fix(gitlab): apply 10-agent validation findings across all 62 tools

- MR draft flag now applied via Draft: title prefix (GitLab has no draft body param)
- update_user only sends admin when a real boolean (untouched switch serialized null and could demote admins)
- add_member 409 soft-success now verified against the conflict body
- auto_merge sent alongside deprecated merge_when_pipeline_succeeds
- job log capped at 200k chars, file content at 1M chars, with truncated outputs
- MR diffs signal hasMore beyond 100 files
- wire dropped params: update_issue milestoneId, MR milestone/squash/removeSourceBranch, pipelines ref, tree ref, branches search, commits since/until/path/author, update_file lastCommitId, jobs includeRetried, create_user forceRandomPassword
- complete pipeline/job status enums, access-level enums, widen stale type unions
- guards: update_invitation requires a change; create_user requires a password strategy
- fix double-encoding trap in path descriptions; doc-accuracy touch-ups

Author: waleedlatif1

apps/docs/content/docs/en/integrations/gitlab.mdx

@@ -79,7 +79,12 @@ describe('gitlab_add_member', () => {
 
   it('treats a 409 as a soft success so workflows are re-runnable', async () => {
     const result = await gitlabAddMemberTool.transformResponse!(
-      mockResponse({ ok: false, status: 409, json: { message: 'Member already exists' } }),
+      mockResponse({
+        ok: false,
+        status: 409,
+        json: { message: 'Member already exists' },
+        text: '{"message":"Member already exists"}',
+      }),
       {} as never
     )
     expect(result.success).toBe(true)
@@ -96,6 +101,14 @@ describe('gitlab_add_member', () => {
     expect(result.output.member).toEqual({ id: 7, access_level: 30 })
   })
 
+  it('surfaces a 409 that is not an already-member conflict as a failure', async () => {
+    const result = await gitlabAddMemberTool.transformResponse!(
+      mockResponse({ ok: false, status: 409, text: '{"message":"Seat limit reached"}' }),
+      {} as never
+    )
+    expect(result.success).toBe(false)
+  })
+
   it('surfaces other errors as hard failures', async () => {
     const result = await gitlabAddMemberTool.transformResponse!(
       mockResponse({ ok: false, status: 403, text: 'Forbidden' }),

apps/sim/blocks/blocks/gitlab.ts

@@ -31,7 +31,7 @@ export const gitlabAddMemberTool: ToolConfig<GitLabAddMemberParams, GitLabAddMem
       type: 'string',
       required: true,
       visibility: 'user-or-llm',
-      description: 'Project or group ID or URL-encoded path',
+      description: 'Project or group ID or path (e.g. mygroup/myproject)',
     },
     userId: {
       type: 'number',
@@ -44,7 +44,7 @@ export const gitlabAddMemberTool: ToolConfig<GitLabAddMemberParams, GitLabAddMem
       required: true,
       visibility: 'user-or-llm',
       description:
-        'Access level: 10 (Guest), 20 (Reporter), 30 (Developer), 40 (Maintainer), 50 (Owner)',
+        'Access level: 10 (Guest), 15 (Planner), 20 (Reporter), 25 (Security Manager), 30 (Developer), 40 (Maintainer), 50 (Owner)',
     },
     expiresAt: {
       type: 'string',
@@ -84,14 +84,23 @@ export const gitlabAddMemberTool: ToolConfig<GitLabAddMemberParams, GitLabAddMem
   },
 
   transformResponse: async (response) => {
-    // A 409 means the user is already a member. Treat it as a soft success so
-    // provisioning workflows remain safely re-runnable.
+    // A 409 with "already exists" means the user is already a member. Treat it
+    // as a soft success so provisioning workflows remain safely re-runnable —
+    // but only for that specific conflict, so other 409s still surface.
     if (response.status === 409) {
+      const conflictText = await response.text()
+      if (/already exists|already a member/i.test(conflictText)) {
+        return {
+          success: true,
+          output: {
+            alreadyMember: true,
+          },
+        }
+      }
       return {
-        success: true,
-        output: {
-          alreadyMember: true,
-        },
+        success: false,
+        error: `GitLab API error: 409 ${conflictText}`,
+        output: {},
       }
     }
 

apps/sim/tools/gitlab/access.test.ts

@@ -12,7 +12,7 @@ export const gitlabAddSamlGroupLinkTool: ToolConfig<
   id: 'gitlab_add_saml_group_link',
   name: 'GitLab Add SAML Group Link',
   description:
-    'Add a SAML group link that maps an identity-provider group to a GitLab group at a given access level',
+    'Add a SAML group link that maps an identity-provider group to a GitLab group at a given access level (GitLab Premium/Ultimate)',
   version: '1.0.0',
 
   params: {
@@ -32,7 +32,7 @@ export const gitlabAddSamlGroupLinkTool: ToolConfig<
       type: 'string',
       required: true,
       visibility: 'user-or-llm',
-      description: 'Group ID or URL-encoded path',
+      description: 'Group ID or path (e.g. my-org/my-group)',
     },
     samlGroupName: {
       type: 'string',
@@ -45,7 +45,7 @@ export const gitlabAddSamlGroupLinkTool: ToolConfig<
       required: true,
       visibility: 'user-or-llm',
       description:
-        'Access level granted to members of the SAML group: 10 (Guest), 20 (Reporter), 30 (Developer), 40 (Maintainer), 50 (Owner)',
+        'Access level granted to members of the SAML group: 10 (Guest), 15 (Planner), 20 (Reporter), 25 (Security Manager), 30 (Developer), 40 (Maintainer), 50 (Owner)',
     },
     memberRoleId: {
       type: 'number',
@@ -57,7 +57,8 @@ export const gitlabAddSamlGroupLinkTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Unique provider name that must match for this group link to be applied',
+      description:
+        'Unique provider name that must match for this group link to be applied (GitLab 18.2+)',
     },
   },
 

apps/sim/tools/gitlab/add_member.ts

@@ -37,7 +37,7 @@ export const gitlabApproveAccessRequestTool: ToolConfig<
       type: 'string',
       required: true,
       visibility: 'user-or-llm',
-      description: 'Project or group ID or URL-encoded path',
+      description: 'Project or group ID or path (e.g. mygroup/myproject)',
     },
     userId: {
       type: 'number',
@@ -50,7 +50,7 @@ export const gitlabApproveAccessRequestTool: ToolConfig<
       required: false,
       visibility: 'user-or-llm',
       description:
-        'Access level to grant: 10 (Guest), 20 (Reporter), 30 (Developer), 40 (Maintainer), 50 (Owner). Defaults to 30 (Developer).',
+        'Access level to grant: 10 (Guest), 15 (Planner), 20 (Reporter), 25 (Security Manager), 30 (Developer), 40 (Maintainer), 50 (Owner). Defaults to 30 (Developer).',
     },
   },
 

apps/sim/tools/gitlab/add_saml_group_link.ts

@@ -31,7 +31,7 @@ export const gitlabApproveMergeRequestTool: ToolConfig<
       type: 'string',
       required: true,
       visibility: 'user-or-llm',
-      description: 'Project ID or URL-encoded path',
+      description: 'Project ID or path (e.g. mygroup/myproject)',
     },
     mergeRequestIid: {
       type: 'number',

apps/sim/tools/gitlab/approve_access_request.ts

@@ -28,7 +28,7 @@ export const gitlabCancelPipelineTool: ToolConfig<
       type: 'string',
       required: true,
       visibility: 'user-or-llm',
-      description: 'Project ID or URL-encoded path',
+      description: 'Project ID or path (e.g. mygroup/myproject)',
     },
     pipelineId: {
       type: 'number',

apps/sim/tools/gitlab/approve_merge_request.ts

@@ -31,7 +31,7 @@ export const gitlabCompareBranchesTool: ToolConfig<
       type: 'string',
       required: true,
       visibility: 'user-or-llm',
-      description: 'Project ID or URL-encoded path',
+      description: 'Project ID or path (e.g. mygroup/myproject)',
     },
     from: {
       type: 'string',

apps/sim/tools/gitlab/cancel_pipeline.ts

@@ -28,7 +28,7 @@ export const gitlabCreateBranchTool: ToolConfig<
       type: 'string',
       required: true,
       visibility: 'user-or-llm',
-      description: 'Project ID or URL-encoded path',
+      description: 'Project ID or path (e.g. mygroup/myproject)',
     },
     branch: {
       type: 'string',