@zereight/mcp-gitlab 2.1.70 → 2.2.1

package/build/test/cli/compact-mcp-result.test.js

@@ -1,93 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { compactMcpToolResult } from "../../cli/compact-mcp-result.js";
-function textResult(text) {
-    return { content: [{ type: "text", text }] };
-}
-describe("When compactMcpToolResult wraps an MCP tool reply", () => {
-    describe("with compact mode disabled", () => {
-        it("should return the original result", () => {
-            const result = textResult("[]");
-            const compacted = compactMcpToolResult({
-                result,
-                enabled: false,
-                maxChars: 1,
-                toolName: "list_issues",
-                args: { project_id: "1" },
-            });
-            assert.equal(compacted, result);
-        });
-    });
-    describe("with a small payload", () => {
-        it("should leave the result alone", () => {
-            const result = textResult('{"iid":1}');
-            const compacted = compactMcpToolResult({
-                result,
-                enabled: true,
-                maxChars: 4000,
-                toolName: "get_issue",
-                args: { project_id: "1", issue_iid: 1 },
-            });
-            assert.equal(compacted, result);
-        });
-    });
-    describe("with a long issue list", () => {
-        it("should keep a preview and a CLI replay command", () => {
-            const issues = Array.from({ length: 20 }, (_, index) => ({ iid: index + 1, title: "x".repeat(80) }));
-            const compacted = compactMcpToolResult({
-                result: textResult(JSON.stringify(issues)),
-                enabled: true,
-                maxChars: 200,
-                toolName: "list_issues",
-                args: { project_id: "123", state: "opened" },
-            });
-            assert.ok(isRecord(compacted));
-            assert.equal(Object.prototype.hasOwnProperty.call(compacted, "structuredContent"), false);
-            const content = compacted.content;
-            assert.ok(Array.isArray(content));
-            const block = content[0];
-            assert.ok(isRecord(block) && typeof block.text === "string");
-            const payload = JSON.parse(block.text);
-            assert.ok(isRecord(payload));
-            assert.equal(payload.compact, true);
-            assert.equal(payload.tool, "list_issues");
-            assert.equal(payload.items_total, 20);
-            assert.ok(Array.isArray(payload.preview));
-            assert.equal(payload.preview.length, 5);
-            assert.equal(payload.cli, "zereight-mcp-gitlab tool list_issues --project-id 123 --state opened");
-        });
-    });
-    describe("with structuredContent on a large payload", () => {
-        it("should drop structuredContent so the full object cannot leak", () => {
-            const issues = Array.from({ length: 20 }, (_, index) => ({ iid: index + 1, title: "x".repeat(80) }));
-            const compacted = compactMcpToolResult({
-                result: {
-                    content: [{ type: "text", text: JSON.stringify(issues) }],
-                    structuredContent: issues,
-                },
-                enabled: true,
-                maxChars: 200,
-                toolName: "list_issues",
-                args: { project_id: "1" },
-            });
-            assert.ok(isRecord(compacted));
-            assert.equal(Object.prototype.hasOwnProperty.call(compacted, "structuredContent"), false);
-        });
-    });
-    describe("with an error result", () => {
-        it("should not compact", () => {
-            const result = { content: [{ type: "text", text: "boom".repeat(500) }], isError: true };
-            const compacted = compactMcpToolResult({
-                result,
-                enabled: true,
-                maxChars: 10,
-                toolName: "list_issues",
-                args: {},
-            });
-            assert.equal(compacted, result);
-        });
-    });
-});
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}

package/build/test/cli/credentials.test.js

@@ -1,153 +0,0 @@
-import assert from "node:assert/strict";
-import { spawn } from "node:child_process";
-import * as fs from "node:fs";
-import * as http from "node:http";
-import * as os from "node:os";
-import * as path from "node:path";
-import * as url from "node:url";
-import { describe, it } from "node:test";
-const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
-const CLI_ENTRY = path.resolve(__dirname, "../../build/index.js");
-const CLI_TIMEOUT_MS = 30_000;
-const MR_FIXTURE = {
-    id: 1,
-    iid: 1,
-    project_id: 7,
-    title: "Hello MR",
-    description: "d",
-    state: "opened",
-    web_url: "http://example.test/mr/1",
-    source_branch: "feature",
-    target_branch: "main",
-    author: { id: 1, username: "u", name: "U", state: "active", avatar_url: null, web_url: "http://example.test/u" },
-    created_at: "2026-01-01T00:00:00Z",
-    updated_at: "2026-01-01T00:00:00Z",
-    merged_at: null,
-    closed_at: null,
-    merge_commit_sha: null,
-};
-function buildCleanEnv(extra) {
-    const env = {};
-    for (const [key, value] of Object.entries(process.env)) {
-        if (value !== undefined && !key.startsWith("GITLAB_")) {
-            env[key] = value;
-        }
-    }
-    return { ...env, ...extra };
-}
-function startFakeGitLabAsync(onRequest) {
-    const server = http.createServer((req, res) => {
-        onRequest(req.headers.authorization);
-        res.setHeader("content-type", "application/json");
-        res.end(JSON.stringify(MR_FIXTURE));
-    });
-    return new Promise(resolve => server.listen(0, "127.0.0.1", () => resolve(server)));
-}
-function getPort(server) {
-    const address = server.address();
-    if (address === null || typeof address === "string") {
-        throw new Error("fake GitLab server is not listening on a TCP port");
-    }
-    return address.port;
-}
-function runCliAsync(env) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(process.execPath, [CLI_ENTRY, "mr", "view", "--project-id", "g/p", "--mr-iid", "1"], {
-            env,
-            stdio: ["ignore", "pipe", "pipe"],
-            timeout: CLI_TIMEOUT_MS,
-            killSignal: "SIGKILL",
-        });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.on("data", chunk => {
-            stdout += String(chunk);
-        });
-        child.stderr.on("data", chunk => {
-            stderr += String(chunk);
-        });
-        child.on("error", reject);
-        child.on("close", exitCode => resolve({ exitCode, stdout, stderr }));
-    });
-}
-function buildOAuthEnv(apiUrl, tmpDir) {
-    const tokenPath = path.join(tmpDir, "token.json");
-    fs.writeFileSync(tokenPath, JSON.stringify({
-        access_token: "oauth-cli-test",
-        refresh_token: "refresh",
-        expires_in: 7200,
-        created_at: Date.now(),
-        token_type: "Bearer",
-    }));
-    return {
-        GITLAB_API_URL: apiUrl,
-        GITLAB_USE_OAUTH: "true",
-        GITLAB_OAUTH_CLIENT_ID: "client-id",
-        GITLAB_OAUTH_TOKEN_PATH: tokenPath,
-    };
-}
-async function runMrViewAgainstFakeGitLabAsync(buildEnv) {
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-cli-credentials-"));
-    let authorization;
-    const server = await startFakeGitLabAsync(value => {
-        authorization = value;
-    });
-    try {
-        const apiUrl = `http://127.0.0.1:${getPort(server)}/api/v4`;
-        const result = await runCliAsync(buildCleanEnv(buildEnv(apiUrl, tmpDir)));
-        return { ...result, authorization };
-    }
-    finally {
-        server.close();
-        fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-}
-describe("When the human CLI runs without an MCP client", () => {
-    describe("with a personal access token in the environment", () => {
-        it("should send the token as a bearer credential", async () => {
-            const run = await runMrViewAgainstFakeGitLabAsync(apiUrl => ({
-                GITLAB_API_URL: apiUrl,
-                GITLAB_PERSONAL_ACCESS_TOKEN: "glpat-cli-test",
-            }));
-            assert.equal(run.exitCode, 0);
-            assert.equal(run.authorization, "Bearer glpat-cli-test");
-        });
-    });
-    describe("with an OAuth token stored by the auth command", () => {
-        it("should send the stored token as a bearer credential", async () => {
-            const run = await runMrViewAgainstFakeGitLabAsync(buildOAuthEnv);
-            assert.equal(run.exitCode, 0);
-            assert.equal(run.authorization, "Bearer oauth-cli-test");
-        });
-    });
-    describe("with an OAuth token and GITLAB_IS_OLD enabled", () => {
-        it("should still send the token as a bearer credential", async () => {
-            const run = await runMrViewAgainstFakeGitLabAsync((apiUrl, tmpDir) => ({
-                ...buildOAuthEnv(apiUrl, tmpDir),
-                GITLAB_IS_OLD: "true",
-            }));
-            assert.equal(run.exitCode, 0);
-            assert.equal(run.authorization, "Bearer oauth-cli-test");
-        });
-    });
-    describe("with OAuth enabled against a cleartext remote URL", () => {
-        it("should refuse to run before any network call", async () => {
-            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-cli-credentials-"));
-            try {
-                const result = await runCliAsync(buildCleanEnv(buildOAuthEnv("http://gitlab.example.invalid/api/v4", tmpDir)));
-                assert.equal(result.exitCode, 1);
-                assert.match(result.stderr, /cleartext HTTP/);
-            }
-            finally {
-                fs.rmSync(tmpDir, { recursive: true, force: true });
-            }
-        });
-    });
-    describe("with no credentials at all", () => {
-        it("should exit with a usage error before any network call", async () => {
-            const run = await runMrViewAgainstFakeGitLabAsync(apiUrl => ({ GITLAB_API_URL: apiUrl }));
-            assert.equal(run.exitCode, 2);
-            assert.equal(run.authorization, undefined);
-        });
-    });
-});

package/build/test/cli/exposure.test.js

@@ -1,104 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { exposureRefusalMessage, isToolExposed, parseToolNameSet } from "../../cli/exposure.js";
-import { compileDeniedToolsRegex } from "../../tools/denied-regex.js";
-import { parseEnabledToolsets } from "../../tools/registry.js";
-const ISSUES = parseEnabledToolsets("issues");
-const EMPTY = new Set();
-function exposure(overrides) {
-    return {
-        toolName: overrides.toolName,
-        enabledToolsets: overrides.enabledToolsets ?? ISSUES,
-        individuallyEnabledTools: overrides.individuallyEnabledTools ?? EMPTY,
-        featureFlagOverrides: overrides.featureFlagOverrides ?? EMPTY,
-        deniedRegex: overrides.deniedRegex,
-        hiddenTools: overrides.hiddenTools ?? EMPTY,
-    };
-}
-describe("When isToolExposed applies MCP filters", () => {
-    describe("with a tool in the enabled toolset", () => {
-        it("should expose list_issues", () => {
-            assert.equal(isToolExposed(exposure({ toolName: "list_issues" })), true);
-        });
-    });
-    describe("with a tool outside the enabled toolsets", () => {
-        it("should hide list_pipelines", () => {
-            assert.equal(isToolExposed(exposure({ toolName: "list_pipelines" })), false);
-        });
-    });
-    describe("with GITLAB_TOOLS", () => {
-        it("should expose an individually enabled tool", () => {
-            assert.equal(isToolExposed(exposure({
-                toolName: "list_pipelines",
-                individuallyEnabledTools: new Set(["list_pipelines"]),
-            })), true);
-        });
-    });
-    describe("with a legacy feature-flag override", () => {
-        it("should expose the overridden wiki tool", () => {
-            assert.equal(isToolExposed(exposure({
-                toolName: "list_wiki_pages",
-                featureFlagOverrides: new Set(["list_wiki_pages"]),
-            })), true);
-        });
-    });
-    describe("with GITLAB_DENIED_TOOLS_REGEX", () => {
-        it("should hide a matching tool even when the toolset is enabled", () => {
-            assert.equal(isToolExposed(exposure({
-                toolName: "list_issues",
-                deniedRegex: /^list_/,
-            })), false);
-        });
-    });
-    describe("with GITLAB_TOOL_POLICY_HIDDEN", () => {
-        it("should hide the named tool", () => {
-            assert.equal(isToolExposed(exposure({
-                toolName: "list_issues",
-                hiddenTools: new Set(["list_issues"]),
-            })), false);
-        });
-    });
-});
-describe("When exposureRefusalMessage explains a block", () => {
-    describe("with a hidden tool", () => {
-        it("should mention GITLAB_TOOL_POLICY_HIDDEN", () => {
-            const message = exposureRefusalMessage(exposure({ toolName: "list_issues", hiddenTools: new Set(["list_issues"]) }));
-            assert.match(String(message), /GITLAB_TOOL_POLICY_HIDDEN/);
-        });
-    });
-    describe("with a denied regex", () => {
-        it("should mention GITLAB_DENIED_TOOLS_REGEX", () => {
-            const message = exposureRefusalMessage(exposure({ toolName: "list_issues", deniedRegex: /^list_/ }));
-            assert.match(String(message), /GITLAB_DENIED_TOOLS_REGEX/);
-        });
-    });
-    describe("with a toolset miss", () => {
-        it("should mention GITLAB_TOOLSETS", () => {
-            const message = exposureRefusalMessage(exposure({ toolName: "list_pipelines" }));
-            assert.match(String(message), /GITLAB_TOOLSETS/);
-        });
-    });
-});
-describe("When parseToolNameSet reads a policy list", () => {
-    describe("with comma-separated names", () => {
-        it("should trim and drop empties", () => {
-            assert.deepEqual([...parseToolNameSet(" push_files, delete_issue , ")], ["push_files", "delete_issue"]);
-        });
-    });
-});
-describe("When compileDeniedToolsRegex validates a pattern", () => {
-    describe("with nested quantifiers", () => {
-        it("should ignore the pattern", () => {
-            const compiled = compileDeniedToolsRegex("(a+)+");
-            assert.equal(compiled.regex, undefined);
-            assert.match(String(compiled.error), /nested quantifiers/);
-        });
-    });
-    describe("with invalid characters", () => {
-        it("should reject unsafe characters", () => {
-            const compiled = compileDeniedToolsRegex("create_; rm -rf /");
-            assert.equal(compiled.regex, undefined);
-            assert.match(String(compiled.error), /invalid characters/);
-        });
-    });
-});

package/build/test/cli/load-config-snapshot.js

@@ -1,5 +0,0 @@
-import { GITLAB_READ_ONLY_MODE, USE_OAUTH } from "../../config.js";
-process.stdout.write(JSON.stringify({
-    GITLAB_READ_ONLY_MODE,
-    USE_OAUTH,
-}));

package/build/test/cli/output.test.js

@@ -1,74 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { formatCliError, formatToolOutput } from "../../cli/output.js";
-describe("When formatToolOutput prints a tool result", () => {
-    describe("with json mode", () => {
-        it("should write the unwrapped payload as JSON", () => {
-            const formatted = formatToolOutput({
-                result: { content: [{ type: "text", text: JSON.stringify({ id: 1, username: "tao" }) }] },
-                mode: "json",
-                tableSpec: undefined,
-            });
-            assert.equal(formatted.stdout, "{\"id\":1,\"username\":\"tao\"}\n");
-            assert.equal(formatted.stderr, "");
-            assert.equal(formatted.isError, false);
-        });
-    });
-    describe("with table mode for a list", () => {
-        it("should print iid state title columns", () => {
-            const formatted = formatToolOutput({
-                result: {
-                    content: [
-                        {
-                            type: "text",
-                            text: JSON.stringify([
-                                { iid: 45, state: "opened", title: "fix: pipeline retry race" },
-                                { iid: 44, state: "opened", title: "chore: bump deps" },
-                            ]),
-                        },
-                    ],
-                },
-                mode: "table",
-                tableSpec: { kind: "list", columns: ["iid", "state", "title"] },
-            });
-            assert.match(formatted.stdout, /IID\s+STATE\s+TITLE/);
-            assert.match(formatted.stdout, /45\s+opened\s+fix: pipeline retry race/);
-            assert.equal(formatted.stderr, "");
-        });
-    });
-    describe("with a non-text content block first", () => {
-        it("should unwrap the first text payload", () => {
-            const formatted = formatToolOutput({
-                result: {
-                    content: [
-                        { type: "image", data: "xxx" },
-                        { type: "text", text: JSON.stringify({ id: 2 }) },
-                    ],
-                },
-                mode: "json",
-                tableSpec: undefined,
-            });
-            assert.equal(formatted.stdout, "{\"id\":2}\n");
-        });
-    });
-    describe("with an API-style error object", () => {
-        it("should mark the result as an error", () => {
-            const formatted = formatToolOutput({
-                result: { content: [{ type: "text", text: "GitLab API error: 404 Not Found" }], isError: true },
-                mode: "json",
-                tableSpec: undefined,
-            });
-            assert.equal(formatted.isError, true);
-        });
-    });
-});
-describe("When formatCliError prints a thrown error", () => {
-    describe("with a token in the message", () => {
-        it("should redact the token", () => {
-            const leaked = `glpat-${"notarealtokenvalue"}`;
-            const text = formatCliError(new Error(`auth failed ${leaked}`));
-            assert.match(text, /\[REDACTED\]/);
-            assert.equal(text.includes(leaked), false);
-        });
-    });
-});

package/build/test/cli/replay-command.test.js

@@ -1,37 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { buildToolReplayCommand } from "../../cli/replay-command.js";
-describe("When buildToolReplayCommand prints a CLI invocation", () => {
-    describe("with scalar tool arguments", () => {
-        it("should emit kebab-case flags without the token", () => {
-            const command = buildToolReplayCommand("list_issues", {
-                project_id: "123",
-                state: "opened",
-                token: "glpat-secret",
-            });
-            assert.equal(command, "zereight-mcp-gitlab tool list_issues --project-id 123 --state opened");
-        });
-    });
-    describe("with a nested object", () => {
-        it("should pass it through --args-json", () => {
-            const command = buildToolReplayCommand("execute_graphql", {
-                query: "{ currentUser { id } }",
-                variables: { n: 1 },
-            });
-            assert.match(command, /tool execute_graphql/);
-            assert.match(command, /--query/);
-            assert.match(command, /--args-json/);
-            assert.equal(command.includes("glpat"), false);
-        });
-    });
-    describe("with confirmation metadata", () => {
-        it("should omit _confirmed", () => {
-            const command = buildToolReplayCommand("push_files", {
-                project_id: "1",
-                _confirmed: true,
-            });
-            assert.equal(command.includes("_confirmed"), false);
-            assert.match(command, /--project-id 1/);
-        });
-    });
-});

package/build/test/cli/router.test.js

@@ -1,183 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { isCliInvocation, resolveCli } from "../../cli/router.js";
-function argv(...args) {
-    return ["node", "index.js", ...args];
-}
-const OPEN_EXPOSURE = {
-    isExposed() {
-        return true;
-    },
-    needsConfirmation() {
-        return false;
-    },
-    exposureRefusal() {
-        return undefined;
-    },
-};
-function resolve(args, extra = {}) {
-    return resolveCli(args, { exposure: extra.exposure ?? OPEN_EXPOSURE, permissionMode: extra.permissionMode });
-}
-describe("When resolveCli classifies argv", () => {
-    describe("with no positional command", () => {
-        it("should stay on the MCP server path", () => {
-            const resolved = resolve(argv("--token", "glpat-xxxxxxxxxxxxxxxxxxxx"));
-            assert.equal(resolved.kind, "server");
-        });
-    });
-    describe("with --help", () => {
-        it("should print global help without starting the server", () => {
-            const resolved = resolve(argv("--help"));
-            assert.equal(resolved.kind, "help");
-            if (resolved.kind === "help") {
-                assert.match(resolved.text, /tool <tool-name>/);
-                assert.match(resolved.text, /auth/);
-            }
-        });
-    });
-    describe("with --help after an unknown positional", () => {
-        it("should print global help instead of starting the server", () => {
-            const resolved = resolve(argv("not-a-command", "--help"));
-            assert.equal(resolved.kind, "help");
-        });
-    });
-    describe("with tool whoami", () => {
-        it("should run whoami with json output by default", () => {
-            const resolved = resolve(argv("tool", "whoami"));
-            assert.equal(resolved.kind, "run");
-            if (resolved.kind === "run") {
-                assert.equal(resolved.toolName, "whoami");
-                assert.equal(resolved.output, "json");
-                assert.deepEqual(resolved.args, {});
-            }
-        });
-    });
-});
-describe("When a curated command is resolved", () => {
-    describe("with mr list --group-id", () => {
-        it("should call list_group_merge_requests", () => {
-            const resolved = resolve(argv("mr", "list", "--group-id", "42", "--state", "opened"));
-            assert.equal(resolved.kind, "run");
-            if (resolved.kind === "run") {
-                assert.equal(resolved.toolName, "list_group_merge_requests");
-                assert.equal(resolved.args.group_id, "42");
-                assert.equal(resolved.output, "table");
-            }
-        });
-    });
-    describe("with issue close", () => {
-        it("should call update_issue with state_event close", () => {
-            const resolved = resolve(argv("issue", "close", "--project-id", "123", "--issue-iid", "9"));
-            assert.equal(resolved.kind, "run");
-            if (resolved.kind === "run") {
-                assert.equal(resolved.toolName, "update_issue");
-                assert.equal(resolved.args.issue_iid, "9");
-                assert.equal(resolved.args.state_event, "close");
-            }
-        });
-    });
-    describe("with mr merge and --yes=false", () => {
-        it("should reject the inline value instead of merging", () => {
-            const resolved = resolve(argv("mr", "merge", "--project-id", "123", "--mr-iid", "45", "--yes=false"));
-            assert.equal(resolved.kind, "usage");
-            if (resolved.kind === "usage") {
-                assert.match(resolved.message, /--yes does not accept a value/);
-            }
-        });
-    });
-    describe("with mr merge and no --yes", () => {
-        it("should refuse until --yes is passed without dumping argument values", () => {
-            const resolved = resolve(argv("mr", "merge", "--project-id", "123", "--mr-iid", "45"));
-            assert.equal(resolved.kind, "refused");
-            if (resolved.kind === "refused") {
-                assert.match(resolved.message, /--yes/);
-                assert.match(resolved.message, /merge_merge_request/);
-                assert.match(resolved.message, /project_id/);
-                assert.equal(resolved.message.includes("123"), false);
-            }
-        });
-    });
-    describe("with variable list scoped via --args-json", () => {
-        it("should call list_group_variables when group_id is only in JSON", () => {
-            const resolved = resolve(argv("variable", "list", "--args-json", '{"group_id":"42"}'));
-            assert.equal(resolved.kind, "run");
-            if (resolved.kind === "run") {
-                assert.equal(resolved.toolName, "list_group_variables");
-                assert.equal(resolved.args.group_id, "42");
-            }
-        });
-    });
-});
-describe("When permission mode blocks a write", () => {
-    describe("with readonly mode and issue create", () => {
-        it("should refuse before dispatch", () => {
-            const resolved = resolve(argv("issue", "create", "--project-id", "123", "--title", "bug"), { permissionMode: "readonly" });
-            assert.equal(resolved.kind, "refused");
-            if (resolved.kind === "refused") {
-                assert.match(resolved.message, /read-only/);
-            }
-        });
-    });
-});
-describe("When isCliInvocation inspects argv", () => {
-    describe("with a curated group", () => {
-        it("should treat it as a human CLI invocation", () => {
-            assert.equal(isCliInvocation(argv("mr", "list")), true);
-        });
-    });
-    describe("with --help", () => {
-        it("should treat it as a human CLI invocation", () => {
-            assert.equal(isCliInvocation(argv("--help")), true);
-        });
-    });
-    describe("with only a server token flag", () => {
-        it("should stay on the MCP server path", () => {
-            assert.equal(isCliInvocation(argv("--token", "x")), false);
-        });
-    });
-});
-describe("When MCP exposure filters block a CLI tool", () => {
-    describe("with a denied-tools regex", () => {
-        it("should refuse before dispatch", () => {
-            const resolved = resolve(argv("tool", "whoami"), {
-                exposure: {
-                    isExposed() {
-                        return false;
-                    },
-                    needsConfirmation() {
-                        return false;
-                    },
-                    exposureRefusal(toolName) {
-                        return `${toolName} is blocked by GITLAB_DENIED_TOOLS_REGEX`;
-                    },
-                },
-            });
-            assert.equal(resolved.kind, "refused");
-            if (resolved.kind === "refused") {
-                assert.match(resolved.message, /GITLAB_DENIED_TOOLS_REGEX/);
-            }
-        });
-    });
-    describe("with GITLAB_TOOL_POLICY_APPROVE", () => {
-        it("should require --yes", () => {
-            const resolved = resolve(argv("tool", "whoami"), {
-                exposure: {
-                    isExposed() {
-                        return true;
-                    },
-                    needsConfirmation() {
-                        return true;
-                    },
-                    exposureRefusal() {
-                        return undefined;
-                    },
-                },
-            });
-            assert.equal(resolved.kind, "refused");
-            if (resolved.kind === "refused") {
-                assert.match(resolved.message, /GITLAB_TOOL_POLICY_APPROVE/);
-                assert.match(resolved.message, /--yes/);
-            }
-        });
-    });
-});