opencode-gitlab-plugin 3.0.1 → 3.2.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file. See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.2.0](https://gitlab.com/vglafirov/opencode-gitlab-plugin/compare/v3.1.0...v3.2.0) (2026-10-25)
+
+
+### ✨ Features
+
+* **notes:** support confidential/internal notes in gitlab_create_note ([90cedca](https://gitlab.com/vglafirov/opencode-gitlab-plugin/commit/90cedcac2ab128a2f2377a2951776e47a0d395ba))
+
+## [3.1.0](https://gitlab.com/vglafirov/opencode-gitlab-plugin/compare/v3.0.1...v3.1.0) (2026-10-13)
+
+
+### ✨ Features
+
+* **orbit:** derive neighbors default rel_types from the schema ([567a114](https://gitlab.com/vglafirov/opencode-gitlab-plugin/commit/567a114be061e6fc5e6d59984c497f8621a9a582))
+
 ## [3.0.1](https://gitlab.com/vglafirov/opencode-gitlab-plugin/compare/v3.0.0...v3.0.1) (2026-10-06)
 
 

package/README.md

@@ -477,11 +477,11 @@ The plugin provides **64 tools** organized into the following categories:
 
 ### Notes Tools (3 tools)
 
-| Tool                 | Description                                                                                         |
-| -------------------- | --------------------------------------------------------------------------------------------------- |
-| `gitlab_list_notes`  | List all notes/comments on any resource (MRs, issues, epics, snippets) with cursor-based pagination |
-| `gitlab_get_note`    | Get a single note by ID (issues and epics only)                                                     |
-| `gitlab_create_note` | Add a simple comment to any resource (for thread replies, use `gitlab_create_discussion`)           |
+| Tool                 | Description                                                                                                                                                                                |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `gitlab_list_notes`  | List all notes/comments on any resource (MRs, issues, epics, snippets) with cursor-based pagination                                                                                        |
+| `gitlab_get_note`    | Get a single note by ID (issues and epics only)                                                                                                                                            |
+| `gitlab_create_note` | Add a simple comment to any resource (for thread replies, use `gitlab_create_discussion`). Pass `internal: true` to post a confidential/internal note on merge requests, issues, and epics |
 
 ### Audit Event Tools (3 tools)
 
@@ -534,6 +534,15 @@ await plugin.tool.gitlab_create_note.execute({
   body: 'I will start working on this today.',
 });
 
+// Add a confidential/internal note (visible only to project members; merge requests, issues, and epics)
+await plugin.tool.gitlab_create_note.execute({
+  resource_type: 'issue',
+  project_id: 'my-group/my-project',
+  iid: issue.iid,
+  body: 'Internal triage note - not visible to the reporter.',
+  internal: true,
+});
+
 // List all issues with specific labels
 const issues = await plugin.tool.gitlab_list_issues.execute({
   project_id: 'my-group/my-project',

package/dist/index.js

@@ -511,9 +511,22 @@ var MergeRequestsClient = class _MergeRequestsClient extends GitLabApiClient {
       requestBody
     );
   }
-  async createMrNote(projectId, mrIid, body, discussionId) {
+  /**
+   * Create a note on a merge request.
+   *
+   * When `discussionId` is set the note is a reply on that discussion thread, which the
+   * GitLab Notes API does not allow to be internal. Passing `internal=true` together with a
+   * `discussionId` therefore throws (fail-closed) rather than silently dropping the
+   * confidentiality flag. Post a standalone internal note (omit `discussionId`) instead.
+   */
+  async createMrNote(projectId, mrIid, body, discussionId, internal) {
     const encodedProject = this.encodeProjectId(projectId);
     if (discussionId) {
+      if (internal) {
+        throw new Error(
+          "internal=true is not supported when replying to a discussion. The GitLab Notes API does not accept an internal flag on discussion replies, so honouring it silently would drop a confidentiality flag. Post a standalone internal note (omit discussionId) instead."
+        );
+      }
       return this.fetch(
         "POST",
         `/projects/${encodedProject}/merge_requests/${mrIid}/discussions/${discussionId}/notes`,
@@ -523,7 +536,7 @@ var MergeRequestsClient = class _MergeRequestsClient extends GitLabApiClient {
     return this.fetch(
       "POST",
       `/projects/${encodedProject}/merge_requests/${mrIid}/notes`,
-      { body }
+      internal ? { body, internal: true } : { body }
     );
   }
   async updateMrNote(projectId, mrIid, noteId, body) {
@@ -989,9 +1002,22 @@ var IssuesClient = class extends GitLabApiClient {
       `/projects/${encodedProject}/issues/${issueIid}/discussions/${discussionId}`
     );
   }
-  async createIssueNote(projectId, issueIid, body, discussionId) {
+  /**
+   * Create a note on an issue.
+   *
+   * When `discussionId` is set the note is a reply on that discussion thread, which the
+   * GitLab Notes API does not allow to be internal. Passing `internal=true` together with a
+   * `discussionId` therefore throws (fail-closed) rather than silently dropping the
+   * confidentiality flag. Post a standalone internal note (omit `discussionId`) instead.
+   */
+  async createIssueNote(projectId, issueIid, body, discussionId, internal) {
     const encodedProject = this.encodeProjectId(projectId);
     if (discussionId) {
+      if (internal) {
+        throw new Error(
+          "internal=true is not supported when replying to a discussion. The GitLab Notes API does not accept an internal flag on discussion replies, so honouring it silently would drop a confidentiality flag. Post a standalone internal note (omit discussionId) instead."
+        );
+      }
       return this.fetch(
         "POST",
         `/projects/${encodedProject}/issues/${issueIid}/discussions/${discussionId}/notes`,
@@ -1001,7 +1027,7 @@ var IssuesClient = class extends GitLabApiClient {
     return this.fetch(
       "POST",
       `/projects/${encodedProject}/issues/${issueIid}/notes`,
-      { body }
+      internal ? { body, internal: true } : { body }
     );
   }
   async resolveIssueDiscussion(projectId, issueIid, discussionId) {
@@ -2332,9 +2358,22 @@ var EpicsClient = class extends GitLabApiClient {
       `/groups/${encodedGroup}/epics/${epicIid}/discussions/${discussionId}`
     );
   }
-  async createEpicNote(groupId, epicIid, body, discussionId) {
+  /**
+   * Create a note on an epic.
+   *
+   * When `discussionId` is set the note is a reply on that discussion thread, which the
+   * GitLab Notes API does not allow to be internal. Passing `internal=true` together with a
+   * `discussionId` therefore throws (fail-closed) rather than silently dropping the
+   * confidentiality flag. Post a standalone internal note (omit `discussionId`) instead.
+   */
+  async createEpicNote(groupId, epicIid, body, discussionId, internal) {
     const encodedGroup = encodeURIComponent(groupId);
     if (discussionId) {
+      if (internal) {
+        throw new Error(
+          "internal=true is not supported when replying to a discussion. The GitLab Notes API does not accept an internal flag on discussion replies, so honouring it silently would drop a confidentiality flag. Post a standalone internal note (omit discussionId) instead."
+        );
+      }
       return this.fetch(
         "POST",
         `/groups/${encodedGroup}/epics/${epicIid}/discussions/${discussionId}/notes`,
@@ -2344,7 +2383,7 @@ var EpicsClient = class extends GitLabApiClient {
     return this.fetch(
       "POST",
       `/groups/${encodedGroup}/epics/${epicIid}/notes`,
-      { body }
+      internal ? { body, internal: true } : { body }
     );
   }
   async getEpicNote(groupId, epicIid, noteId) {
@@ -4902,9 +4941,14 @@ Creates a standalone comment (not part of a thread).
 For replying to existing discussion threads, use gitlab_create_discussion 
 with discussion_id parameter instead.
 
+Set internal=true to post a confidential/internal note visible only to project members
+(supported for merge requests, issues, and epics; not supported for snippets, where passing
+internal=true raises an error rather than silently posting a public note).
+
 Examples:
 - MR comment: resource_type="merge_request", project_id="group/project", iid=123, body="LGTM!"
 - Issue comment: resource_type="issue", project_id="group/project", iid=456, body="Working on this"
+- Internal issue note: resource_type="issue", project_id="group/project", iid=456, body="Internal only", internal=true
 - Epic comment: resource_type="epic", group_id="my-group", iid=1, body="Planning complete"
 - Snippet comment: resource_type="snippet", project_id="group/project", snippet_id=789, body="Nice code!"`,
     args: {
@@ -4913,27 +4957,53 @@ Examples:
       project_id: z14.string().optional().describe("Project ID or path. Required for merge_request, issue, snippet"),
       group_id: z14.string().optional().describe("Group ID or path. Required for epic"),
       iid: z14.number().optional().describe("Internal ID of the resource (for merge_request, issue, epic)"),
-      snippet_id: z14.number().optional().describe("Snippet ID (required for snippet)")
+      snippet_id: z14.number().optional().describe("Snippet ID (required for snippet)"),
+      internal: z14.boolean().optional().describe(
+        "Post as a confidential/internal note visible only to project members (merge requests, issues, and epics; not supported for snippets, where passing true raises an error). Defaults to false (public note)."
+      )
     },
     execute: async (args, _ctx) => {
       validateNoteParams(args.resource_type, args, { allowedTypes: NOTE_RESOURCE_TYPES });
+      if (args.internal && args.resource_type === "snippet") {
+        throw new Error(
+          `internal=true is not supported for snippet notes. Refusing to post a note that was intended to be confidential as a public note.`
+        );
+      }
       const client = getGitLabClient();
       switch (args.resource_type) {
         case "merge_request":
           return JSON.stringify(
-            await client.createMrNote(args.project_id, args.iid, args.body),
+            await client.createMrNote(
+              args.project_id,
+              args.iid,
+              args.body,
+              void 0,
+              args.internal
+            ),
             null,
             2
           );
         case "issue":
           return JSON.stringify(
-            await client.createIssueNote(args.project_id, args.iid, args.body),
+            await client.createIssueNote(
+              args.project_id,
+              args.iid,
+              args.body,
+              void 0,
+              args.internal
+            ),
             null,
             2
           );
         case "epic":
           return JSON.stringify(
-            await client.createEpicNote(args.group_id, args.iid, args.body),
+            await client.createEpicNote(
+              args.group_id,
+              args.iid,
+              args.body,
+              void 0,
+              args.internal
+            ),
             null,
             2
           );
@@ -5450,6 +5520,65 @@ Examples:
 // src/tools/orbit.ts
 import { tool as tool18 } from "@opencode-ai/plugin";
 var z18 = tool18.schema;
+var MAX_REL_TYPES = 10;
+var SCHEMA_CACHE_TTL_MS = 10 * 60 * 1e3;
+var schemaCache = /* @__PURE__ */ new Map();
+var schemaInflight = /* @__PURE__ */ new Map();
+async function loadOrbitSchema(client) {
+  const key = process.env["GITLAB_INSTANCE_URL"] || "https://gitlab.com";
+  const cached = schemaCache.get(key);
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.schema;
+  }
+  const inflight = schemaInflight.get(key);
+  if (inflight) {
+    return inflight;
+  }
+  const request = (async () => {
+    try {
+      const schema = await client.fetch("GET", "/orbit/schema");
+      if (!schema || !Array.isArray(schema.edges)) {
+        return void 0;
+      }
+      schemaCache.set(key, { schema, expiresAt: Date.now() + SCHEMA_CACHE_TTL_MS });
+      return schema;
+    } catch {
+      return void 0;
+    }
+  })();
+  schemaInflight.set(key, request);
+  void request.finally(() => {
+    if (schemaInflight.get(key) === request) {
+      schemaInflight.delete(key);
+    }
+  });
+  return request;
+}
+function deriveRelTypes(schema, entityType, preferred) {
+  const touching = /* @__PURE__ */ new Set();
+  for (const edge of schema.edges ?? []) {
+    const touchesEntity = (edge.variants ?? []).some(
+      (variant) => variant.source_type === entityType || variant.target_type === entityType
+    );
+    if (touchesEntity) {
+      touching.add(edge.name);
+    }
+  }
+  const rank = (name) => {
+    const index = preferred.indexOf(name);
+    return index === -1 ? preferred.length : index;
+  };
+  return [...touching].sort((a, b) => rank(a) - rank(b) || a.localeCompare(b)).slice(0, MAX_REL_TYPES);
+}
+async function defaultRelTypes(client, entityType) {
+  const fallback = orbitRelTypes(entityType);
+  const schema = await loadOrbitSchema(client);
+  if (!schema) {
+    return fallback;
+  }
+  const derived = deriveRelTypes(schema, entityType, fallback);
+  return derived.length > 0 ? derived : fallback;
+}
 function orbitRelTypes(entityType) {
   switch (entityType) {
     case "MergeRequest":
@@ -5786,15 +5915,15 @@ then use that ID (e.g., 377844873). For epics, use the work_item_id.`,
       ),
       direction: z18.enum(["incoming", "outgoing", "both"]).optional().describe("Direction of relationships to traverse (default: both)"),
       rel_types: z18.array(z18.string()).optional().describe(
-        'Relationship types to follow. Required by the API to bound the lookup; if omitted, a sensible default set for the entity type is used. The API caps this at 10 per selector, so more than 10 entries are truncated to the first 10 and the response includes a "warnings" field. See gitlab_orbit_schema for valid edge types.'
+        'Relationship types to follow. Required by the API to bound the lookup; if omitted, up to 10 edge types that touch the entity type are taken from gitlab_orbit_schema (with a built-in default set as fallback if the schema is unavailable). The API caps this at 10 per selector, so more than 10 entries are truncated to the first 10 and the response includes a "warnings" field. See gitlab_orbit_schema for valid edge types.'
       ),
       limit: z18.number().optional().describe("Maximum number of neighbors to return (default: 30)")
     },
     execute: async (args, _ctx) => {
       const client = getGitLabClient();
       const direction = args.direction || "both";
-      const requestedRelTypes = args.rel_types?.length ? args.rel_types : orbitRelTypes(args.entity_type);
-      const relTypes = requestedRelTypes.slice(0, 10);
+      const requestedRelTypes = args.rel_types?.length ? args.rel_types : await defaultRelTypes(client, args.entity_type);
+      const relTypes = requestedRelTypes.slice(0, MAX_REL_TYPES);
       const warnings = requestedRelTypes.length > relTypes.length ? [`rel_types truncated to 10 (got ${requestedRelTypes.length})`] : [];
       const queryObj = {
         query_type: "neighbors",