@zereight/mcp-gitlab 2.2.0 → 2.2.2

package/build/oauth-proxy.js

@@ -51,6 +51,7 @@ import { looksLikeStatelessClientId, mintClientId, openClientId, } from "./state
 import { looksLikeStatelessState, mintPendingAuthState, openPendingAuthState, } from "./stateless/pending-auth.js";
 import { looksLikeStatelessStoredTokensCode, mintStoredTokensCode, openStoredTokensCode, ConsumedProxyCodeCache, PROXY_CODE_CACHE_FULL, } from "./stateless/index.js";
 import { createLogger } from "./utils/logger.js";
+import { redactUrlSecretsInText } from "./utils/redact-url.js";
 const logger = createLogger("gitlab-mcp-oauth-proxy");
 // ---------------------------------------------------------------------------
 // GitLab OAuth Server Provider
@@ -162,7 +163,7 @@ class GitLabOAuthServerProvider {
             throw new Error("callbackUrl is required when callbackProxyEnabled is true");
         }
         if (callbackProxyEnabled) {
-            logger.info(`Callback proxy mode enabled — fixed callback URL: ${callbackUrl}`);
+            logger.info(`Callback proxy mode enabled — fixed callback URL: ${redactUrlSecretsInText(callbackUrl)}`);
         }
         if (stateless) {
             logger.info(`Stateless mode enabled (client_id TTL: ${stateless.clientTtlSeconds}s, ` +

package/build/oauth.js

@@ -10,6 +10,7 @@ import { promisify } from "util";
 import open from "open";
 import pkceChallenge from "pkce-challenge";
 import { createLogger } from "./utils/logger.js";
+import { redactUrlSecretsInText } from "./utils/redact-url.js";
 import { GITLAB_PERMISSION_MODE } from "./config.js";
 import { formatOAuthScopes, grantedOAuthScopes, oauthScopeMismatchError, oauthTokenNeedsReauthorization, runDeviceAuthorizationGrantAsync, } from "./oauth-device-flow.js";
 export { oauthTokenNeedsReauthorization };
@@ -329,10 +330,10 @@ export class GitLabOAuth {
                         // Open browser for this new request
                         const authUrl = await this.getAuthorizationUrl(newState);
                         logger.info("Opening browser for new authentication request...");
-                        logger.info(`If browser doesn't open, visit: ${authUrl}`);
+                        logger.info(`If browser doesn't open, visit: ${redactUrlSecretsInText(authUrl)}`);
                         open(authUrl).catch(err => {
                             logger.error({ err }, "Failed to open browser");
-                            logger.info(`Please manually open: ${authUrl}`);
+                            logger.info(`Please manually open: ${redactUrlSecretsInText(authUrl)}`);
                         });
                         // Wait for the auth to complete
                         const authPromise = new Promise((authResolve, authReject) => {
@@ -485,10 +486,10 @@ export class GitLabOAuth {
                 logger.info(`Shared OAuth callback server listening on port ${callbackPort}`);
                 const authUrl = await this.getAuthorizationUrl(state);
                 logger.info("Opening browser for authentication...");
-                logger.info(`If browser doesn't open, visit: ${authUrl}`);
+                logger.info(`If browser doesn't open, visit: ${redactUrlSecretsInText(authUrl)}`);
                 open(authUrl).catch(err => {
                     logger.error({ err }, "Failed to open browser");
-                    logger.info(`Please manually open: ${authUrl}`);
+                    logger.info(`Please manually open: ${redactUrlSecretsInText(authUrl)}`);
                 });
             });
             server.on("error", error => {

package/build/schemas.js

@@ -259,6 +259,36 @@ export const GetPipelineSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     pipeline_id: z.coerce.string().describe("The ID of the pipeline"),
 });
+// https://docs.gitlab.com/api/runners/#list-all-of-a-projects-runners
+export const ListProjectRunnersSchema = z
+    .object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    type: z
+        .enum(["instance_type", "group_type", "project_type"])
+        .optional()
+        .describe("Runner type: instance_type, group_type, or project_type"),
+    status: z
+        .enum(["online", "offline", "stale", "never_contacted", "active", "paused"])
+        .optional()
+        .describe("Runner status: online, offline, stale, or never_contacted. active and paused are deprecated; use the paused filter instead. offline may also include stale runners"),
+    paused: z
+        .boolean()
+        .optional()
+        .describe("true returns only runners ignoring new jobs; false returns only runners accepting new jobs"),
+    tag_list: z
+        .array(z.string())
+        .optional()
+        .describe("Runner tags that must match. Sent to GitLab as a comma-separated tag_list"),
+})
+    .merge(PaginationOptionsSchema);
+// https://docs.gitlab.com/api/runners/#retrieve-runners-details
+export const GetRunnerSchema = z.object({
+    runner_id: z.coerce.string().describe("The ID of the runner"),
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path used to verify the runner is on that project's runner list. Required when GITLAB_ALLOWED_PROJECT_IDS or a session project scope lists more than one project."),
+});
 export const GetPipelineVariablesSchema = GetPipelineSchema.merge(PaginationOptionsSchema);
 export const UpdatePipelineMetadataSchema = GetPipelineSchema.extend({
     name: z.string().min(1).describe("New pipeline name"),
@@ -3820,6 +3850,73 @@ export const GetTagSignatureSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     tag_name: z.string().describe("The name of the tag"),
 });
+// Protected tags: https://docs.gitlab.com/api/protected_tags/
+// Recognized create access levels are 0 (No access), 30 (Developer), and 40 (Maintainer).
+const protectedTagAccessLevel = z.coerce
+    .number()
+    .int()
+    .refine(level => [0, 30, 40].includes(level), {
+    message: "Access level must be one of 0 (No access), 30 (Developer), or 40 (Maintainer)",
+});
+export const ListProtectedTagsSchema = ProjectParamsSchema.merge(PaginationOptionsSchema);
+export const GetProtectedTagSchema = ProjectParamsSchema.extend({
+    tag_name: z.string().describe("Name of the protected tag or wildcard"),
+});
+function resolveProtectedTagName(tagName, name) {
+    if (tagName) {
+        return tagName;
+    }
+    if (name) {
+        return name;
+    }
+    return "";
+}
+// tag_name and name are both optional in the published JSON Schema so clients
+// that validate before the call can send either field. superRefine still
+// requires one of them, and the transform copies name onto tag_name.
+export const ProtectTagSchema = ProjectParamsSchema.extend({
+    tag_name: z
+        .string()
+        .optional()
+        .describe("Tag name or wildcard pattern to protect (for example v*). Required unless name is set."),
+    name: z
+        .string()
+        .optional()
+        .describe("Alias for tag_name. Required unless tag_name is set."),
+    create_access_level: protectedTagAccessLevel
+        .optional()
+        .describe("Access level allowed to create matching tags (0=No access, 30=Developer, 40=Maintainer). GitLab default is 40 when omitted."),
+})
+    .superRefine((data, ctx) => {
+    if (!data.tag_name && !data.name) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "Either tag_name or name is required",
+            path: ["tag_name"],
+        });
+    }
+})
+    .transform(data => ({
+    project_id: data.project_id,
+    tag_name: resolveProtectedTagName(data.tag_name, data.name),
+    create_access_level: data.create_access_level,
+}));
+export const UnprotectTagSchema = ProjectParamsSchema.extend({
+    tag_name: z.string().describe("Name of the protected tag or wildcard to unprotect"),
+});
+export const GitLabProtectedTagAccessLevelSchema = z.object({
+    id: z.number().optional(),
+    access_level: z.number().nullable().optional(),
+    access_level_description: z.string().optional(),
+    deploy_key_id: z.number().nullable().optional(),
+    // GitLab returns null for role-based access levels (not user-/group-specific)
+    user_id: z.number().nullable().optional(),
+    group_id: z.number().nullable().optional(),
+});
+export const GitLabProtectedTagSchema = z.object({
+    name: z.string(),
+    create_access_levels: z.array(GitLabProtectedTagAccessLevelSchema).optional(),
+});
 export const GitLabTagSchema = z.object({
     name: z.string(),
     message: z.string().nullable(),

package/build/tools/registry.js

@@ -1,7 +1,7 @@
 import { toJSONSchema } from "../utils/schema.js";
 import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP } from "../config.js";
 import { getToolDescription } from "./tool-descriptions.js";
-import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWebhookSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWebhookSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetDraftNoteSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestDiscussionSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, ListGroupMembersSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWebhookSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, } from "../schemas.js";
+import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWebhookSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, ProtectTagSchema, UnprotectBranchSchema, UnprotectTagSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWebhookSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetDraftNoteSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestDiscussionSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetRunnerSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetProtectedTagSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, ListGroupMembersSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListProjectRunnersSchema, ListReleasesSchema, ListTagsSchema, ListProtectedTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWebhookSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, } from "../schemas.js";
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 // Define all available tools
 export const allTools = [
@@ -132,27 +132,27 @@ export const allTools = [
     },
     {
         name: "get_merge_request",
-        description: "Get details of a merge request (mergeRequestIid or branchName required). Set include_summaries=true for deployment/commit/approval summaries",
+        description: "Get details of a merge request (merge_request_iid or source_branch required). Set include_summaries=true for deployment/commit/approval summaries",
         inputSchema: toJSONSchema(GetMergeRequestSchema),
     },
     {
         name: "get_merge_request_diffs",
-        description: "Get the changes/diffs of a merge request (mergeRequestIid or branchName required)",
+        description: "Get the changes/diffs of a merge request (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(GetMergeRequestDiffsSchema),
     },
     {
         name: "list_merge_request_changed_files",
-        description: "List changed file paths in a merge request without diff content (mergeRequestIid or branchName required)",
+        description: "List changed file paths in a merge request without diff content (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(ListMergeRequestChangedFilesSchema),
     },
     {
         name: "list_merge_request_diffs",
-        description: "List merge request diffs with pagination (mergeRequestIid or branchName required)",
+        description: "List merge request diffs with pagination (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(ListMergeRequestDiffsSchema),
     },
     {
         name: "get_merge_request_file_diff",
-        description: "Get diffs for specific files from a merge request (mergeRequestIid or branchName required)",
+        description: "Get diffs for specific files from a merge request (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(GetMergeRequestFileDiffSchema),
     },
     {
@@ -172,7 +172,7 @@ export const allTools = [
     },
     {
         name: "update_merge_request",
-        description: "Update a merge request (mergeRequestIid or branchName required)",
+        description: "Update a merge request (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(UpdateMergeRequestSchema),
     },
     {
@@ -1088,6 +1088,26 @@ export const allTools = [
         description: "Get the X.509 signature of a signed tag (404 if unsigned)",
         inputSchema: toJSONSchema(GetTagSignatureSchema),
     },
+    {
+        name: "list_protected_tags",
+        description: "List protected tags in a project",
+        inputSchema: toJSONSchema(ListProtectedTagsSchema),
+    },
+    {
+        name: "get_protected_tag",
+        description: "Get details of a single protected tag or wildcard (create access levels)",
+        inputSchema: toJSONSchema(GetProtectedTagSchema),
+    },
+    {
+        name: "protect_tag",
+        description: "Protect a repository tag or wildcard (set who can create it)",
+        inputSchema: toJSONSchema(ProtectTagSchema),
+    },
+    {
+        name: "unprotect_tag",
+        description: "Remove protection from a previously protected tag or wildcard",
+        inputSchema: toJSONSchema(UnprotectTagSchema),
+    },
     // --- Snippet tools ---
     {
         name: "list_snippets",
@@ -1366,6 +1386,16 @@ export const allTools = [
         description: "List the MCP tool definitions exposed by GitLab Orbit",
         inputSchema: toJSONSchema(OrbitToolsSchema),
     },
+    {
+        name: "list_project_runners",
+        description: "List runners available to a project",
+        inputSchema: toJSONSchema(ListProjectRunnersSchema),
+    },
+    {
+        name: "get_runner",
+        description: "Get one runner by ID",
+        inputSchema: toJSONSchema(GetRunnerSchema),
+    },
     // --- Meta tool: Dynamic tool discovery ---
     {
         name: "discover_tools",
@@ -1446,6 +1476,8 @@ export const readOnlyTools = new Set([
     "list_pipeline_trigger_jobs",
     "get_pipeline_job",
     "get_pipeline_job_output",
+    "list_project_runners",
+    "get_runner",
     "wait_for_pipeline",
     "wait_for_job",
     "validate_ci_lint",
@@ -1492,6 +1524,8 @@ export const readOnlyTools = new Set([
     "list_tags",
     "get_tag",
     "get_tag_signature",
+    "list_protected_tags",
+    "get_protected_tag",
     "list_snippets",
     "get_snippet",
     "get_merge_request_approval_state",
@@ -1567,6 +1601,8 @@ export const destructiveTools = new Set([
     "delete_branch",
     "unprotect_branch",
     "protect_branch",
+    "unprotect_tag",
+    "protect_tag",
     "update_default_branch",
     "merge_merge_request",
     "push_files",
@@ -1614,12 +1650,13 @@ export const deleteTools = new Set([
     "delete_work_item_note_emoji_reaction",
     "purge_dependency_proxy_cache",
     // Destructive teardown operations whose names do not start with `delete_`:
-    // stopping/cancelling live pipelines and environments, and removing branch protection.
+    // stopping/cancelling live pipelines and environments, and removing branch or tag protection.
     "cancel_pipeline",
     "cancel_pipeline_job",
     "stop_environment",
     "stop_stale_environments",
     "unprotect_branch",
+    "unprotect_tag",
 ]);
 // Define which tools are related to wiki and can be toggled by USE_GITLAB_WIKI
 export const wikiToolNames = new Set([
@@ -1715,6 +1752,8 @@ export const pipelineToolNames = new Set([
     "list_job_artifacts",
     "download_job_artifacts",
     "get_job_artifact_file",
+    "list_project_runners",
+    "get_runner",
 ]);
 export const TOOLSET_DEFINITIONS = [
     {
@@ -1973,6 +2012,8 @@ export const TOOLSET_DEFINITIONS = [
             "list_job_artifacts",
             "download_job_artifacts",
             "get_job_artifact_file",
+            "list_project_runners",
+            "get_runner",
         ]),
     },
     {
@@ -2030,7 +2071,17 @@ export const TOOLSET_DEFINITIONS = [
     {
         id: "tags",
         isDefault: false,
-        tools: new Set(["list_tags", "get_tag", "create_tag", "delete_tag", "get_tag_signature"]),
+        tools: new Set([
+            "list_tags",
+            "get_tag",
+            "create_tag",
+            "delete_tag",
+            "get_tag_signature",
+            "list_protected_tags",
+            "get_protected_tag",
+            "protect_tag",
+            "unprotect_tag",
+        ]),
     },
     {
         id: "snippets",

package/build/tools/tool-descriptions.js

@@ -9,7 +9,7 @@ const TOOL_GUIDANCE = {
     push_files: "Use this to commit several file changes atomically; use `create_or_update_file` when only one path is involved. Each file defaults to action `create`; optional per-file `action` (create/update/delete/move) and `encoding` (text/base64) are additive. `GITLAB_PERMISSION_MODE=modify` rejects `delete` and `move`. The operation writes repository history on the selected branch, requires repository write permission, and returns the commit result or a validation, conflict, or protected-branch error.",
     create_issue: "Use this to open a new issue; use `update_issue` for an existing issue and `create_issue_note` to add discussion without changing issue fields. The operation creates remote project data, requires issue creation permission, and returns the new issue or a validation, permission, or duplicate-related error.",
     list_issues: "Use this for issue management: list GitLab issues, optionally scoped with `project_id`. Use `get_issue` when the issue iid is already known and `my_issues` for issues assigned to the current user. It is read-only and paginated, requires issue read permission, and returns issue records or GitLab errors for invalid identifiers, missing resources, or rate limits.",
-    my_issues: "Use this for issue management: list issues assigned to the authenticated user. Use `list_issues` for project-wide or author-scoped listing and `get_issue` for one issue. It is read-only and paginated, requires authentication, and returns assigned issue records or permission/rate-limit errors.",
+    my_issues: "Use this for issue management: list issues assigned to the authenticated user. Use `list_issues` for project-wide or author-scoped listing and `get_issue` for one issue. Resolving the current user requires classic read_user or fine-grained User:Read. It is read-only and paginated, requires authentication, and returns assigned issue records or permission/rate-limit errors.",
     get_issue: "Use this for issue management: inspect one issue's fields; use `list_issues` or `my_issues` to discover issues first. It is read-only, requires issue read permission, and returns the issue or an error when the identifier is invalid, the issue is missing, or access is denied.",
     create_merge_request: "Use this to open a new merge request from an existing source branch to a target branch; use `update_merge_request` after it exists. The operation creates remote review state, requires project access, and returns the new merge request or a validation, permission, branch, or duplicate-related error.",
     fork_repository: "Use this to create a copy of an existing project in the current user's namespace or a permitted namespace; use `search_repositories` or `get_project` to inspect projects without copying them. The operation creates a new project, requires fork permission, and returns the forked project or a namespace/permission error.",
@@ -17,6 +17,8 @@ const TOOL_GUIDANCE = {
     delete_branch: "Use this only after confirming the branch name and intended data loss; use `get_branch` or `list_branches` before deletion and never use it to remove branch protection. The operation permanently removes a remote branch, requires branch-delete permission, and returns the deletion result or a protected-branch, missing-resource, or permission error.",
     protect_branch: "Use this to create or update protection rules for a branch or wildcard; use `get_protected_branch` to inspect existing rules first. The operation changes who may push, merge, or unprotect, may enable force-push or code-owner settings, requires maintainer-level permission, and returns the protection rule or a validation/permission error.",
     unprotect_branch: "Use this to remove protection from an existing branch; use `protect_branch` to change access levels without removing the rule. The operation changes repository security controls, requires permission to manage protected branches, and returns the result or an error when the branch is missing or policy forbids the change.",
+    protect_tag: "Use this to protect a tag or wildcard such as `v*` so protected CI/CD variables reach tag pipelines; use `get_protected_tag` or `list_protected_tags` to inspect existing rules first. The operation changes who may create matching tags, requires maintainer-level permission, and returns the protection rule or a validation/permission error.",
+    unprotect_tag: "Use this to remove protection from an existing tag or wildcard. To change the create access level, use `unprotect_tag` first, then `protect_tag`; `protect_tag` creates a rule and does not update an existing rule. This change is unavailable in `modify` mode because `unprotect_tag` is blocked there. The operation changes repository security controls, requires permission to manage protected tags, and returns the result or an error when the tag is missing or policy forbids the change.",
     update_default_branch: "Use this to change which branch GitLab treats as the project's default; use `create_branch` to create a branch rather than changing project defaults. The operation changes project settings and may affect clone, merge request, and CI defaults, requires project-maintainer permission, and returns the updated project or a validation/permission error.",
     create_note: "Use this for a top-level comment on an issue or merge request when no typed discussion operation is needed; use `create_merge_request_thread` or `create_issue_note` for threaded replies. The operation creates remote discussion content, requires note permission, and returns the created note or a target/permission/validation error.",
     create_merge_request_thread: "Use this to start a review thread on a merge request; use `create_merge_request_note` for an unthreaded note and `create_merge_request_discussion_note` to reply to an existing thread. The operation creates remote review content, requires note permission, and returns the discussion or a position/permission/validation error.",
@@ -36,8 +38,10 @@ const TOOL_GUIDANCE = {
     download_attachment: "Use this to retrieve a previously uploaded project attachment; remote mode returns inline base64 for images or a download URL, while local mode can save to a path. It is read-only with respect to GitLab, requires project access, and returns the file content or an attachment/permission error.",
     execute_graphql: "Use this only when a supported GitLab REST tool does not cover the requested operation; prefer a typed tool when one exists. The query is sent directly to GitLab and can include mutations when permission allows, so callers must treat it as potentially state-changing and handle GraphQL errors in the returned response.",
     discover_tools: "Use this when a needed opt-in category is not currently exposed; omit `category` to inspect available categories, then call it with a category to activate that group for the current session. It changes only the session's tool registry, returns the active-tool summary, and does not change GitLab data.",
-    health_check: "Use this to verify server connectivity and authentication before making GitLab requests; use `whoami` when the authenticated user's identity is the goal. It does not mutate GitLab state and returns server/authentication status plus GitLab version details when available.",
-    whoami: "Use this to identify the authenticated GitLab user; use `get_user` or `get_users` when looking up another user. It is read-only and returns the current user profile, while missing credentials or GitLab permission failures are reported as errors.",
+    health_check: "Use this to verify server connectivity and authentication before making GitLab requests; use `whoami` when the authenticated user's identity is the goal. A 403 from GET /user with an insufficient_scope error means the token is accepted but User API scope is missing (read_user or fine-grained User:Read); the check stays ok, sets user_api_warning, and omits version metadata. Rate-limit and authentication-ban 403 responses stay unauthenticated. It does not mutate GitLab state and returns server/authentication status plus GitLab version details when available. Connection failures with no HTTP response return status error, authenticated false, and an error object (kind tls, dns, timeout, or network, plus code and message) instead of a protocol error.",
+    whoami: "Use this to identify the authenticated GitLab user; use `get_user` or `get_users` when looking up another user. It requires classic read_user or fine-grained User:Read. It is read-only and returns the current user profile, while missing credentials or GitLab permission failures are reported as errors.",
+    list_project_runners: "Use this when a job is stuck pending with no matching runner and you need the runners a project can use, including ancestor group runners and allowed instance runners. Filter with type, status, paused, and tag_list; the list payload includes id, description, runner_type, status, and paused (among other non-secret GitLab runner fields) but not tags — call `get_runner` for tag_list, run_untagged, locked, and access_level. It is read-only and paginated, requires Maintainer or Auditor access on the project, and never returns a runner registration token (runners_token) or runner authentication token.",
+    get_runner: "Use this after list_project_runners when you already have a runner ID and need tag_list, run_untagged, locked, and access_level to explain a stuck pending job. Instance runner details are visible to authenticated users; group and project runners follow GitLab's role checks for that runner. When GITLAB_ALLOWED_PROJECT_IDS or a session project scope is active, the runner must appear on an allowed project's runner list before details are returned — pass project_id when more than one project is allowed — projects outside that allowlist are omitted, and groups are omitted because a project allowlist cannot verify them. GITLAB_PROJECT_ID alone is only the default project for that membership check when project_id is omitted. It does not omit other projects or groups. It is read-only and never returns a runner registration token (runners_token) or runner authentication token. token_expires_at is expiry metadata, not the token.",
     list_pipeline_schedules: "Use this to survey a project's scheduled pipelines and their `cron`, `next_run_at`, and `active` state, optionally narrowed with `scope` to `active` or `inactive`; use `list_pipelines` for pipelines that already ran and `get_pipeline_schedule` when the schedule ID is known. The list response carries no `variables` — call `get_pipeline_schedule` for those — and includes `inputs` only for Maintainers, Owners, or the schedule owner. It is read-only and paginated, requires project access, and returns schedule records or an error when the project is missing or access is denied.",
     get_pipeline_schedule: "Use this to inspect one schedule's cron, owner, last pipeline, variables, and inputs; use `list_pipeline_schedules` to discover schedule IDs and `list_pipeline_schedule_pipelines` for the pipelines it produced. It is read-only, returns `variables` and `inputs` only to Maintainers, Owners, or the schedule owner, and returns the schedule or an error when the schedule is missing or access is denied.",
     list_pipeline_schedule_pipelines: "Use this to review the pipelines a schedule has actually triggered, for example to see whether the nightly run succeeded; use `get_pipeline` for one pipeline's full detail and `list_pipelines` for project-wide filtering. Narrow the result with `scope`, `status`, `sort`, and the `created_*` / `updated_*` date bounds. It is read-only and paginated, requires project access, and returns pipeline records or an error when the schedule is missing or access is denied.",

package/build/utils/health-check-transport-error.js

@@ -0,0 +1,115 @@
+/**
+ * Classify fetch failures that never produced an HTTP response.
+ * health_check must report these as a normal tool result: the caller is
+ * already asking whether the connection works, so a JSON-RPC -32603 hides the
+ * only signal they came for.
+ *
+ * node-fetch puts the OS code on `code` / `errno`. undici leaves `code` empty
+ * on the TypeError and stores it on `cause.code` (errno there is numeric).
+ */
+import { redactGitLabUrlCredentials, redactUrlSecretsInText } from "./redact-url.js";
+export { redactGitLabUrlCredentials };
+const TLS_CODES = new Set([
+    "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+    "UNABLE_TO_GET_ISSUER_CERT",
+    "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+    "SELF_SIGNED_CERT_IN_CHAIN",
+    "DEPTH_ZERO_SELF_SIGNED_CERT",
+    "CERT_HAS_EXPIRED",
+    "ERR_TLS_CERT_ALTNAME_INVALID",
+]);
+const TLS_CODE_PREFIXES = ["CERT_", "ERR_TLS_", "ERR_SSL_"];
+const DNS_CODES = new Set(["ENOTFOUND", "EAI_AGAIN"]);
+const TIMEOUT_CODES = new Set(["ETIMEDOUT", "UND_ERR_CONNECT_TIMEOUT"]);
+const TIMEOUT_ERROR_NAMES = new Set(["AbortError", "TimeoutError"]);
+const REQUEST_TIMEOUT_TYPE = "request-timeout";
+const TLS_CA_HINT = "Make sure NODE_EXTRA_CA_CERTS or GITLAB_CA_CERT_PATH contains the full certificate chain, including intermediate CAs.";
+const FALLBACK_MESSAGE = "GitLab request failed before an HTTP response";
+export function classifyHealthCheckTransportError(error) {
+    const code = readTransportCode(error);
+    const kind = classifyKind(error, code);
+    const failure = {
+        kind,
+        code,
+        message: readTransportMessage(error),
+    };
+    if (kind === "tls") {
+        failure.hint = TLS_CA_HINT;
+    }
+    return failure;
+}
+function classifyKind(error, code) {
+    if (code !== null) {
+        return kindFromCode(code);
+    }
+    if (isTimeoutSignal(error) || isTimeoutSignal(readCause(error))) {
+        return "timeout";
+    }
+    return "network";
+}
+function kindFromCode(code) {
+    if (isTlsCode(code))
+        return "tls";
+    if (DNS_CODES.has(code))
+        return "dns";
+    if (TIMEOUT_CODES.has(code))
+        return "timeout";
+    return "network";
+}
+function isTlsCode(code) {
+    if (TLS_CODES.has(code))
+        return true;
+    return TLS_CODE_PREFIXES.some(prefix => code.startsWith(prefix));
+}
+function readTransportCode(error) {
+    const cause = readCause(error);
+    return (readStringField(error, "code") ??
+        readStringField(error, "errno") ??
+        readStringField(cause, "code") ??
+        readStringField(cause, "errno"));
+}
+function isTimeoutSignal(value) {
+    const name = readStringField(value, "name");
+    if (name !== null && TIMEOUT_ERROR_NAMES.has(name))
+        return true;
+    return readStringField(value, "type") === REQUEST_TIMEOUT_TYPE;
+}
+function readTransportMessage(error) {
+    if (typeof error === "string") {
+        const trimmed = error.trim();
+        return trimmed.length > 0 ? redactCredentials(trimmed) : FALLBACK_MESSAGE;
+    }
+    const combined = combineMessages(readStringField(error, "message"), readStringField(readCause(error), "message"));
+    if (combined.length === 0)
+        return FALLBACK_MESSAGE;
+    return redactCredentials(combined);
+}
+function combineMessages(outer, inner) {
+    if (outer && inner && !outer.includes(inner)) {
+        return `${outer}: ${inner}`;
+    }
+    return outer ?? inner ?? "";
+}
+function redactCredentials(message) {
+    return redactUrlSecretsInText(message)
+        .replace(/\bBearer\s+\S+/gi, "Bearer [REDACTED]")
+        .replace(/\b((?:private|job)-token|authorization)\b\s*[:=]\s*\S+/gi, "$1: [REDACTED]")
+        .replace(/\bgl(?:pat|dt|rt|pt|ft|oas|soat)-[A-Za-z0-9._-]+/gi, "[REDACTED]");
+}
+function readCause(value) {
+    if (!isRecord(value))
+        return undefined;
+    return value.cause;
+}
+function readStringField(value, key) {
+    if (!isRecord(value))
+        return null;
+    const field = value[key];
+    if (typeof field !== "string")
+        return null;
+    const trimmed = field.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}

package/build/utils/logger.js

@@ -25,30 +25,96 @@ const REDACT_PATHS = [
     "arguments.approval_password",
     "params.arguments.approval_password",
 ];
-function isPrettyFactory(value) {
-    return typeof value === "function";
-}
+const STDERR_FD = 2;
+// Stay under sonic-boom's minLength so a startup warning is still buffered when
+// flushStartupLogs runs. A larger line starts an async write immediately, and
+// flushSync cannot pull that in-flight chunk back into order.
+const ASYNC_LOG_MIN_LENGTH = 1024 * 1024;
+const ASYNC_LOG_MAX_WRITE = ASYNC_LOG_MIN_LENGTH + 1;
+const ASYNC_LOG_FLUSH_INTERVAL_MS = 100;
+const startupFlushes = new WeakMap();
 function isPrettyModule(value) {
-    if (typeof value !== "object" || value === null || !("default" in value)) {
+    if (typeof value !== "function" || !("prettyFactory" in value)) {
         return false;
     }
-    return isPrettyFactory(value.default);
+    return typeof value.prettyFactory === "function";
+}
+function readPrettyModule(value) {
+    if (isPrettyModule(value)) {
+        return value;
+    }
+    if (typeof value === "object" && value !== null && "default" in value) {
+        if (isPrettyModule(value.default)) {
+            return value.default;
+        }
+    }
+    return undefined;
+}
+function loadPrettifier() {
+    const loaded = require("pino-pretty");
+    const prettyModule = readPrettyModule(loaded);
+    if (prettyModule === undefined) {
+        throw new Error("pino-pretty did not export a prettifier");
+    }
+    return prettyModule.prettyFactory({ colorize: true, levelFirst: true });
+}
+function createAsyncStderr() {
+    return pino.destination({
+        dest: STDERR_FD,
+        sync: false,
+        minLength: ASYNC_LOG_MIN_LENGTH,
+        maxWrite: ASYNC_LOG_MAX_WRITE,
+        periodicFlush: ASYNC_LOG_FLUSH_INTERVAL_MS,
+    });
 }
 /**
  * Pretty-print in process. The worker transport has the same text format, but
  * it spawns a thread on every logger, including stdio MCP startup.
  * LOG_FORMAT=json still skips pino-pretty entirely.
+ *
+ * Steady-state writes stay asynchronous. flushSync is only for startup warnings,
+ * so a full stderr pipe cannot block later request logs.
  */
-function createPrettyStream() {
-    const loaded = require("pino-pretty");
-    const options = { colorize: true, levelFirst: true, destination: 2 };
-    if (isPrettyFactory(loaded)) {
-        return loaded(options);
-    }
-    if (isPrettyModule(loaded)) {
-        return loaded.default(options);
+function createPrettyDestination() {
+    const prettify = loadPrettifier();
+    const sonic = createAsyncStderr();
+    return {
+        write(message) {
+            const source = message.endsWith("\n") ? message.slice(0, -1) : message;
+            const line = prettify(source);
+            if (typeof line !== "string" || line.length === 0) {
+                return;
+            }
+            sonic.write(line);
+        },
+        flush(callback) {
+            sonic.flush(callback);
+        },
+        flushSync() {
+            sonic.flushSync();
+        },
+    };
+}
+function rememberStartupFlush(logger, flushSync) {
+    startupFlushes.set(logger, flushSync);
+}
+/**
+ * Block until startup warnings already passed to this logger reach stderr.
+ * Steady-state logs stay buffered and are flushed asynchronously.
+ */
+function flushDestination(logger) {
+    const flush = startupFlushes.get(logger);
+    if (flush === undefined) {
+        return;
     }
-    throw new Error("pino-pretty did not export a stream factory");
+    flush();
+}
+export function flushStartupLogs(logger) {
+    flushDestination(logger);
+}
+/** Write buffered lines now. Info logs stay buffered until this or process exit. */
+export function flushBufferedLogs(logger) {
+    flushDestination(logger);
 }
 /**
  * Create a pino logger with consistent redaction, level, format, and
@@ -71,7 +137,17 @@ export function createLogger(name) {
         },
     };
     if (isJson) {
-        return pino(options, pino.destination(2));
+        const destination = createAsyncStderr();
+        const logger = pino(options, destination);
+        rememberStartupFlush(logger, () => {
+            destination.flushSync();
+        });
+        return logger;
     }
-    return pino(options, createPrettyStream());
+    const destination = createPrettyDestination();
+    const logger = pino(options, destination);
+    rememberStartupFlush(logger, () => {
+        destination.flushSync();
+    });
+    return logger;
 }