@zereight/mcp-gitlab 2.2.1 → 2.2.2

package/build/auth-cli.js

@@ -1,7 +1,9 @@
 import * as os from "os";
 import * as path from "path";
+import { parseCliArgs } from "./cli-boolean-flags.js";
+import { deprecatedEnvInputFromSources, getDeprecatedEnvWarnings } from "./deprecated-env.js";
 import { GitLabOAuth } from "./oauth.js";
-import { createLogger } from "./utils/logger.js";
+import { createLogger, flushStartupLogs } from "./utils/logger.js";
 const logger = createLogger("gitlab-mcp-auth");
 const DEFAULT_API_URL = "https://gitlab.com";
 const DEFAULT_REDIRECT_URI = "http://127.0.0.1:8888/callback";
@@ -42,12 +44,12 @@ function readFlag(argv, name) {
 function wantsHelp(argv) {
     return argv.includes("--help") || argv.includes("-h");
 }
-function isReadOnlyMode(argv, env) {
-    const readOnly = readFlag(argv, "read-only") ?? env.GITLAB_READ_ONLY_MODE;
+function isReadOnlyMode(parsedArgs, env) {
+    const readOnly = parsedArgs["read-only"] ?? env.GITLAB_READ_ONLY_MODE;
     if (readOnly === "true") {
         return true;
     }
-    return (readFlag(argv, "permission-mode") ?? env.GITLAB_PERMISSION_MODE) === "readonly";
+    return (parsedArgs["permission-mode"] ?? env.GITLAB_PERMISSION_MODE) === "readonly";
 }
 export function gitlabOriginFromApiUrl(apiUrl) {
     return apiUrl.replace(/\/api\/v4\/?$/, "");
@@ -56,6 +58,14 @@ export async function runAuthCommandAsync(input = {}) {
     const argv = input.argv ?? process.argv;
     const env = input.env ?? process.env;
     const stdout = input.stdout ?? process.stdout;
+    const parsedArgs = parseCliArgs(argv.slice(2));
+    const warnings = getDeprecatedEnvWarnings(deprecatedEnvInputFromSources(parsedArgs, env));
+    for (const warning of warnings) {
+        logger.warn(warning);
+    }
+    if (warnings.length > 0) {
+        flushStartupLogs(logger);
+    }
     if (wantsHelp(argv)) {
         stdout.write(AUTH_CLI_HELP);
         return;
@@ -69,7 +79,7 @@ export async function runAuthCommandAsync(input = {}) {
         env.GITLAB_OAUTH_TOKEN_PATH ??
         path.join(os.homedir(), ".gitlab-mcp-token.json");
     const gitlabUrl = gitlabOriginFromApiUrl(apiUrl);
-    const scopes = [isReadOnlyMode(argv, env) ? "read_api" : "api"];
+    const scopes = [isReadOnlyMode(parsedArgs, env) ? "read_api" : "api"];
     const oauth = new GitLabOAuth({
         clientId,
         clientSecret: env.GITLAB_OAUTH_CLIENT_SECRET,

package/build/cli-boolean-flags.js

@@ -36,3 +36,37 @@ export function nextBooleanFlagValue(nextToken) {
     }
     return { value: "true", consumeNext: false };
 }
+/** Same flag parse as startup config: CLI values only, positionals ignored. */
+export function parseCliArgs(argv) {
+    const parsed = {};
+    for (let index = 0; index < argv.length; index++) {
+        const arg = argv[index];
+        if (!arg.startsWith("--")) {
+            continue;
+        }
+        const eqIndex = arg.indexOf("=");
+        if (eqIndex !== -1) {
+            const key = arg.slice(2, eqIndex);
+            const value = arg.slice(eqIndex + 1);
+            if (value) {
+                parsed[key] = value;
+            }
+            continue;
+        }
+        const key = arg.slice(2);
+        if (BOOLEAN_CLI_FLAG_NAMES.has(key)) {
+            const next = nextBooleanFlagValue(argv[index + 1]);
+            parsed[key] = next.value;
+            if (next.consumeNext) {
+                index += 1;
+            }
+            continue;
+        }
+        const next = argv[index + 1];
+        if (next !== undefined && !next.startsWith("--")) {
+            index += 1;
+            parsed[key] = next;
+        }
+    }
+    return parsed;
+}

package/build/config.js

@@ -1,35 +1,9 @@
-import { BOOLEAN_CLI_FLAG_NAMES, nextBooleanFlagValue } from "./cli-boolean-flags.js";
+import { parseCliArgs } from "./cli-boolean-flags.js";
+import { deprecatedEnvInputFromSources } from "./deprecated-env.js";
 import { parseToolProfile } from "./tools/tool-profile.js";
 import { parseCompactToolAllowlist } from "./utils/compact-tool-allowlist.js";
 // Parse CLI arguments before anything else
-const args = process.argv.slice(2);
-export const cliArgs = {};
-for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg.startsWith("--")) {
-        const eqIndex = arg.indexOf("=");
-        if (eqIndex !== -1) {
-            const key = arg.slice(2, eqIndex);
-            const value = arg.slice(eqIndex + 1);
-            if (value) {
-                cliArgs[key] = value;
-            }
-        }
-        else {
-            const key = arg.slice(2);
-            if (BOOLEAN_CLI_FLAG_NAMES.has(key)) {
-                const parsed = nextBooleanFlagValue(args[i + 1]);
-                cliArgs[key] = parsed.value;
-                if (parsed.consumeNext) {
-                    i += 1;
-                }
-            }
-            else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
-                cliArgs[key] = args[++i];
-            }
-        }
-    }
-}
+export const cliArgs = parseCliArgs(process.argv.slice(2));
 export function getConfig(cliKey, envKey, defaultValue) {
     return cliArgs[cliKey] || process.env[envKey] || defaultValue;
 }
@@ -103,7 +77,7 @@ export const GITLAB_OAUTH_SCOPES = GITLAB_OAUTH_SCOPES_RAW
         .filter(Boolean)
     : undefined;
 export const GITLAB_OAUTH_CALLBACK_PROXY = getConfig("oauth-callback-proxy", "GITLAB_OAUTH_CALLBACK_PROXY") === "true";
-/** @deprecated Use GITLAB_OAUTH_ALLOWED_GROUPS_RAW instead. Will be removed in the next major version. */
+/** @deprecated Use GITLAB_OAUTH_ALLOWED_GROUPS_RAW instead. Will be removed in v3.0.0. */
 export const GITLAB_ALLOWED_GROUPS_RAW = getConfig("allowed-groups", "GITLAB_ALLOWED_GROUPS");
 export const GITLAB_OAUTH_ALLOWED_GROUPS_RAW = getConfig("oauth-allowed-groups", "GITLAB_OAUTH_ALLOWED_GROUPS");
 export const GITLAB_OAUTH_ALLOWED_GROUPS = (() => {
@@ -202,5 +176,13 @@ export const HTTPS_PROXY = getConfig("https-proxy", "HTTPS_PROXY");
 export const NO_PROXY = getConfig("no-proxy", "NO_PROXY");
 export const NODE_TLS_REJECT_UNAUTHORIZED = getConfig("tls-reject-unauthorized", "NODE_TLS_REJECT_UNAUTHORIZED");
 export const GITLAB_CA_CERT_PATH = getConfig("ca-cert-path", "GITLAB_CA_CERT_PATH");
+/**
+ * Snapshot of deprecated settings for startup warnings.
+ * CLI flags win over env vars, matching getConfig, so the warning can name
+ * the flag the user actually passed.
+ */
+export function buildDeprecatedEnvInput() {
+    return deprecatedEnvInputFromSources(cliArgs, process.env);
+}
 const _poolMaxSizeRaw = getConfig("pool-max-size", "GITLAB_POOL_MAX_SIZE");
 export const GITLAB_POOL_MAX_SIZE = _poolMaxSizeRaw ? Number.parseInt(_poolMaxSizeRaw, 10) : 100;

package/build/deprecated-env.js

@@ -5,31 +5,116 @@ function shownEnvValue(rawValue) {
     }
     return `${singleLine.slice(0, 77)}...`;
 }
+const REMOVAL_VERSION = "v3.0.0";
+const DEPRECATION_NOTICE_URL = "https://github.com/zereight/gitlab-mcp/issues/815";
 // USE_PIPELINE exposes these two tools, but they live in the `ci` toolset, not `pipelines`.
 // Suggesting `ci` would also turn on catalog tools the flag does not expose.
 const LEGACY_TOOLS_OUTSIDE_NAMED_TOOLSET = {
     pipelines: "validate_ci_lint,validate_project_ci_lint",
 };
-function legacyToolsetReplacement(toolset) {
-    const toolsets = `GITLAB_TOOLSETS=core,${toolset}`;
+function explicitToolsets(raw) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    const trimmed = raw.trim();
+    if (trimmed === "") {
+        return undefined;
+    }
+    return trimmed;
+}
+function isAllToolsets(raw) {
+    return raw.trim().toLowerCase() === "all";
+}
+function settingName(envName, cliFlag, fromCli) {
+    if (fromCli) {
+        return `\`--${cliFlag}\` (${envName})`;
+    }
+    return envName;
+}
+function gitlabToolsAssignment(extraTools, toolsRaw, toolsFromCli) {
+    const prefix = toolsFromCli ? "--tools=" : "GITLAB_TOOLS=";
+    const existing = explicitToolsets(toolsRaw);
+    if (existing === undefined) {
+        return `${prefix}${extraTools}`;
+    }
+    const names = existing
+        .split(",")
+        .map(part => part.trim())
+        .filter(part => part.length > 0);
+    const merged = extraTools.split(",").reduce((current, tool) => {
+        if (current.includes(tool)) {
+            return current;
+        }
+        return [...current, tool];
+    }, names);
+    return `${prefix}${merged.join(",")}`;
+}
+function legacyToolsetHint(toolset, toolsetsRaw, toolsetsFromCli, toolsRaw, toolsFromCli, optional) {
     const extraTools = LEGACY_TOOLS_OUTSIDE_NAMED_TOOLSET[toolset];
-    if (extraTools === undefined) {
-        return toolsets;
+    const toolsAssignment = extraTools === undefined
+        ? undefined
+        : gitlabToolsAssignment(extraTools, toolsRaw, toolsFromCli);
+    const listed = explicitToolsets(toolsetsRaw);
+    const toolsetsLabel = toolsetsFromCli && listed !== undefined ? "--toolsets" : "GITLAB_TOOLSETS";
+    if (listed !== undefined) {
+        const shown = shownEnvValue(listed);
+        // parseEnabledToolsets treats only the exact value "all" as every toolset.
+        // "all,pipelines" is not "all"; unknown token "all" is dropped and pipelines remains.
+        if (isAllToolsets(listed)) {
+            return `Keep the existing ${toolsetsLabel} value ("${shown}") and remove the deprecated setting`;
+        }
+        const extra = toolsAssignment === undefined ? "" : ` and set ${toolsAssignment}`;
+        if (optional) {
+            return (`Add \`${toolset}\` to the existing ${toolsetsLabel} list ("${shown}")${extra} ` +
+                "only if you want those tools");
+        }
+        return `Add \`${toolset}\` to the existing ${toolsetsLabel} list ("${shown}")${extra} instead`;
+    }
+    // An explicit toolset list replaces the default toolsets; it does not merge.
+    // Legacy USE_* flags add tools on top of defaults, so the hint must keep `core`
+    // only when the user has not set a toolset list.
+    const toolsets = `GITLAB_TOOLSETS=core,${toolset}`;
+    const replacement = toolsAssignment === undefined ? toolsets : `${toolsets} and ${toolsAssignment}`;
+    if (optional) {
+        return `Set ${replacement} only if you want those tools in addition to core`;
     }
-    return `${toolsets} and GITLAB_TOOLS=${extraTools}`;
+    return `Use ${replacement} instead`;
 }
-function legacyToolsetWarning(envName, rawValue, toolset) {
-    // An explicit GITLAB_TOOLSETS list replaces the default toolsets; it does not merge.
-    // Legacy USE_* flags add tools on top of defaults, so the hint must keep `core`.
-    const replacement = legacyToolsetReplacement(toolset);
+function legacyToolsetWarning(envName, cliFlag, fromCli, rawValue, toolset, toolsetsRaw, toolsetsFromCli, toolsRaw, toolsFromCli) {
+    const name = settingName(envName, cliFlag, fromCli);
     if (rawValue === "true") {
-        return (`${envName} is deprecated and will be removed in the next major version. ` +
-            `Use ${replacement} instead.`);
+        return (`${name} is deprecated and will be removed in ${REMOVAL_VERSION}. ` +
+            `${legacyToolsetHint(toolset, toolsetsRaw, toolsetsFromCli, toolsRaw, toolsFromCli, false)}.`);
     }
     const shown = shownEnvValue(rawValue);
-    return (`${envName} is set to "${shown}" and is deprecated. ` +
+    return (`${name} is set to "${shown}" and is deprecated and will be removed in ${REMOVAL_VERSION}. ` +
         `This value does not enable the ${toolset} toolset. Remove it. ` +
-        `Set ${replacement} only if you want those tools in addition to core.`);
+        `${legacyToolsetHint(toolset, toolsetsRaw, toolsetsFromCli, toolsRaw, toolsFromCli, true)}.`);
+}
+function readOnlyRawValue(input) {
+    if (input.readOnlyRaw !== undefined && input.readOnlyRaw !== "") {
+        return input.readOnlyRaw;
+    }
+    if (input.readOnlyMode) {
+        return "true";
+    }
+    return undefined;
+}
+function readOnlyWarning(input) {
+    const raw = readOnlyRawValue(input);
+    if (raw === undefined) {
+        return undefined;
+    }
+    const name = settingName("GITLAB_READ_ONLY_MODE", "read-only", input.readOnlyFromCli === true);
+    if (raw === "true") {
+        const conflict = input.permissionModeRaw !== undefined && input.permissionModeRaw !== "readonly"
+            ? ` It OVERRIDES the configured permission mode "${input.permissionModeRaw}"; the server runs as "readonly".`
+            : "";
+        return (`${name} is deprecated and will be removed in ${REMOVAL_VERSION}. ` +
+            `Use GITLAB_PERMISSION_MODE=readonly or --permission-mode=readonly instead.${conflict}`);
+    }
+    return (`${name} is set to "${shownEnvValue(raw)}" and is deprecated and will be removed in ${REMOVAL_VERSION}. ` +
+        "This value does not enable legacy read-only mode. The effective permission mode comes from GITLAB_PERMISSION_MODE or --permission-mode. Remove it.");
 }
 /**
  * Builds startup warnings for deprecated env vars / CLI flags.
@@ -37,27 +122,72 @@ function legacyToolsetWarning(envName, rawValue, toolset) {
  */
 export function getDeprecatedEnvWarnings(input) {
     const warnings = [];
-    if (input.readOnlyMode) {
-        const conflict = input.permissionModeRaw !== undefined && input.permissionModeRaw !== "readonly"
-            ? ` It OVERRIDES the configured permission mode "${input.permissionModeRaw}"; the server runs as "readonly".`
-            : "";
-        warnings.push("GITLAB_READ_ONLY_MODE is deprecated and will be removed in the next major version. " +
-            `Use GITLAB_PERMISSION_MODE=readonly or --permission-mode=readonly instead.${conflict}`);
+    const readOnly = readOnlyWarning(input);
+    if (readOnly !== undefined) {
+        warnings.push(readOnly);
     }
     if (input.allowedGroupsRaw) {
+        const name = settingName("GITLAB_ALLOWED_GROUPS", "allowed-groups", input.allowedGroupsFromCli === true);
         warnings.push(input.oauthAllowedGroupsRaw
-            ? "GITLAB_ALLOWED_GROUPS is deprecated and ignored because GITLAB_OAUTH_ALLOWED_GROUPS is set. Remove it."
-            : "GITLAB_ALLOWED_GROUPS is deprecated and will be removed in the next major version. Use GITLAB_OAUTH_ALLOWED_GROUPS instead.");
+            ? `${name} is deprecated and ignored because GITLAB_OAUTH_ALLOWED_GROUPS is set. Remove it. It will be removed in ${REMOVAL_VERSION}.`
+            : `${name} is deprecated and will be removed in ${REMOVAL_VERSION}. Use GITLAB_OAUTH_ALLOWED_GROUPS instead.`);
     }
     const legacyToolsetFlags = [
-        [input.useWikiRaw, "USE_GITLAB_WIKI", "wiki"],
-        [input.useMilestoneRaw, "USE_MILESTONE", "milestones"],
-        [input.usePipelineRaw, "USE_PIPELINE", "pipelines"],
+        {
+            rawValue: input.useWikiRaw,
+            envName: "USE_GITLAB_WIKI",
+            cliFlag: "use-wiki",
+            fromCli: input.useWikiFromCli === true,
+            toolset: "wiki",
+        },
+        {
+            rawValue: input.useMilestoneRaw,
+            envName: "USE_MILESTONE",
+            cliFlag: "use-milestone",
+            fromCli: input.useMilestoneFromCli === true,
+            toolset: "milestones",
+        },
+        {
+            rawValue: input.usePipelineRaw,
+            envName: "USE_PIPELINE",
+            cliFlag: "use-pipeline",
+            fromCli: input.usePipelineFromCli === true,
+            toolset: "pipelines",
+        },
     ];
-    for (const [rawValue, envName, toolset] of legacyToolsetFlags) {
-        if (rawValue !== undefined) {
-            warnings.push(legacyToolsetWarning(envName, rawValue, toolset));
+    for (const flag of legacyToolsetFlags) {
+        if (flag.rawValue !== undefined) {
+            warnings.push(legacyToolsetWarning(flag.envName, flag.cliFlag, flag.fromCli, flag.rawValue, flag.toolset, input.toolsetsRaw, input.toolsetsFromCli === true, input.toolsRaw, input.toolsFromCli === true));
         }
     }
-    return warnings;
+    return warnings.map(warning => `${warning} See ${DEPRECATION_NOTICE_URL} for migration details.`);
+}
+function readSuppliedSetting(parsedArgs, env, cliKey, envKey) {
+    return parsedArgs[cliKey] || env[envKey];
+}
+/**
+ * Warning snapshot for one command. CLI flags in `parsedArgs` win over `env`,
+ * matching getConfig, and neither source is read from the process globals.
+ */
+export function deprecatedEnvInputFromSources(parsedArgs, env) {
+    const readOnlyRaw = readSuppliedSetting(parsedArgs, env, "read-only", "GITLAB_READ_ONLY_MODE");
+    return {
+        readOnlyMode: readOnlyRaw === "true",
+        readOnlyRaw,
+        readOnlyFromCli: Boolean(parsedArgs["read-only"]),
+        permissionModeRaw: readSuppliedSetting(parsedArgs, env, "permission-mode", "GITLAB_PERMISSION_MODE"),
+        allowedGroupsRaw: readSuppliedSetting(parsedArgs, env, "allowed-groups", "GITLAB_ALLOWED_GROUPS"),
+        allowedGroupsFromCli: Boolean(parsedArgs["allowed-groups"]),
+        oauthAllowedGroupsRaw: readSuppliedSetting(parsedArgs, env, "oauth-allowed-groups", "GITLAB_OAUTH_ALLOWED_GROUPS"),
+        useWikiRaw: readSuppliedSetting(parsedArgs, env, "use-wiki", "USE_GITLAB_WIKI"),
+        useWikiFromCli: Boolean(parsedArgs["use-wiki"]),
+        useMilestoneRaw: readSuppliedSetting(parsedArgs, env, "use-milestone", "USE_MILESTONE"),
+        useMilestoneFromCli: Boolean(parsedArgs["use-milestone"]),
+        usePipelineRaw: readSuppliedSetting(parsedArgs, env, "use-pipeline", "USE_PIPELINE"),
+        usePipelineFromCli: Boolean(parsedArgs["use-pipeline"]),
+        toolsetsRaw: readSuppliedSetting(parsedArgs, env, "toolsets", "GITLAB_TOOLSETS"),
+        toolsetsFromCli: Boolean(parsedArgs["toolsets"]),
+        toolsRaw: readSuppliedSetting(parsedArgs, env, "tools", "GITLAB_TOOLS"),
+        toolsFromCli: Boolean(parsedArgs["tools"]),
+    };
 }