@azure-devops/mcp 2.10.0-nightly.20261007 → 2.10.0-nightly.20261009

package/dist/tools/work-items.js

@@ -440,7 +440,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             return { content: [{ type: "text", text: "attachmentId is required for download" }], isError: true };
         if (savePath) {
             const localFileName = fileName ?? attachmentId;
-            if (localFileName.includes("\0") || path.posix.basename(localFileName) !== localFileName || path.win32.basename(localFileName) !== localFileName) {
+            if (!localFileName || localFileName.includes("\0") || path.posix.basename(localFileName) !== localFileName || path.win32.basename(localFileName) !== localFileName) {
                 throw new Error("Invalid fileName: path components are not allowed.");
             }
         }
@@ -455,6 +455,12 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             }
             const workItemApi = await connection.getWorkItemTrackingApi();
             const stream = await workItemApi.getAttachmentContent(attachmentId, fileName, resolvedProject);
+            const responseStream = stream;
+            if (responseStream.statusCode !== undefined && (responseStream.statusCode < 200 || responseStream.statusCode >= 300)) {
+                responseStream.resume();
+                const statusMessage = responseStream.statusMessage ? ` ${responseStream.statusMessage}` : "";
+                throw new Error(`Attachment download failed: HTTP ${responseStream.statusCode}${statusMessage}`);
+            }
             const chunks = [];
             await new Promise((resolve, reject) => {
                 stream.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
@@ -469,7 +475,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
                 if (relativeDirectory === ".." || relativeDirectory.startsWith(`..${path.sep}`) || path.isAbsolute(relativeDirectory)) {
                     throw new Error("Invalid savePath: destination must remain inside the workspace.");
                 }
-                const localFilePath = path.join(resolvedDirectory, fileName ?? attachmentId);
+                const localFilePath = path.resolve(resolvedDirectory, fileName ?? attachmentId);
                 // O_EXCL fails if the file (or a symlink) already exists, so there is no check-then-write race.
                 const file = await open(localFilePath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), 0o600);
                 try {

package/dist/version.js

@@ -1 +1 @@
-export const packageVersion = "2.10.0-nightly.20261007";
+export const packageVersion = "2.10.0-nightly.20261009";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-devops/mcp",
-  "version": "2.10.0-nightly.20261007",
+  "version": "2.10.0-nightly.20261009",
   "mcpName": "microsoft.com/azure-devops",
   "description": "MCP server for interacting with Azure DevOps",
   "license": "MIT",