@zereight/mcp-gitlab 2.1.70 → 2.2.0

package/build/test/callback-proxy-tests.js

@@ -1,321 +0,0 @@
-/**
- * Callback Proxy Mode Tests
- *
- * Tests for GITLAB_OAUTH_CALLBACK_PROXY=true — the mode where the MCP server
- * intercepts the OAuth callback from GitLab, exchanges the code for tokens
- * server-side, and redirects to the MCP client with a proxy code.
- */
-import { describe, test, after, before } from "node:test";
-import assert from "node:assert";
-import { createHash, randomBytes } from "node:crypto";
-import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST, } from "./utils/server-launcher.js";
-import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
-const MOCK_GITLAB_PORT_BASE = 9400;
-const MCP_SERVER_PORT_BASE = 3400;
-const MOCK_ACCESS_TOKEN = "ya29.mock-callback-proxy-token-123456";
-const MOCK_REFRESH_TOKEN = "mock-refresh-token-abcdef";
-const MOCK_APP_ID = "test-callback-proxy-app-id";
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-function generatePKCE() {
-    const verifier = randomBytes(32).toString("base64url");
-    const challenge = createHash("sha256").update(verifier).digest("base64url");
-    return { verifier, challenge };
-}
-/** Register a client via DCR and return the virtual client_id. */
-async function registerClient(mcpBaseUrl, redirectUri) {
-    const res = await fetch(`${mcpBaseUrl}/register`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-            redirect_uris: [redirectUri],
-            client_name: "callback-proxy-test",
-        }),
-    });
-    assert.strictEqual(res.status, 201, `DCR failed: ${res.status}`);
-    const data = (await res.json());
-    return data.client_id;
-}
-/** Hit /authorize and return the redirect Location without following it. */
-async function authorize(mcpBaseUrl, clientId, redirectUri, codeChallenge, state) {
-    const params = new URLSearchParams({
-        response_type: "code",
-        client_id: clientId,
-        redirect_uri: redirectUri,
-        code_challenge: codeChallenge,
-        code_challenge_method: "S256",
-        state,
-        scope: "api",
-    });
-    const res = await fetch(`${mcpBaseUrl}/authorize?${params}`, {
-        redirect: "manual",
-    });
-    assert.strictEqual(res.status, 302, `Expected 302, got ${res.status}`);
-    const location = res.headers.get("location");
-    assert.ok(location, "Missing Location header");
-    return new URL(location);
-}
-/** Simulate GitLab redirecting to the MCP server's /callback. */
-async function simulateGitLabCallback(mcpBaseUrl, code, state) {
-    const res = await fetch(`${mcpBaseUrl}/callback?code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}`, { redirect: "manual" });
-    return {
-        status: res.status,
-        location: res.headers.get("location"),
-        body: await res.text(),
-    };
-}
-/** Exchange a proxy code for tokens via /token. */
-async function exchangeToken(mcpBaseUrl, clientId, code, codeVerifier, redirectUri) {
-    const res = await fetch(`${mcpBaseUrl}/token`, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-            grant_type: "authorization_code",
-            client_id: clientId,
-            code,
-            code_verifier: codeVerifier,
-            redirect_uri: redirectUri,
-        }).toString(),
-    });
-    return {
-        status: res.status,
-        body: (await res.json()),
-    };
-}
-// ---------------------------------------------------------------------------
-// Test suite
-// ---------------------------------------------------------------------------
-describe("Callback Proxy Mode", () => {
-    let mcpBaseUrl;
-    let mockGitLab;
-    let mockGitLabUrl;
-    let servers = [];
-    const clientRedirectUri = "http://localhost:19999/oauth/callback";
-    // Track the last code+verifier GitLab received so we can verify the proxy PKCE
-    let lastTokenRequest = {};
-    before(async () => {
-        const mockPort = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_ACCESS_TOKEN],
-        });
-        await mockGitLab.start();
-        mockGitLabUrl = mockGitLab.getUrl();
-        // Mock GitLab token exchange — returns tokens and records the request
-        mockGitLab.addRootHandler("post", "/oauth/token", (req, res) => {
-            // Body may be URL-encoded (from handleCallback) — parse manually if needed
-            let body = req.body ?? {};
-            if (typeof body === "string") {
-                body = Object.fromEntries(new URLSearchParams(body));
-            }
-            else if (!body.grant_type && req.headers["content-type"]?.includes("urlencoded")) {
-                // express.json() didn't parse it — collect raw body
-                let raw = "";
-                req.on("data", (chunk) => { raw += chunk.toString(); });
-                req.on("end", () => {
-                    lastTokenRequest = Object.fromEntries(new URLSearchParams(raw));
-                    res.json({
-                        access_token: MOCK_ACCESS_TOKEN,
-                        token_type: "Bearer",
-                        expires_in: 7200,
-                        refresh_token: MOCK_REFRESH_TOKEN,
-                        scope: "api",
-                    });
-                });
-                return;
-            }
-            lastTokenRequest = body;
-            res.json({
-                access_token: MOCK_ACCESS_TOKEN,
-                token_type: "Bearer",
-                expires_in: 7200,
-                refresh_token: MOCK_REFRESH_TOKEN,
-                scope: "api",
-            });
-        });
-        // Mock token introspection
-        mockGitLab.addRootHandler("get", "/oauth/token/info", (req, res) => {
-            const auth = req.headers["authorization"];
-            const token = auth?.replace(/^Bearer\s+/i, "");
-            if (token !== MOCK_ACCESS_TOKEN) {
-                res.status(401).json({ error: "invalid_token" });
-                return;
-            }
-            res.json({
-                resource_owner_id: 42,
-                scopes: ["api"],
-                expires_in_seconds: 7200,
-                application: { uid: MOCK_APP_ID },
-                created_at: Math.floor(Date.now() / 1000),
-            });
-        });
-        const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
-        mcpBaseUrl = `http://${HOST}:${mcpPort}`;
-        const server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port: mcpPort,
-            timeout: 5000,
-            env: {
-                STREAMABLE_HTTP: "true",
-                GITLAB_MCP_OAUTH: "true",
-                GITLAB_OAUTH_CALLBACK_PROXY: "true",
-                GITLAB_OAUTH_APP_ID: MOCK_APP_ID,
-                GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-                MCP_SERVER_URL: mcpBaseUrl,
-                MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL: "true",
-            },
-        });
-        servers.push(server);
-    });
-    after(async () => {
-        cleanupServers(servers);
-        if (mockGitLab)
-            await mockGitLab.stop();
-    });
-    // ---- Happy path --------------------------------------------------------
-    test("full flow: authorize → callback → token exchange", async () => {
-        const clientPKCE = generatePKCE();
-        const clientState = "test-state-123";
-        // 1. Register client
-        const clientId = await registerClient(mcpBaseUrl, clientRedirectUri);
-        // 2. Authorize — should redirect to GitLab with fixed callback URL
-        const gitlabUrl = await authorize(mcpBaseUrl, clientId, clientRedirectUri, clientPKCE.challenge, clientState);
-        assert.strictEqual(gitlabUrl.hostname, new URL(mockGitLabUrl).hostname);
-        assert.strictEqual(gitlabUrl.pathname, "/oauth/authorize");
-        // redirect_uri should be the MCP server's /callback, NOT the client's
-        assert.strictEqual(gitlabUrl.searchParams.get("redirect_uri"), `${mcpBaseUrl}/callback`);
-        // State should be a proxy state, NOT the client's original state
-        const proxyState = gitlabUrl.searchParams.get("state");
-        assert.ok(proxyState);
-        assert.notStrictEqual(proxyState, clientState);
-        // 3. Simulate GitLab callback to MCP server
-        const callbackResult = await simulateGitLabCallback(mcpBaseUrl, "gitlab-auth-code-xyz", proxyState);
-        assert.strictEqual(callbackResult.status, 302);
-        assert.ok(callbackResult.location);
-        const clientCallbackUrl = new URL(callbackResult.location);
-        // Should redirect to the CLIENT's callback URL
-        assert.ok(clientCallbackUrl.href.startsWith(clientRedirectUri));
-        // Should include a proxy code (not the GitLab code)
-        const proxyCode = clientCallbackUrl.searchParams.get("code");
-        assert.ok(proxyCode);
-        assert.notStrictEqual(proxyCode, "gitlab-auth-code-xyz");
-        // Should restore the client's original state
-        assert.strictEqual(clientCallbackUrl.searchParams.get("state"), clientState);
-        // 4. Exchange proxy code for tokens
-        const tokenResult = await exchangeToken(mcpBaseUrl, clientId, proxyCode, clientPKCE.verifier, clientRedirectUri);
-        assert.strictEqual(tokenResult.status, 200);
-        assert.strictEqual(tokenResult.body.access_token, MOCK_ACCESS_TOKEN);
-        assert.strictEqual(tokenResult.body.refresh_token, MOCK_REFRESH_TOKEN);
-    });
-    // ---- One-time use proxy code -------------------------------------------
-    test("proxy code cannot be reused", async () => {
-        const clientPKCE = generatePKCE();
-        const clientId = await registerClient(mcpBaseUrl, clientRedirectUri);
-        const gitlabUrl = await authorize(mcpBaseUrl, clientId, clientRedirectUri, clientPKCE.challenge, "state-reuse");
-        const proxyState = gitlabUrl.searchParams.get("state");
-        const cb = await simulateGitLabCallback(mcpBaseUrl, "code-reuse", proxyState);
-        const proxyCode = new URL(cb.location).searchParams.get("code");
-        // First exchange succeeds
-        const first = await exchangeToken(mcpBaseUrl, clientId, proxyCode, clientPKCE.verifier, clientRedirectUri);
-        assert.strictEqual(first.status, 200);
-        // Second exchange with same code fails
-        const second = await exchangeToken(mcpBaseUrl, clientId, proxyCode, clientPKCE.verifier, clientRedirectUri);
-        assert.notStrictEqual(second.status, 200);
-    });
-    // ---- Client binding -----------------------------------------------------
-    test("proxy code cannot be redeemed by a different client_id", async () => {
-        const clientPKCE = generatePKCE();
-        const clientId = await registerClient(mcpBaseUrl, clientRedirectUri);
-        const otherClientId = await registerClient(mcpBaseUrl, "http://localhost:19998/oauth/callback");
-        const gitlabUrl = await authorize(mcpBaseUrl, clientId, clientRedirectUri, clientPKCE.challenge, "state-client-binding");
-        const proxyState = gitlabUrl.searchParams.get("state");
-        const cb = await simulateGitLabCallback(mcpBaseUrl, "code-client-binding", proxyState);
-        const proxyCode = new URL(cb.location).searchParams.get("code");
-        const result = await exchangeToken(mcpBaseUrl, otherClientId, proxyCode, clientPKCE.verifier, clientRedirectUri);
-        assert.notStrictEqual(result.status, 200);
-    });
-    test("proxy code cannot be redeemed with a different redirect_uri", async () => {
-        const clientPKCE = generatePKCE();
-        const clientId = await registerClient(mcpBaseUrl, clientRedirectUri);
-        const gitlabUrl = await authorize(mcpBaseUrl, clientId, clientRedirectUri, clientPKCE.challenge, "state-redirect-binding");
-        const proxyState = gitlabUrl.searchParams.get("state");
-        const cb = await simulateGitLabCallback(mcpBaseUrl, "code-redirect-binding", proxyState);
-        const proxyCode = new URL(cb.location).searchParams.get("code");
-        const result = await exchangeToken(mcpBaseUrl, clientId, proxyCode, clientPKCE.verifier, "http://localhost:19998/oauth/callback");
-        assert.notStrictEqual(result.status, 200);
-    });
-    // ---- Unknown state parameter -------------------------------------------
-    test("callback with unknown state returns 400", async () => {
-        const result = await simulateGitLabCallback(mcpBaseUrl, "some-code", "unknown-state-value");
-        assert.strictEqual(result.status, 400);
-        assert.ok(result.body.includes("Unknown or expired"));
-    });
-    // ---- PKCE verification failure -----------------------------------------
-    test("token exchange with wrong code_verifier fails", async () => {
-        const clientPKCE = generatePKCE();
-        const clientId = await registerClient(mcpBaseUrl, clientRedirectUri);
-        const gitlabUrl = await authorize(mcpBaseUrl, clientId, clientRedirectUri, clientPKCE.challenge, "state-pkce");
-        const proxyState = gitlabUrl.searchParams.get("state");
-        const cb = await simulateGitLabCallback(mcpBaseUrl, "code-pkce", proxyState);
-        const proxyCode = new URL(cb.location).searchParams.get("code");
-        // Exchange with WRONG verifier
-        const result = await exchangeToken(mcpBaseUrl, clientId, proxyCode, "wrong-verifier-value", clientRedirectUri);
-        assert.notStrictEqual(result.status, 200);
-    });
-    // ---- PKCE verifier omitted ---------------------------------------------
-    test("token exchange without code_verifier fails when challenge was stored", async () => {
-        const clientPKCE = generatePKCE();
-        const clientId = await registerClient(mcpBaseUrl, clientRedirectUri);
-        const gitlabUrl = await authorize(mcpBaseUrl, clientId, clientRedirectUri, clientPKCE.challenge, "state-no-verifier");
-        const proxyState = gitlabUrl.searchParams.get("state");
-        const cb = await simulateGitLabCallback(mcpBaseUrl, "code-no-verifier", proxyState);
-        const proxyCode = new URL(cb.location).searchParams.get("code");
-        // Exchange WITHOUT verifier — should fail
-        const res = await fetch(`${mcpBaseUrl}/token`, {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({
-                grant_type: "authorization_code",
-                client_id: clientId,
-                code: proxyCode,
-                redirect_uri: clientRedirectUri,
-            }).toString(),
-        });
-        assert.notStrictEqual(res.status, 200);
-    });
-    // ---- Replayed state parameter ------------------------------------------
-    test("state cannot be replayed after callback", async () => {
-        const clientPKCE = generatePKCE();
-        const clientId = await registerClient(mcpBaseUrl, clientRedirectUri);
-        const gitlabUrl = await authorize(mcpBaseUrl, clientId, clientRedirectUri, clientPKCE.challenge, "state-replay");
-        const proxyState = gitlabUrl.searchParams.get("state");
-        // First callback succeeds
-        const first = await simulateGitLabCallback(mcpBaseUrl, "code-replay-1", proxyState);
-        assert.strictEqual(first.status, 302);
-        // Second callback with same state fails
-        const second = await simulateGitLabCallback(mcpBaseUrl, "code-replay-2", proxyState);
-        assert.strictEqual(second.status, 400);
-    });
-    // ---- Dual PKCE verification --------------------------------------------
-    test("proxy uses its own PKCE pair with GitLab", async () => {
-        const clientPKCE = generatePKCE();
-        const clientId = await registerClient(mcpBaseUrl, clientRedirectUri);
-        const gitlabUrl = await authorize(mcpBaseUrl, clientId, clientRedirectUri, clientPKCE.challenge, "state-dual-pkce");
-        // The code_challenge sent to GitLab should NOT be the client's challenge
-        const gitlabChallenge = gitlabUrl.searchParams.get("code_challenge");
-        assert.ok(gitlabChallenge);
-        assert.notStrictEqual(gitlabChallenge, clientPKCE.challenge);
-        // Complete the flow to verify the proxy verifier was sent to GitLab
-        const proxyState = gitlabUrl.searchParams.get("state");
-        await simulateGitLabCallback(mcpBaseUrl, "code-dual-pkce", proxyState);
-        // The token request to GitLab should have a code_verifier that matches
-        // the proxy challenge (not the client's verifier)
-        assert.ok(lastTokenRequest.code_verifier);
-        assert.notStrictEqual(lastTokenRequest.code_verifier, clientPKCE.verifier);
-        const computedChallenge = createHash("sha256")
-            .update(lastTokenRequest.code_verifier)
-            .digest("base64url");
-        assert.strictEqual(computedChallenge, gitlabChallenge);
-    });
-});

package/build/test/cli/args.test.js

@@ -1,175 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { allTools } from "../../tools/registry.js";
-import { CreateWebhookSchema, GetPipelineJobOutputSchema, ProtectBranchSchema, } from "../../schemas.js";
-import { applyFlagAliases, CliUsageError, parseArgv, parseToolArgs } from "../../cli/args.js";
-function argv(...args) {
-    return ["node", "index.js", ...args];
-}
-function schemaFor(toolName) {
-    const tool = allTools.find(entry => entry.name === toolName);
-    assert.ok(tool, `missing tool ${toolName}`);
-    return tool.inputSchema;
-}
-describe("When parseArgv reads a command line", () => {
-    describe("with a generic tool invocation", () => {
-        it("should keep positionals and kebab flags as snake_case tool args", () => {
-            const parsed = parseArgv(argv("tool", "list_issues", "--project-id", "123", "--state", "opened"));
-            assert.deepEqual(parsed.positionals, ["tool", "list_issues"]);
-            assert.equal(parsed.toolFlags.project_id, "123");
-            assert.equal(parsed.toolFlags.state, "opened");
-            assert.equal(parsed.output, undefined);
-        });
-    });
-    describe("with global flags mixed in", () => {
-        it("should not treat --token --output --yes as tool flags", () => {
-            const parsed = parseArgv(argv("tool", "whoami", "--token", "glpat-xxxxxxxxxxxxxxxxxxxx", "--output=json", "--yes"));
-            assert.equal(parsed.output, "json");
-            assert.equal(parsed.yes, true);
-            assert.deepEqual(parsed.toolFlags, {});
-        });
-    });
-    describe("with --args-json", () => {
-        it("should parse the object and ignore prototype keys", () => {
-            const parsed = parseArgv(argv("tool", "create_issue", "--args-json", '{"title":"bug","__proto__":{"x":1}}'));
-            assert.equal(parsed.argsJson?.title, "bug");
-            assert.equal(Object.prototype.hasOwnProperty.call(parsed.argsJson, "__proto__"), false);
-        });
-    });
-    describe("with --use-oauth before a curated command", () => {
-        it("should keep mr list as positionals instead of consuming mr as the flag value", () => {
-            const parsed = parseArgv(argv("--use-oauth", "mr", "list"));
-            assert.deepEqual(parsed.positionals, ["mr", "list"]);
-        });
-    });
-    describe("with --read-only false before a curated command", () => {
-        it("should keep false as the flag value and mr list as positionals", () => {
-            const parsed = parseArgv(argv("--read-only", "false", "mr", "list"));
-            assert.deepEqual(parsed.positionals, ["mr", "list"]);
-        });
-    });
-});
-describe("When parseToolArgs validates a real schema", () => {
-    describe("with whoami", () => {
-        it("should accept an empty flag set", () => {
-            const args = parseToolArgs({
-                schema: schemaFor("whoami"),
-                flags: {},
-                argsJson: undefined,
-                extraArgs: undefined,
-            });
-            assert.deepEqual(args, {});
-        });
-    });
-    describe("with create_issue missing title", () => {
-        it("should throw a usage error for the required flag", () => {
-            assert.throws(() => parseToolArgs({
-                schema: schemaFor("create_issue"),
-                flags: { project_id: "123" },
-                argsJson: undefined,
-                extraArgs: undefined,
-            }), (error) => error instanceof CliUsageError && error.message.includes("--title"));
-        });
-    });
-    describe("with flags overlaying --args-json", () => {
-        it("should let flags win", () => {
-            const args = parseToolArgs({
-                schema: schemaFor("create_issue"),
-                flags: { title: "from-flag" },
-                argsJson: { project_id: "123", title: "from-json" },
-                extraArgs: undefined,
-            });
-            assert.equal(args.project_id, "123");
-            assert.equal(args.title, "from-flag");
-        });
-    });
-    describe("with an unknown flag", () => {
-        it("should throw a usage error", () => {
-            assert.throws(() => parseToolArgs({
-                schema: schemaFor("whoami"),
-                flags: { nope: "1" },
-                argsJson: undefined,
-                extraArgs: undefined,
-            }), (error) => error instanceof CliUsageError && error.message === "Unknown flag: --nope");
-        });
-    });
-});
-describe("When parseToolArgs coerces scalar flags from the schema", () => {
-    describe("with a number flag", () => {
-        it("should pass a number that the tool schema accepts", () => {
-            const args = parseToolArgs({
-                schema: schemaFor("get_pipeline_job_output"),
-                flags: { project_id: "1", job_id: "9", limit: "10" },
-                argsJson: undefined,
-                extraArgs: undefined,
-            });
-            assert.equal(GetPipelineJobOutputSchema.safeParse(args).success, true);
-        });
-    });
-    describe("with a boolean flag", () => {
-        it("should pass a boolean that the tool schema accepts", () => {
-            const args = parseToolArgs({
-                schema: schemaFor("create_webhook"),
-                flags: { project_id: "1", url: "https://example.com/hook", push_events: "false" },
-                argsJson: undefined,
-                extraArgs: undefined,
-            });
-            assert.equal(CreateWebhookSchema.safeParse(args).success, true);
-        });
-    });
-    describe("with an integer flag", () => {
-        it("should pass an integer that the tool schema accepts", () => {
-            const args = parseToolArgs({
-                schema: schemaFor("protect_branch"),
-                flags: { project_id: "1", branch_name: "main", push_access_level: "40" },
-                argsJson: undefined,
-                extraArgs: undefined,
-            });
-            assert.strictEqual(args.push_access_level, 40);
-            assert.equal(ProtectBranchSchema.safeParse(args).success, true);
-        });
-    });
-    describe("with a field that also accepts strings", () => {
-        it("should keep the raw string", () => {
-            const args = parseToolArgs({
-                schema: schemaFor("list_webhook_events"),
-                flags: { project_id: "1", hook_id: "2", status: "500" },
-                argsJson: undefined,
-                extraArgs: undefined,
-            });
-            assert.equal(args.status, "500");
-        });
-    });
-    describe("with a non-boolean value for a boolean flag", () => {
-        it("should throw a usage error", () => {
-            assert.throws(() => parseToolArgs({
-                schema: schemaFor("create_webhook"),
-                flags: { project_id: "1", url: "https://example.com/hook", push_events: "yes" },
-                argsJson: undefined,
-                extraArgs: undefined,
-            }), (error) => error instanceof CliUsageError && error.message === "--push-events must be true or false");
-        });
-    });
-    describe("with a fraction for an integer flag", () => {
-        it("should throw a usage error", () => {
-            assert.throws(() => parseToolArgs({
-                schema: schemaFor("protect_branch"),
-                flags: { project_id: "1", branch_name: "main", push_access_level: "40.5" },
-                argsJson: undefined,
-                extraArgs: undefined,
-            }), (error) => error instanceof CliUsageError &&
-                error.message === "--push-access-level must be an integer");
-        });
-    });
-});
-describe("When applyFlagAliases rewrites curated shorts", () => {
-    describe("with --mr-iid", () => {
-        it("should map onto merge_request_iid", () => {
-            const mapped = applyFlagAliases({ mr_iid: "45", project_id: "123" }, {
-                mr_iid: "merge_request_iid",
-            });
-            assert.equal(mapped.merge_request_iid, "45");
-            assert.equal(mapped.project_id, "123");
-        });
-    });
-});

package/build/test/cli/boolean-flags.test.js

@@ -1,106 +0,0 @@
-import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import * as path from "node:path";
-import * as url from "node:url";
-import { describe, it } from "node:test";
-import { isBooleanFlagLiteral, nextBooleanFlagValue } from "../../cli-boolean-flags.js";
-const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
-const SNAPSHOT_PATH = path.resolve(__dirname, "load-config-snapshot.ts");
-function loadConfig(argv) {
-    const childEnv = {};
-    for (const [key, value] of Object.entries(process.env)) {
-        if (value !== undefined) {
-            childEnv[key] = value;
-        }
-    }
-    delete childEnv.GITLAB_READ_ONLY_MODE;
-    delete childEnv.GITLAB_USE_OAUTH;
-    const stdout = execFileSync(process.execPath, ["--import", "tsx/esm", SNAPSHOT_PATH, ...argv], {
-        env: childEnv,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    return readBooleanConfigSnapshot(JSON.parse(stdout));
-}
-function readBooleanConfigSnapshot(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new Error("config snapshot was not an object");
-    }
-    if (!("GITLAB_READ_ONLY_MODE" in value) || typeof value.GITLAB_READ_ONLY_MODE !== "boolean") {
-        throw new Error("GITLAB_READ_ONLY_MODE missing");
-    }
-    if (!("USE_OAUTH" in value) || typeof value.USE_OAUTH !== "boolean") {
-        throw new Error("USE_OAUTH missing");
-    }
-    return {
-        GITLAB_READ_ONLY_MODE: value.GITLAB_READ_ONLY_MODE,
-        USE_OAUTH: value.USE_OAUTH,
-    };
-}
-describe("When nextBooleanFlagValue reads the following token", () => {
-    describe("with a positional command", () => {
-        it("should treat the flag as true and leave the command", () => {
-            assert.deepEqual(nextBooleanFlagValue("mr"), { value: "true", consumeNext: false });
-        });
-    });
-    describe("with an explicit false", () => {
-        it("should consume the literal", () => {
-            assert.deepEqual(nextBooleanFlagValue("false"), { value: "false", consumeNext: true });
-        });
-    });
-    describe("with a missing token", () => {
-        it("should default to true", () => {
-            assert.deepEqual(nextBooleanFlagValue(undefined), { value: "true", consumeNext: false });
-        });
-    });
-});
-describe("When isBooleanFlagLiteral inspects a token", () => {
-    describe("with true", () => {
-        it("should accept it", () => {
-            assert.equal(isBooleanFlagLiteral("true"), true);
-        });
-    });
-    describe("with a command name", () => {
-        it("should reject it", () => {
-            assert.equal(isBooleanFlagLiteral("mr"), false);
-        });
-    });
-});
-describe("When config.ts parses space-separated boolean flags", () => {
-    describe("with --read-only as the last argument", () => {
-        it("should turn read-only mode on", () => {
-            const cfg = loadConfig(["--read-only"]);
-            assert.equal(cfg.GITLAB_READ_ONLY_MODE, true);
-        });
-    });
-    describe("with --read-only followed by another flag", () => {
-        it("should turn read-only mode on", () => {
-            const cfg = loadConfig(["--read-only", "--use-pipeline"]);
-            assert.equal(cfg.GITLAB_READ_ONLY_MODE, true);
-        });
-    });
-    describe("with an empty --read-only= assignment", () => {
-        it("should leave read-only mode off", () => {
-            const cfg = loadConfig(["--read-only="]);
-            assert.equal(cfg.GITLAB_READ_ONLY_MODE, false);
-        });
-    });
-    describe("with --read-only false", () => {
-        it("should keep read-only off", () => {
-            const cfg = loadConfig(["--read-only", "false"]);
-            assert.equal(cfg.GITLAB_READ_ONLY_MODE, false);
-        });
-    });
-    describe("with --read-only before a command", () => {
-        it("should turn read-only on without consuming mr", () => {
-            const cfg = loadConfig(["--read-only", "mr", "list"]);
-            assert.equal(cfg.GITLAB_READ_ONLY_MODE, true);
-        });
-    });
-    describe("with --use-oauth false", () => {
-        it("should keep oauth off", () => {
-            const cfg = loadConfig(["--use-oauth", "false"]);
-            assert.equal(cfg.USE_OAUTH, false);
-        });
-    });
-});