@zereight/mcp-gitlab 2.1.67 → 2.1.69

package/build/cli/exposure.js

@@ -0,0 +1,72 @@
+import { GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_TOOLS_RAW, GITLAB_TOOLSETS_RAW, getConfig, } from "../config.js";
+import { compileDeniedToolsRegex } from "../tools/denied-regex.js";
+import { buildFeatureFlagOverrides, isToolInEnabledToolset, parseEnabledToolsets, parseIndividualTools, } from "../tools/registry.js";
+export function parseToolNameSet(raw) {
+    if (!raw || raw.trim() === "") {
+        return new Set();
+    }
+    return new Set(raw
+        .split(",")
+        .map(name => name.trim())
+        .filter(Boolean));
+}
+export function isToolExposed(input) {
+    if (input.hiddenTools.has(input.toolName)) {
+        return false;
+    }
+    if (input.deniedRegex?.test(input.toolName) === true) {
+        return false;
+    }
+    if (isToolInEnabledToolset(input.toolName, input.enabledToolsets)) {
+        return true;
+    }
+    if (input.individuallyEnabledTools.has(input.toolName)) {
+        return true;
+    }
+    return input.featureFlagOverrides.has(input.toolName);
+}
+export function exposureRefusalMessage(input) {
+    if (input.hiddenTools.has(input.toolName)) {
+        return `${input.toolName} is hidden by GITLAB_TOOL_POLICY_HIDDEN`;
+    }
+    if (input.deniedRegex?.test(input.toolName) === true) {
+        return `${input.toolName} is blocked by GITLAB_DENIED_TOOLS_REGEX`;
+    }
+    if (isToolExposed(input)) {
+        return undefined;
+    }
+    return `${input.toolName} is not enabled by GITLAB_TOOLSETS, GITLAB_TOOLS, or legacy wiki/milestone/pipeline flags`;
+}
+export function liveCliExposure() {
+    const enabledToolsets = parseEnabledToolsets(GITLAB_TOOLSETS_RAW);
+    const individuallyEnabledTools = parseIndividualTools(GITLAB_TOOLS_RAW);
+    const featureFlagOverrides = buildFeatureFlagOverrides();
+    const deniedRegex = compileDeniedToolsRegex(getConfig("denied-tools-regex", "GITLAB_DENIED_TOOLS_REGEX")).regex;
+    const hiddenTools = parseToolNameSet(GITLAB_TOOL_POLICY_HIDDEN_RAW);
+    const approveTools = parseToolNameSet(GITLAB_TOOL_POLICY_APPROVE_RAW);
+    return {
+        isExposed(toolName) {
+            return isToolExposed({
+                toolName,
+                enabledToolsets,
+                individuallyEnabledTools,
+                featureFlagOverrides,
+                deniedRegex,
+                hiddenTools,
+            });
+        },
+        needsConfirmation(toolName) {
+            return approveTools.has(toolName);
+        },
+        exposureRefusal(toolName) {
+            return exposureRefusalMessage({
+                toolName,
+                enabledToolsets,
+                individuallyEnabledTools,
+                featureFlagOverrides,
+                deniedRegex,
+                hiddenTools,
+            });
+        },
+    };
+}

package/build/cli/help.js

@@ -0,0 +1,108 @@
+import { allTools } from "../tools/registry.js";
+import { readObjectSchema, snakeToKebab } from "./args.js";
+import { CURATED_COMMANDS, listGroupActions, listGroups } from "./curated.js";
+const BINARY = "zereight-mcp-gitlab";
+export function globalHelpText() {
+    const groups = listGroups().map(group => `  ${group}`).join("\n");
+    return `${BINARY} — GitLab MCP server and human CLI
+
+Usage:
+  ${BINARY} auth [options]
+  ${BINARY} tool <tool-name> [options]
+  ${BINARY} <group> <action> [options]
+  ${BINARY} --help
+
+Global flags:
+  --output table|json   Output format (table default for curated, json for tool)
+  --yes                 Confirm destructive or approval-policy commands
+  --args-json '{...}'   Nested/array arguments
+  --token TOKEN         GitLab personal access token
+  --api-url URL         GitLab API URL
+  --permission-mode     readonly | modify | full
+
+Groups:
+${groups}
+
+Advanced: ${BINARY} tool <name> covers registry tools allowed by the current toolsets and filters. Curated commands are the daily path.
+Human CLI honors GITLAB_TOOLSETS, GITLAB_TOOLS, GITLAB_DENIED_TOOLS_REGEX, and tool-policy hidden/approve.
+MCP compact (server): --compact-results replaces oversized tool replies with a preview plus a CLI command for the full payload.
+`;
+}
+export function groupHelpText(group) {
+    const commands = listGroupActions(group);
+    if (commands.length === 0) {
+        return `Unknown group: ${group}\n`;
+    }
+    const lines = commands.map(command => `  ${command.group} ${command.action}    ${command.tool}`);
+    return `${BINARY} ${group}
+
+Usage:
+  ${BINARY} ${group} <action> [options]
+  ${BINARY} ${group} <action> --help
+
+Actions:
+${lines.join("\n")}
+`;
+}
+export function toolHelpText(toolName) {
+    const tool = allTools.find(entry => entry.name === toolName);
+    if (tool === undefined || toolName === "discover_tools") {
+        return `Unknown tool: ${toolName}\n`;
+    }
+    const schema = readObjectSchema(tool.inputSchema);
+    const description = typeof tool.description === "string" ? tool.description : "";
+    const flags = formatSchemaFlags(schema.properties, schema.required ?? []);
+    return `${BINARY} tool ${toolName}
+
+${description}
+
+Flags:
+${flags}
+  --output json|table
+  --args-json '{...}'
+`;
+}
+export function curatedHelpText(group, action) {
+    const command = CURATED_COMMANDS.find(entry => entry.group === group && entry.action === action);
+    if (command === undefined) {
+        return `Unknown command: ${group} ${action}\n`;
+    }
+    const tool = allTools.find(entry => entry.name === command.tool);
+    const schema = readObjectSchema(tool?.inputSchema);
+    const flags = formatSchemaFlags(schema.properties, schema.required ?? [], command.flagAliases);
+    return `${BINARY} ${group} ${action}
+
+Maps to ${command.tool}${command.scope ? ` (or ${command.scope.groupTool} with --group-id)` : ""}
+
+Flags:
+${flags}
+  --output table|json
+  --yes
+`;
+}
+export function toolIndexHelpText() {
+    const names = allTools
+        .filter(tool => tool.name !== "discover_tools")
+        .map(tool => `  ${tool.name}`)
+        .join("\n");
+    return `${BINARY} tool <tool-name> [options]
+
+Default output is JSON. Use --help after a tool name for generated flags.
+
+Tools:
+${names}
+`;
+}
+function formatSchemaFlags(properties, required, aliases) {
+    if (properties === undefined || Object.keys(properties).length === 0) {
+        return "  (none)";
+    }
+    const requiredSet = new Set(required);
+    const aliasHints = aliases === undefined ? [] : Object.entries(aliases).map(([shortName, fullName]) => `  --${snakeToKebab(shortName)}    alias for --${snakeToKebab(fullName)}`);
+    const flags = Object.entries(properties).map(([name, property]) => {
+        const suffix = requiredSet.has(name) ? " (required)" : "";
+        const description = typeof property.description === "string" ? `  ${property.description}` : "";
+        return `  --${snakeToKebab(name)}${suffix}${description}`;
+    });
+    return [...flags, ...aliasHints].join("\n");
+}

package/build/cli/output.js

@@ -0,0 +1,65 @@
+import { renderTable } from "./tables.js";
+export function formatToolOutput(input) {
+    const isError = resultIsError(input.result);
+    const text = unwrapToolText(input.result);
+    if (input.mode === "json") {
+        return { stdout: ensureTrailingNewline(jsonOrRaw(text)), stderr: "", isError };
+    }
+    const parsed = parseJsonValue(text);
+    if (parsed === undefined && input.tableSpec?.kind !== "text") {
+        return {
+            stdout: ensureTrailingNewline(text),
+            stderr: "No table renderer for this result; printed raw output.\n",
+            isError,
+        };
+    }
+    const rendered = renderTable(parsed ?? text, input.tableSpec);
+    return { stdout: rendered.stdout, stderr: rendered.stderr, isError };
+}
+export function formatCliError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return `${redactSecrets(message)}\n`;
+}
+export function resultIsError(result) {
+    return isRecord(result) && result.isError === true;
+}
+function unwrapToolText(result) {
+    if (!isRecord(result) || !Array.isArray(result.content)) {
+        return stringifyUnknown(result);
+    }
+    const textBlock = result.content.find(item => isRecord(item) && typeof item.text === "string");
+    if (!isRecord(textBlock) || typeof textBlock.text !== "string") {
+        return stringifyUnknown(result);
+    }
+    return textBlock.text;
+}
+function jsonOrRaw(text) {
+    const parsed = parseJsonValue(text);
+    if (parsed === undefined) {
+        return JSON.stringify(text);
+    }
+    return JSON.stringify(parsed);
+}
+function parseJsonValue(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function stringifyUnknown(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return JSON.stringify(value);
+}
+function ensureTrailingNewline(text) {
+    return text.endsWith("\n") ? text : `${text}\n`;
+}
+function redactSecrets(message) {
+    return message.replace(/glpat-[A-Za-z0-9_-]+/g, "[REDACTED]");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/build/cli/replay-command.js

@@ -0,0 +1,53 @@
+import { snakeToKebab } from "./args.js";
+const BINARY = "zereight-mcp-gitlab";
+const SIMPLE_SHELL_TOKEN = /^[A-Za-z0-9._:/=+-]+$/;
+const SECRET_ARGUMENT_NAMES = new Set([
+    "token",
+    "job_token",
+    "private_token",
+    "access_token",
+    "cookie",
+    "cookie_path",
+    "password",
+    "signing_token",
+    "authorization",
+]);
+export function buildToolReplayCommand(toolName, args) {
+    const parts = [BINARY, "tool", toolName];
+    const nested = {};
+    if (args !== undefined) {
+        for (const key of Object.keys(args)) {
+            if (shouldOmitReplayArgument(key)) {
+                continue;
+            }
+            const value = Reflect.get(args, key);
+            if (value === undefined) {
+                continue;
+            }
+            if (isScalarReplayValue(value)) {
+                parts.push(`--${snakeToKebab(key)}`, shellToken(String(value)));
+                continue;
+            }
+            nested[key] = value;
+        }
+    }
+    if (Object.keys(nested).length > 0) {
+        parts.push("--args-json", shellToken(JSON.stringify(nested)));
+    }
+    return parts.join(" ");
+}
+function shouldOmitReplayArgument(name) {
+    if (name.startsWith("_")) {
+        return true;
+    }
+    return SECRET_ARGUMENT_NAMES.has(name);
+}
+function isScalarReplayValue(value) {
+    return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function shellToken(value) {
+    if (SIMPLE_SHELL_TOKEN.test(value)) {
+        return value;
+    }
+    return JSON.stringify(value);
+}

package/build/cli/router.js

@@ -0,0 +1,158 @@
+import { GITLAB_PERMISSION_MODE } from "../config.js";
+import { allTools, deleteTools, destructiveTools, readOnlyTools } from "../tools/registry.js";
+import { getPositionalCliCommand } from "../cli-command.js";
+import { applyFlagAliases, argvHasHelp, CliUsageError, parseArgv, parseToolArgs, } from "./args.js";
+import { liveCliExposure } from "./exposure.js";
+import { canonicalGroup, findCuratedCommand, isKnownCliCommand, resolveScopedTool, } from "./curated.js";
+import { curatedHelpText, globalHelpText, groupHelpText, toolHelpText, toolIndexHelpText, } from "./help.js";
+export function isCliInvocation(argv) {
+    if (argvHasHelp(argv)) {
+        return true;
+    }
+    const positional = getPositionalCliCommand(argv);
+    if (positional === undefined) {
+        return false;
+    }
+    return isKnownCliCommand(positional);
+}
+export function resolveCli(argv, options = {}) {
+    try {
+        return resolveCliUnsafe(argv, options.permissionMode ?? GITLAB_PERMISSION_MODE, options.exposure ?? liveCliExposure());
+    }
+    catch (error) {
+        if (error instanceof CliUsageError) {
+            return { kind: "usage", message: error.message };
+        }
+        throw error;
+    }
+}
+function resolveCliUnsafe(argv, permissionMode, exposure) {
+    const parsed = parseArgv(argv);
+    const [head, action, extra] = parsed.positionals;
+    if (head === undefined) {
+        if (parsed.help) {
+            return { kind: "help", text: globalHelpText() };
+        }
+        return { kind: "server" };
+    }
+    if (head === "auth") {
+        return { kind: "auth" };
+    }
+    if (head === "tool") {
+        if (extra !== undefined) {
+            return { kind: "usage", message: `Unexpected extra arguments: ${parsed.positionals.slice(2).join(" ")}` };
+        }
+        if (action === undefined) {
+            if (parsed.help) {
+                return { kind: "help", text: toolIndexHelpText() };
+            }
+            return { kind: "usage", message: `Usage: zereight-mcp-gitlab tool <tool-name> [options]` };
+        }
+        if (parsed.help) {
+            return { kind: "help", text: toolHelpText(action) };
+        }
+        return buildRun({
+            toolName: action,
+            flags: parsed.toolFlags,
+            argsJson: parsed.argsJson,
+            extraArgs: undefined,
+            output: parsed.output ?? "json",
+            yes: parsed.yes,
+            permissionMode,
+            exposure,
+            tableSpec: undefined,
+        });
+    }
+    const group = canonicalGroup(head);
+    if (group === undefined) {
+        if (parsed.help) {
+            return { kind: "help", text: globalHelpText() };
+        }
+        return { kind: "server" };
+    }
+    if (extra !== undefined) {
+        return { kind: "usage", message: `Unexpected extra arguments: ${parsed.positionals.slice(2).join(" ")}` };
+    }
+    if (action === undefined) {
+        return { kind: "help", text: groupHelpText(group) };
+    }
+    if (parsed.help) {
+        return { kind: "help", text: curatedHelpText(group, action) };
+    }
+    const command = findCuratedCommand(group, action);
+    if (command === undefined) {
+        return { kind: "usage", message: `Unknown command: ${head} ${action}` };
+    }
+    const aliased = applyFlagAliases(parsed.toolFlags, command.flagAliases);
+    const scopeArgs = {
+        ...(parsed.argsJson ?? {}),
+        ...aliased,
+        ...(command.extraArgs ?? {}),
+    };
+    const toolName = resolveScopedTool(command, scopeArgs);
+    return buildRun({
+        toolName,
+        flags: aliased,
+        argsJson: parsed.argsJson,
+        extraArgs: command.extraArgs,
+        output: parsed.output ?? "table",
+        yes: parsed.yes,
+        permissionMode,
+        exposure,
+        tableSpec: command.table,
+    });
+}
+function buildRun(input) {
+    if (input.toolName === "discover_tools") {
+        return {
+            kind: "usage",
+            message: "discover_tools is MCP-only; use `tool <name>` for registry tools allowed by the current filters",
+        };
+    }
+    const tool = allTools.find(entry => entry.name === input.toolName);
+    if (tool === undefined) {
+        return { kind: "usage", message: `Unknown tool: ${input.toolName}` };
+    }
+    const args = parseToolArgs({
+        schema: tool.inputSchema,
+        flags: input.flags,
+        argsJson: input.argsJson,
+        extraArgs: input.extraArgs,
+    });
+    const exposureMessage = input.exposure.exposureRefusal(input.toolName);
+    if (exposureMessage !== undefined) {
+        return { kind: "refused", message: exposureMessage };
+    }
+    const permissionMessage = permissionRefusal(input.toolName, input.permissionMode);
+    if (permissionMessage !== undefined) {
+        return { kind: "refused", message: permissionMessage };
+    }
+    if (destructiveTools.has(input.toolName) && !input.yes) {
+        return {
+            kind: "refused",
+            message: `Would run ${input.toolName} with arguments [${Object.keys(args).join(", ")}]. Re-run with --yes to proceed.`,
+        };
+    }
+    if (input.exposure.needsConfirmation(input.toolName) && !input.yes) {
+        return {
+            kind: "refused",
+            message: `${input.toolName} requires confirmation (GITLAB_TOOL_POLICY_APPROVE). Re-run with --yes to proceed.`,
+        };
+    }
+    return {
+        kind: "run",
+        toolName: input.toolName,
+        args,
+        output: input.output,
+        tableSpec: input.tableSpec,
+    };
+}
+function permissionRefusal(toolName, permissionMode) {
+    if (permissionMode === "readonly" && !readOnlyTools.has(toolName)) {
+        return `${toolName} is not allowed in read-only mode`;
+    }
+    if (permissionMode === "modify" && deleteTools.has(toolName)) {
+        return `${toolName} is not allowed in modify mode (delete operations are disabled)`;
+    }
+    return undefined;
+}

package/build/cli/tables.js

@@ -0,0 +1,117 @@
+const MAX_CELL = 48;
+export function renderTable(value, spec) {
+    if (spec === undefined || spec.kind === "text") {
+        return { stdout: stringifyValue(value), stderr: "" };
+    }
+    const rows = spec.kind === "list" ? asObjectRows(value) : undefined;
+    if (spec.kind === "list") {
+        if (rows === undefined) {
+            return {
+                stdout: stringifyValue(value),
+                stderr: "No table renderer for this result; printed JSON.\n",
+            };
+        }
+        if (rows.length === 0) {
+            return { stdout: "No items.\n", stderr: "" };
+        }
+        const columns = spec.columns ?? inferColumns(rows);
+        return { stdout: formatGrid(rows, columns), stderr: "" };
+    }
+    const record = asRecord(value);
+    if (record === undefined) {
+        return {
+            stdout: stringifyValue(value),
+            stderr: "No table renderer for this result; printed JSON.\n",
+        };
+    }
+    const keys = spec.columns ?? Object.keys(record);
+    return { stdout: formatKeyValue(record, keys), stderr: "" };
+}
+function asObjectRows(value) {
+    if (Array.isArray(value)) {
+        return value.every(isRecord) ? value : undefined;
+    }
+    const record = asRecord(value);
+    if (record === undefined) {
+        return undefined;
+    }
+    for (const nested of Object.values(record)) {
+        if (Array.isArray(nested) && nested.every(isRecord)) {
+            return nested;
+        }
+    }
+    return undefined;
+}
+function inferColumns(rows) {
+    const preferred = ["iid", "id", "name", "key", "tag_name", "slug", "short_id", "state", "status", "title", "path_with_namespace"];
+    const present = new Set();
+    for (const row of rows) {
+        for (const key of Object.keys(row)) {
+            present.add(key);
+        }
+    }
+    const columns = preferred.filter(key => present.has(key));
+    return columns.length > 0 ? columns : Object.keys(rows[0] ?? {}).slice(0, 4);
+}
+function formatGrid(rows, columns) {
+    const header = columns.map(key => key.toUpperCase());
+    const cells = rows.map(row => columns.map(key => cellText(row[key])));
+    const widths = columns.map((_, index) => {
+        const longest = cells.reduce((max, row) => Math.max(max, row[index]?.length ?? 0), header[index]?.length ?? 0);
+        return Math.min(longest, MAX_CELL);
+    });
+    const lines = [
+        padRow(header, widths),
+        ...cells.map(row => padRow(row, widths)),
+    ];
+    return `${lines.join("\n")}\n`;
+}
+function formatKeyValue(record, keys) {
+    const lines = [];
+    for (const key of keys) {
+        if (record[key] === undefined) {
+            continue;
+        }
+        lines.push(`${key}\t${cellText(record[key])}`);
+    }
+    if (lines.length === 0) {
+        return stringifyValue(record);
+    }
+    return `${lines.join("\n")}\n`;
+}
+function padRow(cells, widths) {
+    return cells
+        .map((cell, index) => truncate(cell).padEnd(widths[index] ?? 0))
+        .join("  ")
+        .trimEnd();
+}
+function cellText(value) {
+    if (value === null || value === undefined) {
+        return "";
+    }
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+        return truncate(String(value));
+    }
+    return truncate(JSON.stringify(value));
+}
+function truncate(value) {
+    if (value.length <= MAX_CELL) {
+        return value;
+    }
+    return `${value.slice(0, MAX_CELL - 1)}…`;
+}
+function stringifyValue(value) {
+    if (typeof value === "string") {
+        return value.endsWith("\n") ? value : `${value}\n`;
+    }
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function asRecord(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    return value;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/build/cli-boolean-flags.js

@@ -0,0 +1,38 @@
+// Boolean flags accept `--flag`, `--flag=true`, or `--flag false`.
+// They must not consume the following positional command
+// (`--use-oauth mr list` is `mr`, not `list`).
+export const BOOLEAN_CLI_FLAG_NAMES = new Set([
+    "use-oauth",
+    "is-old",
+    "read-only",
+    "masking-enabled",
+    "use-wiki",
+    "use-milestone",
+    "use-pipeline",
+    "disable-version-check",
+    "sse",
+    "streamable-http",
+    "remote-auth",
+    "mcp-oauth",
+    "allow-unauthenticated-tool-discovery",
+    "mcp-trust-proxy",
+    "oauth-callback-proxy",
+    "enable-dynamic-api-url",
+    "enable-dynamic-project-scope",
+    "enable-strict-project-scope",
+    "oauth-stateless-mode",
+    "compact-results",
+]);
+const BOOLEAN_FLAG_LITERALS = new Set(["true", "false", "1", "0"]);
+export function isBooleanFlagLiteral(value) {
+    if (value === undefined || value.startsWith("-")) {
+        return false;
+    }
+    return BOOLEAN_FLAG_LITERALS.has(value.toLowerCase());
+}
+export function nextBooleanFlagValue(nextToken) {
+    if (isBooleanFlagLiteral(nextToken)) {
+        return { value: nextToken, consumeNext: true };
+    }
+    return { value: "true", consumeNext: false };
+}

package/build/cli-command.js

@@ -1,5 +1,11 @@
+import { BOOLEAN_CLI_FLAG_NAMES, isBooleanFlagLiteral } from "./cli-boolean-flags.js";
 const SCRIPT_PATH_PATTERN = /\.(cjs|mjs|js|cts|mts|ts)$/;
-const FLAGS_WITHOUT_VALUE = new Set(["--help", "-h"]);
+const FLAGS_WITHOUT_VALUE = new Set([
+    "--help",
+    "-h",
+    "--yes",
+    ...[...BOOLEAN_CLI_FLAG_NAMES].map(name => `--${name}`),
+]);
 function isScriptPath(arg) {
     return SCRIPT_PATH_PATTERN.test(arg);
 }
@@ -17,9 +23,13 @@ export function getPositionalCliCommand(argv) {
             continue;
         }
         if (arg.startsWith("-")) {
-            if (!FLAGS_WITHOUT_VALUE.has(arg) &&
-                i + 1 < args.length &&
-                !args[i + 1].startsWith("-")) {
+            if (FLAGS_WITHOUT_VALUE.has(arg)) {
+                if (BOOLEAN_CLI_FLAG_NAMES.has(arg.replace(/^--/, "")) && isBooleanFlagLiteral(args[i + 1])) {
+                    i += 1;
+                }
+                continue;
+            }
+            if (i + 1 < args.length && !args[i + 1].startsWith("-")) {
                 i += 1;
             }
             continue;