, caCertPath } = this.options;
-        let sslOptions = {};
+        const tls = {};
         if (rejectUnauthorized === false) {
-            sslOptions.rejectUnauthorized = false;
+            tls.rejectUnauthorized = false;
         }
         else if (caCertPath) {
             try {
-                sslOptions.ca = fs.readFileSync(caCertPath);
+                tls.ca = fs.readFileSync(caCertPath);
             }
             catch (error) {
                 console.error(`Failed to read CA certificate from ${caCertPath}:`, error);
                 throw new Error(`Failed to read CA certificate: ${caCertPath}`);
             }
         }
-        // Check if this URL should bypass the proxy
+        const httpDirect = createDispatcher(undefined, tls);
+        const httpsDirect = createDispatcher(undefined, tls);
+        const httpProxyDispatcher = createDispatcher(httpProxy, tls);
+        const httpsProxyDispatcher = createDispatcher(httpsProxy, tls);
         const bypassProxy = shouldBypassProxy(apiUrl, noProxy);
-        let httpAgent;
-        let httpsAgent;
-        // Configure HTTP agent with proxy if specified and not bypassed
-        if (httpProxy && !bypassProxy) {
-            httpAgent = httpProxy.startsWith("socks")
-                ? new SocksProxyAgent(httpProxy)
-                : new HttpProxyAgent(httpProxy);
-        }
-        else {
-            httpAgent = new Agent({ keepAlive: true });
-        }
-        // Configure HTTPS agent with proxy and SSL options if specified and not bypassed
-        if (httpsProxy && !bypassProxy) {
-            httpsAgent = httpsProxy.startsWith("socks")
-                // The `as any` cast is used here to bypass a TypeScript type mismatch error.
-                // The `socks-proxy-agent` documentation indicates that TLS options like
-                // `rejectUnauthorized` and `ca` are valid in the constructor's options
-                // object, but the type definitions in this environment seem to disagree.
-                // This cast ensures the options are passed through at runtime.
-                ? new SocksProxyAgent(httpsProxy, sslOptions)
-                : new HttpsProxyAgent(httpsProxy, { ...sslOptions });
-        }
-        else {
-            httpsAgent = new HttpsAgent({ ...sslOptions, keepAlive: true });
-        }
-        return { httpAgent, httpsAgent };
+        return {
+            httpDispatcher: bypassProxy ? httpDirect : httpProxyDispatcher,
+            httpsDispatcher: bypassProxy ? httpsDirect : httpsProxyDispatcher,
+            dispatcher: new ProtocolDispatcher(httpDirect, httpsDirect, httpProxyDispatcher, httpsProxyDispatcher, noProxy),
+        };
     }
     /**
-     * Retrieves the appropriate agent (HTTP or HTTPS) for a given API URL.
-     * If an agent for the URL does not exist, it creates and caches one.
-     * @param apiUrl The full URL of the request.
-     * @returns The corresponding `Agent` for the URL's protocol.
+     * Retrieves the protocol-specific dispatcher for a given API URL.
+     * Used by NO_PROXY tests to distinguish Agent vs ProxyAgent.
      */
     getOrCreateAgentForUrl(apiUrl) {
-        const agents = this.getOrCreateAgentsForUrl(apiUrl);
+        const dispatchers = this.getOrCreateDispatchersForUrl(apiUrl);
         const url = new URL(apiUrl);
-        return url.protocol === "https:" ? agents.httpsAgent : agents.httpAgent;
+        return url.protocol === "https:" ? dispatchers.httpsDispatcher : dispatchers.httpDispatcher;
     }
     /**
-     * Returns an agent-selection function for use with node-fetch's `agent` option.
-     * The returned function picks the correct HTTP or HTTPS agent based on the
-     * request URL's protocol. This is critical for self-hosted GitLab instances
-     * where the server may redirect between HTTP and HTTPS (e.g., when
-     * `external_url` differs from the actual internal protocol).
-     * @param apiUrl The base API URL used to look up or create the agent pair.
-     * @returns A function `(parsedURL: URL) => Agent` suitable for node-fetch.
+     * Returns a dispatcher that picks HTTP vs HTTPS based on the request origin.
+     * Needed when a self-hosted GitLab redirects between HTTP and HTTPS.
      */
-    getAgentFunctionForUrl(apiUrl) {
-        const agents = this.getOrCreateAgentsForUrl(apiUrl);
-        return (parsedURL) => {
-            return parsedURL.protocol === "https:" ? agents.httpsAgent : agents.httpAgent;
-        };
+    getDispatcherForUrl(apiUrl) {
+        return this.getOrCreateDispatchersForUrl(apiUrl).dispatcher;
     }
     /**
-     * Ensures agents exist for the given API URL and returns the pair.
-     * @param apiUrl The full URL of the request.
-     * @returns The `ClientAgents` (both HTTP and HTTPS agents) for the URL.
+     * Which inner dispatcher would handle `originUrl` after following a redirect
+     * from `apiUrl`. Used to verify NO_PROXY is re-evaluated per origin.
      */
-    getOrCreateAgentsForUrl(apiUrl) {
+    getDispatcherForOrigin(apiUrl, originUrl) {
+        const dispatcher = this.getOrCreateDispatchersForUrl(apiUrl).dispatcher;
+        if (dispatcher instanceof ProtocolDispatcher) {
+            return dispatcher.dispatcherForOrigin(originUrl);
+        }
+        return dispatcher;
+    }
+    getOrCreateDispatchersForUrl(apiUrl) {
         const url = new URL(apiUrl);
-        const baseUrl = `${url.protocol}//${url.host}${url.pathname.substring(0, url.pathname.lastIndexOf('/api/v4') + '/api/v4'.length)}`;
+        const apiIndex = url.pathname.lastIndexOf("/api/v4");
+        const basePath = apiIndex === -1 ? url.pathname : url.pathname.substring(0, apiIndex + "/api/v4".length);
+        const baseUrl = `${url.protocol}//${url.host}${basePath}`;
         if (!this.clients.has(baseUrl)) {
-            // Check pool size limit
             if (this.options.poolMaxSize !== undefined && this.clients.size >= this.options.poolMaxSize) {
                 throw new Error(`Server capacity reached: Connection pool is full (max ${this.options.poolMaxSize} instances). Please try again later.`);
             }
-            this.clients.set(baseUrl, this.createAgentsForUrl(baseUrl));
+            this.clients.set(baseUrl, this.createDispatchersForUrl(baseUrl));
         }
-        const agents = this.clients.get(baseUrl);
-        if (!agents) {
-            // This should not happen given the logic above, but it satisfies TypeScript
+        const dispatchers = this.clients.get(baseUrl);
+        if (!dispatchers) {
             throw new Error(`Failed to create or get client for URL: ${baseUrl}`);
         }
-        return agents;
+        return dispatchers;
     }
-    /**
-     * Retrieves the client agents for a specific base API URL.
-     * @param apiUrl The base API URL (e.g., "https://gitlab.com/api/v4").
-     * @returns The `ClientAgents` object or undefined if not found.
-     */
     getClient(apiUrl) {
         return this.clients.get(apiUrl);
     }
-    /**
-     * Returns the default client agents, which corresponds to the first URL in the list.
-     * @returns The default `ClientAgents`.
-     */
     getDefaultClient() {
         const defaultUrl = this.options.apiUrls?.[0];
         if (!defaultUrl) {
             throw new Error("No default API URL configured.");
         }
         if (!this.clients.has(defaultUrl)) {
-            this.clients.set(defaultUrl, this.createAgentsForUrl(defaultUrl));
+            this.clients.set(defaultUrl, this.createDispatchersForUrl(defaultUrl));
         }
-        return this.clients.get(defaultUrl);
+        const client = this.clients.get(defaultUrl);
+        if (!client) {
+            throw new Error("No default API URL configured.");
+        }
+        return client;
     }
-    /**
-     * Destroy all pooled agents and clear pool state.
-     * This should be called on graceful shutdown so sockets are closed
-     * and the process can exit cleanly.
-     */
     closeAll() {
-        for (const [, agents] of this.clients) {
-            const destroyIfSupported = (agent) => {
-                if (agent && typeof agent.destroy === "function") {
-                    agent.destroy();
-                }
-            };
-            destroyIfSupported(agents.httpAgent);
-            destroyIfSupported(agents.httpsAgent);
+        for (const [, dispatchers] of this.clients) {
+            void dispatchers.httpDispatcher.destroy();
+            void dispatchers.httpsDispatcher.destroy();
         }
         this.clients.clear();
     }