@zereight/mcp-gitlab 2.1.70 → 2.2.0

package/build/test/test-vulnerabilities.js

@@ -1,399 +0,0 @@
-import { describe, test, before, after } from "node:test";
-import assert from "node:assert";
-import { spawn } from "child_process";
-import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
-const MOCK_TOKEN = "glpat-mock-token-12345";
-const TEST_PROJECT_ID = "456";
-const TEST_PROJECT_FULL_PATH = "test-group/test-project";
-const TEST_VULNERABILITY_ID = "789";
-const TEST_VULNERABILITY_GID = `gid://gitlab/Vulnerability/${TEST_VULNERABILITY_ID}`;
-const mockVulnerability = {
-    id: TEST_VULNERABILITY_GID,
-    title: "Hard-coded credential detected",
-    description: "A hard-coded credential was found in source code",
-    state: "DETECTED",
-    severity: "CRITICAL",
-    reportType: "SECRET_DETECTION",
-    detectedAt: "2024-06-01T10:00:00Z",
-    confirmedAt: null,
-    resolvedAt: null,
-    dismissedAt: null,
-    dismissalReason: null,
-    webUrl: "https://gitlab.mock/test-group/test-project/-/security/vulnerabilities/789",
-    scanner: { name: "GitLeaks", externalId: "gitleaks", vendor: "GitLab" },
-    identifiers: [
-        { externalType: "cve", externalId: "CVE-2024-0001", name: "CVE-2024-0001", url: null },
-    ],
-    links: [{ name: "More info", url: "https://example.com/vuln/789" }],
-    location: { file: "config/secrets.yml", startLine: 42, endLine: 42 },
-};
-const mockVulnerabilityList = [
-    mockVulnerability,
-    {
-        ...mockVulnerability,
-        id: "gid://gitlab/Vulnerability/790",
-        title: "SQL Injection in login form",
-        state: "CONFIRMED",
-        severity: "HIGH",
-        reportType: "SAST",
-        confirmedAt: "2024-06-03T09:00:00Z",
-        location: { file: "src/auth/login.ts", startLine: 18, endLine: 22 },
-    },
-    {
-        ...mockVulnerability,
-        id: "gid://gitlab/Vulnerability/791",
-        title: "Outdated dependency with known CVE",
-        state: "DISMISSED",
-        severity: "MEDIUM",
-        reportType: "DEPENDENCY_SCANNING",
-        dismissedAt: "2024-05-20T14:00:00Z",
-        dismissalReason: "ACCEPTABLE_RISK",
-        location: { file: "package.json", dependency: { package: { name: "foo" }, version: "1.2.3" } },
-    },
-];
-async function callTool(toolName, args, env) {
-    return new Promise((resolve, reject) => {
-        const proc = spawn("node", ["build/index.js"], {
-            stdio: ["pipe", "pipe", "pipe"],
-            env: {
-                ...process.env,
-                ...env,
-                USE_PIPELINE: "true",
-            },
-        });
-        let output = "";
-        let errorOutput = "";
-        proc.stdout?.on("data", (d) => (output += d));
-        proc.stderr?.on("data", (d) => (errorOutput += d));
-        proc.on("close", code => {
-            if (code !== 0) {
-                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
-            }
-            const line = output.split("\n").find(l => l.startsWith("{"));
-            if (!line) {
-                return reject(new Error("No JSON output found"));
-            }
-            try {
-                const response = JSON.parse(line);
-                if (response.error) {
-                    reject(response.error);
-                }
-                else {
-                    const content = response.result?.content?.[0]?.text;
-                    if (content) {
-                        try {
-                            resolve(JSON.parse(content));
-                        }
-                        catch {
-                            resolve(content);
-                        }
-                    }
-                    else {
-                        resolve(response.result);
-                    }
-                }
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        proc.stdin?.end(JSON.stringify({
-            jsonrpc: "2.0",
-            id: 1,
-            method: "tools/call",
-            params: { name: toolName, arguments: args },
-        }) + "\n");
-    });
-}
-describe("vulnerability tools", () => {
-    let mockGitLab;
-    let mockGitLabUrl;
-    // Capture variables for verifying GraphQL payloads
-    let lastListVariables = null;
-    let lastDismissInput = null;
-    let lastConfirmInput = null;
-    let lastGetId = null;
-    const baseEnv = () => ({
-        GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-        GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        GITLAB_TOOLSETS: "vulnerabilities",
-    });
-    before(async () => {
-        const mockPort = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_TOKEN],
-        });
-        // All four tools go through POST /api/graphql; dispatch on operation name
-        mockGitLab.addRootHandler("post", "/api/graphql", (req, res) => {
-            const query = req.body.query || "";
-            const variables = req.body.variables || {};
-            if (query.includes("vulnerabilityDismiss")) {
-                lastDismissInput = variables.input;
-                res.json({
-                    data: {
-                        vulnerabilityDismiss: {
-                            vulnerability: {
-                                id: TEST_VULNERABILITY_GID,
-                                state: "DISMISSED",
-                                dismissedAt: "2024-06-10T12:00:00Z",
-                                dismissalReason: variables.input?.dismissalReason || null,
-                            },
-                            errors: [],
-                        },
-                    },
-                });
-                return;
-            }
-            if (query.includes("vulnerabilityConfirm")) {
-                lastConfirmInput = variables.input;
-                res.json({
-                    data: {
-                        vulnerabilityConfirm: {
-                            vulnerability: {
-                                id: TEST_VULNERABILITY_GID,
-                                state: "CONFIRMED",
-                                confirmedAt: "2024-06-10T12:00:00Z",
-                            },
-                            errors: [],
-                        },
-                    },
-                });
-                return;
-            }
-            if (query.includes("listProjectVulnerabilities")) {
-                lastListVariables = variables;
-                let nodes = mockVulnerabilityList;
-                if (variables.state) {
-                    nodes = nodes.filter(v => variables.state.includes(v.state));
-                }
-                if (variables.severity) {
-                    nodes = nodes.filter(v => variables.severity.includes(v.severity));
-                }
-                if (variables.reportType) {
-                    nodes = nodes.filter(v => variables.reportType.includes(v.reportType));
-                }
-                res.json({
-                    data: {
-                        project: {
-                            vulnerabilities: {
-                                nodes,
-                                pageInfo: { endCursor: "cursor-abc", hasNextPage: false },
-                            },
-                        },
-                    },
-                });
-                return;
-            }
-            if (query.includes("getVulnerability")) {
-                lastGetId = variables.id;
-                res.json({
-                    data: {
-                        vulnerability: {
-                            ...mockVulnerability,
-                            project: {
-                                id: "gid://gitlab/Project/456",
-                                name: "Test Project",
-                                fullPath: TEST_PROJECT_FULL_PATH,
-                            },
-                        },
-                    },
-                });
-                return;
-            }
-            res
-                .status(400)
-                .json({ errors: [{ message: `Unexpected GraphQL query: ${query.slice(0, 80)}` }] });
-        });
-        await mockGitLab.start();
-        mockGitLabUrl = mockGitLab.getUrl();
-    });
-    after(async () => {
-        await mockGitLab.stop();
-    });
-    test("list_project_vulnerabilities returns vulnerabilities with pageInfo", async () => {
-        const result = await callTool("list_project_vulnerabilities", { project_id: TEST_PROJECT_ID }, baseEnv());
-        assert.ok(Array.isArray(result.vulnerabilities), "Response should contain vulnerabilities array");
-        assert.strictEqual(result.vulnerabilities.length, 3, "Should return 3 vulnerabilities");
-        assert.strictEqual(result.vulnerabilities[0].id, TEST_VULNERABILITY_GID);
-        assert.strictEqual(result.vulnerabilities[0].title, "Hard-coded credential detected");
-        assert.ok(result.pageInfo, "Response should include pageInfo for cursor pagination");
-        assert.strictEqual(result.pageInfo.hasNextPage, false);
-    });
-    test("list_project_vulnerabilities resolves numeric project ID to full path", async () => {
-        lastListVariables = null;
-        await callTool("list_project_vulnerabilities", { project_id: TEST_PROJECT_ID }, baseEnv());
-        assert.ok(lastListVariables, "GraphQL variables should have been captured");
-        assert.strictEqual(lastListVariables.fullPath, TEST_PROJECT_FULL_PATH, "Numeric project ID should be resolved to the project full path");
-    });
-    test("list_project_vulnerabilities passes state filter as GraphQL enum", async () => {
-        lastListVariables = null;
-        const result = await callTool("list_project_vulnerabilities", { project_id: TEST_PROJECT_ID, state: "detected" }, baseEnv());
-        assert.ok(lastListVariables, "GraphQL variables should have been captured");
-        assert.deepStrictEqual(lastListVariables.state, ["DETECTED"], "state should be uppercased enum array");
-        assert.strictEqual(result.vulnerabilities.length, 1, "Mock should filter to only DETECTED");
-    });
-    test("list_project_vulnerabilities passes severity filter as GraphQL enum", async () => {
-        lastListVariables = null;
-        const result = await callTool("list_project_vulnerabilities", { project_id: TEST_PROJECT_ID, severity: "critical" }, baseEnv());
-        assert.ok(lastListVariables, "GraphQL variables should have been captured");
-        assert.deepStrictEqual(lastListVariables.severity, ["CRITICAL"]);
-        assert.strictEqual(result.vulnerabilities.length, 1, "Mock should filter to only CRITICAL");
-    });
-    test("list_project_vulnerabilities passes report_type filter as GraphQL enum", async () => {
-        lastListVariables = null;
-        const result = await callTool("list_project_vulnerabilities", { project_id: TEST_PROJECT_ID, report_type: "secret_detection" }, baseEnv());
-        assert.ok(lastListVariables, "GraphQL variables should have been captured");
-        assert.deepStrictEqual(lastListVariables.reportType, ["SECRET_DETECTION"]);
-        assert.strictEqual(result.vulnerabilities.length, 1, "Mock should filter to only SECRET_DETECTION");
-    });
-    test("list_project_vulnerabilities forwards cursor pagination", async () => {
-        lastListVariables = null;
-        await callTool("list_project_vulnerabilities", { project_id: TEST_PROJECT_ID, first: 50, after: "cursor-abc" }, baseEnv());
-        assert.ok(lastListVariables, "GraphQL variables should have been captured");
-        assert.strictEqual(lastListVariables.first, 50);
-        assert.strictEqual(lastListVariables.after, "cursor-abc");
-    });
-    test("get_vulnerability returns full vulnerability object via GID", async () => {
-        lastGetId = null;
-        const result = await callTool("get_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID }, baseEnv());
-        assert.strictEqual(lastGetId, TEST_VULNERABILITY_GID, "Numeric ID should be converted to a GraphQL global ID");
-        assert.strictEqual(result.id, TEST_VULNERABILITY_GID);
-        assert.strictEqual(result.title, "Hard-coded credential detected");
-        assert.strictEqual(result.description, "A hard-coded credential was found in source code");
-        assert.strictEqual(result.state, "DETECTED");
-        assert.strictEqual(result.severity, "CRITICAL");
-        assert.strictEqual(result.reportType, "SECRET_DETECTION");
-        assert.strictEqual(result.location.file, "config/secrets.yml");
-        assert.strictEqual(result.location.startLine, 42);
-        assert.strictEqual(result.identifiers[0].name, "CVE-2024-0001");
-        assert.strictEqual(result.links[0].url, "https://example.com/vuln/789");
-        assert.strictEqual(result.project.fullPath, TEST_PROJECT_FULL_PATH);
-    });
-    test("dismiss_vulnerability sends dismissalReason in mutation input", async () => {
-        lastDismissInput = null;
-        const result = await callTool("dismiss_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID, reason: "false_positive" }, baseEnv());
-        assert.ok(lastDismissInput, "Mutation input should have been captured");
-        assert.strictEqual(lastDismissInput.id, TEST_VULNERABILITY_GID);
-        assert.strictEqual(lastDismissInput.dismissalReason, "FALSE_POSITIVE", "Reason should be mapped to the GraphQL enum");
-        assert.strictEqual(result.state, "DISMISSED");
-        assert.strictEqual(result.dismissalReason, "FALSE_POSITIVE");
-    });
-    test("dismiss_vulnerability includes comment when provided", async () => {
-        lastDismissInput = null;
-        await callTool("dismiss_vulnerability", {
-            vulnerability_id: TEST_VULNERABILITY_ID,
-            reason: "acceptable_risk",
-            comment: "Reviewed by security team, risk accepted",
-        }, baseEnv());
-        assert.ok(lastDismissInput, "Mutation input should have been captured");
-        assert.strictEqual(lastDismissInput.dismissalReason, "ACCEPTABLE_RISK");
-        assert.strictEqual(lastDismissInput.comment, "Reviewed by security team, risk accepted");
-    });
-    test("dismiss_vulnerability accepts mitigating_control and not_applicable reasons", async () => {
-        lastDismissInput = null;
-        await callTool("dismiss_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID, reason: "mitigating_control" }, baseEnv());
-        assert.strictEqual(lastDismissInput.dismissalReason, "MITIGATING_CONTROL");
-        lastDismissInput = null;
-        await callTool("dismiss_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID, reason: "not_applicable" }, baseEnv());
-        assert.strictEqual(lastDismissInput.dismissalReason, "NOT_APPLICABLE");
-    });
-    test("confirm_vulnerability sends mutation with GID", async () => {
-        lastConfirmInput = null;
-        const result = await callTool("confirm_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID }, baseEnv());
-        assert.ok(lastConfirmInput, "Mutation input should have been captured");
-        assert.strictEqual(lastConfirmInput.id, TEST_VULNERABILITY_GID);
-        assert.strictEqual(result.state, "CONFIRMED");
-        assert.strictEqual(result.confirmedAt, "2024-06-10T12:00:00Z");
-    });
-    test("confirm_vulnerability includes comment when provided", async () => {
-        lastConfirmInput = null;
-        await callTool("confirm_vulnerability", {
-            vulnerability_id: TEST_VULNERABILITY_ID,
-            comment: "Confirmed after manual verification",
-        }, baseEnv());
-        assert.ok(lastConfirmInput, "Mutation input should have been captured");
-        assert.strictEqual(lastConfirmInput.comment, "Confirmed after manual verification");
-    });
-    // Read-only mode tests
-    test("read-only mode: list_project_vulnerabilities succeeds", async () => {
-        const result = await callTool("list_project_vulnerabilities", { project_id: TEST_PROJECT_ID }, { ...baseEnv(), GITLAB_PERMISSION_MODE: "readonly" });
-        assert.ok(Array.isArray(result.vulnerabilities), "Should return vulnerabilities in readonly mode");
-        assert.strictEqual(result.vulnerabilities.length, 3);
-    });
-    test("read-only mode: get_vulnerability succeeds", async () => {
-        const result = await callTool("get_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID }, { ...baseEnv(), GITLAB_PERMISSION_MODE: "readonly" });
-        assert.strictEqual(result.id, TEST_VULNERABILITY_GID);
-        assert.strictEqual(result.title, "Hard-coded credential detected");
-    });
-    test("read-only mode: dismiss_vulnerability is rejected", async () => {
-        await assert.rejects(() => callTool("dismiss_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID, reason: "false_positive" }, { ...baseEnv(), GITLAB_PERMISSION_MODE: "readonly" }), (err) => {
-            const msg = typeof err === "string" ? err : err?.message || JSON.stringify(err);
-            assert.ok(msg.toLowerCase().includes("not allowed") ||
-                msg.toLowerCase().includes("read-only") ||
-                msg.toLowerCase().includes("readonly") ||
-                msg.toLowerCase().includes("not available"), `Expected read-only rejection, got: ${msg}`);
-            return true;
-        });
-    });
-    test("read-only mode: confirm_vulnerability is rejected", async () => {
-        await assert.rejects(() => callTool("confirm_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID }, { ...baseEnv(), GITLAB_PERMISSION_MODE: "readonly" }), (err) => {
-            const msg = typeof err === "string" ? err : err?.message || JSON.stringify(err);
-            assert.ok(msg.toLowerCase().includes("not allowed") ||
-                msg.toLowerCase().includes("read-only") ||
-                msg.toLowerCase().includes("readonly") ||
-                msg.toLowerCase().includes("not available"), `Expected read-only rejection, got: ${msg}`);
-            return true;
-        });
-    });
-    // GITLAB_ALLOWED_PROJECT_IDS tests: the mock vulnerability belongs to
-    // project 456 (test-group/test-project), so an allowlist of "999" must
-    // deny all id-only vulnerability tools.
-    const assertAccessDenied = (err) => {
-        const msg = typeof err === "string" ? err : err?.message || JSON.stringify(err);
-        assert.ok(msg.includes("Access denied"), `Expected allowlist rejection, got: ${msg}`);
-        return true;
-    };
-    test("allowlist: get_vulnerability is rejected for a vulnerability outside allowed projects", async () => {
-        await assert.rejects(() => callTool("get_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID }, { ...baseEnv(), GITLAB_ALLOWED_PROJECT_IDS: "999" }), assertAccessDenied);
-    });
-    test("allowlist: get_vulnerability succeeds when project is allowed by numeric ID", async () => {
-        const result = await callTool("get_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID }, { ...baseEnv(), GITLAB_ALLOWED_PROJECT_IDS: TEST_PROJECT_ID });
-        assert.strictEqual(result.id, TEST_VULNERABILITY_GID);
-    });
-    test("allowlist: get_vulnerability succeeds when project is allowed by full path", async () => {
-        const result = await callTool("get_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID }, { ...baseEnv(), GITLAB_ALLOWED_PROJECT_IDS: `999,${TEST_PROJECT_FULL_PATH}` });
-        assert.strictEqual(result.id, TEST_VULNERABILITY_GID);
-    });
-    test("allowlist: dismiss_vulnerability is rejected before the mutation is sent", async () => {
-        lastDismissInput = null;
-        await assert.rejects(() => callTool("dismiss_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID, reason: "false_positive" }, { ...baseEnv(), GITLAB_ALLOWED_PROJECT_IDS: "999" }), assertAccessDenied);
-        assert.strictEqual(lastDismissInput, null, "vulnerabilityDismiss mutation must not be sent for a denied project");
-    });
-    test("allowlist: confirm_vulnerability is rejected before the mutation is sent", async () => {
-        lastConfirmInput = null;
-        await assert.rejects(() => callTool("confirm_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID }, { ...baseEnv(), GITLAB_ALLOWED_PROJECT_IDS: "999" }), assertAccessDenied);
-        assert.strictEqual(lastConfirmInput, null, "vulnerabilityConfirm mutation must not be sent for a denied project");
-    });
-    test("allowlist: dismiss_vulnerability succeeds when the vulnerability's project is allowed", async () => {
-        lastDismissInput = null;
-        const result = await callTool("dismiss_vulnerability", { vulnerability_id: TEST_VULNERABILITY_ID, reason: "false_positive" }, { ...baseEnv(), GITLAB_ALLOWED_PROJECT_IDS: TEST_PROJECT_ID });
-        assert.ok(lastDismissInput, "Mutation should be sent after the allowlist check passes");
-        assert.strictEqual(lastDismissInput.id, TEST_VULNERABILITY_GID);
-        assert.strictEqual(result.state, "DISMISSED");
-    });
-    // GID validation tests: only numeric IDs and Vulnerability GIDs are accepted
-    const assertInvalidVulnerabilityId = (err) => {
-        const msg = typeof err === "string" ? err : err?.message || JSON.stringify(err);
-        assert.ok(msg.includes("Invalid vulnerability ID"), `Expected invalid-ID rejection, got: ${msg}`);
-        return true;
-    };
-    test("gid validation: get_vulnerability rejects non-Vulnerability GIDs", async () => {
-        await assert.rejects(() => callTool("get_vulnerability", { vulnerability_id: "gid://gitlab/Project/456" }, baseEnv()), assertInvalidVulnerabilityId);
-    });
-    test("gid validation: dismiss_vulnerability rejects a non-numeric ID before any request", async () => {
-        lastDismissInput = null;
-        await assert.rejects(() => callTool("dismiss_vulnerability", { vulnerability_id: "not-a-vuln-id", reason: "false_positive" }, baseEnv()), assertInvalidVulnerabilityId);
-        assert.strictEqual(lastDismissInput, null, "vulnerabilityDismiss mutation must not be sent for an invalid ID");
-    });
-});

package/build/test/test-webhooks.js

@@ -1,218 +0,0 @@
-import { describe, test, before, after } from "node:test";
-import assert from "node:assert";
-import { spawn } from "child_process";
-import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
-const MOCK_TOKEN = "glpat-mock-token-webhooks";
-const TEST_PROJECT_ID = "123";
-const TEST_GROUP_ID = "my-group";
-const TEST_HOOK_ID = 42;
-const MOCK_PROJECT_HOOK = {
-    id: TEST_HOOK_ID,
-    url: "https://example.com/hook",
-    name: "AI Hook",
-    description: "Registered by MCP",
-    project_id: Number(TEST_PROJECT_ID),
-    push_events: true,
-    issues_events: false,
-    enable_ssl_verification: true,
-};
-const MOCK_GROUP_HOOK = {
-    id: TEST_HOOK_ID,
-    url: "https://example.com/group-hook",
-    name: "Group Hook",
-    group_id: 3,
-    push_events: true,
-    member_events: true,
-    enable_ssl_verification: true,
-};
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-async function callTool(toolName, args, env) {
-    return new Promise((resolve, reject) => {
-        const proc = spawn("node", ["build/index.js"], {
-            stdio: ["pipe", "pipe", "pipe"],
-            env: { ...process.env, ...env },
-        });
-        let output = "";
-        let errorOutput = "";
-        proc.stdout?.on("data", (d) => (output += d));
-        proc.stderr?.on("data", (d) => (errorOutput += d));
-        proc.on("close", code => {
-            if (code !== 0) {
-                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
-            }
-            const line = output.split("\n").find(l => l.startsWith("{"));
-            if (!line)
-                return reject(new Error("No JSON output found"));
-            try {
-                const response = JSON.parse(line);
-                if (response.error) {
-                    reject(new Error(response.error?.message ?? String(response.error)));
-                }
-                else {
-                    const content = response.result?.content?.[0]?.text;
-                    resolve(content ? JSON.parse(content) : response.result);
-                }
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        proc.stdin?.end(JSON.stringify({
-            jsonrpc: "2.0",
-            id: 1,
-            method: "tools/call",
-            params: { name: toolName, arguments: args },
-        }) + "\n");
-    });
-}
-describe("When managing webhooks", () => {
-    let mockServer;
-    let baseEnv;
-    let lastCreateBody;
-    let lastUpdateBody;
-    let lastDeletePath;
-    before(async () => {
-        mockServer = new MockGitLabServer({
-            port: await findMockServerPort(),
-            validTokens: [MOCK_TOKEN],
-        });
-        mockServer.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/hooks`, (req, res) => {
-            lastCreateBody = isRecord(req.body) ? req.body : undefined;
-            res.status(201).json({ ...MOCK_PROJECT_HOOK, ...lastCreateBody });
-        });
-        mockServer.addMockHandler("put", `/projects/${TEST_PROJECT_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
-            lastUpdateBody = isRecord(req.body) ? req.body : undefined;
-            res.json({ ...MOCK_PROJECT_HOOK, ...lastUpdateBody, id: TEST_HOOK_ID });
-        });
-        mockServer.addMockHandler("delete", `/projects/${TEST_PROJECT_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
-            lastDeletePath = req.path;
-            res.status(204).send();
-        });
-        mockServer.addMockHandler("post", `/groups/${TEST_GROUP_ID}/hooks`, (req, res) => {
-            lastCreateBody = isRecord(req.body) ? req.body : undefined;
-            res.status(201).json({ ...MOCK_GROUP_HOOK, ...lastCreateBody });
-        });
-        mockServer.addMockHandler("put", `/groups/${TEST_GROUP_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
-            lastUpdateBody = isRecord(req.body) ? req.body : undefined;
-            res.json({ ...MOCK_GROUP_HOOK, ...lastUpdateBody, id: TEST_HOOK_ID });
-        });
-        mockServer.addMockHandler("delete", `/groups/${TEST_GROUP_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
-            lastDeletePath = req.path;
-            res.status(204).send();
-        });
-        await mockServer.start();
-        baseEnv = {
-            GITLAB_API_URL: mockServer.getUrl() + "/api/v4",
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-            GITLAB_TOOLSETS: "webhooks",
-            GITLAB_READ_ONLY_MODE: "false",
-        };
-    });
-    after(async () => {
-        if (mockServer)
-            await mockServer.stop();
-    });
-    describe("with create_webhook on a project", () => {
-        test("should create a webhook and return the GitLab response", async () => {
-            lastCreateBody = undefined;
-            const result = await callTool("create_webhook", {
-                project_id: TEST_PROJECT_ID,
-                url: "https://example.com/hook",
-                name: "AI Hook",
-                push_events: true,
-                issues_events: true,
-            }, baseEnv);
-            assert.deepStrictEqual(lastCreateBody, {
-                url: "https://example.com/hook",
-                name: "AI Hook",
-                push_events: true,
-                issues_events: true,
-            });
-            assert.ok(isRecord(result));
-            assert.strictEqual(result.url, "https://example.com/hook");
-            assert.strictEqual(result.name, "AI Hook");
-        });
-    });
-    describe("with update_webhook on a project", () => {
-        test("should update a webhook and return the GitLab response", async () => {
-            lastUpdateBody = undefined;
-            const result = await callTool("update_webhook", {
-                project_id: TEST_PROJECT_ID,
-                hook_id: TEST_HOOK_ID,
-                url: "https://example.com/hook-updated",
-                name: "Renamed Hook",
-            }, baseEnv);
-            assert.deepStrictEqual(lastUpdateBody, {
-                url: "https://example.com/hook-updated",
-                name: "Renamed Hook",
-            });
-            assert.ok(isRecord(result));
-            assert.strictEqual(result.url, "https://example.com/hook-updated");
-        });
-    });
-    describe("with delete_webhook on a project", () => {
-        test("should delete a webhook and return a deleted status", async () => {
-            lastDeletePath = undefined;
-            const result = await callTool("delete_webhook", {
-                project_id: TEST_PROJECT_ID,
-                hook_id: TEST_HOOK_ID,
-            }, baseEnv);
-            assert.strictEqual(lastDeletePath, `/projects/${TEST_PROJECT_ID}/hooks/${TEST_HOOK_ID}`);
-            assert.deepStrictEqual(result, { status: "deleted", hook_id: TEST_HOOK_ID });
-        });
-    });
-    describe("with create_webhook on a group", () => {
-        test("should create a group webhook", async () => {
-            lastCreateBody = undefined;
-            const result = await callTool("create_webhook", {
-                group_id: TEST_GROUP_ID,
-                url: "https://example.com/group-hook",
-                member_events: true,
-            }, baseEnv);
-            assert.ok(lastCreateBody);
-            assert.strictEqual(lastCreateBody["url"], "https://example.com/group-hook");
-            assert.strictEqual(lastCreateBody["member_events"], true);
-            assert.ok(isRecord(result));
-            assert.strictEqual(result["url"], "https://example.com/group-hook");
-        });
-    });
-    describe("with update_webhook on a group", () => {
-        test("should update a group webhook", async () => {
-            lastUpdateBody = undefined;
-            const result = await callTool("update_webhook", {
-                group_id: TEST_GROUP_ID,
-                hook_id: TEST_HOOK_ID,
-                url: "https://example.com/group-hook-updated",
-                name: "Renamed Group Hook",
-            }, baseEnv);
-            assert.deepStrictEqual(lastUpdateBody, {
-                url: "https://example.com/group-hook-updated",
-                name: "Renamed Group Hook",
-            });
-            assert.ok(isRecord(result));
-            assert.strictEqual(result.url, "https://example.com/group-hook-updated");
-        });
-    });
-    describe("with delete_webhook on a group", () => {
-        test("should delete a group webhook", async () => {
-            lastDeletePath = undefined;
-            const result = await callTool("delete_webhook", {
-                group_id: TEST_GROUP_ID,
-                hook_id: TEST_HOOK_ID,
-            }, baseEnv);
-            assert.strictEqual(lastDeletePath, `/groups/${TEST_GROUP_ID}/hooks/${TEST_HOOK_ID}`);
-            assert.deepStrictEqual(result, { status: "deleted", hook_id: TEST_HOOK_ID });
-        });
-    });
-    describe("with invalid scope", () => {
-        test("should reject when both project_id and group_id are provided", async () => {
-            await assert.rejects(() => callTool("create_webhook", {
-                project_id: TEST_PROJECT_ID,
-                group_id: TEST_GROUP_ID,
-                url: "https://example.com/hook",
-            }, baseEnv), /project_id or group_id/);
-        });
-    });
-});

package/build/test/tool-description-quality.test.js

@@ -1,50 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { allTools, TOOLSET_DEFINITIONS } from "../tools/registry.js";
-function getExposedTool(name) {
-    const tool = allTools.find(candidate => candidate.name === name);
-    assert.ok(tool);
-    return tool;
-}
-function getDefaultToolNames() {
-    return new Set(TOOLSET_DEFINITIONS.filter(definition => definition.isDefault).flatMap(definition => [
-        ...definition.tools,
-    ]));
-}
-describe("When MCP tool descriptions are exposed", () => {
-    describe("with the default toolsets", () => {
-        it("should provide enough context for first-attempt tool selection", () => {
-            const defaultToolNames = getDefaultToolNames();
-            const defaultTools = allTools.filter(tool => defaultToolNames.has(tool.name));
-            assert.ok(defaultTools.length > 0);
-            assert.ok(defaultTools.every(tool => tool.description.length >= 120));
-        });
-    });
-    describe("with create_branch", () => {
-        it("should explain its source revision and neighboring branch operations", () => {
-            const tool = getExposedTool("create_branch");
-            assert.match(tool.description, /source branch|tag|commit[\s\S]*protect_branch[\s\S]*already-exists/i);
-        });
-    });
-    describe("with list_issues", () => {
-        it("should include issue-management guidance and omit group_id", () => {
-            const tool = getExposedTool("list_issues");
-            assert.match(tool.description, /issue management/i);
-            assert.doesNotMatch(tool.description, /group_id/);
-        });
-    });
-    describe("with my_issues", () => {
-        it("should include issue-management guidance and omit group_id", () => {
-            const tool = getExposedTool("my_issues");
-            assert.match(tool.description, /issue management/i);
-            assert.doesNotMatch(tool.description, /group_id/);
-        });
-    });
-    describe("with get_issue", () => {
-        it("should include issue-management guidance and omit group_id", () => {
-            const tool = getExposedTool("get_issue");
-            assert.match(tool.description, /issue management/i);
-            assert.doesNotMatch(tool.description, /group_id/);
-        });
-    });
-});