@hanhnd/agent-kit 1.0.41 → 1.0.43

package/dist/cli.js

@@ -15136,26 +15136,26 @@ var DigestModelRegistryError = class extends Error {
 var DIGEST_MODEL_REGISTRY = {
   ["tiny" /* TINY */]: {
     id: "tiny" /* TINY */,
-    ggufUri: "hf:bartowski/Qwen2.5-0.5B-Instruct-GGUF/Qwen2.5-0.5B-Instruct-Q4_K_M.gguf",
-    approxSizeBytes: 4e8,
+    ggufUri: "hf:lmstudio-community/Qwen3.5-0.8B-GGUF/Qwen3.5-0.8B-Q4_K_M.gguf",
+    approxSizeBytes: 528e6,
     license: "Apache-2.0",
-    sourceUrl: "https://huggingface.co/bartowski/Qwen2.5-0.5B-Instruct-GGUF",
+    sourceUrl: "https://huggingface.co/lmstudio-community/Qwen3.5-0.8B-GGUF",
     enabled: true
   },
   ["base" /* BASE */]: {
     id: "base" /* BASE */,
-    ggufUri: "hf:bartowski/Qwen2.5-1.5B-Instruct-GGUF/Qwen2.5-1.5B-Instruct-Q4_K_M.gguf",
-    approxSizeBytes: 1e9,
+    ggufUri: "hf:lmstudio-community/Qwen3.5-2B-GGUF/Qwen3.5-2B-Q4_K_M.gguf",
+    approxSizeBytes: 127e7,
     license: "Apache-2.0",
-    sourceUrl: "https://huggingface.co/bartowski/Qwen2.5-1.5B-Instruct-GGUF",
+    sourceUrl: "https://huggingface.co/lmstudio-community/Qwen3.5-2B-GGUF",
     enabled: true
   },
   ["large" /* LARGE */]: {
     id: "large" /* LARGE */,
-    ggufUri: "hf:bartowski/Qwen2.5-3B-Instruct-GGUF/Qwen2.5-3B-Instruct-Q4_K_M.gguf",
-    approxSizeBytes: 19e8,
+    ggufUri: "hf:lmstudio-community/Qwen3.5-4B-GGUF/Qwen3.5-4B-Q4_K_M.gguf",
+    approxSizeBytes: 271e7,
     license: "Apache-2.0",
-    sourceUrl: "https://huggingface.co/bartowski/Qwen2.5-3B-Instruct-GGUF",
+    sourceUrl: "https://huggingface.co/lmstudio-community/Qwen3.5-4B-GGUF",
     enabled: true
   }
 };
@@ -15315,7 +15315,8 @@ async function createLlamaLocalDigestProvider(modelId) {
         const response = await withTimeout(
           session.prompt(userContent, {
             maxTokens: LLAMA_MAX_GENERATED_TOKENS,
-            temperature: LLAMA_TEMPERATURE
+            temperature: LLAMA_TEMPERATURE,
+            budgets: { thoughtTokens: 0 }
           }),
           options.timeoutMs,
           () => new LlamaLocalDigestProviderError(`Llama provider timed out after ${options.timeoutMs}ms`)

package/dist/mcp/confluence.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mcp/confluence.test.js

@@ -0,0 +1,258 @@
+import * as assert from 'node:assert/strict';
+import * as fs from 'node:fs';
+import { afterEach, describe, mock, test } from 'node:test';
+import { LARGE_PAYLOAD_THRESHOLD, handleConfluenceGetPage, resolveConfluencePageId } from './integration.js';
+const PAGE_ID = '123456789';
+const PAGE_URL = `https://acme.atlassian.net/wiki/spaces/ENG/pages/${PAGE_ID}/Some+Page+Title`;
+const BLOG_URL = 'https://acme.atlassian.net/wiki/spaces/ENG/blog/2026/01/15/987654321/Post+Title';
+const TINY_URL = 'https://acme.atlassian.net/wiki/x/AbCdEf';
+// Credentials resolve through process.env first, which is enough for these tests: every
+// case here supplies credentials rather than asserting their absence.
+process.env.ATLASSIAN_CLOUD_ID = 'cloud-a';
+process.env.ATLASSIAN_USER_EMAIL = 'dev@acme.test';
+process.env.CONFLUENCE_API_TOKEN = 'confluence-token';
+/** Replace the global fetch for one test; `afterEach` restores it. */
+function stubFetch(status, body) {
+    const calls = [];
+    const authHeaders = [];
+    mock.method(globalThis, 'fetch', async (input, init) => {
+        calls.push(String(input));
+        authHeaders.push(String(init?.headers?.Authorization ?? ''));
+        return new Response(typeof body === 'string' ? body : JSON.stringify(body), {
+            status,
+            headers: { 'content-type': 'application/json' },
+        });
+    });
+    return { calls, authHeaders };
+}
+const spilledFiles = [];
+afterEach(() => {
+    mock.restoreAll();
+    while (spilledFiles.length > 0) {
+        const file = spilledFiles.pop();
+        if (file)
+            fs.rmSync(file, { force: true });
+    }
+});
+/** Decode the `email:token` pair a Basic auth header carries. */
+function decodeBasicAuth(header) {
+    return Buffer.from(header.replace('Basic ', ''), 'base64').toString('utf8');
+}
+function pageFixture(overrides = {}) {
+    return {
+        id: PAGE_ID,
+        title: 'Design Notes',
+        status: 'current',
+        spaceId: '98765',
+        version: { number: 7, createdAt: '2026-07-01T10:00:00.000Z' },
+        body: { storage: { value: '<p>Hello <strong>world</strong></p>' } },
+        labels: { results: [{ name: 'design' }, { name: 'api' }] },
+        _links: { base: 'https://acme.atlassian.net/wiki', webui: `/spaces/ENG/pages/${PAGE_ID}/Design+Notes` },
+        ...overrides,
+    };
+}
+async function textFor(input) {
+    return (await handleConfluenceGetPage({ input })).content[0].text;
+}
+async function successText(page) {
+    stubFetch(200, page);
+    return textFor(PAGE_URL);
+}
+describe('resolveConfluencePageId (BC2, BC5, BC6, BC7)', () => {
+    test('H1: full page URL with a title segment resolves to the numeric id', () => {
+        assert.deepEqual(resolveConfluencePageId(PAGE_URL), { kind: 'id', pageId: PAGE_ID });
+    });
+    test('H2: page URL with a query string and fragment but no title segment resolves', () => {
+        const url = `https://acme.atlassian.net/wiki/spaces/ENG/pages/${PAGE_ID}?focusedCommentId=99#anchor`;
+        assert.deepEqual(resolveConfluencePageId(url), { kind: 'id', pageId: PAGE_ID });
+    });
+    test('H3: legacy viewpage.action form resolves from the pageId query parameter', () => {
+        const url = `https://acme.atlassian.net/pages/viewpage.action?pageId=${PAGE_ID}`;
+        assert.deepEqual(resolveConfluencePageId(url), { kind: 'id', pageId: PAGE_ID });
+    });
+    test('H4: bare numeric id resolves', () => {
+        assert.deepEqual(resolveConfluencePageId(PAGE_ID), { kind: 'id', pageId: PAGE_ID });
+    });
+    test('H8: blog URL is classified as blog, never as an id from its date segments', () => {
+        const resolution = resolveConfluencePageId(BLOG_URL);
+        assert.equal(resolution.kind, 'blog');
+        assert.notEqual(resolution.kind, 'id');
+        const serialised = JSON.stringify(resolution);
+        assert.ok(!serialised.includes('2026'), 'a date segment must never become a page id');
+        assert.ok(!serialised.includes('987654321'), 'a blog post id must never become a page id');
+    });
+});
+describe('handleConfluenceGetPage — pre-network error paths (BC5, BC6, BC7, BC8)', () => {
+    test('H5: tiny link errors before any network call and asks for the full page URL', async () => {
+        assert.deepEqual(resolveConfluencePageId(TINY_URL), { kind: 'tiny' });
+        const { calls } = stubFetch(200, pageFixture());
+        const text = await textFor(TINY_URL);
+        assert.equal(calls.length, 0, 'MUST NOT call fetch for a tiny link');
+        assert.match(text, /tiny link/i);
+        assert.match(text, /full page URL/i);
+    });
+    test('H6: blog URL errors before any network call', async () => {
+        const { calls } = stubFetch(200, pageFixture());
+        const text = await textFor(BLOG_URL);
+        assert.equal(calls.length, 0, 'MUST NOT call fetch for a blog URL');
+        assert.match(text, /blog posts are not supported/i);
+    });
+    test('H7: unrecognised input errors before any network call and lists accepted forms', async () => {
+        assert.deepEqual(resolveConfluencePageId('not a confluence link at all'), { kind: 'unknown' });
+        const { calls } = stubFetch(200, pageFixture());
+        const text = await textFor('not a confluence link at all');
+        assert.equal(calls.length, 0, 'MUST NOT call fetch for unrecognised input');
+        assert.match(text, /Accepted input forms/);
+        assert.match(text, /viewpage\.action\?pageId=/);
+        assert.match(text, /numeric page ID/);
+    });
+});
+describe('handleConfluenceGetPage — happy path output (BC3)', () => {
+    test('H13: renders the full brief in exactly one request', async () => {
+        const { calls, authHeaders } = stubFetch(200, pageFixture());
+        const text = await textFor(PAGE_URL);
+        assert.equal(calls.length, 1, 'exactly one HTTP request — no space or user lookup');
+        assert.ok(calls[0].includes('/ex/confluence/cloud-a/'), `must use the shared cloud id, got: ${calls[0]}`);
+        assert.equal(decodeBasicAuth(authHeaders[0]), 'dev@acme.test:confluence-token', 'Confluence must authenticate with the shared email and its own token, not the Jira token');
+        assert.ok(calls[0].includes('body-format=storage'), `got: ${calls[0]}`);
+        assert.ok(calls[0].includes('include-labels=true'), `got: ${calls[0]}`);
+        assert.ok(calls[0].includes('include-version=true'), `got: ${calls[0]}`);
+        assert.match(text, /Design Notes/);
+        assert.match(text, /\*\*Status:\*\* current/);
+        assert.match(text, /\*\*Space:\*\* ENG/);
+        assert.match(text, /\*\*Version:\*\* 7/);
+        assert.match(text, /\*\*Last updated:\*\* 2026-07-01T10:00:00\.000Z/);
+        assert.match(text, new RegExp(`\\*\\*URL:\\*\\* https://acme\\.atlassian\\.net/wiki/spaces/ENG/pages/${PAGE_ID}/Design\\+Notes`));
+        assert.match(text, /### Content\nHello \*\*world\*\*/);
+        assert.match(text, /### Labels\ndesign, api/);
+    });
+    test('H14: space line is omitted, never guessed, when webui has no /spaces/<KEY>/', async () => {
+        const text = await successText(pageFixture({ _links: { base: 'https://acme.atlassian.net/wiki', webui: '/foo/bar' } }));
+        assert.ok(!text.includes('**Space:**'), `space line must be omitted, got: ${text}`);
+        assert.ok(!text.includes('98765'), 'spaceId must never be presented as a space key');
+        assert.match(text, /\*\*URL:\*\* https:\/\/acme\.atlassian\.net\/wiki\/foo\/bar/);
+    });
+});
+describe('handleConfluenceGetPage — distinct HTTP and schema errors (BC9)', () => {
+    async function errorText(status, body = { message: 'nope' }) {
+        stubFetch(status, body);
+        return textFor(PAGE_URL);
+    }
+    test('H15: 401 identifies an auth failure', async () => {
+        const text = await errorText(401);
+        assert.match(text, /401/);
+        assert.match(text, /Auth failed/i);
+        assert.ok(!/Not found/i.test(text), '401 must be distinct from the 404 message');
+    });
+    test('H16: 403 mentions permission or restriction and is distinct from 404', async () => {
+        const text = await errorText(403);
+        assert.match(text, /403/);
+        assert.match(text, /permission|restricted/i);
+        assert.ok(!/Not found/i.test(text), '403 must be distinct from the 404 message');
+    });
+    test('H17: 404 identifies not-found and is distinct from 403', async () => {
+        const text = await errorText(404);
+        assert.match(text, /Not found/i);
+        assert.ok(!text.includes('403'), '404 must be distinct from the 403 message');
+    });
+    test('H18: other non-OK statuses include the status code', async () => {
+        const text = await errorText(500);
+        assert.match(text, /500/);
+        assert.ok(!/Auth failed/i.test(text), '500 must be distinct from 401');
+        assert.ok(!/Not found/i.test(text), '500 must be distinct from 404');
+        assert.ok(!/permission|restricted/i.test(text), '500 must be distinct from 403');
+    });
+    test('H19: a 200 missing title is reported as an invalid response format', async () => {
+        const { title: _title, ...withoutTitle } = pageFixture();
+        const text = await successText(withoutTitle);
+        assert.match(text, /Invalid Confluence response format/);
+        assert.ok(!text.includes('### Content'), 'a schema failure must not be presented as partial success');
+    });
+});
+describe('handleConfluenceGetPage — empty and unconvertible bodies (BC10)', () => {
+    const EXPECTED_URL = `https://acme.atlassian.net/wiki/spaces/ENG/pages/${PAGE_ID}/Design+Notes`;
+    function assertEmptyWarning(text, status) {
+        assert.match(text, /⚠️ Confluence returned no readable body/);
+        assert.ok(text.includes(`status: ${status}`), `warning must name the page status, got: ${text}`);
+        assert.ok(text.includes(EXPECTED_URL), `warning must include the absolute URL, got: ${text}`);
+        assert.ok(!/### Content\n\s*\n/.test(text), 'MUST NOT emit an empty Content section as if it were success');
+    }
+    test('H20: body: {} (the documented Atlassian defect) warns explicitly', async () => {
+        assertEmptyWarning(await successText(pageFixture({ body: {} })), 'current');
+    });
+    test('H21: an empty storage value warns explicitly', async () => {
+        assertEmptyWarning(await successText(pageFixture({ body: { storage: { value: '' } } })), 'current');
+    });
+    test('H22: a body that converts to whitespace only warns explicitly', async () => {
+        assertEmptyWarning(await successText(pageFixture({ body: { storage: { value: '<p>&nbsp;</p>' } } })), 'current');
+    });
+    test('H23: a trashed page names its status in the warning', async () => {
+        const text = await successText(pageFixture({ status: 'trashed', body: {} }));
+        assertEmptyWarning(text, 'trashed');
+        assert.match(text, /\*\*Status:\*\* trashed/);
+    });
+});
+describe('handleConfluenceGetPage — oversize bodies spill to a temp file (BC11)', () => {
+    const HUGE_TEXT = 'x'.repeat(LARGE_PAYLOAD_THRESHOLD + 10);
+    test('H24: the body is written to /tmp and referenced, not inlined', async () => {
+        stubFetch(200, pageFixture({ body: { storage: { value: `<p>${HUGE_TEXT}</p>` } } }));
+        const text = await textFor(PAGE_URL);
+        const spilledPath = text.match(new RegExp(`/tmp/kit-confluence-${PAGE_ID}-\\d+\\.md`))?.[0];
+        assert.ok(spilledPath, `output must reference a temp path, got: ${text.slice(0, 300)}`);
+        spilledFiles.push(spilledPath);
+        assert.ok(fs.existsSync(spilledPath), 'the temp file must actually be written');
+        assert.ok(fs.readFileSync(spilledPath, 'utf8').includes(HUGE_TEXT), 'the temp file must hold the markdown');
+        assert.ok(!text.includes(HUGE_TEXT), 'MUST NOT inline the body once it has been spilled');
+    });
+});
+describe('handleConfluenceGetPage — secret redaction and labels (BC19, BC20)', () => {
+    test('H26: a pasted AWS key in the page body is redacted', async () => {
+        const secret = 'AKIAABCDEFGHIJKLMNOP';
+        const text = await successText(pageFixture({ body: { storage: { value: `<p>key ${secret} here</p>` } } }));
+        assert.match(text, /\[REDACTED\]/);
+        assert.ok(!text.includes(secret), 'the raw token MUST NOT reach the agent context');
+    });
+    test('H27: absent labels render None', async () => {
+        const { labels: _labels, ...withoutLabels } = pageFixture();
+        assert.match(await successText(withoutLabels), /### Labels\nNone/);
+    });
+    test('H28: an empty labels result renders None', async () => {
+        assert.match(await successText(pageFixture({ labels: { results: [] } })), /### Labels\nNone/);
+    });
+    test('H29: multiple labels render comma-joined', async () => {
+        assert.match(await successText(pageFixture()), /### Labels\ndesign, api/);
+    });
+});
+describe('handleConfluenceGetPage — never rejects (H30)', () => {
+    test('H30: every error and success scenario resolves to a valid mcpText envelope', async () => {
+        const scenarios = [
+            { label: 'tiny link', input: TINY_URL, status: 200, body: pageFixture() },
+            { label: 'blog URL', input: BLOG_URL, status: 200, body: pageFixture() },
+            { label: 'unrecognised', input: 'nonsense', status: 200, body: pageFixture() },
+            ...[401, 403, 404, 500].map((status) => ({
+                label: `HTTP ${status}`,
+                input: PAGE_URL,
+                status,
+                body: { message: 'nope' },
+            })),
+            { label: 'schema mismatch', input: PAGE_URL, status: 200, body: { id: PAGE_ID } },
+            { label: 'empty body', input: PAGE_URL, status: 200, body: pageFixture({ body: {} }) },
+            {
+                label: 'malformed body markup',
+                input: PAGE_URL,
+                status: 200,
+                body: pageFixture({ body: { storage: { value: '<p><strong>oops</p><![CDATA[' } } }),
+            },
+            { label: 'happy path', input: PAGE_URL, status: 200, body: pageFixture() },
+        ];
+        for (const scenario of scenarios) {
+            stubFetch(scenario.status, scenario.body);
+            const result = await handleConfluenceGetPage({ input: scenario.input });
+            assert.equal(result.content.length, 1, `${scenario.label}: expected one content entry`);
+            assert.equal(result.content[0].type, 'text', `${scenario.label}: expected a text envelope`);
+            assert.equal(typeof result.content[0].text, 'string', `${scenario.label}: expected string text`);
+            assert.ok(result.content[0].text.length > 0, `${scenario.label}: expected a non-empty message`);
+            mock.restoreAll();
+        }
+    });
+});

package/dist/mcp/integration.d.ts

@@ -1,6 +1,48 @@
 /**
- * Integration Tools - Bitbucket, Jira
- * Tools: kit_get_bitbucket_pr, kit_jira_get_ticket
+ * Integration Tools - Bitbucket, Jira, Confluence
+ * Tools: kit_get_bitbucket_pr, kit_jira_get_ticket, kit_confluence_get_page
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * Payload size (chars) at or above which a body is spilled to a temp file
+ * instead of inlined into the agent context.
+ */
+export declare const LARGE_PAYLOAD_THRESHOLD = 50000;
+export type ConfluenceIdResolution = {
+    kind: 'id';
+    pageId: string;
+} | {
+    kind: 'tiny';
+} | {
+    kind: 'blog';
+} | {
+    kind: 'unknown';
+};
+export interface AtlassianContext {
+    auth: string;
+    cloudId: string;
+}
+/** Resolve the shared cloud id plus the product's basic-auth header (shared email, own token). */
+export declare function buildAtlassianContext(product: 'jira' | 'confluence'): AtlassianContext;
+/**
+ * Resolve a user-supplied Confluence reference to a numeric page id.
+ *
+ * The blog branch MUST stay ahead of numeric extraction: a blog URL carries date and
+ * post-id segments that generic extraction would misread as a page id, silently
+ * fetching the wrong content.
+ */
+export declare function resolveConfluencePageId(input: string): ConfluenceIdResolution;
+/**
+ * Handler for kit_confluence_get_page. Exported (rather than living inside the
+ * registerTool closure) so behaviour is unit testable without a transport or network.
+ * Never rejects — every failure path resolves to an actionable mcpText message.
+ */
+export declare function handleConfluenceGetPage(args: {
+    input: string;
+}): Promise<{
+    content: [{
+        type: 'text';
+        text: string;
+    }];
+}>;
 export declare function registerIntegrationTools(server: McpServer): void;

package/dist/mcp/integration.js

@@ -1,13 +1,19 @@
 /**
- * Integration Tools - Bitbucket, Jira
- * Tools: kit_get_bitbucket_pr, kit_jira_get_ticket
+ * Integration Tools - Bitbucket, Jira, Confluence
+ * Tools: kit_get_bitbucket_pr, kit_jira_get_ticket, kit_confluence_get_page
  */
 import { writeFileSync } from 'fs';
 import { z } from 'zod';
 import { getCredential } from '../services/integration/credentials.js';
 import { mcpText } from '../utils/utils.js';
 import { adfToMarkdown } from '../services/integration/parser/adf.js';
-import { sanitize } from '../core/security/index.js';
+import { storageToMarkdown } from '../services/integration/parser/storage.js';
+import { sanitize, sanitizeOutput } from '../core/security/index.js';
+/**
+ * Payload size (chars) at or above which a body is spilled to a temp file
+ * instead of inlined into the agent context.
+ */
+export const LARGE_PAYLOAD_THRESHOLD = 50_000;
 // Zod schema for Bitbucket PR REST API response
 const BitbucketPrSchema = z.object({
     id: z.number(),
@@ -55,6 +61,34 @@ const JiraTicketSchema = z.object({
     errorMessages: z.array(z.string()).optional(),
     fields: JiraFieldsSchema,
 });
+// Confluence Cloud REST v2 page schema. Deliberately permissive: only the fields the
+// output renders are required, so an additive Atlassian change cannot break the tool.
+const ConfluencePageSchema = z.object({
+    id: z.string(),
+    title: z.string(),
+    status: z.string().optional(),
+    spaceId: z.string().optional(),
+    version: z
+        .object({
+        number: z.number().optional(),
+        createdAt: z.string().optional(),
+        message: z.string().optional(),
+        minorEdit: z.boolean().optional(),
+        authorId: z.string().optional(),
+    })
+        .optional(),
+    body: z
+        .object({
+        storage: z.object({ value: z.string().optional() }).passthrough().optional(),
+    })
+        .passthrough()
+        .optional(),
+    labels: z
+        .object({ results: z.array(z.object({ name: z.string() }).passthrough()).optional() })
+        .passthrough()
+        .optional(),
+    _links: z.object({ base: z.string().optional(), webui: z.string().optional() }).passthrough().optional(),
+});
 function buildBasicAuth(emailVar, tokenVar) {
     const email = getCredential(emailVar);
     const token = getCredential(tokenVar);
@@ -62,16 +96,134 @@ function buildBasicAuth(emailVar, tokenVar) {
         throw new Error(`Missing ${emailVar} or ${tokenVar}`);
     return 'Basic ' + Buffer.from(`${email}:${token}`).toString('base64');
 }
+// Jira and Confluence share one site and one account, so they share ATLASSIAN_CLOUD_ID
+// and ATLASSIAN_USER_EMAIL — but Atlassian issues scoped API tokens per app, so each
+// product carries its own token.
+const PRODUCT_TOKEN_KEY = {
+    jira: 'JIRA_API_TOKEN',
+    confluence: 'CONFLUENCE_API_TOKEN',
+};
+/** Resolve the shared cloud id plus the product's basic-auth header (shared email, own token). */
+export function buildAtlassianContext(product) {
+    const cloudId = getCredential('ATLASSIAN_CLOUD_ID');
+    if (!cloudId)
+        throw new Error('Missing ATLASSIAN_CLOUD_ID');
+    return { auth: buildBasicAuth('ATLASSIAN_USER_EMAIL', PRODUCT_TOKEN_KEY[product]), cloudId };
+}
 async function callRestApi(url, auth, accept = 'application/json') {
     const resp = await fetch(url, { headers: { Authorization: auth, Accept: accept } });
     if (resp.status === 401)
         throw new Error(`❌ Auth failed (401): ${url}`);
+    if (resp.status === 403)
+        throw new Error(`❌ Access denied (403): ${url}\n\nYou lack permission for this resource, or it is restricted.`);
     if (resp.status === 404)
         throw new Error(`❌ Not found: ${url}`);
     if (!resp.ok)
         throw new Error(`❌ API error ${resp.status}: ${await resp.text()}`);
     return accept === 'text/plain' ? resp.text() : resp.json();
 }
+const CONFLUENCE_INPUT_FORMS = [
+    'Accepted input forms:',
+    '  • https://<site>.atlassian.net/wiki/spaces/<SPACEKEY>/pages/<pageId>/<Title>',
+    '  • https://<site>.atlassian.net/pages/viewpage.action?pageId=<pageId>',
+    '  • a bare numeric page ID (e.g. 123456789)',
+].join('\n');
+/**
+ * Resolve a user-supplied Confluence reference to a numeric page id.
+ *
+ * The blog branch MUST stay ahead of numeric extraction: a blog URL carries date and
+ * post-id segments that generic extraction would misread as a page id, silently
+ * fetching the wrong content.
+ */
+export function resolveConfluencePageId(input) {
+    const trimmed = input.trim();
+    if (!trimmed)
+        return { kind: 'unknown' };
+    if (/\/blog(?:posts?)?\//.test(trimmed))
+        return { kind: 'blog' };
+    if (/\/wiki\/x\/[A-Za-z0-9]+/.test(trimmed))
+        return { kind: 'tiny' };
+    const spacesPageMatch = trimmed.match(/\/wiki\/spaces\/[^/]+\/pages\/(\d+)(?:[/?#]|$)/);
+    if (spacesPageMatch)
+        return { kind: 'id', pageId: spacesPageMatch[1] };
+    const queryMatch = trimmed.match(/[?&]pageId=(\d+)(?:[&#]|$)/);
+    if (queryMatch)
+        return { kind: 'id', pageId: queryMatch[1] };
+    if (/^\d+$/.test(trimmed))
+        return { kind: 'id', pageId: trimmed };
+    return { kind: 'unknown' };
+}
+function buildConfluenceHeader(page, absoluteUrl) {
+    const webui = page._links?.webui ?? '';
+    const spaceKey = webui.match(/\/spaces\/([^/]+)\//)?.[1];
+    const lines = [`## 📄 ${page.title}`, '', `**Status:** ${page.status || 'Unknown'}`];
+    if (spaceKey)
+        lines.push(`**Space:** ${spaceKey}`);
+    lines.push(`**Version:** ${page.version?.number ?? 'Unknown'}`);
+    lines.push(`**Last updated:** ${page.version?.createdAt || 'Unknown'}`);
+    lines.push(`**URL:** ${absoluteUrl || 'Unknown'}`);
+    return lines.join('\n');
+}
+/**
+ * Handler for kit_confluence_get_page. Exported (rather than living inside the
+ * registerTool closure) so behaviour is unit testable without a transport or network.
+ * Never rejects — every failure path resolves to an actionable mcpText message.
+ */
+export async function handleConfluenceGetPage(args) {
+    try {
+        const resolution = resolveConfluencePageId(args.input);
+        if (resolution.kind === 'tiny') {
+            return mcpText(`❌ Confluence tiny links cannot be resolved without following a redirect.\n\nOpen the link in a browser and pass the full page URL instead.\n\n${CONFLUENCE_INPUT_FORMS}`);
+        }
+        if (resolution.kind === 'blog') {
+            return mcpText(`❌ Confluence blog posts are not supported — they live on a different endpoint than pages.\n\n${CONFLUENCE_INPUT_FORMS}`);
+        }
+        if (resolution.kind === 'unknown') {
+            return mcpText(`❌ Could not extract a Confluence page ID from: ${args.input}\n\n${CONFLUENCE_INPUT_FORMS}`);
+        }
+        const { auth, cloudId } = buildAtlassianContext('confluence');
+        const url = `https://api.atlassian.com/ex/confluence/${cloudId}/wiki/api/v2/pages/${resolution.pageId}?body-format=storage&include-labels=true&include-version=true`;
+        const jsonData = await callRestApi(url, auth);
+        const parseResult = ConfluencePageSchema.safeParse(jsonData);
+        if (!parseResult.success) {
+            return mcpText(`❌ Invalid Confluence response format: ${parseResult.error.message}`);
+        }
+        const page = parseResult.data;
+        const base = page._links?.base ?? '';
+        const webui = page._links?.webui ?? '';
+        const absoluteUrl = base && webui ? `${base}${webui}` : base || webui;
+        const markdown = storageToMarkdown(page.body?.storage?.value);
+        let contentSection;
+        if (!markdown.trim()) {
+            contentSection = `⚠️ Confluence returned no readable body for this page (status: ${page.status || 'Unknown'}). Open ${absoluteUrl || 'the page in Confluence'} to view it directly.`;
+        }
+        else if (markdown.length >= LARGE_PAYLOAD_THRESHOLD) {
+            const filePath = `/tmp/kit-confluence-${resolution.pageId}-${Date.now()}.md`;
+            try {
+                writeFileSync(filePath, sanitizeOutput(markdown), 'utf8');
+                contentSection = `Content is large (${markdown.length} chars). Full markdown written to: \`${filePath}\`. Read this file before proceeding.`;
+            }
+            catch {
+                contentSection = `⚠️ Could not write page content to a temp file. Showing inline (may be very large).\n\n${markdown}`;
+            }
+        }
+        else {
+            contentSection = markdown;
+        }
+        const labels = page.labels?.results?.map((label) => label.name).filter((name) => name.length > 0) ?? [];
+        const output = `${buildConfluenceHeader(page, absoluteUrl)}
+
+### Content
+${contentSection}
+
+### Labels
+${labels.length > 0 ? labels.join(', ') : 'None'}`;
+        return mcpText(sanitizeOutput(output));
+    }
+    catch (error) {
+        return mcpText(`Error: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 export function registerIntegrationTools(server) {
     // TOOL: GET BITBUCKET PR
     server.registerTool('kit_get_bitbucket_pr', {
@@ -128,8 +280,7 @@ ${pr.description || 'No description'}`;
             if (includeDiff) {
                 const diffUrl = `https://api.bitbucket.org/2.0/repositories/${safeWs}/${safeRepo}/pullrequests/${prId}/diff`;
                 const diff = (await callRestApi(diffUrl, auth, 'text/plain'));
-                const DIFF_FILE_THRESHOLD = 50_000;
-                if (diff.length < DIFF_FILE_THRESHOLD) {
+                if (diff.length < LARGE_PAYLOAD_THRESHOLD) {
                     output += `\n\n### Diff\n\`\`\`diff\n${diff}\n\`\`\``;
                 }
                 else {
@@ -163,10 +314,7 @@ ${pr.description || 'No description'}`;
             if (!safeTicketId) {
                 return mcpText(`❌ Invalid ticket ID format: ${ticketId}\n\nExpected format: PROJ-123`);
             }
-            const cloudId = getCredential('ATLASSIAN_CLOUD_ID');
-            if (!cloudId)
-                throw new Error('Missing ATLASSIAN_CLOUD_ID');
-            const auth = buildBasicAuth('ATLASSIAN_USER_EMAIL', 'ATLASSIAN_API_TOKEN');
+            const { auth, cloudId } = buildAtlassianContext('jira');
             const url = `https://api.atlassian.com/ex/jira/${cloudId}/rest/api/3/issue/${safeTicketId}`;
             const jsonData = await callRestApi(url, auth);
             const parseResult = JiraTicketSchema.safeParse(jsonData);
@@ -196,4 +344,13 @@ ${ticket.fields.labels?.join(', ') || 'None'}`;
             return mcpText(`Error: ${error instanceof Error ? error.message : String(error)}`);
         }
     });
+    // TOOL: CONFLUENCE GET PAGE
+    server.registerTool('kit_confluence_get_page', {
+        title: 'Get Confluence Page',
+        description: 'Get a Confluence page as markdown using the Atlassian REST API. Accepts a full Confluence page URL or a numeric page ID.',
+        inputSchema: {
+            input: z.string().describe('Confluence page URL or numeric page ID'),
+        },
+        annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+    }, async ({ input }) => handleConfluenceGetPage({ input }));
 }

package/dist/mcp/jira.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mcp/jira.test.js

@@ -0,0 +1,37 @@
+import * as assert from 'node:assert/strict';
+import { describe, test } from 'node:test';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import { buildAtlassianContext, registerIntegrationTools } from './integration.js';
+// Both products' tokens are present so J1 can prove they share an email but not a token.
+process.env.ATLASSIAN_CLOUD_ID = 'cloud-a';
+process.env.ATLASSIAN_USER_EMAIL = 'dev@acme.test';
+process.env.JIRA_API_TOKEN = 'token-123';
+process.env.CONFLUENCE_API_TOKEN = 'confluence-token';
+async function buildClient() {
+    const server = new McpServer({ name: 'test-kit', version: '0.0.0' });
+    registerIntegrationTools(server);
+    const [serverTransport, clientTransport] = InMemoryTransport.createLinkedPair();
+    const client = new Client({ name: 'test-client', version: '0.0.0' });
+    await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
+    return client;
+}
+describe('kit_jira_get_ticket regression after the buildAtlassianContext refactor (BC21)', () => {
+    test('J1: jira and confluence share the cloud id and email but not the token', () => {
+        const jira = buildAtlassianContext('jira');
+        const confluence = buildAtlassianContext('confluence');
+        const decode = (auth) => Buffer.from(auth.replace('Basic ', ''), 'base64').toString('utf8');
+        assert.equal(jira.cloudId, 'cloud-a');
+        assert.equal(confluence.cloudId, 'cloud-a', 'both products must use the same ATLASSIAN_CLOUD_ID');
+        assert.equal(decode(jira.auth), 'dev@acme.test:token-123');
+        assert.equal(decode(confluence.auth), 'dev@acme.test:confluence-token');
+        assert.notEqual(jira.auth, confluence.auth, 'a per-app scoped token must never cross products');
+    });
+    test('J2: an invalid ticket ID still returns the pre-existing format message', async () => {
+        const client = await buildClient();
+        const result = await client.callTool({ name: 'kit_jira_get_ticket', arguments: { ticketId: 'not-a-ticket' } });
+        const content = result.content;
+        assert.equal(content[0].text, '❌ Invalid ticket ID format: not-a-ticket\n\nExpected format: PROJ-123');
+    });
+});

package/dist/mcp/registration.test.js

@@ -11,6 +11,7 @@ const EXPECTED_NON_MEMORY_TOOLS = [
     'kit_trigger_agent',
     'kit_get_bitbucket_pr',
     'kit_jira_get_ticket',
+    'kit_confluence_get_page',
 ];
 async function buildClientWithTools() {
     const server = new McpServer({ name: 'test-kit', version: '0.0.0' });
@@ -23,7 +24,7 @@ async function buildClientWithTools() {
     return client;
 }
 describe('MCP tool registration smoke tests', () => {
-    test('R1: all 4 non-memory tool names are registered', async () => {
+    test('R1: all 5 non-memory tool names are registered', async () => {
         const client = await buildClientWithTools();
         const { tools } = await client.listTools();
         const names = tools.map((t) => t.name);
@@ -74,4 +75,14 @@ describe('MCP tool registration smoke tests', () => {
         assert.equal(tool.annotations.idempotentHint, true, 'idempotentHint must be true');
         assert.equal(tool.annotations.openWorldHint, true, 'openWorldHint must be true');
     });
+    test('R6: kit_confluence_get_page (readOnlyHint:true) has correct annotations (BC1)', async () => {
+        const client = await buildClientWithTools();
+        const { tools } = await client.listTools();
+        const tool = tools.find((t) => t.name === 'kit_confluence_get_page');
+        assert.ok(tool, 'kit_confluence_get_page must be registered');
+        assert.ok(tool.annotations, 'kit_confluence_get_page must have annotations');
+        assert.equal(tool.annotations.readOnlyHint, true, 'readOnlyHint must be true');
+        assert.equal(tool.annotations.idempotentHint, true, 'idempotentHint must be true');
+        assert.equal(tool.annotations.openWorldHint, true, 'openWorldHint must be true');
+    });
 });