@azure-devops/mcp 2.10.0-nightly.20260927 → 2.10.0-nightly.20260928

package/dist/tools/pipelines.js

@@ -8,8 +8,23 @@ import { ConfigurationType, RepositoryType } from "azure-devops-node-api/interfa
 import { mkdirSync, createWriteStream } from "fs";
 import { createExternalContentResponse } from "../shared/content-safety.js";
 import { join, posix, resolve, win32 } from "path";
+import { Readable, Transform } from "stream";
+import { pipeline } from "stream/promises";
 import { pipelinesWriteShape } from "./pipelines.dto.js";
 const errorResult = (text) => ({ content: [{ type: "text", text }], isError: true });
+const MAX_ARTIFACT_FILE_BYTES = 1024 * 1024 * 1024;
+const MAX_ARTIFACT_BASE64_BYTES = 10 * 1024 * 1024;
+function getArtifactResponseStream(response) {
+    if (!response.body)
+        throw new Error("Artifact download returned an empty response body.");
+    return Readable.fromWeb(response.body);
+}
+function validateArtifactContentLength(response, maxBytes, limitDescription) {
+    const contentLength = Number(response.headers.get("content-length"));
+    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+        throw new Error(`Artifact download exceeds the ${limitDescription} limit.`);
+    }
+}
 async function runPipeline(args, connectionProvider) {
     if (!args.pipelineId)
         return errorResult("pipelineId is required for run_pipeline");
@@ -338,25 +353,47 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
                 if (!artifact) {
                     return { content: [{ type: "text", text: `Artifact ${resolvedArtifactName} not found in build ${buildId}.` }], isError: true };
                 }
-                const fileStream = await buildApi.getArtifactContentZip(project, buildId, resolvedArtifactName);
+                if (!artifact.resource?.downloadUrl) {
+                    throw new Error(`Artifact ${resolvedArtifactName} does not have a download URL.`);
+                }
+                const accessToken = await tokenProvider();
+                const response = await fetch(artifact.resource.downloadUrl, {
+                    headers: { "Authorization": `Bearer ${accessToken}`, "User-Agent": userAgentProvider() },
+                });
+                if (!response.ok) {
+                    throw new Error(`Artifact download failed: ${response.status} ${response.statusText}`);
+                }
                 if (destinationPath) {
+                    validateArtifactContentLength(response, MAX_ARTIFACT_FILE_BYTES, "1 GB file size");
                     const fullDestinationPath = resolve(destinationPath);
                     mkdirSync(fullDestinationPath, { recursive: true });
                     const fileDestinationPath = join(fullDestinationPath, `${resolvedArtifactName}.zip`);
                     const writeStream = createWriteStream(fileDestinationPath);
-                    await new Promise((resolve, reject) => {
-                        fileStream.pipe(writeStream);
-                        fileStream.on("end", () => resolve());
-                        fileStream.on("error", (err) => reject(err));
+                    let downloadedBytes = 0;
+                    const sizeLimitStream = new Transform({
+                        transform(chunk, _encoding, callback) {
+                            downloadedBytes += chunk.length;
+                            if (downloadedBytes > MAX_ARTIFACT_FILE_BYTES) {
+                                callback(new Error("Artifact download exceeds the 1 GB file size limit."));
+                                return;
+                            }
+                            callback(null, chunk);
+                        },
                     });
+                    await pipeline(getArtifactResponseStream(response), sizeLimitStream, writeStream);
                     return { content: [{ type: "text", text: `Artifact ${resolvedArtifactName} downloaded to ${destinationPath}.` }] };
                 }
+                validateArtifactContentLength(response, MAX_ARTIFACT_BASE64_BYTES, "10 MB base64 response size");
                 const chunks = [];
-                await new Promise((resolve, reject) => {
-                    fileStream.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-                    fileStream.on("end", () => resolve());
-                    fileStream.on("error", (err) => reject(err));
-                });
+                let downloadedBytes = 0;
+                for await (const chunk of getArtifactResponseStream(response)) {
+                    const bufferChunk = Buffer.from(chunk);
+                    downloadedBytes += bufferChunk.length;
+                    if (downloadedBytes > MAX_ARTIFACT_BASE64_BYTES) {
+                        throw new Error("Artifact download exceeds the 10 MB base64 response size limit.");
+                    }
+                    chunks.push(bufferChunk);
+                }
                 const buffer = Buffer.concat(chunks);
                 const base64Data = buffer.toString("base64");
                 return {

package/dist/version.js

@@ -1 +1 @@
-export const packageVersion = "2.10.0-nightly.20260927";
+export const packageVersion = "2.10.0-nightly.20260928";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-devops/mcp",
-  "version": "2.10.0-nightly.20260927",
+  "version": "2.10.0-nightly.20260928",
   "mcpName": "microsoft.com/azure-devops",
   "description": "MCP server for interacting with Azure DevOps",
   "license": "MIT",