@zereight/mcp-gitlab 2.1.56 → 2.1.57

package/build/index.js

@@ -69,7 +69,7 @@ import fetchCookie from "fetch-cookie";
 import fs from "node:fs";
 import { pipeline as streamPipeline } from "node:stream/promises";
 import os from "node:os";
-import nodeFetch from "node-fetch";
+import { fetch as undiciFetch, File, FormData } from "undici";
 import path from "node:path";
 import { CookieJar, parse as parseCookie } from "tough-cookie";
 import { URL } from "node:url";
@@ -111,7 +111,7 @@ GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
 GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabGroupMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineScheduleSchema, GitLabPipelineScheduleVariableSchema, GitLabPipelineSchedulePlayResultSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
-GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListGroupMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
+GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListGroupMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, CreateWebhookSchema, UpdateWebhookSchema, DeleteWebhookSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
 import { randomUUID, timingSafeEqual, } from "node:crypto";
 import { createLogger } from "./utils/logger.js";
 const logger = createLogger();
@@ -913,7 +913,7 @@ function defaultAuthRetryConfig() {
 }
 // Cookie jar and fetch - reloaded when cookie file changes
 let cookieJar = null;
-let fetch = wrapWithAuthRetry(nodeFetch, defaultAuthRetryConfig());
+let fetch = wrapWithAuthRetry(undiciFetch, defaultAuthRetryConfig());
 let lastCookieMtime = 0;
 let cookieReloadLock = null; // Mutex to prevent parallel reloads
 // Auth proxies may redirect and set cookies on the first request. We make a throwaway
@@ -933,7 +933,7 @@ async function reloadCookiesIfChanged() {
                 lastCookieMtime = mtime;
                 const newJar = await createCookieJar();
                 cookieJar = newJar;
-                fetch = wrapWithAuthRetry(newJar ? fetchCookie(nodeFetch, newJar) : nodeFetch, defaultAuthRetryConfig());
+                fetch = wrapWithAuthRetry(newJar ? fetchCookie(undiciFetch, newJar) : undiciFetch, defaultAuthRetryConfig());
                 initialSessionRequestMade = false;
             }
         }
@@ -942,7 +942,7 @@ async function reloadCookiesIfChanged() {
             if (cookieJar) {
                 logger.info("Cookie file removed, clearing cached cookies");
                 cookieJar = null;
-                fetch = wrapWithAuthRetry(nodeFetch, defaultAuthRetryConfig());
+                fetch = wrapWithAuthRetry(undiciFetch, defaultAuthRetryConfig());
                 lastCookieMtime = 0;
                 initialSessionRequestMade = false;
             }
@@ -1060,10 +1060,10 @@ function getEffectiveApiUrl() {
  */
 const getFetchConfig = () => {
     const effectiveApiUrl = getEffectiveApiUrl();
-    const agent = clientPool.getAgentFunctionForUrl(effectiveApiUrl);
+    const dispatcher = clientPool.getDispatcherForUrl(effectiveApiUrl);
     return {
         headers: { ...BASE_HEADERS, ...buildAuthHeaders() },
-        agent: agent,
+        dispatcher,
     };
 };
 // Compute at startup
@@ -1193,7 +1193,7 @@ if (getPositionalCliCommand(process.argv) !== "auth" &&
  * Utility function for handling GitLab API errors
  * API 에러 처리를 위한 유틸리티 함수 (Utility function for handling API errors)
  *
- * @param {import("node-fetch").Response} response - The response from GitLab API
+ * @param {Response} response - The response from GitLab API
  * @throws {Error} Throws an error with response details if the request failed
  */
 async function handleGitLabError(response) {
@@ -4816,6 +4816,54 @@ async function listWebhooks(options) {
     await handleGitLabError(response);
     return (await response.json());
 }
+function buildWebhookMutationBody(options) {
+    const body = {};
+    for (const [key, value] of Object.entries(options)) {
+        if (key === "project_id" || key === "group_id" || key === "hook_id")
+            continue;
+        if (value !== undefined)
+            body[key] = value;
+    }
+    return body;
+}
+/**
+ * Create a webhook on a project or group
+ */
+async function createWebhook(options) {
+    const url = buildWebhookBaseUrl(options.project_id, options.group_id);
+    const response = await fetch(url, {
+        ...getFetchConfig(),
+        method: "POST",
+        body: JSON.stringify(buildWebhookMutationBody(options)),
+    });
+    await handleGitLabError(response);
+    return await response.json();
+}
+/**
+ * Update a webhook on a project or group
+ */
+async function updateWebhook(options) {
+    const url = `${buildWebhookBaseUrl(options.project_id, options.group_id)}/${options.hook_id}`;
+    const response = await fetch(url, {
+        ...getFetchConfig(),
+        method: "PUT",
+        body: JSON.stringify(buildWebhookMutationBody(options)),
+    });
+    await handleGitLabError(response);
+    return await response.json();
+}
+/**
+ * Delete a webhook from a project or group
+ */
+async function deleteWebhook(options) {
+    const url = `${buildWebhookBaseUrl(options.project_id, options.group_id)}/${options.hook_id}`;
+    const response = await fetch(url, {
+        ...getFetchConfig(),
+        method: "DELETE",
+    });
+    await handleGitLabError(response);
+    return { status: "deleted", hook_id: options.hook_id };
+}
 /**
  * Fetch a single page of webhook events
  */
@@ -7015,15 +7063,11 @@ async function markdownUpload(projectId, filePath, content, filename) {
         throw new Error("Either file_path or content must be provided");
     }
     // Create form data
-    const FormData = (await import("form-data")).default;
     const form = new FormData();
-    form.append("file", fileBuffer, {
-        filename: fileName,
-        contentType: "application/octet-stream",
-    });
+    form.append("file", new File([fileBuffer], fileName, { type: "application/octet-stream" }));
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/uploads`);
     const defaultFetchConfig = getFetchConfig();
-    delete defaultFetchConfig.headers["Content-Type"]; // Let form-data set the correct Content-Type with boundary
+    delete defaultFetchConfig.headers["Content-Type"];
     const response = await fetch(url.toString(), {
         ...defaultFetchConfig,
         method: "POST",
@@ -9744,6 +9788,27 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(webhooks) }],
                 };
             }
+            case "create_webhook": {
+                const args = CreateWebhookSchema.parse(params.arguments);
+                const webhook = await createWebhook(args);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(webhook) }],
+                };
+            }
+            case "update_webhook": {
+                const args = UpdateWebhookSchema.parse(params.arguments);
+                const webhook = await updateWebhook(args);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(webhook) }],
+                };
+            }
+            case "delete_webhook": {
+                const args = DeleteWebhookSchema.parse(params.arguments);
+                const result = await deleteWebhook(args);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(result) }],
+                };
+            }
             case "list_webhook_events": {
                 const args = ListWebhookEventsSchema.parse(params.arguments);
                 const events = await listWebhookEvents(args);
@@ -9981,8 +10046,8 @@ function buildDownloadProxyDeps() {
         encodeGitLabPathSegment,
         encodeGitLabPath,
         getEffectiveProjectId,
-        getAgentFunctionForUrl: clientPool.getAgentFunctionForUrl.bind(clientPool),
-        fetch: nodeFetch,
+        getDispatcherForUrl: clientPool.getDispatcherForUrl.bind(clientPool),
+        fetch: undiciFetch,
         logger,
     };
 }

package/build/schemas.js

@@ -4091,6 +4091,14 @@ export const CreateTimelineEventSchema = z.object({
         .describe("Timeline event tags to attach. Available: 'Start time', 'End time', 'Impact detected', 'Response initiated', 'Impact mitigated', 'Cause identified'."),
 });
 // --- Webhook schemas ---
+function hasExactlyOneWebhookScope(data) {
+    const hasProject = Boolean(data.project_id);
+    const hasGroup = Boolean(data.group_id);
+    return (hasProject || hasGroup) && !(hasProject && hasGroup);
+}
+const EXACTLY_ONE_WEBHOOK_SCOPE = {
+    message: "Provide exactly one of project_id or group_id",
+};
 export const ListWebhooksSchema = z
     .object({
     project_id: z.coerce
@@ -4103,9 +4111,7 @@ export const ListWebhooksSchema = z
         .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
 })
     .merge(PaginationOptionsSchema)
-    .refine(data => (data.project_id || data.group_id) && !(data.project_id && data.group_id), {
-    message: "Provide exactly one of project_id or group_id",
-});
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
 export const ListWebhookEventsSchema = z
     .object({
     project_id: z.coerce
@@ -4128,9 +4134,7 @@ export const ListWebhookEventsSchema = z
     per_page: z.number().max(20).optional().default(20).describe("Number of events per page"),
     page: z.coerce.number().optional().describe("Page number for pagination"),
 })
-    .refine(data => (data.project_id || data.group_id) && !(data.project_id && data.group_id), {
-    message: "Provide exactly one of project_id or group_id",
-});
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
 export const GetWebhookEventSchema = z
     .object({
     project_id: z.coerce
@@ -4148,9 +4152,115 @@ export const GetWebhookEventSchema = z
         .optional()
         .describe("If known, the page where the event is located (from list_webhook_events). Skips auto-pagination and fetches only this page."),
 })
-    .refine(data => (data.project_id || data.group_id) && !(data.project_id && data.group_id), {
-    message: "Provide exactly one of project_id or group_id",
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
+const WebhookCustomHeaderSchema = z.object({
+    key: z.string().min(1).describe("Custom header name"),
+    value: z.string().describe("Custom header value"),
 });
+const WebhookMutationFields = {
+    url: z.string().url().describe("Webhook destination URL"),
+    name: z.string().optional().describe("Display name for the webhook"),
+    description: z.string().optional().describe("Description of the webhook"),
+    token: z
+        .string()
+        .optional()
+        .describe("Secret token to validate received payloads. Not returned by GitLab in responses."),
+    signing_token: z
+        .string()
+        .optional()
+        .describe("HMAC signing token in whsec_<base64> form, where the Base64 suffix encodes a 32-byte key. Used for the webhook-signature header. Not returned by GitLab in responses."),
+    enable_ssl_verification: z
+        .boolean()
+        .optional()
+        .describe("Verify SSL when delivering the webhook"),
+    push_events: z.boolean().optional().describe("Trigger on push events"),
+    push_events_branch_filter: z
+        .string()
+        .optional()
+        .describe("Only trigger push events for matching branches"),
+    branch_filter_strategy: z
+        .enum(["wildcard", "regex", "all_branches"])
+        .optional()
+        .describe("How push_events_branch_filter is interpreted"),
+    issues_events: z.boolean().optional().describe("Trigger on issue events"),
+    confidential_issues_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on confidential issue events"),
+    merge_requests_events: z.boolean().optional().describe("Trigger on merge request events"),
+    tag_push_events: z.boolean().optional().describe("Trigger on tag push events"),
+    note_events: z.boolean().optional().describe("Trigger on note/comment events"),
+    confidential_note_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on confidential note events"),
+    job_events: z.boolean().optional().describe("Trigger on job events"),
+    pipeline_events: z.boolean().optional().describe("Trigger on pipeline events"),
+    wiki_page_events: z.boolean().optional().describe("Trigger on wiki page events"),
+    deployment_events: z.boolean().optional().describe("Trigger on deployment events"),
+    feature_flag_events: z.boolean().optional().describe("Trigger on feature flag events"),
+    releases_events: z.boolean().optional().describe("Trigger on release events"),
+    milestone_events: z.boolean().optional().describe("Trigger on milestone events"),
+    resource_access_token_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on access token expiry events"),
+    resource_deploy_token_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on project deploy token expiry events (project webhooks)"),
+    member_events: z.boolean().optional().describe("Trigger on member events (group webhooks)"),
+    project_events: z.boolean().optional().describe("Trigger on project events (group webhooks)"),
+    subgroup_events: z.boolean().optional().describe("Trigger on subgroup events (group webhooks)"),
+    custom_webhook_template: z
+        .string()
+        .optional()
+        .describe("Custom JSON payload template for the webhook"),
+    custom_headers: z
+        .array(WebhookCustomHeaderSchema)
+        .optional()
+        .describe("Custom HTTP headers sent with the webhook. Each item has key and value strings."),
+};
+export const CreateWebhookSchema = z
+    .object({
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    group_id: z.coerce
+        .string()
+        .optional()
+        .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    ...WebhookMutationFields,
+})
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
+export const UpdateWebhookSchema = z
+    .object({
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    group_id: z.coerce
+        .string()
+        .optional()
+        .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    hook_id: z.coerce.number().describe("ID of the webhook to update"),
+    ...WebhookMutationFields,
+})
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
+export const DeleteWebhookSchema = z
+    .object({
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    group_id: z.coerce
+        .string()
+        .optional()
+        .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    hook_id: z.coerce.number().describe("ID of the webhook to delete"),
+})
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
 export const HealthCheckSchema = z.object({});
 // --- CI/CD Variable types ---
 export const GitLabCiVariableSchema = z.object({

package/build/scripts/generate-tool-docs.js

@@ -101,7 +101,7 @@ const GROUP_META = {
     },
     webhooks: {
         title: "Webhooks",
-        blurb: "List webhooks configured on projects or groups, and inspect recent webhook events.",
+        blurb: "Create, update, and delete project or group webhooks, and inspect recent webhook events.",
     },
     search: {
         title: "Search",

package/build/test/no-proxy-test.js

@@ -134,5 +134,16 @@ describe('NO_PROXY Pattern Matching', () => {
         assert.strictEqual(agent1.constructor.name, 'Agent', 'Should match case-insensitively (lowercase)');
         assert.strictEqual(agent2.constructor.name, 'Agent', 'Should match case-insensitively (uppercase)');
     });
+    test('should re-evaluate NO_PROXY for redirect origins', () => {
+        const pool = new GitLabClientPool({
+            httpProxy: 'http://proxy.example.com:8080',
+            httpsProxy: 'http://proxy.example.com:8080',
+            noProxy: 'gitlab.internal.com',
+        });
+        const proxyToBypass = pool.getDispatcherForOrigin('https://gitlab.external.com/api/v4', 'https://gitlab.internal.com/api/v4');
+        const bypassToProxy = pool.getDispatcherForOrigin('https://gitlab.internal.com/api/v4', 'https://gitlab.external.com/api/v4');
+        assert.strictEqual(proxyToBypass.constructor.name, 'Agent', 'redirect onto NO_PROXY host should bypass');
+        assert.notStrictEqual(bypassToProxy.constructor.name, 'Agent', 'redirect onto proxied host should use proxy');
+    });
 });
 console.log('✅ NO_PROXY tests completed');

package/build/test/remote-auth-tests.js

@@ -4,7 +4,6 @@
  */
 import { describe, test, after, before } from 'node:test';
 import assert from 'node:assert';
-import fetch from 'node-fetch';
 import { launchServer, findAvailablePort, cleanupServers, TransportMode, checkHealthEndpoint, HOST } from './utils/server-launcher.js';
 console.log('🔐 Remote Authorization Tests');
 console.log('');

package/build/test/test-auth-retry.js

@@ -6,20 +6,18 @@
  */
 import { describe, test } from "node:test";
 import assert from "node:assert";
-import { Headers, Response } from "node-fetch";
+import { Readable } from "node:stream";
+import { Response } from "undici";
 import { headersToPlainObject, isNonReplayableBody, wrapWithAuthRetry, } from "../auth-retry.js";
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
 function mockFetch(status) {
-    return (async () => new Response("", { status }));
+    return async () => new Response("", { status });
 }
 function mockFetchThenRetry() {
     let callCount = 0;
-    return (async () => {
+    return async () => {
         callCount++;
         return new Response("", { status: callCount === 1 ? 401 : 200 });
-    });
+    };
 }
 function makeConfig(overrides) {
     return {
@@ -30,9 +28,6 @@ function makeConfig(overrides) {
         ...overrides,
     };
 }
-// ---------------------------------------------------------------------------
-// headersToPlainObject
-// ---------------------------------------------------------------------------
 describe("headersToPlainObject", () => {
     test("null returns empty object", () => {
         assert.deepStrictEqual(headersToPlainObject(null), {});
@@ -63,9 +58,6 @@ describe("headersToPlainObject", () => {
         });
     });
 });
-// ---------------------------------------------------------------------------
-// isNonReplayableBody
-// ---------------------------------------------------------------------------
 describe("isNonReplayableBody", () => {
     test("null returns false", () => {
         assert.strictEqual(isNonReplayableBody(null), false);
@@ -85,16 +77,15 @@ describe("isNonReplayableBody", () => {
     test("object with .read() returns true (stream-like)", () => {
         assert.strictEqual(isNonReplayableBody({ read: () => { } }), true);
     });
-    test("object with .getBuffer() and .getBoundary() returns true (FormData-like)", () => {
-        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { }, getBoundary: () => { } }), true);
-    });
-    test("object with only .getBuffer() (no .getBoundary()) returns false", () => {
-        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { } }), false);
+    test("Web ReadableStream returns true", () => {
+        const stream = new ReadableStream({
+            start(controller) {
+                controller.close();
+            },
+        });
+        assert.strictEqual(isNonReplayableBody(stream), true);
     });
 });
-// ---------------------------------------------------------------------------
-// wrapWithAuthRetry
-// ---------------------------------------------------------------------------
 describe("wrapWithAuthRetry", () => {
     test("non-401 response passes through unchanged", async () => {
         const wrapped = wrapWithAuthRetry(mockFetch(200), makeConfig());
@@ -137,7 +128,29 @@ describe("wrapWithAuthRetry", () => {
         });
         const wrapped = wrapWithAuthRetry(mockFetch(401), config);
         const res = await wrapped("http://example.com", {
-            body: { pipe: () => { } }, // stream-like
+            body: Readable.from([]),
+            duplex: "half",
+        });
+        assert.strictEqual(res.status, 401);
+        assert.strictEqual(refreshCalled, false);
+    });
+    test("401 with Web ReadableStream body skips retry", async () => {
+        let refreshCalled = false;
+        const config = makeConfig({
+            refreshToken: async () => {
+                refreshCalled = true;
+                return "tok";
+            },
+        });
+        const stream = new ReadableStream({
+            start(controller) {
+                controller.close();
+            },
+        });
+        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
+        const res = await wrapped("http://example.com", {
+            body: stream,
+            duplex: "half",
         });
         assert.strictEqual(res.status, 401);
         assert.strictEqual(refreshCalled, false);
@@ -148,27 +161,21 @@ describe("wrapWithAuthRetry", () => {
         const config = makeConfig({
             refreshToken: () => {
                 refreshCount++;
-                return new Promise((resolve) => {
+                return new Promise(resolve => {
                     resolveRefresh = resolve;
                 });
             },
             buildAuthHeaders: () => ({ Authorization: "Bearer stamped" }),
         });
-        // Each call returns 401 first, then 200 on retry
         let callCount = 0;
-        const base = (async () => {
+        const base = async () => {
             callCount++;
-            // First two calls are the initial requests (both 401)
-            // Next two are the retries (both 200)
             return new Response("", { status: callCount <= 2 ? 401 : 200 });
-        });
+        };
         const wrapped = wrapWithAuthRetry(base, config);
-        // Fire two concurrent requests
         const p1 = wrapped("http://example.com/a");
         const p2 = wrapped("http://example.com/b");
-        // Wait a tick for both to hit the refresh path
-        await new Promise((r) => setTimeout(r, 10));
-        // Resolve the single pending refresh
+        await new Promise(r => setTimeout(r, 10));
         resolveRefresh("stamped-token");
         const [r1, r2] = await Promise.all([p1, p2]);
         assert.strictEqual(r1.status, 200);

package/build/test/test-permission-mode.js

@@ -58,6 +58,7 @@ const DELETE_SAMPLE_TOOLS = [
     "delete_milestone",
     "delete_group_milestone",
     "delete_project_variable",
+    "delete_webhook",
 ];
 const MODIFY_SAMPLE_TOOLS = [
     "create_issue",

package/build/test/test-toolset-filtering.js

@@ -31,7 +31,7 @@ const TOOLSET_TOOL_COUNTS = {
     users: 7,
     search: 3,
     workitems: 18,
-    webhooks: 3,
+    webhooks: 6,
     groups: 1,
     variables: 10,
     dependency_proxy: 4,
@@ -83,7 +83,7 @@ const TOOLSET_SAMPLE_TOOLS = {
     tags: ["list_tags", "create_tag", "get_tag_signature"],
     users: ["get_users", "upload_markdown", "download_attachment"],
     search: ["search_code", "search_project_code", "search_group_code"],
-    webhooks: ["list_webhooks", "list_webhook_events", "get_webhook_event"],
+    webhooks: ["list_webhooks", "create_webhook", "update_webhook", "delete_webhook", "list_webhook_events", "get_webhook_event"],
     groups: ["create_group"],
     variables: ["list_project_variables", "create_project_variable", "delete_project_variable", "list_group_variables", "create_group_variable", "delete_group_variable"],
     dependency_proxy: ["get_dependency_proxy_settings", "list_dependency_proxy_blobs", "purge_dependency_proxy_cache"],