@softeria/ms-365-mcp-server 0.154.1 → 0.154.2

package/Dockerfile.ghcr

@@ -0,0 +1,29 @@
+# The image published to ghcr.io/softeria/ms-365-mcp-server. It installs the released npm
+# package rather than building from source, so a version tag holds exactly what npm serves
+# for that version. `generate` downloads Microsoft's live spec, so a source build of the
+# same version can drift from it.
+#
+# Separate from Dockerfile because the legacy (non-BuildKit) builder runs every stage in a
+# file whatever --target says, which would break the source build documented in
+# docs/deployment.md.
+FROM node:24-alpine
+
+LABEL org.opencontainers.image.source="https://github.com/Softeria/ms-365-mcp-server"
+
+# No default. npm resolves an empty spec to latest, which would stamp whatever is newest
+# with the tag the workflow passes.
+ARG VERSION
+
+ENV NODE_ENV=production
+
+RUN test -n "$VERSION" || { echo 'VERSION build arg is required'; exit 1; }
+
+# --ignore-scripts keeps keytar (optional, native, no musl prebuild) from attempting a
+# node-gyp build that cannot succeed here. --omit=optional would drop @azure/identity and
+# @azure/keyvault-secrets with it, which Key Vault mode needs.
+RUN npm i -g --ignore-scripts "@softeria/ms-365-mcp-server@${VERSION}" && \
+    npm cache clean --force
+
+USER node
+
+ENTRYPOINT ["ms-365-mcp-server"]

package/dist/__tests__/graph-client.test.js

@@ -88,6 +88,121 @@ describe("GraphClient audit metadata", () => {
     const result = await createGraphClient().graphRequest("/me/messages/m1/$value");
     expect(result._meta).toMatchObject({ response_bytes: raw.byteLength });
   });
+  describe("forceBinary", () => {
+    const doc = Buffer.from([
+      208,
+      207,
+      17,
+      224,
+      161,
+      177,
+      26,
+      225,
+      255,
+      254,
+      0,
+      65
+    ]);
+    it("returns base64 bytes for a content type outside the binary allowlist", async () => {
+      fetchWithResilienceMock.mockResolvedValue(
+        new Response(doc, { status: 200, headers: { "content-type": "application/msword" } })
+      );
+      const result = await createGraphClient().graphRequest(
+        "/me/messages/m1/attachments/a1/$value",
+        {
+          rawResponse: true,
+          forceBinary: true
+        }
+      );
+      const payload = JSON.parse(result.content[0].text);
+      expect(payload).toMatchObject({
+        contentType: "application/msword",
+        encoding: "base64",
+        contentLength: doc.byteLength
+      });
+      expect(Buffer.from(payload.contentBytes, "base64").equals(doc)).toBe(true);
+      expect(payload).not.toHaveProperty("rawResponse");
+      expect(result._meta).toMatchObject({ response_bytes: doc.byteLength });
+    });
+  });
+  describe("never returns lossy text", () => {
+    const cases = [
+      {
+        name: "Word 97-2003 document",
+        contentType: "application/msword",
+        body: Buffer.from([208, 207, 17, 224, 161, 177, 26, 225, 255, 254, 0, 65])
+      },
+      {
+        name: "RTF with Windows-1252 quotes",
+        contentType: "application/rtf",
+        body: Buffer.from("{\\rtf1\\ansi \x93quoted\x94}", "latin1")
+      },
+      {
+        name: "8-bit MIME message",
+        contentType: "message/rfc822",
+        body: Buffer.from("Subject: caf\xE9\r\n\r\nna\xEFve body\r\n", "latin1")
+      },
+      {
+        name: "text/plain in Windows-1252",
+        contentType: "text/plain; charset=windows-1252",
+        body: Buffer.from("caf\xE9 \x96 dash", "latin1")
+      }
+    ];
+    for (const c of cases) {
+      it(`returns ${c.name} (${c.contentType}) as byte-identical base64`, async () => {
+        fetchWithResilienceMock.mockResolvedValue(
+          new Response(new Uint8Array(c.body), {
+            status: 200,
+            headers: { "content-type": c.contentType }
+          })
+        );
+        const result = await createGraphClient().graphRequest(
+          "/me/messages/m1/attachments/a1/$value",
+          {
+            rawResponse: true
+          }
+        );
+        const payload = JSON.parse(result.content[0].text);
+        expect(payload).not.toHaveProperty("rawResponse");
+        expect(payload).toMatchObject({ encoding: "base64", contentLength: c.body.byteLength });
+        expect(Buffer.from(payload.contentBytes, "base64").equals(c.body)).toBe(true);
+        expect(result._meta).toMatchObject({ response_bytes: c.body.byteLength });
+      });
+    }
+    it("still returns valid UTF-8 text as text, byte for byte, BOM included", async () => {
+      const body = Buffer.concat([
+        Buffer.from([239, 187, 191]),
+        Buffer.from("h\xE9llo\r\nw\xF6rld\n", "utf8")
+      ]);
+      fetchWithResilienceMock.mockResolvedValue(
+        new Response(body, {
+          status: 200,
+          headers: { "content-type": "text/plain; charset=utf-8" }
+        })
+      );
+      const result = await createGraphClient().graphRequest(
+        "/me/messages/m1/attachments/a1/$value",
+        {
+          rawResponse: true
+        }
+      );
+      const payload = JSON.parse(result.content[0].text);
+      expect(payload).not.toHaveProperty("contentBytes");
+      expect(Buffer.from(payload.rawResponse, "utf8").equals(body)).toBe(true);
+      expect(result._meta).toMatchObject({ response_bytes: body.byteLength });
+    });
+    it("still parses JSON, even with a leading byte-order mark", async () => {
+      const body = Buffer.concat([
+        Buffer.from([239, 187, 191]),
+        Buffer.from('{"id":"u1"}', "utf8")
+      ]);
+      fetchWithResilienceMock.mockResolvedValue(
+        new Response(body, { status: 200, headers: { "content-type": "application/json" } })
+      );
+      const result = await createGraphClient().graphRequest("/me");
+      expect(JSON.parse(result.content[0].text)).toEqual({ id: "u1" });
+    });
+  });
   it("preserves HTTP status metadata when response headers are requested", async () => {
     fetchWithResilienceMock.mockResolvedValue(
       new Response(JSON.stringify({ id: "task-1" }), {

package/dist/__tests__/graph-tools.test.js

@@ -2187,6 +2187,8 @@ describe("graph-tools", () => {
       const [path, options] = graphClient.graphRequest.mock.calls[0];
       expect(path).toBe("/me/photo/$value");
       expect(options.accessToken).toBeUndefined();
+      expect(options.forceBinary).toBe(true);
+      expect(options.rawResponse).toBe(true);
     });
     it("rejects absolute URLs (Graph paths only)", async () => {
       mockEndpoints.length = 0;

package/dist/graph-client.js

@@ -11,6 +11,7 @@ import { applyMessageSignoffToRequest } from "./lib/message-signoff.js";
 import { TRANSPORT_OK_MESSAGE } from "./lib/select-projection.js";
 import { open, stat, unlink } from "fs/promises";
 import { pipeline } from "stream/promises";
+const UTF8_STRICT = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 function isBinaryContentType(contentType) {
   if (!contentType) return false;
   const lower = contentType.toLowerCase().split(";")[0].trim();
@@ -120,11 +121,20 @@ class GraphClient {
         throw await this.createGraphApiError(response);
       }
       const contentTypeHeader = response.headers?.get?.("content-type") || "";
-      const isBinaryResponse = isBinaryContentType(contentTypeHeader);
+      const isBinaryResponse = options.forceBinary === true || isBinaryContentType(contentTypeHeader);
       let metadata = { http_status: response.status };
       let result;
-      if (isBinaryResponse) {
-        const buffer = Buffer.from(await response.arrayBuffer());
+      const buffer = Buffer.from(await response.arrayBuffer());
+      metadata = { ...metadata, response_bytes: buffer.byteLength };
+      let text;
+      if (!isBinaryResponse) {
+        try {
+          text = UTF8_STRICT.decode(buffer);
+        } catch {
+          text = void 0;
+        }
+      }
+      if (text === void 0) {
         result = {
           message: TRANSPORT_OK_MESSAGE,
           contentType: contentTypeHeader,
@@ -132,20 +142,15 @@ class GraphClient {
           contentLength: buffer.byteLength,
           contentBytes: buffer.toString("base64")
         };
-        metadata = { ...metadata, response_bytes: buffer.byteLength };
+      } else if (text === "") {
+        result = { message: TRANSPORT_OK_MESSAGE };
+      } else if (options.rawResponse) {
+        result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
       } else {
-        const text = await response.text();
-        metadata = { ...metadata, response_bytes: Buffer.byteLength(text, "utf8") };
-        if (text === "") {
-          result = { message: TRANSPORT_OK_MESSAGE };
-        } else if (options.rawResponse) {
+        try {
+          result = JSON.parse(text.charCodeAt(0) === 65279 ? text.slice(1) : text);
+        } catch {
           result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
-        } else {
-          try {
-            result = JSON.parse(text);
-          } catch {
-            result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
-          }
         }
       }
       if (endpoint === "/$batch") {

package/dist/graph-tools.js

@@ -679,7 +679,8 @@ const UTILITY_TOOLS = [
         }
         return await graphClient.graphRequest(target, {
           accessToken: accountAccessToken,
-          rawResponse: true
+          rawResponse: true,
+          forceBinary: true
         });
       } catch (error) {
         return {

package/docs/deployment.md

@@ -28,7 +28,25 @@ In HTTP mode, `MS365_MCP_AUTH_CACHE_COMMAND` is skipped at startup and per Graph
 
 ## Docker
 
-A `Dockerfile` is included for containerized deployments:
+Released images are published to GitHub Container Registry:
+
+```bash
+docker pull ghcr.io/softeria/ms-365-mcp-server:latest
+# or pin a release
+docker pull ghcr.io/softeria/ms-365-mcp-server:<version>
+```
+
+The image runs as a non-root user and takes the same arguments as the CLI:
+
+```bash
+docker run -p 3000:3000 \
+  -e MS365_MCP_CLIENT_ID=your-client-id \
+  -e MS365_MCP_TENANT_ID=your-tenant-id \
+  ghcr.io/softeria/ms-365-mcp-server:latest \
+  --http 3000 --org-mode
+```
+
+A `Dockerfile` is also included, to build from source instead:
 
 ```bash
 # Build the image

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.154.1",
+  "version": "0.154.2",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",