opencode-gitlab-plugin 3.1.0 → 3.2.1

package/dist/mcp-server.cjs

@@ -29275,9 +29275,22 @@ var MergeRequestsClient = class _MergeRequestsClient extends GitLabApiClient {
       requestBody
     );
   }
-  async createMrNote(projectId, mrIid, body, discussionId) {
+  /**
+   * Create a note on a merge request.
+   *
+   * When `discussionId` is set the note is a reply on that discussion thread, which the
+   * GitLab Notes API does not allow to be internal. Passing `internal=true` together with a
+   * `discussionId` therefore throws (fail-closed) rather than silently dropping the
+   * confidentiality flag. Post a standalone internal note (omit `discussionId`) instead.
+   */
+  async createMrNote(projectId, mrIid, body, discussionId, internal) {
     const encodedProject = this.encodeProjectId(projectId);
     if (discussionId) {
+      if (internal) {
+        throw new Error(
+          "internal=true is not supported when replying to a discussion. The GitLab Notes API does not accept an internal flag on discussion replies, so honouring it silently would drop a confidentiality flag. Post a standalone internal note (omit discussionId) instead."
+        );
+      }
       return this.fetch(
         "POST",
         `/projects/${encodedProject}/merge_requests/${mrIid}/discussions/${discussionId}/notes`,
@@ -29287,7 +29300,7 @@ var MergeRequestsClient = class _MergeRequestsClient extends GitLabApiClient {
     return this.fetch(
       "POST",
       `/projects/${encodedProject}/merge_requests/${mrIid}/notes`,
-      { body }
+      internal ? { body, internal: true } : { body }
     );
   }
   async updateMrNote(projectId, mrIid, noteId, body) {
@@ -29753,9 +29766,22 @@ var IssuesClient = class extends GitLabApiClient {
       `/projects/${encodedProject}/issues/${issueIid}/discussions/${discussionId}`
     );
   }
-  async createIssueNote(projectId, issueIid, body, discussionId) {
+  /**
+   * Create a note on an issue.
+   *
+   * When `discussionId` is set the note is a reply on that discussion thread, which the
+   * GitLab Notes API does not allow to be internal. Passing `internal=true` together with a
+   * `discussionId` therefore throws (fail-closed) rather than silently dropping the
+   * confidentiality flag. Post a standalone internal note (omit `discussionId`) instead.
+   */
+  async createIssueNote(projectId, issueIid, body, discussionId, internal) {
     const encodedProject = this.encodeProjectId(projectId);
     if (discussionId) {
+      if (internal) {
+        throw new Error(
+          "internal=true is not supported when replying to a discussion. The GitLab Notes API does not accept an internal flag on discussion replies, so honouring it silently would drop a confidentiality flag. Post a standalone internal note (omit discussionId) instead."
+        );
+      }
       return this.fetch(
         "POST",
         `/projects/${encodedProject}/issues/${issueIid}/discussions/${discussionId}/notes`,
@@ -29765,7 +29791,7 @@ var IssuesClient = class extends GitLabApiClient {
     return this.fetch(
       "POST",
       `/projects/${encodedProject}/issues/${issueIid}/notes`,
-      { body }
+      internal ? { body, internal: true } : { body }
     );
   }
   async resolveIssueDiscussion(projectId, issueIid, discussionId) {
@@ -31096,9 +31122,22 @@ var EpicsClient = class extends GitLabApiClient {
       `/groups/${encodedGroup}/epics/${epicIid}/discussions/${discussionId}`
     );
   }
-  async createEpicNote(groupId, epicIid, body, discussionId) {
+  /**
+   * Create a note on an epic.
+   *
+   * When `discussionId` is set the note is a reply on that discussion thread, which the
+   * GitLab Notes API does not allow to be internal. Passing `internal=true` together with a
+   * `discussionId` therefore throws (fail-closed) rather than silently dropping the
+   * confidentiality flag. Post a standalone internal note (omit `discussionId`) instead.
+   */
+  async createEpicNote(groupId, epicIid, body, discussionId, internal) {
     const encodedGroup = encodeURIComponent(groupId);
     if (discussionId) {
+      if (internal) {
+        throw new Error(
+          "internal=true is not supported when replying to a discussion. The GitLab Notes API does not accept an internal flag on discussion replies, so honouring it silently would drop a confidentiality flag. Post a standalone internal note (omit discussionId) instead."
+        );
+      }
       return this.fetch(
         "POST",
         `/groups/${encodedGroup}/epics/${epicIid}/discussions/${discussionId}/notes`,
@@ -31108,7 +31147,7 @@ var EpicsClient = class extends GitLabApiClient {
     return this.fetch(
       "POST",
       `/groups/${encodedGroup}/epics/${epicIid}/notes`,
-      { body }
+      internal ? { body, internal: true } : { body }
     );
   }
   async getEpicNote(groupId, epicIid, noteId) {
@@ -31544,36 +31583,67 @@ applyMixins(UnifiedGitLabClient, [
 ]);
 
 // src/utils.ts
+var integrationToken;
+function credentialToToken(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const credential = value;
+  if (credential["type"] === "oauth") {
+    const access = credential["access"];
+    if (typeof access !== "string" || !access) {
+      return void 0;
+    }
+    return isExpired(credential["expires"]) ? void 0 : access;
+  }
+  if (typeof credential["key"] === "string" && credential["key"]) {
+    return credential["key"];
+  }
+  if (typeof credential["token"] === "string" && credential["token"]) {
+    return credential["token"];
+  }
+  return void 0;
+}
+function isExpired(expires) {
+  return typeof expires === "number" && expires > 0 && expires <= Date.now();
+}
 function readTokenFromAuthStorage() {
   try {
     const authPath = import_path.default.join(import_os.default.homedir(), ".local", "share", "opencode", "auth.json");
     if (!import_fs.default.existsSync(authPath)) {
-      return void 0;
+      return {};
     }
     const authData = JSON.parse(import_fs.default.readFileSync(authPath, "utf-8"));
     const gitlabAuth = authData?.gitlab;
     if (!gitlabAuth) {
-      return void 0;
+      return {};
     }
-    if (gitlabAuth.type === "oauth" && gitlabAuth.access) {
-      return gitlabAuth.access;
+    const token = credentialToToken(gitlabAuth);
+    if (token) {
+      return { token };
     }
-    if (gitlabAuth.type === "api" && gitlabAuth.key) {
-      return gitlabAuth.key;
+    if (gitlabAuth.type === "oauth" && isExpired(gitlabAuth.expires)) {
+      return { expired: new Date(gitlabAuth.expires) };
     }
-    return gitlabAuth.token || void 0;
+    return {};
   } catch (error45) {
-    return void 0;
+    return {};
   }
 }
 function getGitLabClient() {
-  let token = process.env["GITLAB_TOKEN"];
+  let token = process.env["GITLAB_TOKEN"] || integrationToken;
+  let expired;
   if (!token) {
-    token = readTokenFromAuthStorage();
+    ({ token, expired } = readTokenFromAuthStorage());
   }
   if (!token) {
+    if (expired) {
+      throw new Error(
+        `GitLab OAuth token in ~/.local/share/opencode/auth.json expired on ${expired.toISOString()}. Re-authenticate GitLab in OpenCode or set the GITLAB_TOKEN environment variable.`
+      );
+    }
     throw new Error(
-      "GitLab API token not found. Set GITLAB_TOKEN environment variable or configure it in OpenCode auth storage (~/.local/share/opencode/auth.json)."
+      "GitLab API token not found. Set GITLAB_TOKEN environment variable or connect GitLab in OpenCode."
     );
   }
   const instanceUrl = process.env["GITLAB_INSTANCE_URL"] || "https://gitlab.com";
@@ -33659,9 +33729,14 @@ Creates a standalone comment (not part of a thread).
 For replying to existing discussion threads, use gitlab_create_discussion 
 with discussion_id parameter instead.
 
+Set internal=true to post a confidential/internal note visible only to project members
+(supported for merge requests, issues, and epics; not supported for snippets, where passing
+internal=true raises an error rather than silently posting a public note).
+
 Examples:
 - MR comment: resource_type="merge_request", project_id="group/project", iid=123, body="LGTM!"
 - Issue comment: resource_type="issue", project_id="group/project", iid=456, body="Working on this"
+- Internal issue note: resource_type="issue", project_id="group/project", iid=456, body="Internal only", internal=true
 - Epic comment: resource_type="epic", group_id="my-group", iid=1, body="Planning complete"
 - Snippet comment: resource_type="snippet", project_id="group/project", snippet_id=789, body="Nice code!"`,
     args: {
@@ -33670,27 +33745,53 @@ Examples:
       project_id: z14.string().optional().describe("Project ID or path. Required for merge_request, issue, snippet"),
       group_id: z14.string().optional().describe("Group ID or path. Required for epic"),
       iid: z14.number().optional().describe("Internal ID of the resource (for merge_request, issue, epic)"),
-      snippet_id: z14.number().optional().describe("Snippet ID (required for snippet)")
+      snippet_id: z14.number().optional().describe("Snippet ID (required for snippet)"),
+      internal: z14.boolean().optional().describe(
+        "Post as a confidential/internal note visible only to project members (merge requests, issues, and epics; not supported for snippets, where passing true raises an error). Defaults to false (public note)."
+      )
     },
     execute: async (args, _ctx) => {
       validateNoteParams(args.resource_type, args, { allowedTypes: NOTE_RESOURCE_TYPES });
+      if (args.internal && args.resource_type === "snippet") {
+        throw new Error(
+          `internal=true is not supported for snippet notes. Refusing to post a note that was intended to be confidential as a public note.`
+        );
+      }
       const client = getGitLabClient();
       switch (args.resource_type) {
         case "merge_request":
           return JSON.stringify(
-            await client.createMrNote(args.project_id, args.iid, args.body),
+            await client.createMrNote(
+              args.project_id,
+              args.iid,
+              args.body,
+              void 0,
+              args.internal
+            ),
             null,
             2
           );
         case "issue":
           return JSON.stringify(
-            await client.createIssueNote(args.project_id, args.iid, args.body),
+            await client.createIssueNote(
+              args.project_id,
+              args.iid,
+              args.body,
+              void 0,
+              args.internal
+            ),
             null,
             2
           );
         case "epic":
           return JSON.stringify(
-            await client.createEpicNote(args.group_id, args.iid, args.body),
+            await client.createEpicNote(
+              args.group_id,
+              args.iid,
+              args.body,
+              void 0,
+              args.internal
+            ),
             null,
             2
           );
@@ -34727,7 +34828,7 @@ async function main() {
 `);
     process.exit(1);
   }
-  const version2 = true ? "3.1.0" : "0.0.0";
+  const version2 = true ? "3.2.1" : "0.0.0";
   const server = new McpServer({ name: "gitlab", version: version2 });
   adaptToolsToMcp(server, mcpTools);
   const transport = new StdioServerTransport();