@daghis/teamcity-mcp 1.8.1 → 1.8.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.8.2](https://github.com/Daghis/teamcity-mcp/compare/v1.8.1...v1.8.2) (2025-09-20)
+
+
+### Bug Fixes
+
+* **tools:** harden batch artifact streaming outputs ([#177](https://github.com/Daghis/teamcity-mcp/issues/177)) ([0874325](https://github.com/Daghis/teamcity-mcp/commit/0874325c77aa2a79050cff57fced0aeec5a55ba0))
+
 ## [1.8.1](https://github.com/Daghis/teamcity-mcp/compare/v1.8.0...v1.8.1) (2025-09-20)
 
 

package/dist/index.js

@@ -1308,7 +1308,7 @@ var ArtifactManager = class _ArtifactManager {
     }
   }
   async delay(ms) {
-    await new Promise((resolve) => setTimeout(resolve, ms));
+    await new Promise((resolve2) => setTimeout(resolve2, ms));
   }
 };
 
@@ -2836,13 +2836,13 @@ async function handleRetry(axiosInstance, currentState, error2, config2) {
   if (config2.signal?.aborted) {
     return Promise.resolve(axiosInstance(config2));
   }
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const abortListener = () => {
       clearTimeout(timeout);
-      resolve(axiosInstance(config2));
+      resolve2(axiosInstance(config2));
     };
     const timeout = setTimeout(() => {
-      resolve(axiosInstance(config2));
+      resolve2(axiosInstance(config2));
       if (config2.signal?.removeEventListener) {
         config2.signal.removeEventListener("abort", abortListener);
       }
@@ -36890,12 +36890,13 @@ var ensureUniquePath = async (candidate) => {
   const probe = async (attempt) => {
     const next = attempt === 0 ? candidate : `${stem}-${attempt}${ext}`;
     try {
-      await import_node_fs.promises.access(next);
-      return probe(attempt + 1);
+      const handle = await import_node_fs.promises.open(next, "wx");
+      await handle.close();
+      return next;
     } catch (error2) {
       const err = error2;
-      if (err?.code === "ENOENT") {
-        return next;
+      if (err?.code === "EEXIST") {
+        return probe(attempt + 1);
       }
       throw error2;
     }
@@ -36912,7 +36913,12 @@ var resolveStreamOutputPath = async (artifact, options) => {
     const segments = sanitizePathSegments(artifact.path, artifact.name);
     const parts = segments.slice(0, -1);
     const fileName = segments[segments.length - 1] ?? sanitizeFileName(artifact.name).sanitizedBase;
-    const candidate = (0, import_node_path.join)(options.outputDir, ...parts, fileName);
+    const baseDir = (0, import_node_path.resolve)(options.outputDir);
+    const candidate = (0, import_node_path.resolve)(baseDir, ...parts, fileName);
+    const relativePath = (0, import_node_path.relative)(baseDir, candidate);
+    if (relativePath.startsWith("..") || (0, import_node_path.isAbsolute)(relativePath)) {
+      throw new Error("Resolved artifact path escapes the configured output directory");
+    }
     await import_node_fs.promises.mkdir((0, import_node_path.dirname)(candidate), { recursive: true });
     return ensureUniquePath(candidate);
   }
@@ -37594,8 +37600,8 @@ var DEV_TOOLS = [
             }
             return new Error(String(error2));
           };
-          const wait = (ms) => new Promise((resolve) => {
-            setTimeout(resolve, ms);
+          const wait = (ms) => new Promise((resolve2) => {
+            setTimeout(resolve2, ms);
           });
           const attemptBuffered = async () => {
             if (typed.tail) {