@zereight/mcp-gitlab 2.1.67 → 2.1.69

package/build/test/cli/compact-mcp-result.test.js

@@ -0,0 +1,93 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { compactMcpToolResult } from "../../cli/compact-mcp-result.js";
+function textResult(text) {
+    return { content: [{ type: "text", text }] };
+}
+describe("When compactMcpToolResult wraps an MCP tool reply", () => {
+    describe("with compact mode disabled", () => {
+        it("should return the original result", () => {
+            const result = textResult("[]");
+            const compacted = compactMcpToolResult({
+                result,
+                enabled: false,
+                maxChars: 1,
+                toolName: "list_issues",
+                args: { project_id: "1" },
+            });
+            assert.equal(compacted, result);
+        });
+    });
+    describe("with a small payload", () => {
+        it("should leave the result alone", () => {
+            const result = textResult('{"iid":1}');
+            const compacted = compactMcpToolResult({
+                result,
+                enabled: true,
+                maxChars: 4000,
+                toolName: "get_issue",
+                args: { project_id: "1", issue_iid: 1 },
+            });
+            assert.equal(compacted, result);
+        });
+    });
+    describe("with a long issue list", () => {
+        it("should keep a preview and a CLI replay command", () => {
+            const issues = Array.from({ length: 20 }, (_, index) => ({ iid: index + 1, title: "x".repeat(80) }));
+            const compacted = compactMcpToolResult({
+                result: textResult(JSON.stringify(issues)),
+                enabled: true,
+                maxChars: 200,
+                toolName: "list_issues",
+                args: { project_id: "123", state: "opened" },
+            });
+            assert.ok(isRecord(compacted));
+            assert.equal(Object.prototype.hasOwnProperty.call(compacted, "structuredContent"), false);
+            const content = compacted.content;
+            assert.ok(Array.isArray(content));
+            const block = content[0];
+            assert.ok(isRecord(block) && typeof block.text === "string");
+            const payload = JSON.parse(block.text);
+            assert.ok(isRecord(payload));
+            assert.equal(payload.compact, true);
+            assert.equal(payload.tool, "list_issues");
+            assert.equal(payload.items_total, 20);
+            assert.ok(Array.isArray(payload.preview));
+            assert.equal(payload.preview.length, 5);
+            assert.equal(payload.cli, "zereight-mcp-gitlab tool list_issues --project-id 123 --state opened");
+        });
+    });
+    describe("with structuredContent on a large payload", () => {
+        it("should drop structuredContent so the full object cannot leak", () => {
+            const issues = Array.from({ length: 20 }, (_, index) => ({ iid: index + 1, title: "x".repeat(80) }));
+            const compacted = compactMcpToolResult({
+                result: {
+                    content: [{ type: "text", text: JSON.stringify(issues) }],
+                    structuredContent: issues,
+                },
+                enabled: true,
+                maxChars: 200,
+                toolName: "list_issues",
+                args: { project_id: "1" },
+            });
+            assert.ok(isRecord(compacted));
+            assert.equal(Object.prototype.hasOwnProperty.call(compacted, "structuredContent"), false);
+        });
+    });
+    describe("with an error result", () => {
+        it("should not compact", () => {
+            const result = { content: [{ type: "text", text: "boom".repeat(500) }], isError: true };
+            const compacted = compactMcpToolResult({
+                result,
+                enabled: true,
+                maxChars: 10,
+                toolName: "list_issues",
+                args: {},
+            });
+            assert.equal(compacted, result);
+        });
+    });
+});
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/build/test/cli/exposure.test.js

@@ -0,0 +1,104 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { exposureRefusalMessage, isToolExposed, parseToolNameSet } from "../../cli/exposure.js";
+import { compileDeniedToolsRegex } from "../../tools/denied-regex.js";
+import { parseEnabledToolsets } from "../../tools/registry.js";
+const ISSUES = parseEnabledToolsets("issues");
+const EMPTY = new Set();
+function exposure(overrides) {
+    return {
+        toolName: overrides.toolName,
+        enabledToolsets: overrides.enabledToolsets ?? ISSUES,
+        individuallyEnabledTools: overrides.individuallyEnabledTools ?? EMPTY,
+        featureFlagOverrides: overrides.featureFlagOverrides ?? EMPTY,
+        deniedRegex: overrides.deniedRegex,
+        hiddenTools: overrides.hiddenTools ?? EMPTY,
+    };
+}
+describe("When isToolExposed applies MCP filters", () => {
+    describe("with a tool in the enabled toolset", () => {
+        it("should expose list_issues", () => {
+            assert.equal(isToolExposed(exposure({ toolName: "list_issues" })), true);
+        });
+    });
+    describe("with a tool outside the enabled toolsets", () => {
+        it("should hide list_pipelines", () => {
+            assert.equal(isToolExposed(exposure({ toolName: "list_pipelines" })), false);
+        });
+    });
+    describe("with GITLAB_TOOLS", () => {
+        it("should expose an individually enabled tool", () => {
+            assert.equal(isToolExposed(exposure({
+                toolName: "list_pipelines",
+                individuallyEnabledTools: new Set(["list_pipelines"]),
+            })), true);
+        });
+    });
+    describe("with a legacy feature-flag override", () => {
+        it("should expose the overridden wiki tool", () => {
+            assert.equal(isToolExposed(exposure({
+                toolName: "list_wiki_pages",
+                featureFlagOverrides: new Set(["list_wiki_pages"]),
+            })), true);
+        });
+    });
+    describe("with GITLAB_DENIED_TOOLS_REGEX", () => {
+        it("should hide a matching tool even when the toolset is enabled", () => {
+            assert.equal(isToolExposed(exposure({
+                toolName: "list_issues",
+                deniedRegex: /^list_/,
+            })), false);
+        });
+    });
+    describe("with GITLAB_TOOL_POLICY_HIDDEN", () => {
+        it("should hide the named tool", () => {
+            assert.equal(isToolExposed(exposure({
+                toolName: "list_issues",
+                hiddenTools: new Set(["list_issues"]),
+            })), false);
+        });
+    });
+});
+describe("When exposureRefusalMessage explains a block", () => {
+    describe("with a hidden tool", () => {
+        it("should mention GITLAB_TOOL_POLICY_HIDDEN", () => {
+            const message = exposureRefusalMessage(exposure({ toolName: "list_issues", hiddenTools: new Set(["list_issues"]) }));
+            assert.match(String(message), /GITLAB_TOOL_POLICY_HIDDEN/);
+        });
+    });
+    describe("with a denied regex", () => {
+        it("should mention GITLAB_DENIED_TOOLS_REGEX", () => {
+            const message = exposureRefusalMessage(exposure({ toolName: "list_issues", deniedRegex: /^list_/ }));
+            assert.match(String(message), /GITLAB_DENIED_TOOLS_REGEX/);
+        });
+    });
+    describe("with a toolset miss", () => {
+        it("should mention GITLAB_TOOLSETS", () => {
+            const message = exposureRefusalMessage(exposure({ toolName: "list_pipelines" }));
+            assert.match(String(message), /GITLAB_TOOLSETS/);
+        });
+    });
+});
+describe("When parseToolNameSet reads a policy list", () => {
+    describe("with comma-separated names", () => {
+        it("should trim and drop empties", () => {
+            assert.deepEqual([...parseToolNameSet(" push_files, delete_issue , ")], ["push_files", "delete_issue"]);
+        });
+    });
+});
+describe("When compileDeniedToolsRegex validates a pattern", () => {
+    describe("with nested quantifiers", () => {
+        it("should ignore the pattern", () => {
+            const compiled = compileDeniedToolsRegex("(a+)+");
+            assert.equal(compiled.regex, undefined);
+            assert.match(String(compiled.error), /nested quantifiers/);
+        });
+    });
+    describe("with invalid characters", () => {
+        it("should reject unsafe characters", () => {
+            const compiled = compileDeniedToolsRegex("create_; rm -rf /");
+            assert.equal(compiled.regex, undefined);
+            assert.match(String(compiled.error), /invalid characters/);
+        });
+    });
+});

package/build/test/cli/load-config-snapshot.js

@@ -0,0 +1,5 @@
+import { GITLAB_READ_ONLY_MODE, USE_OAUTH } from "../../config.js";
+process.stdout.write(JSON.stringify({
+    GITLAB_READ_ONLY_MODE,
+    USE_OAUTH,
+}));

package/build/test/cli/output.test.js

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { formatCliError, formatToolOutput } from "../../cli/output.js";
+describe("When formatToolOutput prints a tool result", () => {
+    describe("with json mode", () => {
+        it("should write the unwrapped payload as JSON", () => {
+            const formatted = formatToolOutput({
+                result: { content: [{ type: "text", text: JSON.stringify({ id: 1, username: "tao" }) }] },
+                mode: "json",
+                tableSpec: undefined,
+            });
+            assert.equal(formatted.stdout, "{\"id\":1,\"username\":\"tao\"}\n");
+            assert.equal(formatted.stderr, "");
+            assert.equal(formatted.isError, false);
+        });
+    });
+    describe("with table mode for a list", () => {
+        it("should print iid state title columns", () => {
+            const formatted = formatToolOutput({
+                result: {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify([
+                                { iid: 45, state: "opened", title: "fix: pipeline retry race" },
+                                { iid: 44, state: "opened", title: "chore: bump deps" },
+                            ]),
+                        },
+                    ],
+                },
+                mode: "table",
+                tableSpec: { kind: "list", columns: ["iid", "state", "title"] },
+            });
+            assert.match(formatted.stdout, /IID\s+STATE\s+TITLE/);
+            assert.match(formatted.stdout, /45\s+opened\s+fix: pipeline retry race/);
+            assert.equal(formatted.stderr, "");
+        });
+    });
+    describe("with a non-text content block first", () => {
+        it("should unwrap the first text payload", () => {
+            const formatted = formatToolOutput({
+                result: {
+                    content: [
+                        { type: "image", data: "xxx" },
+                        { type: "text", text: JSON.stringify({ id: 2 }) },
+                    ],
+                },
+                mode: "json",
+                tableSpec: undefined,
+            });
+            assert.equal(formatted.stdout, "{\"id\":2}\n");
+        });
+    });
+    describe("with an API-style error object", () => {
+        it("should mark the result as an error", () => {
+            const formatted = formatToolOutput({
+                result: { content: [{ type: "text", text: "GitLab API error: 404 Not Found" }], isError: true },
+                mode: "json",
+                tableSpec: undefined,
+            });
+            assert.equal(formatted.isError, true);
+        });
+    });
+});
+describe("When formatCliError prints a thrown error", () => {
+    describe("with a token in the message", () => {
+        it("should redact the token", () => {
+            const leaked = `glpat-${"notarealtokenvalue"}`;
+            const text = formatCliError(new Error(`auth failed ${leaked}`));
+            assert.match(text, /\[REDACTED\]/);
+            assert.equal(text.includes(leaked), false);
+        });
+    });
+});

package/build/test/cli/replay-command.test.js

@@ -0,0 +1,37 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { buildToolReplayCommand } from "../../cli/replay-command.js";
+describe("When buildToolReplayCommand prints a CLI invocation", () => {
+    describe("with scalar tool arguments", () => {
+        it("should emit kebab-case flags without the token", () => {
+            const command = buildToolReplayCommand("list_issues", {
+                project_id: "123",
+                state: "opened",
+                token: "glpat-secret",
+            });
+            assert.equal(command, "zereight-mcp-gitlab tool list_issues --project-id 123 --state opened");
+        });
+    });
+    describe("with a nested object", () => {
+        it("should pass it through --args-json", () => {
+            const command = buildToolReplayCommand("execute_graphql", {
+                query: "{ currentUser { id } }",
+                variables: { n: 1 },
+            });
+            assert.match(command, /tool execute_graphql/);
+            assert.match(command, /--query/);
+            assert.match(command, /--args-json/);
+            assert.equal(command.includes("glpat"), false);
+        });
+    });
+    describe("with confirmation metadata", () => {
+        it("should omit _confirmed", () => {
+            const command = buildToolReplayCommand("push_files", {
+                project_id: "1",
+                _confirmed: true,
+            });
+            assert.equal(command.includes("_confirmed"), false);
+            assert.match(command, /--project-id 1/);
+        });
+    });
+});

package/build/test/cli/router.test.js

@@ -0,0 +1,183 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { isCliInvocation, resolveCli } from "../../cli/router.js";
+function argv(...args) {
+    return ["node", "index.js", ...args];
+}
+const OPEN_EXPOSURE = {
+    isExposed() {
+        return true;
+    },
+    needsConfirmation() {
+        return false;
+    },
+    exposureRefusal() {
+        return undefined;
+    },
+};
+function resolve(args, extra = {}) {
+    return resolveCli(args, { exposure: extra.exposure ?? OPEN_EXPOSURE, permissionMode: extra.permissionMode });
+}
+describe("When resolveCli classifies argv", () => {
+    describe("with no positional command", () => {
+        it("should stay on the MCP server path", () => {
+            const resolved = resolve(argv("--token", "glpat-xxxxxxxxxxxxxxxxxxxx"));
+            assert.equal(resolved.kind, "server");
+        });
+    });
+    describe("with --help", () => {
+        it("should print global help without starting the server", () => {
+            const resolved = resolve(argv("--help"));
+            assert.equal(resolved.kind, "help");
+            if (resolved.kind === "help") {
+                assert.match(resolved.text, /tool <tool-name>/);
+                assert.match(resolved.text, /auth/);
+            }
+        });
+    });
+    describe("with --help after an unknown positional", () => {
+        it("should print global help instead of starting the server", () => {
+            const resolved = resolve(argv("not-a-command", "--help"));
+            assert.equal(resolved.kind, "help");
+        });
+    });
+    describe("with tool whoami", () => {
+        it("should run whoami with json output by default", () => {
+            const resolved = resolve(argv("tool", "whoami"));
+            assert.equal(resolved.kind, "run");
+            if (resolved.kind === "run") {
+                assert.equal(resolved.toolName, "whoami");
+                assert.equal(resolved.output, "json");
+                assert.deepEqual(resolved.args, {});
+            }
+        });
+    });
+});
+describe("When a curated command is resolved", () => {
+    describe("with mr list --group-id", () => {
+        it("should call list_group_merge_requests", () => {
+            const resolved = resolve(argv("mr", "list", "--group-id", "42", "--state", "opened"));
+            assert.equal(resolved.kind, "run");
+            if (resolved.kind === "run") {
+                assert.equal(resolved.toolName, "list_group_merge_requests");
+                assert.equal(resolved.args.group_id, "42");
+                assert.equal(resolved.output, "table");
+            }
+        });
+    });
+    describe("with issue close", () => {
+        it("should call update_issue with state_event close", () => {
+            const resolved = resolve(argv("issue", "close", "--project-id", "123", "--issue-iid", "9"));
+            assert.equal(resolved.kind, "run");
+            if (resolved.kind === "run") {
+                assert.equal(resolved.toolName, "update_issue");
+                assert.equal(resolved.args.issue_iid, "9");
+                assert.equal(resolved.args.state_event, "close");
+            }
+        });
+    });
+    describe("with mr merge and --yes=false", () => {
+        it("should reject the inline value instead of merging", () => {
+            const resolved = resolve(argv("mr", "merge", "--project-id", "123", "--mr-iid", "45", "--yes=false"));
+            assert.equal(resolved.kind, "usage");
+            if (resolved.kind === "usage") {
+                assert.match(resolved.message, /--yes does not accept a value/);
+            }
+        });
+    });
+    describe("with mr merge and no --yes", () => {
+        it("should refuse until --yes is passed without dumping argument values", () => {
+            const resolved = resolve(argv("mr", "merge", "--project-id", "123", "--mr-iid", "45"));
+            assert.equal(resolved.kind, "refused");
+            if (resolved.kind === "refused") {
+                assert.match(resolved.message, /--yes/);
+                assert.match(resolved.message, /merge_merge_request/);
+                assert.match(resolved.message, /project_id/);
+                assert.equal(resolved.message.includes("123"), false);
+            }
+        });
+    });
+    describe("with variable list scoped via --args-json", () => {
+        it("should call list_group_variables when group_id is only in JSON", () => {
+            const resolved = resolve(argv("variable", "list", "--args-json", '{"group_id":"42"}'));
+            assert.equal(resolved.kind, "run");
+            if (resolved.kind === "run") {
+                assert.equal(resolved.toolName, "list_group_variables");
+                assert.equal(resolved.args.group_id, "42");
+            }
+        });
+    });
+});
+describe("When permission mode blocks a write", () => {
+    describe("with readonly mode and issue create", () => {
+        it("should refuse before dispatch", () => {
+            const resolved = resolve(argv("issue", "create", "--project-id", "123", "--title", "bug"), { permissionMode: "readonly" });
+            assert.equal(resolved.kind, "refused");
+            if (resolved.kind === "refused") {
+                assert.match(resolved.message, /read-only/);
+            }
+        });
+    });
+});
+describe("When isCliInvocation inspects argv", () => {
+    describe("with a curated group", () => {
+        it("should treat it as a human CLI invocation", () => {
+            assert.equal(isCliInvocation(argv("mr", "list")), true);
+        });
+    });
+    describe("with --help", () => {
+        it("should treat it as a human CLI invocation", () => {
+            assert.equal(isCliInvocation(argv("--help")), true);
+        });
+    });
+    describe("with only a server token flag", () => {
+        it("should stay on the MCP server path", () => {
+            assert.equal(isCliInvocation(argv("--token", "x")), false);
+        });
+    });
+});
+describe("When MCP exposure filters block a CLI tool", () => {
+    describe("with a denied-tools regex", () => {
+        it("should refuse before dispatch", () => {
+            const resolved = resolve(argv("tool", "whoami"), {
+                exposure: {
+                    isExposed() {
+                        return false;
+                    },
+                    needsConfirmation() {
+                        return false;
+                    },
+                    exposureRefusal(toolName) {
+                        return `${toolName} is blocked by GITLAB_DENIED_TOOLS_REGEX`;
+                    },
+                },
+            });
+            assert.equal(resolved.kind, "refused");
+            if (resolved.kind === "refused") {
+                assert.match(resolved.message, /GITLAB_DENIED_TOOLS_REGEX/);
+            }
+        });
+    });
+    describe("with GITLAB_TOOL_POLICY_APPROVE", () => {
+        it("should require --yes", () => {
+            const resolved = resolve(argv("tool", "whoami"), {
+                exposure: {
+                    isExposed() {
+                        return true;
+                    },
+                    needsConfirmation() {
+                        return true;
+                    },
+                    exposureRefusal() {
+                        return undefined;
+                    },
+                },
+            });
+            assert.equal(resolved.kind, "refused");
+            if (resolved.kind === "refused") {
+                assert.match(resolved.message, /GITLAB_TOOL_POLICY_APPROVE/);
+                assert.match(resolved.message, /--yes/);
+            }
+        });
+    });
+});

package/build/test/oauth-device-flow-tests.js

@@ -193,6 +193,16 @@ describe("When reading the CLI command", () => {
             assert.equal(getPositionalCliCommand(["node", "/usr/local/bin/tsx", "index.ts", "auth", "--help"]), "auth");
         });
     });
+    describe("with --use-oauth before a curated command", () => {
+        it("should still return mr instead of consuming it as the flag value", () => {
+            assert.equal(getPositionalCliCommand(["node", "index.js", "--use-oauth", "mr", "list"]), "mr");
+        });
+    });
+    describe("with --read-only false before a curated command", () => {
+        it("should skip the boolean literal and return mr", () => {
+            assert.equal(getPositionalCliCommand(["node", "index.js", "--read-only", "false", "mr", "list"]), "mr");
+        });
+    });
     describe("with space-separated --api-url before auth", () => {
         it("should skip the URL value and return auth", () => {
             assert.equal(getPositionalCliCommand([