@zereight/mcp-gitlab 2.1.70 → 2.2.1

package/build/test/test-deployment-tools.js

@@ -1,463 +0,0 @@
-import { describe, test, before, after } from "node:test";
-import assert from "node:assert";
-import { spawn } from "child_process";
-import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
-const MOCK_TOKEN = "glpat-mock-token-12345";
-const TEST_PROJECT_ID = "123";
-const TEST_DEPLOYMENT_ID = "777";
-const TEST_ENVIRONMENT_ID = "42";
-const TEST_MERGE_REQUEST_IID = "88";
-const TEST_MERGE_REQUEST_SHA = "merge-sha-6870";
-const TEST_DIVERGED_COMMITS_COUNT = 35;
-const TEST_SOURCE_COMMITS_COUNT = 6;
-const TEST_APPROVER_USERNAME = "sergey.kravchenya";
-const TEST_APPROVER_NAME = "Sergey Kravchenya";
-const mrDeploymentsByCreatedAtAsc = Array.from({ length: 12 }, (_, index) => {
-    const sequence = index + 1;
-    const day = String(sequence).padStart(2, "0");
-    return {
-        id: `mr-deploy-${sequence}`,
-        status: "success",
-        ref: "main",
-        sha: TEST_MERGE_REQUEST_SHA,
-        created_at: `2026-02-${day}T10:00:00.000Z`,
-        updated_at: `2026-02-${day}T10:05:00.000Z`,
-        environment: {
-            id: `mr-env-${sequence}`,
-            name: sequence % 2 === 0 ? "prod" : "stage",
-            external_url: sequence % 2 === 0 ? "https://api.prod.example.com" : "https://api.stage.example.com",
-        },
-        deployable: {
-            id: `mr-job-${sequence}`,
-            name: `Deploy ${sequence}`,
-            status: "success",
-            stage: "deploy",
-            pipeline: {
-                id: `mr-pipeline-${sequence}`,
-                status: "success",
-                ref: "main",
-                sha: TEST_MERGE_REQUEST_SHA,
-            },
-        },
-    };
-});
-const mrDeploymentsUnsorted = [
-    mrDeploymentsByCreatedAtAsc[4],
-    mrDeploymentsByCreatedAtAsc[0],
-    mrDeploymentsByCreatedAtAsc[10],
-    mrDeploymentsByCreatedAtAsc[2],
-    mrDeploymentsByCreatedAtAsc[11],
-    mrDeploymentsByCreatedAtAsc[7],
-    mrDeploymentsByCreatedAtAsc[1],
-    mrDeploymentsByCreatedAtAsc[9],
-    mrDeploymentsByCreatedAtAsc[3],
-    mrDeploymentsByCreatedAtAsc[6],
-    mrDeploymentsByCreatedAtAsc[8],
-    mrDeploymentsByCreatedAtAsc[5],
-];
-async function callTool(toolName, args, env) {
-    return new Promise((resolve, reject) => {
-        const proc = spawn("node", ["build/index.js"], {
-            stdio: ["pipe", "pipe", "pipe"],
-            env: {
-                ...process.env,
-                ...env,
-                GITLAB_READ_ONLY_MODE: env.GITLAB_READ_ONLY_MODE ?? "true",
-                USE_PIPELINE: "true",
-            },
-        });
-        let output = "";
-        let errorOutput = "";
-        proc.stdout?.on("data", (d) => (output += d));
-        proc.stderr?.on("data", (d) => (errorOutput += d));
-        proc.on("close", (code) => {
-            if (code !== 0) {
-                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
-            }
-            const line = output.split("\n").find((l) => l.startsWith("{"));
-            if (!line) {
-                return reject(new Error("No JSON output found"));
-            }
-            try {
-                const response = JSON.parse(line);
-                if (response.error) {
-                    reject(response.error);
-                }
-                else {
-                    const content = response.result?.content?.[0]?.text;
-                    if (content) {
-                        try {
-                            resolve(JSON.parse(content));
-                        }
-                        catch {
-                            resolve(content);
-                        }
-                    }
-                    else {
-                        resolve(response.result);
-                    }
-                }
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        proc.stdin?.end(JSON.stringify({
-            jsonrpc: "2.0",
-            id: 1,
-            method: "tools/call",
-            params: { name: toolName, arguments: args },
-        }) + "\n");
-    });
-}
-describe("deployment and environment tools", () => {
-    let mockGitLab;
-    let mockGitLabUrl;
-    before(async () => {
-        const mockPort = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_TOKEN],
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/deployments`, (req, res) => {
-            const querySha = Array.isArray(req.query.sha) ? req.query.sha[0] : req.query.sha;
-            if (querySha === TEST_MERGE_REQUEST_SHA) {
-                res.json(mrDeploymentsUnsorted);
-                return;
-            }
-            res.json([
-                {
-                    id: TEST_DEPLOYMENT_ID,
-                    status: "success",
-                    ref: "master",
-                    sha: "abc123",
-                    created_at: "2026-02-20T16:27:59.348Z",
-                    updated_at: "2026-02-20T16:32:38.235Z",
-                    environment: { id: TEST_ENVIRONMENT_ID, name: "stage" },
-                    deployable: {
-                        id: "11",
-                        name: "Stage deploy",
-                        status: "success",
-                        stage: "deploy",
-                        pipeline: { id: "190349", status: "success", ref: "master", sha: "abc123" },
-                    },
-                },
-            ]);
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/merge_requests/${TEST_MERGE_REQUEST_IID}`, (req, res) => {
-            res.json({
-                id: TEST_MERGE_REQUEST_IID,
-                iid: TEST_MERGE_REQUEST_IID,
-                project_id: TEST_PROJECT_ID,
-                title: "Deployment summary test MR",
-                description: "MR used by tests to validate deployment summary enrichment",
-                state: "merged",
-                author: {
-                    id: "1",
-                    username: "test-user",
-                    name: "Test User",
-                },
-                source_branch: "feature/deploy-summary",
-                target_branch: "main",
-                web_url: "https://gitlab.mock/project/123/merge_requests/88",
-                created_at: "2026-02-01T10:00:00.000Z",
-                updated_at: "2026-02-20T11:00:00.000Z",
-                merged_at: "2026-02-20T11:05:00.000Z",
-                closed_at: null,
-                merge_commit_sha: TEST_MERGE_REQUEST_SHA,
-                diverged_commits_count: TEST_DIVERGED_COMMITS_COUNT,
-                rebase_in_progress: false,
-            });
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/merge_requests/${TEST_MERGE_REQUEST_IID}/commits`, (req, res) => {
-            const page = Number.parseInt((Array.isArray(req.query.page) ? req.query.page[0] : req.query.page)?.toString() ?? "1", 10);
-            if (page > 1) {
-                res.set("x-next-page", "");
-                res.json([]);
-                return;
-            }
-            res.set("x-next-page", "");
-            res.json(Array.from({ length: TEST_SOURCE_COMMITS_COUNT }, (_, index) => ({
-                id: `commit-${index + 1}`,
-                short_id: `${index + 1}`,
-                title: `Commit ${index + 1}`,
-                author_name: "Test Author",
-                author_email: "author@example.com",
-                authored_date: "2026-02-20T10:00:00.000Z",
-                committer_name: "Test Committer",
-                committer_email: "committer@example.com",
-                committed_date: "2026-02-20T10:00:00.000Z",
-                web_url: `https://gitlab.mock/project/123/-/commit/${index + 1}`,
-                parent_ids: [],
-            })));
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/merge_requests/${TEST_MERGE_REQUEST_IID}/approval_state`, (_req, res) => {
-            res.json({
-                approval_rules_overwritten: false,
-                rules: [
-                    {
-                        id: "101",
-                        name: "Default rule",
-                        rule_type: "regular",
-                        approvals_required: 1,
-                        approved: true,
-                        approved_by: [
-                            {
-                                id: "35",
-                                username: TEST_APPROVER_USERNAME,
-                                name: TEST_APPROVER_NAME,
-                                state: "active",
-                                avatar_url: "https://gitlab.mock/uploads/avatar.png",
-                                web_url: "https://gitlab.mock/sergey.kravchenya",
-                            },
-                        ],
-                    },
-                ],
-            });
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}`, (req, res) => {
-            res.json({
-                id: TEST_PROJECT_ID,
-                path_with_namespace: "test-group/test-project",
-                merge_method: "merge",
-            });
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/deployments/${TEST_DEPLOYMENT_ID}`, (req, res) => {
-            res.json({
-                id: TEST_DEPLOYMENT_ID,
-                status: "success",
-                ref: "master",
-                sha: "abc123",
-                created_at: "2026-02-20T16:27:59.348Z",
-                updated_at: "2026-02-20T16:32:38.235Z",
-                environment: { id: TEST_ENVIRONMENT_ID, name: "stage" },
-                deployable: {
-                    id: "11",
-                    name: "Stage deploy",
-                    status: "success",
-                    stage: "deploy",
-                    pipeline: { id: "190349", status: "success", ref: "master", sha: "abc123" },
-                },
-                pending_approval_count: 1,
-                approvals: [
-                    {
-                        user: {
-                            id: "100",
-                            username: "security-user-1",
-                            name: "Security User",
-                            state: "active",
-                            web_url: "https://gitlab.example.com/security-user-1",
-                        },
-                        status: "approved",
-                        created_at: "2026-02-20T16:33:00.000Z",
-                        comment: "Looks good to me",
-                    },
-                ],
-                approval_summary: {
-                    rules: [
-                        {
-                            group_id: "134",
-                            access_level: null,
-                            access_level_description: "security-group",
-                            required_approvals: 2,
-                            deployment_approvals: [
-                                {
-                                    user: {
-                                        id: "100",
-                                        username: "security-user-1",
-                                        name: "Security User",
-                                        state: "active",
-                                        web_url: "https://gitlab.example.com/security-user-1",
-                                    },
-                                    status: "approved",
-                                    created_at: "2026-02-20T16:33:00.000Z",
-                                    comment: "Looks good to me",
-                                },
-                            ],
-                        },
-                    ],
-                },
-            });
-        });
-        mockGitLab.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/deployments`, (_req, res) => {
-            res.status(201).json({ id: "created-deployment", status: "created" });
-        });
-        mockGitLab.addMockHandler("put", `/projects/${TEST_PROJECT_ID}/deployments/${TEST_DEPLOYMENT_ID}`, (_req, res) => {
-            res.json({ id: TEST_DEPLOYMENT_ID, status: "success" });
-        });
-        mockGitLab.addMockHandler("delete", `/projects/${TEST_PROJECT_ID}/deployments/${TEST_DEPLOYMENT_ID}`, (_req, res) => {
-            res.status(204).send();
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/deployments/${TEST_DEPLOYMENT_ID}/merge_requests`, (_req, res) => {
-            res.json([{ iid: TEST_MERGE_REQUEST_IID, title: "Shipped change" }]);
-        });
-        mockGitLab.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/deployments/${TEST_DEPLOYMENT_ID}/approval`, (_req, res) => {
-            res.json({ id: TEST_DEPLOYMENT_ID, status: "approved" });
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/environments`, (req, res) => {
-            res.json([
-                {
-                    id: TEST_ENVIRONMENT_ID,
-                    name: "stage",
-                    slug: "stage",
-                    state: "available",
-                    external_url: "https://api.stage.example.com",
-                    last_deployment: {
-                        id: TEST_DEPLOYMENT_ID,
-                        status: "success",
-                        ref: "master",
-                        sha: "abc123",
-                        created_at: "2026-02-20T16:27:59.348Z",
-                    },
-                },
-            ]);
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/environments/${TEST_ENVIRONMENT_ID}`, (req, res) => {
-            res.json({
-                id: TEST_ENVIRONMENT_ID,
-                name: "stage",
-                slug: "stage",
-                state: "available",
-                external_url: "https://api.stage.example.com",
-                last_deployment: {
-                    id: TEST_DEPLOYMENT_ID,
-                    status: "success",
-                    ref: "master",
-                    sha: "abc123",
-                    created_at: "2026-02-20T16:27:59.348Z",
-                },
-            });
-        });
-        await mockGitLab.start();
-        mockGitLabUrl = mockGitLab.getUrl();
-    });
-    after(async () => {
-        await mockGitLab.stop();
-    });
-    test("list_deployments returns deployment list", async () => {
-        const result = await callTool("list_deployments", { project_id: TEST_PROJECT_ID, environment: "stage" }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        });
-        assert.ok(Array.isArray(result), "Response should be an array");
-        assert.strictEqual(result.length, 1, "Should return one deployment");
-        assert.strictEqual(result[0].id, TEST_DEPLOYMENT_ID);
-        assert.strictEqual(result[0].environment.name, "stage");
-    });
-    test("get_deployment returns one deployment", async () => {
-        const result = await callTool("get_deployment", { project_id: TEST_PROJECT_ID, deployment_id: TEST_DEPLOYMENT_ID }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        });
-        assert.strictEqual(result.id, TEST_DEPLOYMENT_ID);
-        assert.strictEqual(result.ref, "master");
-        assert.strictEqual(result.status, "success");
-        assert.strictEqual(result.pending_approval_count, 1);
-        assert.strictEqual(result.approvals[0].status, "approved");
-        assert.strictEqual(result.approvals[0].user.username, "security-user-1");
-        assert.strictEqual(result.approval_summary.rules[0].group_id, "134");
-        assert.strictEqual(result.approval_summary.rules[0].deployment_approvals[0].comment, "Looks good to me");
-    });
-    test("supports deployment lifecycle and approval operations", async () => {
-        const env = {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-            GITLAB_READ_ONLY_MODE: "false",
-        };
-        const created = await callTool("create_deployment", {
-            project_id: TEST_PROJECT_ID,
-            environment: "stage",
-            sha: "abc123",
-            ref: "master",
-            tag: false,
-            status: "running",
-        }, env);
-        assert.strictEqual(created.id, "created-deployment");
-        const updated = await callTool("update_deployment", { project_id: TEST_PROJECT_ID, deployment_id: TEST_DEPLOYMENT_ID, status: "success" }, env);
-        assert.strictEqual(updated.status, "success");
-        const mergeRequests = await callTool("list_deployment_merge_requests", { project_id: TEST_PROJECT_ID, deployment_id: TEST_DEPLOYMENT_ID }, env);
-        assert.strictEqual(mergeRequests[0].iid, TEST_MERGE_REQUEST_IID);
-        const approval = await callTool("approve_deployment", { project_id: TEST_PROJECT_ID, deployment_id: TEST_DEPLOYMENT_ID, status: "approved" }, env);
-        assert.strictEqual(approval.status, "approved");
-        const deleted = await callTool("delete_deployment", { project_id: TEST_PROJECT_ID, deployment_id: TEST_DEPLOYMENT_ID }, env);
-        assert.deepStrictEqual(deleted, { success: true });
-    });
-    test("list_environments returns environment list", async () => {
-        const result = await callTool("list_environments", { project_id: TEST_PROJECT_ID }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        });
-        assert.ok(Array.isArray(result), "Response should be an array");
-        assert.strictEqual(result.length, 1, "Should return one environment");
-        assert.strictEqual(result[0].id, TEST_ENVIRONMENT_ID);
-        assert.strictEqual(result[0].name, "stage");
-    });
-    test("get_environment returns one environment", async () => {
-        const result = await callTool("get_environment", { project_id: TEST_PROJECT_ID, environment_id: TEST_ENVIRONMENT_ID }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        });
-        assert.strictEqual(result.id, TEST_ENVIRONMENT_ID);
-        assert.strictEqual(result.name, "stage");
-        assert.strictEqual(result.state, "available");
-    });
-    test("get_merge_request omits summaries by default", async () => {
-        const result = await callTool("get_merge_request", { project_id: TEST_PROJECT_ID, merge_request_iid: TEST_MERGE_REQUEST_IID }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        });
-        assert.strictEqual(result.iid, TEST_MERGE_REQUEST_IID);
-        assert.strictEqual(result.deployment_summary, undefined, "deployment_summary should be omitted by default");
-        assert.strictEqual(result.commit_addition_summary, undefined, "commit_addition_summary should be omitted by default");
-        assert.strictEqual(result.approval_summary, undefined, "approval_summary should be omitted by default");
-    });
-    test("get_merge_request returns compact deployment summary sorted by created_at desc", async () => {
-        const result = await callTool("get_merge_request", {
-            project_id: TEST_PROJECT_ID,
-            merge_request_iid: TEST_MERGE_REQUEST_IID,
-            include_summaries: true,
-        }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        });
-        assert.ok(result.deployment_summary, "deployment_summary should be present");
-        assert.strictEqual(result.diverged_commits_count, TEST_DIVERGED_COMMITS_COUNT, "diverged_commits_count should be requested and returned by default");
-        assert.strictEqual(result.deployment_summary.lookup_sha, TEST_MERGE_REQUEST_SHA);
-        assert.ok(result.commit_addition_summary, "commit_addition_summary should be present");
-        assert.strictEqual(result.commit_addition_summary.source_commits_count, TEST_SOURCE_COMMITS_COUNT);
-        assert.strictEqual(result.commit_addition_summary.merge_method, "merge");
-        assert.strictEqual(result.commit_addition_summary.merge_commit_count, 1);
-        assert.strictEqual(result.commit_addition_summary.summary, "6 commits and 1 merge commit will be added to main.");
-        assert.ok(result.approval_summary, "approval_summary should be present");
-        assert.strictEqual(result.approval_summary.source_endpoint, "approval_state");
-        assert.strictEqual(result.approval_summary.approved, true);
-        assert.deepStrictEqual(result.approval_summary.approved_by_usernames, [TEST_APPROVER_USERNAME]);
-        assert.strictEqual(result.approval_summary.approved_by.length, 1);
-        assert.strictEqual(result.approval_summary.approved_by[0].name, TEST_APPROVER_NAME);
-        assert.strictEqual(result.deployment_summary.sort, "created_at_desc");
-        assert.strictEqual(result.deployment_summary.limit, 10);
-        assert.strictEqual(result.deployment_summary.total_count, 12);
-        assert.strictEqual(result.deployment_summary.returned_count, 10);
-        assert.ok(Array.isArray(result.deployment_summary.records), "records should be an array");
-        assert.strictEqual(result.deployment_summary.records.length, 10);
-        assert.ok(result.deployment_summary.records.every((record) => record.sha === TEST_MERGE_REQUEST_SHA), "all summary records should match MR sha");
-        for (let i = 1; i < result.deployment_summary.records.length; i++) {
-            const previousCreatedAt = Date.parse(result.deployment_summary.records[i - 1].created_at);
-            const currentCreatedAt = Date.parse(result.deployment_summary.records[i].created_at);
-            assert.ok(previousCreatedAt >= currentCreatedAt, "records should be sorted by created_at descending");
-        }
-        assert.strictEqual(result.deployment_summary.records[0].id, "mr-deploy-12", "latest deployment should be first");
-        assert.ok(!result.deployment_summary.records.some((record) => record.id === "mr-deploy-1"), "oldest deployment should be truncated");
-        assert.ok(!result.deployment_summary.records.some((record) => record.id === "mr-deploy-2"), "second oldest deployment should be truncated");
-    });
-    test("get_merge_request always requests diverged_commits_count", async () => {
-        const result = await callTool("get_merge_request", {
-            project_id: TEST_PROJECT_ID,
-            merge_request_iid: TEST_MERGE_REQUEST_IID,
-        }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        });
-        assert.strictEqual(result.diverged_commits_count, TEST_DIVERGED_COMMITS_COUNT, "diverged_commits_count should always be included in get_merge_request response");
-    });
-});

package/build/test/test-download-attachment.js

@@ -1,190 +0,0 @@
-import { describe, test, before, after } from 'node:test';
-import assert from 'node:assert';
-import { spawn } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
-const MOCK_TOKEN = 'glpat-mock-token-12345';
-const TEST_PROJECT_ID = '123';
-const TEST_SECRET = 'testsecret123';
-// Minimum valid 1x1 transparent PNG
-const MINIMAL_PNG_BUF = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==', 'base64');
-// Unique suffix per test run to avoid conflicts on concurrent executions
-const RUN_ID = Math.random().toString(36).slice(2, 8);
-/**
- * Spawn build/index.js, send a single download_attachment JSON-RPC call, and
- * return the raw parsed JSON-RPC response (either {result:...} or {error:...}).
- */
-function callDownloadAttachment(args, env, timeoutMs = 15_000) {
-    return new Promise((resolve, reject) => {
-        const proc = spawn('node', ['build/index.js'], {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            env: { ...process.env, ...env, GITLAB_READ_ONLY_MODE: 'true' },
-        });
-        const timer = setTimeout(() => {
-            proc.kill();
-            reject(new Error(`Process timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
-        let stdout = '';
-        let stderr = '';
-        proc.stdout?.on('data', (d) => (stdout += d.toString()));
-        proc.stderr?.on('data', (d) => (stderr += d.toString()));
-        proc.on('error', (err) => {
-            clearTimeout(timer);
-            reject(new Error(`Failed to spawn process: ${err.message}`));
-        });
-        proc.on('close', () => {
-            clearTimeout(timer);
-            // Find the JSON-RPC response line matching our request id
-            const lines = stdout.split('\n').filter(l => l.trim().startsWith('{'));
-            for (const line of lines) {
-                try {
-                    const parsed = JSON.parse(line);
-                    if (parsed.id === 1) {
-                        resolve(parsed);
-                        return;
-                    }
-                }
-                catch { /* try next line */ }
-            }
-            reject(new Error(`No matching JSON-RPC response found.\nstderr: ${stderr}`));
-        });
-        proc.stdin?.end(JSON.stringify({
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'tools/call',
-            params: { name: 'download_attachment', arguments: args },
-        }) + '\n');
-    });
-}
-describe('download_attachment', () => {
-    let mockGitLab;
-    let env;
-    before(async () => {
-        const port = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({ port, validTokens: [MOCK_TOKEN] });
-        await mockGitLab.start();
-        env = {
-            GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        };
-        // PNG upload endpoint
-        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/image.png`, (_req, res) => { res.set('Content-Type', 'image/png').send(MINIMAL_PNG_BUF); });
-        // Plain-text upload endpoint
-        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/document.txt`, (_req, res) => { res.set('Content-Type', 'text/plain').send('hello world'); });
-        // GitLab redirects uploads to its object storage, so the hop after this response
-        // leaves the origin. The destination is a non-public address here.
-        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/redirected.txt`, (_req, res) => { res.redirect('http://169.254.169.254/latest/meta-data/'); });
-    });
-    after(async () => {
-        await mockGitLab.stop();
-    });
-    test('image file without local_path returns base64 image content block', async () => {
-        const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'image.png' }, env);
-        const content = raw.result?.content;
-        assert.ok(Array.isArray(content), 'result.content should be an array');
-        const imageBlock = content.find(c => c.type === 'image');
-        assert.ok(imageBlock, 'Should contain an image content block');
-        assert.strictEqual(imageBlock.mimeType, 'image/png', 'mimeType should be image/png');
-        assert.ok(typeof imageBlock.data === 'string' && imageBlock.data.length > 0, 'Image block should have non-empty base64 data');
-    });
-    test('non-image file is saved to disk and returns file_path', async () => {
-        const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'document.txt' }, env);
-        const text = raw.result?.content?.[0]?.text;
-        assert.ok(text, 'Should have text content');
-        const parsed = JSON.parse(text);
-        try {
-            assert.strictEqual(parsed.success, true, 'success should be true');
-            assert.ok(typeof parsed.file_path === 'string', 'file_path should be a string');
-            assert.ok(parsed.file_path.endsWith('document.txt'), 'file_path should end with document.txt');
-        }
-        finally {
-            if (parsed.file_path && fs.existsSync(parsed.file_path)) {
-                fs.unlinkSync(parsed.file_path);
-            }
-        }
-    });
-    test('image file with local_path is saved to disk and returns file_path', async () => {
-        // Must be a relative path – the implementation rejects absolute paths as traversal
-        const localPath = `omc-test-save-${RUN_ID}`;
-        try {
-            const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'image.png', local_path: localPath }, env);
-            const text = raw.result?.content?.[0]?.text;
-            assert.ok(text, 'Should have text content');
-            const parsed = JSON.parse(text);
-            assert.strictEqual(parsed.success, true, 'success should be true');
-            assert.ok(typeof parsed.file_path === 'string', 'file_path should be a string');
-            assert.ok(parsed.file_path.includes('image.png'), 'file_path should include image.png');
-        }
-        finally {
-            fs.rmSync(localPath, { recursive: true, force: true });
-        }
-    });
-    test('local_path with ".." returns path traversal error', async () => {
-        const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'image.png', local_path: '../../../tmp' }, env);
-        // MCP SDK may return a JSON-RPC error or an isError content block; both must mention "traversal"
-        const isRpcError = typeof raw.error?.message === 'string' &&
-            raw.error.message.toLowerCase().includes('traversal');
-        const isContentError = Array.isArray(raw.result?.content) &&
-            raw.result.content.some(c => typeof c.text === 'string' && c.text.toLowerCase().includes('traversal'));
-        assert.ok(isRpcError || isContentError, 'Should return an error mentioning directory traversal');
-    });
-    test('a redirect to a non-public address is refused', async () => {
-        const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'redirected.txt' }, env);
-        const mentionsRefusal = (text) => text.toLowerCase().includes('non-public address');
-        const isRpcError = typeof raw.error?.message === 'string' && mentionsRefusal(raw.error.message);
-        const isContentError = Array.isArray(raw.result?.content) &&
-            raw.result.content.some(c => typeof c.text === 'string' && mentionsRefusal(c.text));
-        assert.ok(isRpcError || isContentError, `Should refuse the redirect instead of following it, got ${JSON.stringify(raw)}`);
-    });
-    test('local_path through a symlink directory is rejected', async () => {
-        const linkDir = `omc-test-symlink-${RUN_ID}`;
-        fs.rmSync(linkDir, { recursive: true, force: true });
-        fs.symlinkSync(os.tmpdir(), linkDir);
-        try {
-            const raw = await callDownloadAttachment({
-                project_id: TEST_PROJECT_ID,
-                secret: TEST_SECRET,
-                filename: 'image.png',
-                local_path: linkDir,
-            }, env);
-            const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
-                (Array.isArray(raw.result?.content)
-                    ? raw.result.content.map(c => c.text || '').join(' ')
-                    : '');
-            const lower = msg.toLowerCase();
-            assert.ok(lower.includes('symbolic') ||
-                lower.includes('symlink') ||
-                lower.includes('escapes') ||
-                lower.includes('traversal') ||
-                lower.includes('invalid'), `Expected symlink rejection, got: ${msg}`);
-        }
-        finally {
-            fs.rmSync(linkDir, { recursive: true, force: true });
-        }
-    });
-    test('filename with directory traversal is rejected before writing to disk', async () => {
-        const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'image.png#../../owned.txt' }, env);
-        const isRpcError = typeof raw.error?.message === 'string' &&
-            raw.error.message.toLowerCase().includes('filename');
-        const isContentError = Array.isArray(raw.result?.content) &&
-            raw.result.content.some(c => typeof c.text === 'string' && c.text.toLowerCase().includes('filename'));
-        assert.ok(isRpcError || isContentError, 'Should return an error mentioning filename validation');
-    });
-    test('non-existent local_path directory is auto-created before saving', async () => {
-        const baseDir = `omc-test-newdir-${RUN_ID}`;
-        const localPath = `${baseDir}/subdir`;
-        fs.rmSync(baseDir, { recursive: true, force: true });
-        try {
-            const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'document.txt', local_path: localPath }, env);
-            const text = raw.result?.content?.[0]?.text;
-            assert.ok(text, 'Should have text content');
-            const parsed = JSON.parse(text);
-            assert.strictEqual(parsed.success, true, 'success should be true');
-            assert.ok(fs.existsSync(parsed.file_path), 'Saved file should exist on disk');
-        }
-        finally {
-            fs.rmSync(baseDir, { recursive: true, force: true });
-        }
-    });
-});