@zereight/mcp-gitlab 2.1.68 → 2.1.69

package/build/test/cli/output.test.js

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { formatCliError, formatToolOutput } from "../../cli/output.js";
+describe("When formatToolOutput prints a tool result", () => {
+    describe("with json mode", () => {
+        it("should write the unwrapped payload as JSON", () => {
+            const formatted = formatToolOutput({
+                result: { content: [{ type: "text", text: JSON.stringify({ id: 1, username: "tao" }) }] },
+                mode: "json",
+                tableSpec: undefined,
+            });
+            assert.equal(formatted.stdout, "{\"id\":1,\"username\":\"tao\"}\n");
+            assert.equal(formatted.stderr, "");
+            assert.equal(formatted.isError, false);
+        });
+    });
+    describe("with table mode for a list", () => {
+        it("should print iid state title columns", () => {
+            const formatted = formatToolOutput({
+                result: {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify([
+                                { iid: 45, state: "opened", title: "fix: pipeline retry race" },
+                                { iid: 44, state: "opened", title: "chore: bump deps" },
+                            ]),
+                        },
+                    ],
+                },
+                mode: "table",
+                tableSpec: { kind: "list", columns: ["iid", "state", "title"] },
+            });
+            assert.match(formatted.stdout, /IID\s+STATE\s+TITLE/);
+            assert.match(formatted.stdout, /45\s+opened\s+fix: pipeline retry race/);
+            assert.equal(formatted.stderr, "");
+        });
+    });
+    describe("with a non-text content block first", () => {
+        it("should unwrap the first text payload", () => {
+            const formatted = formatToolOutput({
+                result: {
+                    content: [
+                        { type: "image", data: "xxx" },
+                        { type: "text", text: JSON.stringify({ id: 2 }) },
+                    ],
+                },
+                mode: "json",
+                tableSpec: undefined,
+            });
+            assert.equal(formatted.stdout, "{\"id\":2}\n");
+        });
+    });
+    describe("with an API-style error object", () => {
+        it("should mark the result as an error", () => {
+            const formatted = formatToolOutput({
+                result: { content: [{ type: "text", text: "GitLab API error: 404 Not Found" }], isError: true },
+                mode: "json",
+                tableSpec: undefined,
+            });
+            assert.equal(formatted.isError, true);
+        });
+    });
+});
+describe("When formatCliError prints a thrown error", () => {
+    describe("with a token in the message", () => {
+        it("should redact the token", () => {
+            const leaked = `glpat-${"notarealtokenvalue"}`;
+            const text = formatCliError(new Error(`auth failed ${leaked}`));
+            assert.match(text, /\[REDACTED\]/);
+            assert.equal(text.includes(leaked), false);
+        });
+    });
+});

package/build/test/cli/replay-command.test.js

@@ -0,0 +1,37 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { buildToolReplayCommand } from "../../cli/replay-command.js";
+describe("When buildToolReplayCommand prints a CLI invocation", () => {
+    describe("with scalar tool arguments", () => {
+        it("should emit kebab-case flags without the token", () => {
+            const command = buildToolReplayCommand("list_issues", {
+                project_id: "123",
+                state: "opened",
+                token: "glpat-secret",
+            });
+            assert.equal(command, "zereight-mcp-gitlab tool list_issues --project-id 123 --state opened");
+        });
+    });
+    describe("with a nested object", () => {
+        it("should pass it through --args-json", () => {
+            const command = buildToolReplayCommand("execute_graphql", {
+                query: "{ currentUser { id } }",
+                variables: { n: 1 },
+            });
+            assert.match(command, /tool execute_graphql/);
+            assert.match(command, /--query/);
+            assert.match(command, /--args-json/);
+            assert.equal(command.includes("glpat"), false);
+        });
+    });
+    describe("with confirmation metadata", () => {
+        it("should omit _confirmed", () => {
+            const command = buildToolReplayCommand("push_files", {
+                project_id: "1",
+                _confirmed: true,
+            });
+            assert.equal(command.includes("_confirmed"), false);
+            assert.match(command, /--project-id 1/);
+        });
+    });
+});

package/build/test/cli/router.test.js

@@ -0,0 +1,183 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { isCliInvocation, resolveCli } from "../../cli/router.js";
+function argv(...args) {
+    return ["node", "index.js", ...args];
+}
+const OPEN_EXPOSURE = {
+    isExposed() {
+        return true;
+    },
+    needsConfirmation() {
+        return false;
+    },
+    exposureRefusal() {
+        return undefined;
+    },
+};
+function resolve(args, extra = {}) {
+    return resolveCli(args, { exposure: extra.exposure ?? OPEN_EXPOSURE, permissionMode: extra.permissionMode });
+}
+describe("When resolveCli classifies argv", () => {
+    describe("with no positional command", () => {
+        it("should stay on the MCP server path", () => {
+            const resolved = resolve(argv("--token", "glpat-xxxxxxxxxxxxxxxxxxxx"));
+            assert.equal(resolved.kind, "server");
+        });
+    });
+    describe("with --help", () => {
+        it("should print global help without starting the server", () => {
+            const resolved = resolve(argv("--help"));
+            assert.equal(resolved.kind, "help");
+            if (resolved.kind === "help") {
+                assert.match(resolved.text, /tool <tool-name>/);
+                assert.match(resolved.text, /auth/);
+            }
+        });
+    });
+    describe("with --help after an unknown positional", () => {
+        it("should print global help instead of starting the server", () => {
+            const resolved = resolve(argv("not-a-command", "--help"));
+            assert.equal(resolved.kind, "help");
+        });
+    });
+    describe("with tool whoami", () => {
+        it("should run whoami with json output by default", () => {
+            const resolved = resolve(argv("tool", "whoami"));
+            assert.equal(resolved.kind, "run");
+            if (resolved.kind === "run") {
+                assert.equal(resolved.toolName, "whoami");
+                assert.equal(resolved.output, "json");
+                assert.deepEqual(resolved.args, {});
+            }
+        });
+    });
+});
+describe("When a curated command is resolved", () => {
+    describe("with mr list --group-id", () => {
+        it("should call list_group_merge_requests", () => {
+            const resolved = resolve(argv("mr", "list", "--group-id", "42", "--state", "opened"));
+            assert.equal(resolved.kind, "run");
+            if (resolved.kind === "run") {
+                assert.equal(resolved.toolName, "list_group_merge_requests");
+                assert.equal(resolved.args.group_id, "42");
+                assert.equal(resolved.output, "table");
+            }
+        });
+    });
+    describe("with issue close", () => {
+        it("should call update_issue with state_event close", () => {
+            const resolved = resolve(argv("issue", "close", "--project-id", "123", "--issue-iid", "9"));
+            assert.equal(resolved.kind, "run");
+            if (resolved.kind === "run") {
+                assert.equal(resolved.toolName, "update_issue");
+                assert.equal(resolved.args.issue_iid, "9");
+                assert.equal(resolved.args.state_event, "close");
+            }
+        });
+    });
+    describe("with mr merge and --yes=false", () => {
+        it("should reject the inline value instead of merging", () => {
+            const resolved = resolve(argv("mr", "merge", "--project-id", "123", "--mr-iid", "45", "--yes=false"));
+            assert.equal(resolved.kind, "usage");
+            if (resolved.kind === "usage") {
+                assert.match(resolved.message, /--yes does not accept a value/);
+            }
+        });
+    });
+    describe("with mr merge and no --yes", () => {
+        it("should refuse until --yes is passed without dumping argument values", () => {
+            const resolved = resolve(argv("mr", "merge", "--project-id", "123", "--mr-iid", "45"));
+            assert.equal(resolved.kind, "refused");
+            if (resolved.kind === "refused") {
+                assert.match(resolved.message, /--yes/);
+                assert.match(resolved.message, /merge_merge_request/);
+                assert.match(resolved.message, /project_id/);
+                assert.equal(resolved.message.includes("123"), false);
+            }
+        });
+    });
+    describe("with variable list scoped via --args-json", () => {
+        it("should call list_group_variables when group_id is only in JSON", () => {
+            const resolved = resolve(argv("variable", "list", "--args-json", '{"group_id":"42"}'));
+            assert.equal(resolved.kind, "run");
+            if (resolved.kind === "run") {
+                assert.equal(resolved.toolName, "list_group_variables");
+                assert.equal(resolved.args.group_id, "42");
+            }
+        });
+    });
+});
+describe("When permission mode blocks a write", () => {
+    describe("with readonly mode and issue create", () => {
+        it("should refuse before dispatch", () => {
+            const resolved = resolve(argv("issue", "create", "--project-id", "123", "--title", "bug"), { permissionMode: "readonly" });
+            assert.equal(resolved.kind, "refused");
+            if (resolved.kind === "refused") {
+                assert.match(resolved.message, /read-only/);
+            }
+        });
+    });
+});
+describe("When isCliInvocation inspects argv", () => {
+    describe("with a curated group", () => {
+        it("should treat it as a human CLI invocation", () => {
+            assert.equal(isCliInvocation(argv("mr", "list")), true);
+        });
+    });
+    describe("with --help", () => {
+        it("should treat it as a human CLI invocation", () => {
+            assert.equal(isCliInvocation(argv("--help")), true);
+        });
+    });
+    describe("with only a server token flag", () => {
+        it("should stay on the MCP server path", () => {
+            assert.equal(isCliInvocation(argv("--token", "x")), false);
+        });
+    });
+});
+describe("When MCP exposure filters block a CLI tool", () => {
+    describe("with a denied-tools regex", () => {
+        it("should refuse before dispatch", () => {
+            const resolved = resolve(argv("tool", "whoami"), {
+                exposure: {
+                    isExposed() {
+                        return false;
+                    },
+                    needsConfirmation() {
+                        return false;
+                    },
+                    exposureRefusal(toolName) {
+                        return `${toolName} is blocked by GITLAB_DENIED_TOOLS_REGEX`;
+                    },
+                },
+            });
+            assert.equal(resolved.kind, "refused");
+            if (resolved.kind === "refused") {
+                assert.match(resolved.message, /GITLAB_DENIED_TOOLS_REGEX/);
+            }
+        });
+    });
+    describe("with GITLAB_TOOL_POLICY_APPROVE", () => {
+        it("should require --yes", () => {
+            const resolved = resolve(argv("tool", "whoami"), {
+                exposure: {
+                    isExposed() {
+                        return true;
+                    },
+                    needsConfirmation() {
+                        return true;
+                    },
+                    exposureRefusal() {
+                        return undefined;
+                    },
+                },
+            });
+            assert.equal(resolved.kind, "refused");
+            if (resolved.kind === "refused") {
+                assert.match(resolved.message, /GITLAB_TOOL_POLICY_APPROVE/);
+                assert.match(resolved.message, /--yes/);
+            }
+        });
+    });
+});

package/build/test/oauth-device-flow-tests.js

@@ -193,6 +193,16 @@ describe("When reading the CLI command", () => {
             assert.equal(getPositionalCliCommand(["node", "/usr/local/bin/tsx", "index.ts", "auth", "--help"]), "auth");
         });
     });
+    describe("with --use-oauth before a curated command", () => {
+        it("should still return mr instead of consuming it as the flag value", () => {
+            assert.equal(getPositionalCliCommand(["node", "index.js", "--use-oauth", "mr", "list"]), "mr");
+        });
+    });
+    describe("with --read-only false before a curated command", () => {
+        it("should skip the boolean literal and return mr", () => {
+            assert.equal(getPositionalCliCommand(["node", "index.js", "--read-only", "false", "mr", "list"]), "mr");
+        });
+    });
     describe("with space-separated --api-url before auth", () => {
         it("should skip the URL value and return auth", () => {
             assert.equal(getPositionalCliCommand([

package/build/test/oauth-startup.test.js

@@ -0,0 +1,204 @@
+/**
+ * OAuth startup tests.
+ *
+ * - isAuthInvalidTokenResponse: pure classifier — refresh failures that mean
+ *   "re-login would fix it" vs transient/config errors that must not open a browser.
+ * - ensureOAuthToken: lazy first-use delivery — the caller must receive the
+ *   token even when the on-disk token is still valid (regression: returning
+ *   early on hasValidToken() alone leaves requests unauthenticated).
+ *
+ * Temp token files + a loopback mock for /oauth/token only; no MCP server.
+ * The missing-token and invalid_grant paths start the interactive browser
+ * flow and are deliberately not covered here.
+ */
+import { describe, test, afterEach } from "node:test";
+import assert from "node:assert";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as http from "node:http";
+import { GitLabOAuth, ensureOAuthToken, isAuthInvalidTokenResponse } from "../oauth.js";
+const validTokenFile = {
+    access_token: "cached-access-token",
+    refresh_token: "cached-refresh-token",
+    expires_in: 7200,
+    created_at: Date.now(),
+    token_type: "Bearer",
+};
+const expiredTokenFile = {
+    ...validTokenFile,
+    created_at: Date.now() - 10 * 3600 * 1000,
+};
+const tmpDirs = [];
+const servers = [];
+afterEach(async () => {
+    for (const server of servers.splice(0)) {
+        await new Promise(resolve => server.close(() => resolve()));
+    }
+    for (const dir of tmpDirs.splice(0)) {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+function makeTokenFile(data) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "oauth-startup-"));
+    tmpDirs.push(dir);
+    const file = path.join(dir, "token.json");
+    fs.writeFileSync(file, JSON.stringify(data));
+    return file;
+}
+function makeClient(tokenStoragePath, gitlabUrl, extra) {
+    return new GitLabOAuth({
+        clientId: "test-client",
+        redirectUri: "http://127.0.0.1:8888/callback",
+        gitlabUrl,
+        scopes: ["api"],
+        tokenStoragePath,
+        ...extra,
+    });
+}
+async function startTokenServer(handler) {
+    const bodies = [];
+    const server = http.createServer((req, res) => {
+        let body = "";
+        req.on("data", (chunk) => {
+            body += chunk.toString();
+        });
+        req.on("end", () => {
+            bodies.push(body);
+            const { status, json } = handler();
+            res.writeHead(status, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(json));
+        });
+    });
+    servers.push(server);
+    await new Promise(resolve => server.listen(0, "127.0.0.1", () => resolve()));
+    const addr = server.address();
+    assert(addr && typeof addr !== "string");
+    return { url: `http://127.0.0.1:${addr.port}`, bodies };
+}
+describe("isAuthInvalidTokenResponse", () => {
+    test("400 invalid_grant is auth-invalid", () => {
+        assert.strictEqual(isAuthInvalidTokenResponse(400, '{"error":"invalid_grant"}'), true);
+    });
+    test("400 invalid_token is auth-invalid", () => {
+        assert.strictEqual(isAuthInvalidTokenResponse(400, '{"error":"invalid_token"}'), true);
+    });
+    test("401 invalid_grant is auth-invalid", () => {
+        assert.strictEqual(isAuthInvalidTokenResponse(401, '{"error":"invalid_grant"}'), true);
+    });
+    test("400 invalid_client is not auth-invalid (config error)", () => {
+        assert.strictEqual(isAuthInvalidTokenResponse(400, '{"error":"invalid_client"}'), false);
+    });
+    test("400 invalid_request is not auth-invalid (config error)", () => {
+        assert.strictEqual(isAuthInvalidTokenResponse(400, '{"error":"invalid_request"}'), false);
+    });
+    test("500 server_error is not auth-invalid (transient)", () => {
+        assert.strictEqual(isAuthInvalidTokenResponse(500, '{"error":"server_error"}'), false);
+    });
+    test("429 is not auth-invalid (rate limited)", () => {
+        assert.strictEqual(isAuthInvalidTokenResponse(429, '{"error":"invalid_grant"}'), false);
+    });
+    test("non-JSON body is not auth-invalid", () => {
+        assert.strictEqual(isAuthInvalidTokenResponse(400, "gateway timeout"), false);
+    });
+});
+describe("ensureOAuthToken", () => {
+    test("null client is a no-op", async () => {
+        const delivered = [];
+        await ensureOAuthToken(null, null, t => {
+            delivered.push(t);
+        });
+        await ensureOAuthToken(undefined, undefined, t => {
+            delivered.push(t);
+        });
+        assert.deepStrictEqual(delivered, []);
+    });
+    test("first call with valid cached token delivers it without network", async () => {
+        // Closed port: any fetch attempt fails, proving the cached path is network-free.
+        const client = makeClient(makeTokenFile(validTokenFile), "http://127.0.0.1:9");
+        const delivered = [];
+        await ensureOAuthToken(client, null, t => {
+            delivered.push(t);
+        });
+        assert.deepStrictEqual(delivered, ["cached-access-token"]);
+    });
+    test("already-held valid token is not re-delivered", async () => {
+        const client = makeClient(makeTokenFile(validTokenFile), "http://127.0.0.1:9");
+        const delivered = [];
+        await ensureOAuthToken(client, "cached-access-token", t => {
+            delivered.push(t);
+        });
+        assert.deepStrictEqual(delivered, []);
+    });
+    test("expired token refreshes via /oauth/token and persists", async () => {
+        const { url, bodies } = await startTokenServer(() => ({
+            status: 200,
+            json: {
+                access_token: "fresh-token",
+                refresh_token: "fresh-refresh",
+                expires_in: 7200,
+                token_type: "Bearer",
+            },
+        }));
+        const file = makeTokenFile(expiredTokenFile);
+        const client = makeClient(file, url);
+        const delivered = [];
+        await ensureOAuthToken(client, null, t => {
+            delivered.push(t);
+        });
+        assert.deepStrictEqual(delivered, ["fresh-token"]);
+        assert.strictEqual(bodies.length, 1);
+        assert.match(bodies[0], /grant_type=refresh_token/);
+        assert.match(bodies[0], /refresh_token=cached-refresh-token/);
+        const saved = JSON.parse(fs.readFileSync(file, "utf8"));
+        assert.strictEqual(saved.access_token, "fresh-token");
+    });
+    test("transient refresh failure propagates without opening a browser", async () => {
+        const { url } = await startTokenServer(() => ({ status: 500, json: { error: "server_error" } }));
+        const client = makeClient(makeTokenFile(expiredTokenFile), url);
+        const delivered = [];
+        // Rejection (not a browser popup) proves the no-browser path.
+        await assert.rejects(() => ensureOAuthToken(client, null, t => {
+            delivered.push(t);
+        }), /Token refresh failed: 500/);
+        assert.deepStrictEqual(delivered, []);
+    });
+    test("token script resolves once, then fast path holds", async () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "oauth-startup-"));
+        tmpDirs.push(dir);
+        const client = makeClient(path.join(dir, "token.json"), "http://127.0.0.1:9", {
+            tokenScript: "echo script-token-1",
+        });
+        const delivered = [];
+        await ensureOAuthToken(client, null, t => {
+            delivered.push(t);
+        });
+        assert.deepStrictEqual(delivered, ["script-token-1"]);
+        await ensureOAuthToken(client, delivered[0], t => {
+            delivered.push(t);
+        });
+        assert.deepStrictEqual(delivered, ["script-token-1"]);
+    });
+    test("concurrent calls coalesce into a single refresh request", async () => {
+        const { url, bodies } = await startTokenServer(() => ({
+            status: 200,
+            json: {
+                access_token: "coalesced-token",
+                refresh_token: "new-refresh",
+                expires_in: 7200,
+                token_type: "Bearer",
+            },
+        }));
+        const file = makeTokenFile(expiredTokenFile);
+        const client = makeClient(file, url);
+        const deliveredA = [];
+        const deliveredB = [];
+        await Promise.all([
+            ensureOAuthToken(client, null, t => deliveredA.push(t)),
+            ensureOAuthToken(client, null, t => deliveredB.push(t)),
+        ]);
+        assert.deepStrictEqual(deliveredA, ["coalesced-token"]);
+        assert.deepStrictEqual(deliveredB, ["coalesced-token"]);
+        assert.strictEqual(bodies.length, 1);
+    });
+});

package/build/test/test-dynamic-project-scope.js

@@ -79,6 +79,7 @@ describe("Dynamic project scope", { concurrency: 1 }, () => {
                     ENABLE_DYNAMIC_PROJECT_SCOPE: "true",
                     ENABLE_STRICT_PROJECT_SCOPE: "true",
                     GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                    GITLAB_TOOLS: "execute_graphql",
                     GITLAB_ALLOWED_PROJECT_IDS: "1,2",
                 },
             });
@@ -286,6 +287,7 @@ describe("Dynamic project scope", { concurrency: 1 }, () => {
                     REMOTE_AUTHORIZATION: "true",
                     ENABLE_DYNAMIC_PROJECT_SCOPE: "true",
                     GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                    GITLAB_TOOLS: "execute_graphql,get_vulnerability",
                 },
             });
             servers.push(server);

package/build/test/test-geteffectiveprojectid.js

@@ -168,6 +168,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
                     GITLAB_READ_ONLY_MODE: 'false',
+                    GITLAB_TOOLSETS: 'all',
                 }
             });
             servers.push(server);
@@ -318,6 +319,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                     GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
                     GITLAB_ALLOWED_PROJECT_IDS: DEFAULT_PROJECT_ID,
                     GITLAB_READ_ONLY_MODE: 'true',
+                    GITLAB_TOOLSETS: 'all',
                 }
             });
             servers.push(server);
@@ -484,7 +486,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                     REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
-                    GITLAB_TOOLSETS: 'variables',
+                    GITLAB_TOOLSETS: 'variables,repositories,groups,projects',
                 }
             });
             servers.push(server);
@@ -582,7 +584,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                     REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_ALLOWED_PROJECT_IDS: DEFAULT_PROJECT_ID,
-                    GITLAB_TOOLSETS: 'variables,merge_requests,issues,pipelines',
+                    GITLAB_TOOLSETS: 'variables,merge_requests,issues,pipelines,repositories,groups,projects',
                 }
             });
             servers.push(server);

package/build/test/test-permission-mode.js

@@ -31,6 +31,8 @@ async function launchMcpServer(extraEnv = {}) {
             REMOTE_AUTHORIZATION: "true",
             GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
             GITLAB_TOOLSETS: "all",
+            // execute_graphql is in no toolset; opt in so the guards under test are reachable.
+            GITLAB_TOOLS: "execute_graphql",
             ...extraEnv,
         },
     });
@@ -280,6 +282,90 @@ describe("Permission Mode", { concurrency: 1 }, () => {
             }
         });
     });
+    describe("call-time enforcement of list filters (modify mode)", () => {
+        const servers = [];
+        after(() => cleanupServers(servers));
+        /** Calls a tool on a fresh client and returns the serialized result, or the error message. */
+        async function callOutcome(server, name, args) {
+            const client = await connectClient(server);
+            try {
+                return JSON.stringify(await client.callTool(name, args));
+            }
+            catch (error) {
+                return error instanceof Error ? error.message : String(error);
+            }
+            finally {
+                await client.disconnect();
+            }
+        }
+        test("rejects a regex-denied tool and an execute_graphql with no GITLAB_TOOLS entry", async () => {
+            const server = await launchMcpServer({
+                GITLAB_PERMISSION_MODE: "modify",
+                GITLAB_TOOLS: "",
+                GITLAB_DENIED_TOOLS_REGEX: "^merge_merge_request$",
+            });
+            servers.push(server);
+            const names = await getToolNames(server);
+            assert.ok(!names.includes("merge_merge_request"), "regex-denied tool must be unlisted");
+            assert.ok(!names.includes("execute_graphql"), "execute_graphql must be unlisted");
+            const merge = await callOutcome(server, "merge_merge_request", {
+                project_id: "1",
+                merge_request_iid: 1,
+            });
+            assert.ok(merge.includes("not available"), `merge_merge_request: ${merge}`);
+            const graphql = await callOutcome(server, "execute_graphql", {
+                query: "query { currentUser { id } }",
+            });
+            assert.ok(graphql.includes("not available"), `execute_graphql: ${graphql}`);
+        });
+        test("policy-hidden tool is unlisted but still callable", async () => {
+            const server = await launchMcpServer({
+                GITLAB_PERMISSION_MODE: "modify",
+                GITLAB_TOOL_POLICY_HIDDEN: "list_issues",
+            });
+            servers.push(server);
+            const names = await getToolNames(server);
+            assert.ok(!names.includes("list_issues"), "hidden tool must be unlisted");
+            const outcome = await callOutcome(server, "list_issues", { project_id: "1" });
+            assert.ok(!outcome.includes("not available"), `hidden tool must stay callable: ${outcome}`);
+        });
+        test("policy-hidden tool that is also regex-denied is rejected", async () => {
+            const server = await launchMcpServer({
+                GITLAB_PERMISSION_MODE: "modify",
+                GITLAB_TOOL_POLICY_HIDDEN: "list_issues",
+                GITLAB_DENIED_TOOLS_REGEX: "^list_issues$",
+            });
+            servers.push(server);
+            const names = await getToolNames(server);
+            assert.ok(!names.includes("list_issues"), "hidden tool must be unlisted");
+            const outcome = await callOutcome(server, "list_issues", { project_id: "1" });
+            assert.ok(outcome.includes("not available"), `regex denial must win over hidden exemption: ${outcome}`);
+        });
+        test("tool outside the enabled toolsets is rejected until discover_tools activates it", async () => {
+            const server = await launchMcpServer({
+                GITLAB_PERMISSION_MODE: "modify",
+                GITLAB_TOOLSETS: "issues",
+            });
+            servers.push(server);
+            const client = await connectClient(server);
+            try {
+                const before = await client
+                    .callTool("list_pipelines", { project_id: "1" })
+                    .then(r => JSON.stringify(r))
+                    .catch((e) => e.message);
+                assert.ok(before.includes("not available"), `before activation: ${before}`);
+                await client.callTool("discover_tools", { category: "pipelines" });
+                const after = await client
+                    .callTool("list_pipelines", { project_id: "1" })
+                    .then(r => JSON.stringify(r))
+                    .catch((e) => e.message);
+                assert.ok(!after.includes("not available"), `after activation: ${after}`);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+    });
     describe("readonly mode via GITLAB_PERMISSION_MODE", () => {
         let server;
         const servers = [];