@softspark/jira-mcp 1.0.0 → 1.2.0

package/CHANGELOG.md

@@ -7,6 +7,56 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v1.2.0 -- Per-Instance Credentials & Jira API Migration (2026-04-14)
+
+### Added
+- **Per-instance credentials** -- `set-credentials --url` flag allows different API tokens per Jira instance. Auto-migrates legacy Format A to Format B on first use.
+- **Live Jira API smoke tests** -- post-release SOP now includes Phase 4 with 15 steps testing all MCP tools against the KAN sandbox project.
+- **`validate_counts.py` in pre-commit SOP** -- added as Step 5 to catch README count drift before commit.
+
+### Changed
+- **Search endpoint migrated** -- `/rest/api/3/search` → `/rest/api/3/search/jql` (Jira Cloud deprecated the old endpoint with HTTP 410).
+- **`set-credentials` CLI** -- read-modify-write instead of overwrite. Preserves existing credentials when adding instance overrides.
+
+### Fixed
+- **Jira Cloud 410 on sync/search** -- `sync_tasks` and `search_tasks` failed on instances where Jira had removed the legacy search endpoint.
+
+---
+
+## v1.1.0 -- Hardening & Market Readiness (2026-04-14)
+
+### Added
+- **Boundary test suite** -- 96 new tests covering `server.ts` (25), `cli/index.ts` (27), and `JiraConnector` (44). Total: 509 tests across 51 files.
+- **Retry/backoff for transient failures** -- `JiraConnector` retries 429 and 503 responses up to 3 times with exponential backoff (1s/2s/4s). Respects `Retry-After` header.
+- **Count validation script** -- `scripts/validate_counts.py` verifies README counts match source code. Enforced in CI via `validate-counts` job.
+- **Count validation in CI** -- new `validate-counts` job in `ci.yml` catches README drift before merge.
+- **ADR-0001** -- documented "hardening before refactor" decision with alternatives and guardrails.
+- **Hardening plan** -- full plan with success criteria and pre-mortem in `kb/planning/`.
+
+### Changed
+- **server.ts refactored** -- 719 → 324 lines (-55%). Tool definitions extracted to `src/tools/definitions.ts`, argument helpers to `src/tools/args.ts`.
+- **Major dependency upgrades** -- TypeScript 5 → 6, ESLint 9 → 10, zod 3 → 4, vitest 3 → 4, @types/node 22 → 25.
+- **TypeScript 6 migration** -- added `types: ["node"]` and `ignoreDeprecations: "6.0"` to tsconfig.
+- **zod 4 migration** -- `.default({})` replaced with factory function in `BulkOptionsSchema`.
+- **vitest 4 migration** -- arrow function mocks replaced with regular function syntax for constructor compatibility.
+- **Bundle size** -- 325KB → 520KB (due to zod 4, which is significantly larger).
+- **README** -- "Zero runtime dependencies" corrected to "Minimal runtime dependencies". Test counts updated.
+- **CONTRIBUTING.md** -- full CI workflow documented, `validate:counts` noted as maintainer-managed.
+- **Coverage exclusions reduced** -- `server.ts` and `jira-connector.ts` removed from vitest exclusion list.
+
+### Security
+- **Cache file permissions** -- all cache writes use `mode: 0o600` (owner-only). Prevents local privilege escalation on shared machines.
+- **CWD config loading warning** -- stderr warning when `config.json` or `credentials.json` loaded from working directory instead of global config.
+- **Error message truncation** -- Jira API error responses truncated to 200 characters to prevent information leakage.
+- **`saveJsonFile` JSDoc** -- `@security` annotation warns against use for sensitive data.
+
+### Documentation
+- **Hardcoded counts removed** from secondary docs (CLAUDE.md, kb/, rules/, copilot-instructions). Counts live only in README (single source of truth pattern from ai-toolkit).
+- **KB docs updated** -- caching.md, architecture.md, configuration.md, troubleshooting/common-issues.md reflect security changes.
+- **Release SOP updated** -- Step 4.5 (validate counts) and Step 3.2 (README "What's New" update) added.
+
+---
+
 ## v1.0.0 -- Initial Public Release (2026-04-14)
 
 ### MCP Tools (15)
@@ -27,7 +77,7 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 - **`create_task`** -- create a new Jira issue with ADF description, assignee, labels, epic link
 - **`search_tasks`** -- search Jira issues with raw JQL (no caching)
 
-### CLI Commands (17)
+### CLI Commands (16)
 
 - **`jira-mcp`** / **`jira-mcp serve`** -- start MCP server (stdio transport)
 - **`jira-mcp config init`** -- initialize global config at `~/.softspark/jira-mcp/`

package/README.md

@@ -4,20 +4,17 @@
 
 [![CI](https://github.com/softspark/jira-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/softspark/jira-mcp/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@softspark/jira-mcp)](https://www.npmjs.com/package/@softspark/jira-mcp)
-[![version](https://img.shields.io/badge/version-1.0.0-blue)](CHANGELOG.md)
+[![version](https://img.shields.io/badge/version-1.1.0-blue)](CHANGELOG.md)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
 ---
 
-## What's New in v1.0.0
+## What's New in v1.2.0
 
-- **15 MCP tools** -- `update_task` for editing issues, `get_project_language` for AI language awareness.
-- **Language configuration** -- global `default_language` + per-project override. Supports: pl, en, de, es, fr, pt, it, nl.
-- **17 CLI commands** -- `config set-default`, `config set-language`, `config set-project-language` added.
-- **Zero runtime dependencies** -- built-in `fetch` client (Jira REST API v3), built-in ADF parsers. Self-contained 325KB bundle.
-- **Per-instance credentials** -- different username/token per Jira instance URL (Format A + Format B).
-- **Supply chain protection** -- `ignore-scripts=true`, no axios, no dynamic requires.
-- **413 tests** across 47 test files with strict TypeScript.
+- **Per-instance credentials** -- `set-credentials --url` allows different API tokens per Jira instance. Auto-migrates legacy format.
+- **Jira Cloud API migration** -- search endpoint updated to `/rest/api/3/search/jql` (old endpoint returns 410).
+- **Live Jira smoke tests** -- post-release SOP tests all 15 MCP tools against a sandbox project.
+- **518 tests** across 52 test files.
 
 See [CHANGELOG.md](CHANGELOG.md) for full details.
 
@@ -163,7 +160,7 @@ Or copy `rules/jira-mcp.md` to your ai-toolkit rules directory manually. The rul
 - **Sync before read** -- cache may be stale
 - **Status transitions** -- check valid transitions before changing status
 - **Time format** -- `"2h 30m"`, never days
-- **All 15 MCP tools** and **17 CLI commands** reference
+- **All 15 MCP tools** and **16 CLI commands** reference
 
 ## Usage with Other MCP Clients
 
@@ -219,11 +216,11 @@ src/
 
 **Per-instance credentials** -- different API tokens per Jira instance URL. Single-credential format still works (backward compatible). See [Configuration](kb/reference/configuration.md).
 
-**Supply chain protection** -- `ignore-scripts=true`, no axios, no dynamic requires. Self-contained 325KB bundle, 1 runtime dep (commander).
+**Supply chain protection** -- `ignore-scripts=true`, no axios, no dynamic requires. Self-contained 520KB bundle, 1 runtime dep (commander).
 
 **Typed error hierarchy** -- 15 error classes with machine-readable codes. Every tool returns structured `{ success, error, code }` responses. No stack traces leak to MCP clients.
 
-**Strict TypeScript** -- `strict: true`, no `any`, `readonly` interfaces, Zod validation at all boundaries, 413 tests across 47 test files. Self-contained 325KB package.
+**Strict TypeScript** -- `strict: true`, no `any`, `readonly` interfaces, Zod validation at all boundaries, 518 tests across 52 test files. Self-contained 520KB package.
 
 ## Documentation