@zereight/mcp-gitlab 2.3.7-next.136 → 2.3.7-next.137

package/build/index.js

@@ -94,7 +94,7 @@ import { listMcpResources, listMcpResourceTemplates, readMcpResource, } from "./
 import { getMcpPrompt, listMcpPrompts } from "./server/mcp-prompts.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
-import { apiUrlHostnameForLog, apiUrlUserinfoWarning, commaSplitHint, configuredApiUrlErrors, encodeGitLabPath, encodeGitLabPathSegment, invalidListEntryError, isCleartextRemoteUrl, normalizeGitLabApiUrl, parseConfiguredGitLabApiUrls, } from "./utils/url.js";
+import { apiUrlUserinfoWarning, commaSplitHint, configuredApiUrlErrors, encodeGitLabPath, encodeGitLabPathSegment, invalidListEntryError, isCleartextRemoteUrl, normalizeGitLabApiUrl, parseConfiguredGitLabApiUrls, } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, resolveDownloadRoot, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
@@ -12976,8 +12976,9 @@ function initOAuthClient() {
     }
     if (isCleartextRemoteUrl(GITLAB_API_URL)) {
         throw new Error(
-        // The host name only: a port can hold the start of a password (see apiUrlHostnameForLog).
-        `Refusing to send OAuth tokens over cleartext HTTP to http://${apiUrlHostnameForLog(GITLAB_API_URL)}. ` +
+        // The host name only, from the list GITLAB_API_URL is the first of: a port, or a
+        // whole URL split off by a comma, can be part of a password (see parseConfiguredGitLabApiUrls).
+        `Refusing to send OAuth tokens over cleartext HTTP to http://${CONFIGURED_GITLAB_API_URLS.hostnamesForLog[0]}. ` +
             "Use an https:// GITLAB_API_URL (http:// is only allowed for localhost).");
     }
     oauthClient = createGitLabOAuthClient(GITLAB_API_URL.replace(/\/api\/v4$/, ""));
@@ -13017,9 +13018,11 @@ async function runServer() {
                 }
             });
         }
-        // Host names only. GITLAB_API_URL is GITLAB_API_URLS[0], so it is logged the same way.
-        logger.info(`Configured GitLab API URLs: ${GITLAB_API_URLS.map(apiUrlHostnameForLog).join(", ")}`);
-        logger.info(`Default GitLab API URL: ${apiUrlHostnameForLog(GITLAB_API_URL)}`);
+        // Host names only, decided for the whole list (see parseConfiguredGitLabApiUrls).
+        // GITLAB_API_URL is GITLAB_API_URLS[0], so it is logged the same way.
+        const hostnames = CONFIGURED_GITLAB_API_URLS.hostnamesForLog;
+        logger.info(`Configured GitLab API URLs: ${hostnames.join(", ")}`);
+        logger.info(`Default GitLab API URL: ${hostnames[0]}`);
         if (GITLAB_OAUTH_ALLOWED_GROUPS) {
             logger.info(`Group access control enabled for: ${GITLAB_OAUTH_ALLOWED_GROUPS.join(", ")}`);
         }

package/build/utils/url.js

@@ -102,19 +102,43 @@ function apiUrlProblem(url) {
  * them would fail every request and echo the password in the error.
  */
 export function parseConfiguredGitLabApiUrls(value) {
-    const entries = splitCommaSeparatedUrls(value).map(stripUrlUserinfo);
+    const rawEntries = splitCommaSeparatedUrls(value);
+    const entries = rawEntries.map(stripUrlUserinfo);
+    const urls = entries.map(entry => normalizeGitLabApiUrl(entry.url));
     return {
-        urls: entries.map(entry => normalizeGitLabApiUrl(entry.url)),
+        urls,
         hadUserinfo: entries.some(entry => entry.hadUserinfo),
+        hostnamesForLog: apiUrlHostnamesForLog(rawEntries, urls),
     };
 }
+const INVALID_HOSTNAME = "<invalid>";
 /**
- * The host name of a configured API URL, for the startup log. A password with a
- * literal comma can be split into two URLs, and "http://alice:12" then reads
+ * The host name of each configured API URL, for the startup log. `rawEntries`
+ * are the entries as split, before userinfo is dropped, and `urls` the URLs
+ * built from them. A password with literal commas can be split into several
+ * URLs: "http://alice:12,http://password:34,http://tail@host" gives
+ * "http://password:34", whose host is part of the password, and no single
+ * entry shows that. The password ends at an "@", so every entry before the last
+ * one with an "@" shows as "<invalid>", even when it is a whole URL of its own.
+ */
+function apiUrlHostnamesForLog(rawEntries, urls) {
+    let lastWithAt = -1;
+    rawEntries.forEach((entry, index) => {
+        if (entry.includes("@")) {
+            lastWithAt = index;
+        }
+    });
+    return urls.map((url, index) => index < lastWithAt ? INVALID_HOSTNAME : apiUrlHostnameForLog(url));
+}
+/**
+ * The host name of one configured API URL, for the startup log. A password with
+ * a literal comma can be split into two URLs, and "http://alice:12" then reads
  * the start of the password as a port, which text redaction keeps. The port,
  * userinfo, path, and query are left out. An IPv6 host keeps its brackets.
  * An "@" after the host means the host can be part of a password
  * ("http://sec/ret@host" from "alice:12,http://sec/ret@host"), so it is not shown.
+ * The host of a URL cut out of the middle of a password looks like any other
+ * host here, so the startup log uses the list from parseConfiguredGitLabApiUrls.
  */
 export function apiUrlHostnameForLog(url) {
     let parsed;
@@ -122,10 +146,10 @@ export function apiUrlHostnameForLog(url) {
         parsed = new URL(url);
     }
     catch {
-        return "<invalid>";
+        return INVALID_HOSTNAME;
     }
     const atAfterHost = parsed.pathname.includes("@") || parsed.search.includes("@") || parsed.hash.includes("@");
-    return parsed.hostname.length === 0 || atAfterHost ? "<invalid>" : parsed.hostname;
+    return parsed.hostname.length === 0 || atAfterHost ? INVALID_HOSTNAME : parsed.hostname;
 }
 const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.3.7-next.136",
+  "version": "2.3.7-next.137",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [