@de-otio/epimethian-mcp 5.5.0 → 5.6.0

package/dist/cli/index.js

@@ -35054,7 +35054,7 @@ async function getPage(pageId, includeBody) {
 async function _rawCreatePage(spaceId, title, body, parentId, clientLabel) {
   const cfg = await getConfig();
   const pageBody = stripAttributionFooter(toStorageFormat(body));
-  const epimethianTag = `Epimethian v${"5.5.0"}`;
+  const epimethianTag = `Epimethian v${"5.6.0"}`;
   const versionMsg = cfg.attribution && clientLabel ? `Created by ${clientLabel} (via ${epimethianTag})` : `Created by ${epimethianTag}`;
   const payload = {
     title,
@@ -35079,7 +35079,7 @@ async function _rawCreatePage(spaceId, title, body, parentId, clientLabel) {
 async function _rawUpdatePage(pageId, opts) {
   const cfg = await getConfig();
   const newVersion = opts.version + 1;
-  const epimethianTag = `Epimethian v${"5.5.0"}`;
+  const epimethianTag = `Epimethian v${"5.6.0"}`;
   const effectiveClient = cfg.attribution ? opts.clientLabel : void 0;
   let versionMessage;
   if (opts.versionMessage && effectiveClient)
@@ -46648,6 +46648,35 @@ var init_content_safety_guards = __esm({
 });
 
 // src/server/safe-write.ts
+function detectMixedInput(body) {
+  let stripped = body.replace(
+    /^(`{3,})[^\n]*\n[\s\S]*?^\1\s*$/gm,
+    ""
+  );
+  stripped = stripped.replace(/<!\[CDATA\[[\s\S]*?\]\]>/g, "");
+  stripped = stripped.replace(
+    /<ac:plain-text-body>[\s\S]*?<\/ac:plain-text-body>/gi,
+    ""
+  );
+  if (!/<ac:|<ri:|<time[\s/>]/i.test(stripped)) {
+    return [];
+  }
+  const STRUCTURAL_MD = [
+    { name: "ATX heading (## ...)", re: /^#{1,6}[ \t]+\S/m },
+    { name: "fenced code block (```...)", re: /^```/m },
+    { name: "GFM table separator (| --- |)", re: /^\|[\s\-:|]+\|\s*$/m },
+    { name: "unordered list (- ... or * ...)", re: /^[-*][ \t]+\S/m },
+    { name: "ordered list (1. ...)", re: /^\d+\.[ \t]+\S/m },
+    {
+      name: "GitHub alert (> [!NOTE])",
+      re: /^>\s*\[!(INFO|NOTE|TIP|WARNING|CAUTION|IMPORTANT)\]/im
+    },
+    { name: "YAML frontmatter delimiter (---)", re: /^---\s*$/m }
+  ];
+  return STRUCTURAL_MD.filter(({ re }) => re.test(stripped)).map(
+    ({ name }) => name
+  );
+}
 function assertPostTransformBody(inputLen, outputBody) {
   if (outputBody.trim().length === 0) {
     throw new ConverterError(
@@ -46759,6 +46788,25 @@ async function safePrepareBody(input) {
       READ_ONLY_MARKDOWN_ROUND_TRIP
     );
   }
+  const mixedSignals = detectMixedInput(body);
+  if (mixedSignals.length > 0) {
+    throw new ConverterError(
+      `Body contains BOTH Confluence storage tags (<ac:.../>, <ri:.../>) AND markdown structural patterns: ${mixedSignals.join(", ")}.
+
+The format detector classifies any body containing storage tags as storage format and skips markdown\u2192storage conversion. Submitting this would store the markdown verbatim and Confluence would render it as literal text.
+
+Pick one path:
+  \u2022 TOC macro from markdown \u2014 drop the inline <ac:structured-macro ac:name="toc"/> and add YAML frontmatter at the top of the body:
+        ---
+        toc:
+          maxLevel: 3
+          minLevel: 1
+        ---
+  \u2022 Other macros from markdown \u2014 use directive syntax (e.g. ":info[content]", ":mention[Name]{accountId=...}", ":date[2026-04-23]").
+  \u2022 Pure storage format \u2014 convert the markdown structure (## headings, lists, tables, code fences) to <h1>/<h2>/<p>/<ul>/<table>/etc. before submitting.`,
+      MIXED_INPUT_DETECTED
+    );
+  }
   const converterOptions = {
     allowRawHtml: allowRawHtml === true,
     ...confluenceBaseUrl ? { confluenceBaseUrl } : {}
@@ -46951,7 +46999,7 @@ async function safeSubmitPage(input) {
     throw err;
   }
 }
-var DELETION_ACK_MISMATCH, POST_TRANSFORM_BODY_REJECTED, READ_ONLY_MARKDOWN_ROUND_TRIP, POST_TRANSFORM_MIN_INPUT_LEN, POST_TRANSFORM_MAX_REDUCTION_RATIO;
+var DELETION_ACK_MISMATCH, POST_TRANSFORM_BODY_REJECTED, READ_ONLY_MARKDOWN_ROUND_TRIP, MIXED_INPUT_DETECTED, POST_TRANSFORM_MIN_INPUT_LEN, POST_TRANSFORM_MAX_REDUCTION_RATIO;
 var init_safe_write = __esm({
   "src/server/safe-write.ts"() {
     "use strict";
@@ -46965,6 +47013,7 @@ var init_safe_write = __esm({
     DELETION_ACK_MISMATCH = "DELETION_ACK_MISMATCH";
     POST_TRANSFORM_BODY_REJECTED = "POST_TRANSFORM_BODY_REJECTED";
     READ_ONLY_MARKDOWN_ROUND_TRIP = "READ_ONLY_MARKDOWN_ROUND_TRIP";
+    MIXED_INPUT_DETECTED = "MIXED_INPUT_DETECTED";
     POST_TRANSFORM_MIN_INPUT_LEN = 500;
     POST_TRANSFORM_MAX_REDUCTION_RATIO = 0.9;
   }
@@ -47944,7 +47993,7 @@ __export(upgrade_exports, {
   runUpgrade: () => runUpgrade
 });
 async function runUpgrade() {
-  const currentVersion = "5.5.0";
+  const currentVersion = "5.6.0";
   console.log(`epimethian-mcp upgrade: current version v${currentVersion}`);
   let pending = await getPendingUpdate();
   if (!pending) {
@@ -58962,7 +59011,7 @@ function registerTools(server, config3) {
     {
       description: describeWithLock(
         withDestructiveWarning(
-          "Create a new page in Confluence. Accepts either Confluence storage format (XHTML) or GFM markdown \u2014 markdown is automatically converted to storage format before submission. Use allow_raw_html: true to permit raw HTML inside markdown (disabled by default for security). Use confluence_base_url to override the base URL used by the link rewriter (defaults to the configured Confluence URL)."
+          "Create a new page in Confluence. Accepts either Confluence storage format (XHTML) or GFM markdown \u2014 markdown is automatically converted to storage format before submission. Do NOT mix the two: a body that contains both <ac:.../> storage tags AND markdown structural patterns (## headings, lists, fenced code blocks) is rejected with MIXED_INPUT_DETECTED. To inject a TOC macro from markdown, use YAML frontmatter at the top of the body: `---\\ntoc:\\n  maxLevel: 3\\n  minLevel: 1\\n---`. For other macros from markdown, use directive syntax: `:info[content]`, `:mention[Name]{accountId=...}`, `:date[2026-04-23]`. Use allow_raw_html: true to permit raw HTML inside markdown (disabled by default for security). Use confluence_base_url to override the base URL used by the link rewriter (defaults to the configured Confluence URL)."
         ),
         config3
       ),
@@ -58970,7 +59019,7 @@ function registerTools(server, config3) {
         title: external_exports.string().describe("Page title"),
         space_key: external_exports.string().describe("Confluence space key, e.g. 'DEV' or 'TEAM'"),
         body: external_exports.string().describe(
-          "Page content \u2014 GFM markdown or Confluence storage format (XHTML). Markdown is auto-detected and converted."
+          "Page content \u2014 GFM markdown or Confluence storage format (XHTML). Markdown is auto-detected and converted. Do not mix the two: inlining <ac:.../> macros inside a markdown body is rejected. For a TOC use YAML frontmatter (toc: { maxLevel, minLevel }); for other macros use directive syntax (:info[...], :mention[...]{...})."
         ),
         parent_id: external_exports.string().optional().describe("Optional parent page ID"),
         allow_raw_html: external_exports.boolean().default(false).describe("Allow raw HTML passthrough inside markdown bodies (disabled by default; only enable for trusted content)."),
@@ -59099,7 +59148,7 @@ ${truncated}`);
     {
       description: describeWithLock(
         withDestructiveWarning(
-          "Update an existing Confluence page. Accepts GFM markdown or Confluence storage format \u2014 markdown is automatically converted via the token-aware write path, which preserves all existing macros and rich elements. You must provide the version number from your most recent get_page call. If the page was modified by someone else since then, this will return a conflict error \u2014 re-read the page and retry.\n\nFor narrow changes to a single section, prefer update_page_section \u2014 it leaves the rest of the page untouched and is safer for targeted edits.\n\nMarkdown update flags:\n- confirm_deletions: set to true to acknowledge removing preserved macros/elements (default false \u2014 any deletion errors until confirmed).\n- replace_body: set to true for a wholesale rewrite that skips preservation (default false).\n- confirm_shrinkage: set to true to acknowledge a >50% body size reduction (default false).\n- confirm_structure_loss: set to true to acknowledge a >50% heading count drop (default false).\n- allow_raw_html: allow raw HTML inside markdown bodies (default false).\n- confluence_base_url: override the URL used by the link rewriter.\n\nreplace_body skips all safety nets (token preservation, deletion confirmation). When delegating update_page to a subagent, ensure the agent includes the full existing body \u2014 replace_body replaces ALL content with only what you provide."
+          "Update an existing Confluence page. Accepts GFM markdown or Confluence storage format \u2014 markdown is automatically converted via the token-aware write path, which preserves all existing macros and rich elements. Do NOT mix the two: a body that contains both <ac:.../> storage tags AND markdown structural patterns (## headings, lists, fenced code blocks) is rejected with MIXED_INPUT_DETECTED. To inject a TOC macro from markdown, use YAML frontmatter at the top of the body: `---\\ntoc:\\n  maxLevel: 3\\n  minLevel: 1\\n---`. For other macros from markdown, use directive syntax: `:info[content]`, `:mention[Name]{accountId=...}`, `:date[2026-04-23]`. You must provide the version number from your most recent get_page call. If the page was modified by someone else since then, this will return a conflict error \u2014 re-read the page and retry.\n\nFor narrow changes to a single section, prefer update_page_section \u2014 it leaves the rest of the page untouched and is safer for targeted edits.\n\nMarkdown update flags:\n- confirm_deletions: set to true to acknowledge removing preserved macros/elements (default false \u2014 any deletion errors until confirmed).\n- replace_body: set to true for a wholesale rewrite that skips preservation (default false).\n- confirm_shrinkage: set to true to acknowledge a >50% body size reduction (default false).\n- confirm_structure_loss: set to true to acknowledge a >50% heading count drop (default false).\n- allow_raw_html: allow raw HTML inside markdown bodies (default false).\n- confluence_base_url: override the URL used by the link rewriter.\n\nreplace_body skips all safety nets (token preservation, deletion confirmation). When delegating update_page to a subagent, ensure the agent includes the full existing body \u2014 replace_body replaces ALL content with only what you provide."
         ),
         config3
       ),
@@ -59107,7 +59156,7 @@ ${truncated}`);
         page_id: external_exports.string().describe("The Confluence page ID"),
         title: external_exports.string().describe("Page title (use the title from get_page if unchanged)"),
         version: external_exports.number().int().positive().describe("The page version number from your most recent get_page call"),
-        body: external_exports.string().optional().describe("New body content \u2014 GFM markdown or Confluence storage format (XHTML). Markdown is auto-detected and converted via the token-aware write path."),
+        body: external_exports.string().optional().describe("New body content \u2014 GFM markdown or Confluence storage format (XHTML). Markdown is auto-detected and converted via the token-aware write path. Do not mix the two: inlining <ac:.../> macros inside a markdown body is rejected. For a TOC use YAML frontmatter (toc: { maxLevel, minLevel }); for other macros use directive syntax (:info[...], :mention[...]{...})."),
         version_message: external_exports.string().optional().describe("Optional version comment"),
         confirm_deletions: external_exports.boolean().default(false).describe("Set to true to acknowledge that your markdown removes preserved macros or rich elements. Required when any preserved element would be deleted."),
         replace_body: external_exports.boolean().default(false).describe("Set to true for a wholesale page rewrite that skips token preservation. All existing macros will be lost. Use only when intentionally replacing the full body."),
@@ -59207,7 +59256,7 @@ ${truncated}`);
       inputSchema: {
         page_id: external_exports.string().describe("The Confluence page ID"),
         section: external_exports.string().describe("Heading text identifying the section to replace (case-insensitive)"),
-        body: external_exports.string().describe("New content for this section \u2014 GFM markdown or Confluence storage format. Markdown is auto-detected and converted via the token-aware write path, which preserves existing macros and emoticons within the section. The heading itself is preserved; only content under it is replaced."),
+        body: external_exports.string().describe("New content for this section \u2014 GFM markdown or Confluence storage format. Markdown is auto-detected and converted via the token-aware write path, which preserves existing macros and emoticons within the section. The heading itself is preserved; only content under it is replaced. Do not mix the two: inlining <ac:.../> macros inside a markdown body is rejected with MIXED_INPUT_DETECTED. For macros from markdown use directive syntax (:info[...], :mention[...]{...})."),
         version: external_exports.number().int().positive().describe("The page version number from your most recent get_page call"),
         version_message: external_exports.string().optional().describe("Optional version comment"),
         confirm_deletions: external_exports.boolean().default(false).describe("Set to true to acknowledge that your markdown removes preserved macros, emoticons, or rich elements from this section. Required when any preserved element would be deleted.")
@@ -60369,7 +60418,7 @@ ${titleFenced}${echo2}`
       inputSchema: {}
     },
     async () => {
-      let text2 = `epimethian-mcp v${"5.5.0"}`;
+      let text2 = `epimethian-mcp v${"5.6.0"}`;
       try {
         const pending = await getPendingUpdate();
         if (pending) {
@@ -60400,7 +60449,7 @@ ${label} update available: v${pending.current} \u2192 v${pending.latest}. Run \`
         const pending = await getPendingUpdate();
         if (!pending) {
           return toolResult(
-            `epimethian-mcp v${"5.5.0"} is already up to date.`
+            `epimethian-mcp v${"5.6.0"} is already up to date.`
           );
         }
         const output = await performUpgrade(pending.latest);
@@ -60422,7 +60471,7 @@ async function startRecoveryServer(profile) {
   const server = new McpServer(
     {
       name: `confluence-${profile}-setup-needed`,
-      version: "5.5.0"
+      version: "5.6.0"
     },
     {
       instructions: `The Confluence profile "${profile}" referenced by CONFLUENCE_PROFILE has no keychain entry, so no Confluence tools are available. Call the setup_profile tool for instructions to create it.`
@@ -60470,21 +60519,21 @@ async function main() {
   const serverName = config3.profile ? `confluence-${config3.profile}` : "confluence";
   const server = new McpServer({
     name: serverName,
-    version: "5.5.0"
+    version: "5.6.0"
   });
   registerTools(server, config3);
   const transport = new StdioServerTransport();
   await server.connect(transport);
   try {
     const pending = await getPendingUpdate();
-    if (pending && pending.current === "5.5.0") {
+    if (pending && pending.current === "5.6.0") {
       console.error(
         `epimethian-mcp: update available: v${pending.current} \u2192 v${pending.latest} (${pending.type}). Run \`epimethian-mcp upgrade\` to install.`
       );
     }
   } catch {
   }
-  checkForUpdates("5.5.0").catch(() => {
+  checkForUpdates("5.6.0").catch(() => {
   });
 }