@zereight/mcp-gitlab 2.2.1 → 2.2.2

package/build/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_READ_ONLY_MODE, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_PERMISSION_MODE_RAW, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_GITLAB_WIKI_RAW, USE_MILESTONE, USE_MILESTONE_RAW, USE_OAUTH, USE_PIPELINE, USE_PIPELINE_RAW, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS_RAW, GITLAB_ALLOWED_GROUPS_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, GITLAB_MCP_COMPACT_TOOL_NAMES, GITLAB_TOOL_PROFILE, } from "./config.js";
+import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, GITLAB_MCP_COMPACT_TOOL_NAMES, GITLAB_TOOL_PROFILE, buildDeprecatedEnvInput, } from "./config.js";
 import { getDeprecatedEnvWarnings } from "./deprecated-env.js";
 /** True when the server is running in remote/network mode (SSE or StreamableHTTP transport). */
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
@@ -97,6 +97,8 @@ import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
 import { encodeRepoFilePayloadContent, fileOperationsIncludeDeleteOrMove, toGitLabCommitActions, } from "./utils/gitlab-commit-actions.js";
 import { redactSensitiveGitLabFields } from "./utils/redact-sensitive.js";
+import { classifyHealthCheckTransportError, redactGitLabUrlCredentials, } from "./utils/health-check-transport-error.js";
+import { redactUrlSecretsInText } from "./utils/redact-url.js";
 import { createMaskingPolicyResolver, getManagedMaskingProjectIds, } from "./masking/index.js";
 import { checkForNewVersion } from "./utils/version-check.js";
 import { assertGitLabVersionAtLeast } from "./utils/gitlab-version-gate.js";
@@ -119,11 +121,15 @@ CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMerg
 GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
-GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabGroupMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineScheduleSchema, GitLabPipelineScheduleVariableSchema, GitLabPipelineSchedulePlayResultSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
-GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListGroupMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, GitLabSnippetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, GetMergeRequestDiscussionSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, CreateWebhookSchema, UpdateWebhookSchema, DeleteWebhookSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
+GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabProtectedTagSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabGroupMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineScheduleSchema, GitLabPipelineScheduleVariableSchema, GitLabPipelineSchedulePlayResultSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
+GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListProjectRunnersSchema, GetRunnerSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListGroupMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, ListProtectedTagsSchema, GetProtectedTagSchema, ProtectTagSchema, UnprotectTagSchema, GitLabTagSchema, GitLabTagSignatureSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, GitLabSnippetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, GetMergeRequestDiscussionSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, CreateWebhookSchema, UpdateWebhookSchema, DeleteWebhookSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
 import { randomUUID, timingSafeEqual, } from "node:crypto";
-import { createLogger } from "./utils/logger.js";
+import { createLogger, flushBufferedLogs, flushStartupLogs } from "./utils/logger.js";
 const logger = createLogger();
+function exitAfterFlush(code) {
+    flushBufferedLogs(logger);
+    process.exit(code);
+}
 // Construct once at startup. When disabled this is undefined and the result
 // path below returns the original objects without reading a config file.
 const maskingPolicyResolver = createMaskingPolicyResolver({
@@ -303,6 +309,7 @@ function createServer() {
                 durationMs,
                 error: safeError instanceof Error ? safeError.message : String(safeError),
             }, `tool_call_error: ${toolName} (${durationMs}ms)`);
+            flushBufferedLogs(logger);
             return safeError;
         };
         try {
@@ -502,7 +509,9 @@ function createServer() {
             return logCompletion(result);
         }
         catch (error) {
-            const isRecoverableToolError = error instanceof GitLabApiError || error instanceof ToolInputError;
+            const isRecoverableToolError = error instanceof GitLabApiError ||
+                error instanceof ToolInputError ||
+                error instanceof ProjectAccessDeniedError;
             const safeError = logError(error);
             if (isRecoverableToolError) {
                 return {
@@ -709,7 +718,7 @@ function validateConfiguration() {
                 new URL(url.trim());
             }
             catch {
-                errors.push(`GITLAB_API_URL contains an invalid URL: ${url.trim()}`);
+                errors.push(`GITLAB_API_URL contains an invalid URL: ${redactUrlSecretsInText(url.trim())}`);
             }
         }
     }
@@ -795,7 +804,7 @@ function validateConfiguration() {
     if (errors.length > 0) {
         logger.error("Configuration validation failed:");
         errors.forEach(err => logger.error(`  - ${err}`));
-        process.exit(1);
+        exitAfterFlush(1);
     }
     logger.info("Configuration validation passed");
 }
@@ -807,6 +816,20 @@ let oauthClient = null;
  * switch to signed/sealed opaque values instead of per-pod in-memory caches.
  */
 let STATELESS_MATERIAL = null;
+let hasEmittedDeprecatedEnvWarnings = false;
+function emitDeprecatedEnvWarnings() {
+    if (hasEmittedDeprecatedEnvWarnings) {
+        return;
+    }
+    hasEmittedDeprecatedEnvWarnings = true;
+    const warnings = getDeprecatedEnvWarnings(buildDeprecatedEnvInput());
+    for (const warning of warnings) {
+        logger.warn(warning);
+    }
+    if (warnings.length > 0) {
+        flushStartupLogs(logger);
+    }
+}
 try {
     // Drive enablement from the already-resolved config flag so the CLI flag
     // (--oauth-stateless-mode) is honored. Re-reading env.OAUTH_STATELESS_MODE
@@ -821,6 +844,7 @@ try {
     }
 }
 catch (err) {
+    emitDeprecatedEnvWarnings();
     // eslint-disable-next-line no-console -- startup failure must be visible
     console.error(`[gitlab-mcp] failed to load stateless secret: ${err.message}`);
     process.exit(1);
@@ -1064,7 +1088,11 @@ const BASE_HEADERS = {
 function buildAuthHeaders() {
     if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
         const ctx = sessionAuthStore.getStore();
-        logger.debug({ sessionId: ctx?.sessionId, header: ctx?.header, apiUrl: ctx?.apiUrl }, "buildAuthHeaders: session context");
+        logger.debug({
+            sessionId: ctx?.sessionId,
+            header: ctx?.header,
+            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
+        }, "buildAuthHeaders: session context");
         if (ctx?.token) {
             return {
                 [ctx.header]: ctx.header === "Authorization" ? `Bearer ${ctx.token}` : ctx.token,
@@ -1112,7 +1140,11 @@ function getEffectiveApiUrl() {
         if (ctx?.apiUrl) {
             return ctx.apiUrl;
         }
-        logger.warn({ sessionId: ctx?.sessionId, header: ctx?.header, apiUrl: ctx?.apiUrl }, "getEffectiveApiUrl: No context or apiUrl found, falling back to default");
+        logger.warn({
+            sessionId: ctx?.sessionId,
+            header: ctx?.header,
+            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
+        }, "getEffectiveApiUrl: No context or apiUrl found, falling back to default");
     }
     return GITLAB_API_URL;
 }
@@ -1278,27 +1310,31 @@ const GITLAB_REPO_FILE_ENCODING = getConfig("repo-file-encoding", "GITLAB_REPO_F
 if (REMOTE_AUTHORIZATION) {
     // Remote authorization mode: token comes from HTTP headers
     if (SSE) {
+        emitDeprecatedEnvWarnings();
         logger.error("REMOTE_AUTHORIZATION=true is not compatible with SSE transport mode");
         logger.error("Please use STREAMABLE_HTTP=true instead");
-        process.exit(1);
+        exitAfterFlush(1);
     }
     if (!STREAMABLE_HTTP) {
+        emitDeprecatedEnvWarnings();
         logger.error("REMOTE_AUTHORIZATION=true requires STREAMABLE_HTTP=true");
         logger.error("Set STREAMABLE_HTTP=true to enable remote authorization");
-        process.exit(1);
+        exitAfterFlush(1);
     }
     logger.info("Remote authorization enabled: tokens will be read from HTTP headers");
 }
 if (GITLAB_MCP_OAUTH) {
     if (SSE) {
+        emitDeprecatedEnvWarnings();
         logger.error("GITLAB_MCP_OAUTH=true is not compatible with SSE transport mode");
         logger.error("Please use STREAMABLE_HTTP=true instead");
-        process.exit(1);
+        exitAfterFlush(1);
     }
     if (!STREAMABLE_HTTP) {
+        emitDeprecatedEnvWarnings();
         logger.error("GITLAB_MCP_OAUTH=true requires STREAMABLE_HTTP=true");
         logger.error("Set STREAMABLE_HTTP=true to enable MCP OAuth");
-        process.exit(1);
+        exitAfterFlush(1);
     }
     logger.info("MCP OAuth enabled: GitLab OAuth proxy active (Private-Token/JOB-TOKEN headers bypass OAuth)");
 }
@@ -1309,10 +1345,12 @@ if (!isCliInvocation(process.argv) &&
     !GITLAB_PERSONAL_ACCESS_TOKEN &&
     !GITLAB_JOB_TOKEN &&
     !GITLAB_AUTH_COOKIE_PATH) {
-    // Standard mode: token must be in environment (unless using OAuth)
+    // Standard mode: token must be in environment (unless using OAuth).
+    // This exit runs before runServer(), so warnings have to be printed here too.
+    emitDeprecatedEnvWarnings();
     logger.error("GITLAB_PERSONAL_ACCESS_TOKEN environment variable is not set");
     logger.info("Either set GITLAB_PERSONAL_ACCESS_TOKEN or enable OAuth with GITLAB_USE_OAUTH=true");
-    process.exit(1);
+    exitAfterFlush(1);
 }
 class GitLabApiError extends Error {
     constructor(message) {
@@ -1326,6 +1364,12 @@ class ToolInputError extends Error {
         this.name = "ToolInputError";
     }
 }
+class ProjectAccessDeniedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ProjectAccessDeniedError";
+    }
+}
 const MERGE_REQUEST_IDENTIFIER_REQUIRED = "Either merge_request_iid or source_branch must be provided";
 /**
  * Utility function for handling GitLab API errors
@@ -1389,7 +1433,8 @@ async function authenticateWithJobTokenFallbackAsync(response) {
 /**
  * @param {string} projectId - The project ID parameter passed to the function
  * @returns {string} The project ID to use for the API call
- * @throws {Error} If GITLAB_ALLOWED_PROJECT_IDS is set and the requested project is not in the whitelist
+ * @throws {ProjectAccessDeniedError} If the requested project is outside the effective allowlist
+ * @throws {Error} If no project can be selected, or multiple allowed projects require an explicit ID
  */
 function getEffectiveProjectId(projectId) {
     const allowedProjectIds = getEffectiveAllowedProjectIds();
@@ -1400,7 +1445,7 @@ function getEffectiveProjectId(projectId) {
         }
         // If a project ID is provided, check if it's in the whitelist
         if (projectId && !allowedProjectIds.includes(projectId)) {
-            throw new Error(`Access denied: Project ${projectId} is not in the allowed project list: ${allowedProjectIds.join(", ")}`);
+            throw new ProjectAccessDeniedError(`Access denied: Project ${projectId} is not in the allowed project list: ${allowedProjectIds.join(", ")}`);
         }
         // If no project ID provided but we have multiple allowed projects, require an explicit choice
         if (!projectId && allowedProjectIds.length > 1) {
@@ -4643,6 +4688,28 @@ async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
         };
     }
 }
+function healthCheckTransportErrorResult(error) {
+    const failure = classifyHealthCheckTransportError(error);
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({
+                    status: "error",
+                    authenticated: false,
+                    gitlab_url: redactGitLabUrlCredentials(getEffectiveApiUrl()),
+                    mcp_server_version: SERVER_VERSION,
+                    error: {
+                        kind: failure.kind,
+                        code: failure.code,
+                        message: failure.message,
+                        ...(failure.hint !== undefined ? { hint: failure.hint } : {}),
+                    },
+                }),
+            },
+        ],
+    };
+}
 async function fetchGitLabVersionMetadata() {
     try {
         const response = await fetch(`${getEffectiveApiUrl()}/version`, {
@@ -5442,6 +5509,132 @@ async function getEnvironment(projectId, environmentId) {
     const data = await response.json();
     return GitLabEnvironmentSchema.parse(data);
 }
+async function listProjectRunners(projectId, options) {
+    const decodedProjectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(decodedProjectId))}/runners`);
+    appendFilterParams(url.searchParams, options);
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    return redactSensitiveGitLabFields(await response.json());
+}
+const PROJECT_RUNNER_LOOKUP_PAGE_SIZE = 100;
+const MAX_PROJECT_RUNNER_LOOKUP_PAGES = 100;
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function runnerEntryId(entry) {
+    if (!isJsonObject(entry)) {
+        return undefined;
+    }
+    const id = entry.id;
+    if (typeof id === "number" && Number.isFinite(id)) {
+        return String(id);
+    }
+    if (typeof id === "string" && id !== "") {
+        return id;
+    }
+    return undefined;
+}
+function projectIsInAllowlist(project, allowedProjectIds) {
+    if (!isJsonObject(project)) {
+        return false;
+    }
+    const id = project.id;
+    const pathWithNamespace = project.path_with_namespace;
+    const idText = typeof id === "number" && Number.isFinite(id)
+        ? String(id)
+        : typeof id === "string"
+            ? id
+            : undefined;
+    return ((idText !== undefined && allowedProjectIds.includes(idText)) ||
+        (typeof pathWithNamespace === "string" && allowedProjectIds.includes(pathWithNamespace)));
+}
+/**
+ * GET /runners/:id is not project-scoped. Instance runner details are visible to
+ * any authenticated user and can list projects outside GITLAB_ALLOWED_PROJECT_IDS.
+ * Keep only projects on the effective allowlist, and drop groups because a group
+ * path cannot be checked against a project allowlist.
+ */
+function restrictRunnerDetailsToAllowlist(runner, allowedProjectIds) {
+    if (!isJsonObject(runner)) {
+        return runner;
+    }
+    const restricted = {};
+    for (const [key, value] of Object.entries(runner)) {
+        if (key === "groups") {
+            continue;
+        }
+        if (key === "projects" && Array.isArray(value)) {
+            restricted.projects = value.filter(project => projectIsInAllowlist(project, allowedProjectIds));
+            continue;
+        }
+        restricted[key] = value;
+    }
+    return restricted;
+}
+/**
+ * Confirm the runner is among the runners available to an allowed project.
+ * GitLab has no single-runner project read; membership is the paginated
+ * GET /projects/:id/runners list, which includes ancestor group runners and
+ * allowed instance runners. Fail closed when the list cannot be fully scanned.
+ */
+async function assertRunnerAvailableToProject(projectId, runnerId) {
+    const effectiveProjectId = getEffectiveProjectId(decodeURIComponent(projectId));
+    let page = 1;
+    while (page <= MAX_PROJECT_RUNNER_LOOKUP_PAGES) {
+        const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/runners`);
+        url.searchParams.set("per_page", String(PROJECT_RUNNER_LOOKUP_PAGE_SIZE));
+        url.searchParams.set("page", String(page));
+        const response = await fetch(url.toString(), {
+            ...getFetchConfig(),
+        });
+        await handleGitLabError(response);
+        const data = await response.json();
+        if (!Array.isArray(data)) {
+            throw new GitLabApiError(`Could not verify runner ${runnerId} against project ${effectiveProjectId}`);
+        }
+        if (data.some(entry => runnerEntryId(entry) === runnerId)) {
+            return;
+        }
+        const nextPageHeader = response.headers.get("x-next-page");
+        if (!nextPageHeader) {
+            throw new GitLabApiError("Runner not found");
+        }
+        const nextPage = Number.parseInt(nextPageHeader, 10);
+        if (!Number.isFinite(nextPage) || nextPage <= page) {
+            throw new ProjectAccessDeniedError(`Access denied: Runner ${runnerId} could not be verified against project ${effectiveProjectId}`);
+        }
+        page = nextPage;
+    }
+    throw new ProjectAccessDeniedError(`Access denied: Runner ${runnerId} could not be verified against project ${effectiveProjectId}`);
+}
+async function getRunner(runnerId, projectId) {
+    const allowedProjectIds = getEffectiveAllowedProjectIds();
+    const decodedProjectId = projectId === undefined || projectId.trim() === "" ? undefined : decodeURIComponent(projectId);
+    // GITLAB_PROJECT_ID is the default project, same as getEffectiveProjectId.
+    // It is not an allowlist, so runner details stay unfiltered unless
+    // GITLAB_ALLOWED_PROJECT_IDS is set.
+    if (allowedProjectIds.length > 0 ||
+        decodedProjectId !== undefined ||
+        Boolean(GITLAB_PROJECT_ID)) {
+        await assertRunnerAvailableToProject(getEffectiveProjectId(decodedProjectId ?? ""), runnerId);
+    }
+    const url = new URL(`${getEffectiveApiUrl()}/runners/${encodeGitLabPathSegment(runnerId)}`);
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    if (response.status === 404) {
+        throw new GitLabApiError("Runner not found");
+    }
+    await handleGitLabError(response);
+    const details = redactSensitiveGitLabFields(await response.json());
+    if (allowedProjectIds.length === 0) {
+        return details;
+    }
+    return restrictRunnerDetailsToAllowlist(details, allowedProjectIds);
+}
 async function environmentRequest(projectId, path, method, body, query) {
     projectId = decodeURIComponent(projectId);
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/environments${path}`);
@@ -7039,7 +7232,7 @@ function assertVulnerabilityProjectAllowed(vulnerabilityId, project) {
     const allowed = (fullPath !== undefined && allowedProjectIds.includes(fullPath)) ||
         (numericId !== undefined && allowedProjectIds.includes(numericId));
     if (!allowed) {
-        throw new Error(`Access denied: Vulnerability ${vulnerabilityId} belongs to project ${fullPath ?? numericId ?? "unknown"}, which is not in the allowed project list: ${allowedProjectIds.join(", ")}`);
+        throw new ProjectAccessDeniedError(`Access denied: Vulnerability ${vulnerabilityId} belongs to project ${fullPath ?? numericId ?? "unknown"}, which is not in the allowed project list: ${allowedProjectIds.join(", ")}`);
     }
 }
 /**
@@ -7863,7 +8056,7 @@ async function handleToolCall(params) {
                 const controller = new AbortController();
                 const timeoutMs = 45000;
                 const timeout = setTimeout(() => controller.abort(), timeoutMs);
-                logger.info({ endpoint: graphqlUrl }, "execute_graphql request");
+                logger.info({ endpoint: redactUrlSecretsInText(graphqlUrl) }, "execute_graphql request");
                 try {
                     const response = await fetch(graphqlUrl, {
                         ...getFetchConfig(),
@@ -9286,6 +9479,20 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(environment) }],
                 };
             }
+            case "list_project_runners": {
+                const { project_id, ...options } = ListProjectRunnersSchema.parse(params.arguments);
+                const runners = await listProjectRunners(project_id, options);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(runners) }],
+                };
+            }
+            case "get_runner": {
+                const { runner_id, project_id } = GetRunnerSchema.parse(params.arguments);
+                const runner = await getRunner(runner_id, project_id);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(runner) }],
+                };
+            }
             case "update_environment": {
                 const { project_id, environment_id, ...body } = UpdateEnvironmentSchema.parse(params.arguments);
                 return {
@@ -10518,6 +10725,77 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(signature) }],
                 };
             }
+            case "list_protected_tags": {
+                const args = ListProtectedTagsSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_tags`);
+                if (args.page)
+                    url.searchParams.append("page", String(args.page));
+                if (args.per_page)
+                    url.searchParams.append("per_page", String(args.per_page));
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                });
+                await handleGitLabError(response);
+                const data = z.array(GitLabProtectedTagSchema).parse(await response.json());
+                return {
+                    content: [{ type: "text", text: JSON.stringify(data) }],
+                };
+            }
+            case "get_protected_tag": {
+                const args = GetProtectedTagSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_tags/${encodeGitLabPathSegment(args.tag_name)}`);
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                });
+                await handleGitLabError(response);
+                const data = GitLabProtectedTagSchema.parse(await response.json());
+                return {
+                    content: [{ type: "text", text: JSON.stringify(data) }],
+                };
+            }
+            case "protect_tag": {
+                const args = ProtectTagSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_tags`);
+                const body = { name: args.tag_name };
+                if (args.create_access_level !== undefined) {
+                    body.create_access_level = args.create_access_level;
+                }
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                    method: "POST",
+                    body: JSON.stringify(body),
+                });
+                await handleGitLabError(response);
+                const data = GitLabProtectedTagSchema.parse(await response.json());
+                return {
+                    content: [{ type: "text", text: JSON.stringify(data) }],
+                };
+            }
+            case "unprotect_tag": {
+                const args = UnprotectTagSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_tags/${encodeGitLabPathSegment(args.tag_name)}`);
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                    method: "DELETE",
+                });
+                await handleGitLabError(response);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ status: "unprotected", tag: args.tag_name }),
+                        },
+                    ],
+                };
+            }
             case "list_snippets": {
                 const args = ListSnippetsSchema.parse(params.arguments);
                 const { project_id, ...options } = args;
@@ -10650,8 +10928,21 @@ async function handleToolCall(params) {
             case "health_check": {
                 HealthCheckSchema.parse(params.arguments ?? {});
                 const url = new URL(`${getEffectiveApiUrl()}/user`);
-                const response = await fetch(url.toString(), getFetchConfig());
-                const jobAuthenticated = await authenticateWithJobTokenFallbackAsync(response);
+                const fetchConfig = getFetchConfig();
+                let response;
+                try {
+                    response = await fetch(url.toString(), fetchConfig);
+                }
+                catch (error) {
+                    return healthCheckTransportErrorResult(error);
+                }
+                let jobAuthenticated;
+                try {
+                    jobAuthenticated = await authenticateWithJobTokenFallbackAsync(response);
+                }
+                catch (error) {
+                    return healthCheckTransportErrorResult(error);
+                }
                 // insufficient_scope and insufficient_granular_scope mean the token was accepted
                 // but User API scope is missing.
                 // Rate-limit and authentication-ban 403s stay unauthenticated.
@@ -10665,7 +10956,7 @@ async function handleToolCall(params) {
                             text: JSON.stringify({
                                 status: authenticated ? "ok" : "error",
                                 authenticated,
-                                gitlab_url: getEffectiveApiUrl(),
+                                gitlab_url: redactGitLabUrlCredentials(getEffectiveApiUrl()),
                                 mcp_server_version: SERVER_VERSION,
                                 ...(insufficientUserScope ? { user_api_warning: USER_API_HEALTH_WARNING } : {}),
                                 ...(versionMetadata ?? {}),
@@ -11198,7 +11489,7 @@ async function startStreamableHTTPServer() {
             }
             catch (error) {
                 const reason = error instanceof Error ? error.message : "Invalid X-GitLab-API-URL";
-                logger.warn(`Invalid X-GitLab-API-URL provided: ${dynamicApiUrl}. ${reason}`);
+                logger.warn(`Invalid X-GitLab-API-URL provided: ${redactUrlSecretsInText(dynamicApiUrl)}. ${reason}`);
                 return null; // Reject if URL is malformed or not allowed
             }
         }
@@ -12250,7 +12541,7 @@ function initOAuthClient() {
         return;
     }
     if (isCleartextRemoteUrl(GITLAB_API_URL)) {
-        throw new Error(`Refusing to send OAuth tokens over cleartext HTTP to ${GITLAB_API_URL}. ` +
+        throw new Error(`Refusing to send OAuth tokens over cleartext HTTP to ${redactUrlSecretsInText(GITLAB_API_URL)}. ` +
             "Use an https:// GITLAB_API_URL (http:// is only allowed for localhost).");
     }
     oauthClient = createGitLabOAuthClient(GITLAB_API_URL.replace(/\/api\/v4$/, ""));
@@ -12261,6 +12552,9 @@ function initOAuthClient() {
  */
 async function runServer() {
     try {
+        // Print before validateConfiguration(), which process.exit()s on failure.
+        // logger.warn goes to stderr; stdio transport owns stdout for JSON-RPC.
+        emitDeprecatedEnvWarnings();
         // Validate configuration before starting server
         validateConfiguration();
         // Initialize OAuth token if OAuth is enabled
@@ -12272,7 +12566,7 @@ async function runServer() {
             }
             catch (error) {
                 logger.error({ err: error }, "OAuth authentication failed");
-                process.exit(1);
+                exitAfterFlush(1);
             }
         }
         const transportMode = determineTransportMode();
@@ -12287,35 +12581,26 @@ async function runServer() {
                 }
             });
         }
-        logger.info(`Configured GitLab API URLs: ${GITLAB_API_URLS.join(", ")}`);
-        logger.info(`Default GitLab API URL: ${GITLAB_API_URL}`);
-        for (const warning of getDeprecatedEnvWarnings({
-            readOnlyMode: GITLAB_READ_ONLY_MODE,
-            permissionModeRaw: GITLAB_PERMISSION_MODE_RAW,
-            allowedGroupsRaw: GITLAB_ALLOWED_GROUPS_RAW,
-            oauthAllowedGroupsRaw: GITLAB_OAUTH_ALLOWED_GROUPS_RAW,
-            useWikiRaw: USE_GITLAB_WIKI_RAW,
-            useMilestoneRaw: USE_MILESTONE_RAW,
-            usePipelineRaw: USE_PIPELINE_RAW,
-        })) {
-            logger.warn(warning);
-        }
+        logger.info(`Configured GitLab API URLs: ${GITLAB_API_URLS.map(redactUrlSecretsInText).join(", ")}`);
+        logger.info(`Default GitLab API URL: ${redactUrlSecretsInText(GITLAB_API_URL)}`);
         if (GITLAB_OAUTH_ALLOWED_GROUPS) {
             logger.info(`Group access control enabled for: ${GITLAB_OAUTH_ALLOWED_GROUPS.join(", ")}`);
         }
     }
     catch (error) {
         logger.error({ err: error }, "Error initializing server");
-        process.exit(1);
+        exitAfterFlush(1);
     }
 }
 async function main() {
     const cli = resolveCli(process.argv);
     if (cli.kind === "help") {
+        emitDeprecatedEnvWarnings();
         process.stdout.write(cli.text);
         process.exit(0);
     }
     if (cli.kind === "usage" || cli.kind === "refused") {
+        emitDeprecatedEnvWarnings();
         process.stderr.write(`${cli.message}\n`);
         process.exit(2);
     }
@@ -12328,10 +12613,11 @@ async function main() {
             const message = error instanceof Error ? error.message : String(error);
             process.stderr.write(`${message}\n`);
             logger.error({ err: error }, "auth command failed");
-            process.exit(1);
+            exitAfterFlush(1);
         }
     }
     if (cli.kind === "run") {
+        emitDeprecatedEnvWarnings();
         if (!hasCliCredentials()) {
             process.stderr.write("Missing GitLab credentials. Set --token or GITLAB_PERSONAL_ACCESS_TOKEN, or run `auth` with GITLAB_USE_OAUTH=true.\n");
             process.exit(2);
@@ -12354,7 +12640,7 @@ async function main() {
         catch (error) {
             process.stderr.write(formatCliError(error));
             logger.error({ err: error }, "cli command failed");
-            process.exit(1);
+            exitAfterFlush(1);
         }
     }
     await runServer();
@@ -12381,5 +12667,5 @@ function maskCliToolResult(toolName, result) {
 }
 main().catch(error => {
     logger.fatal({ err: error }, "Fatal error in main()");
-    process.exit(1);
+    exitAfterFlush(1);
 });

package/build/oauth-proxy.js

@@ -51,6 +51,7 @@ import { looksLikeStatelessClientId, mintClientId, openClientId, } from "./state
 import { looksLikeStatelessState, mintPendingAuthState, openPendingAuthState, } from "./stateless/pending-auth.js";
 import { looksLikeStatelessStoredTokensCode, mintStoredTokensCode, openStoredTokensCode, ConsumedProxyCodeCache, PROXY_CODE_CACHE_FULL, } from "./stateless/index.js";
 import { createLogger } from "./utils/logger.js";
+import { redactUrlSecretsInText } from "./utils/redact-url.js";
 const logger = createLogger("gitlab-mcp-oauth-proxy");
 // ---------------------------------------------------------------------------
 // GitLab OAuth Server Provider
@@ -162,7 +163,7 @@ class GitLabOAuthServerProvider {
             throw new Error("callbackUrl is required when callbackProxyEnabled is true");
         }
         if (callbackProxyEnabled) {
-            logger.info(`Callback proxy mode enabled — fixed callback URL: ${callbackUrl}`);
+            logger.info(`Callback proxy mode enabled — fixed callback URL: ${redactUrlSecretsInText(callbackUrl)}`);
         }
         if (stateless) {
             logger.info(`Stateless mode enabled (client_id TTL: ${stateless.clientTtlSeconds}s, ` +