@softspark/jira-mcp 1.9.0 → 1.11.0

package/CHANGELOG.md

@@ -7,6 +7,24 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v1.11.0 -- Local audits and private configuration (2026-09-06)
+
+- Add text, JSON and SARIF audits for local filesystem permissions and shipped hook ownership.
+- Create new configuration/cache directories with mode 0700 and state files with mode 0600.
+- Complete third-party attribution in NOTICE and require the full applicable module and SOP artifact set in CI.
+- Require behavior, tests and documentation in the same pull request; correct the lockfile-based signature verification procedure.
+
+## v1.10.0 -- Remaining Estimate (2026-09-01)
+
+### Added
+
+- **`remaining_estimate` in `update_task`** -- writes `timetracking.remainingEstimate`.
+  Jira keeps the two estimates independent: setting `original_estimate` on a parent
+  issue leaves its remaining estimate at the old value, so a report that sums
+  remaining still showed the pre-edit total. Setting one field does not disturb
+  the other, and both can be sent in a single call. Same format and day rejection
+  as `original_estimate`.
+
 ## v1.9.0 -- Sub-tasks and Estimates (2026-09-01)
 
 ### Added

package/NOTICE

@@ -19,6 +19,11 @@ limitations under the License.
 If you redistribute this software or a derivative of it, Section 4(d) of the
 License requires you to carry the contents of this NOTICE file with it.
 
+This NOTICE covers jira-mcp only. Third-party dependencies, including code
+bundled into dist/, retain their own copyright notices and licenses. Consult
+package-lock.json for exact dependency versions and each dependency's LICENSE
+and NOTICE files for its terms; npm ls --all lists the installed dependencies.
+
 --------------------------------------------------------------------------------
 
 PRIOR LICENSE

package/README.md

@@ -4,20 +4,16 @@
 
 [![CI](https://github.com/softspark/jira-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/softspark/jira-mcp/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@softspark/jira-mcp)](https://www.npmjs.com/package/@softspark/jira-mcp)
-[![version](https://img.shields.io/badge/version-1.9.0-blue)](CHANGELOG.md)
+[![version](https://img.shields.io/badge/version-1.11.0-blue)](CHANGELOG.md)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 
 ---
 
-## What's New in v1.9.0
+## What's New in v1.11.0
 
-- **Sub-tasks can be created.** `create_task` takes `parent_key`, which sets the Jira `parent` field. `epic_key` writes the Epic Link custom field instead, so a sub-task sent with it came back as `Issue type is a sub-task but parent issue key or id not specified`.
-- **Original estimate is settable.** `create_task` and `update_task` take `original_estimate` and write `timetracking.originalEstimate`. Estimates previously had to be typed into the Jira UI by hand -- `log_task_time` records work already done, which is a separate field.
-- **One time format everywhere.** `original_estimate` goes through the same parser as `log_task_time`: `"2h"`, `"30m"`, `"2h 30m"`, and days are rejected.
-
-See [CHANGELOG.md](CHANGELOG.md) for full details.
-
----
+- `jira-mcp audit --json` and `--sarif` inspect local permissions and the shipped comment hook without contacting Jira.
+- New configuration/cache directories are private, and the state file is created with mode 0600.
+- CI checks the complete applicable module artifact and SOP set. Documentation changes travel with their behavior changes.
 
 ## Table of Contents
 
@@ -71,6 +67,7 @@ All configuration lives in `~/.softspark/jira-mcp/` (created by `jira-mcp config
 |---------|-------------|
 | `jira-mcp` | Start MCP server (default) |
 | `jira-mcp serve` | Start MCP server (explicit) |
+| `jira-mcp audit [--json\|--sarif]` | Audit local permissions and shipped hook ownership without contacting Jira |
 | `jira-mcp create <path>` | Create tasks from config file (dry-run by default) |
 | `jira-mcp create-monthly` | Create monthly admin tasks from built-in templates |
 | `jira-mcp template add <type> <path>` | Install a template override from a local markdown file |
@@ -97,7 +94,7 @@ All configuration lives in `~/.softspark/jira-mcp/` (created by `jira-mcp config
 | `sync_tasks` | Sync tasks from Jira to local cache | `project_key?`, `jql?` |
 | `read_cached_tasks` | Read tasks from cache without hitting Jira | `task_key?` |
 | `update_task_status` | Change task status via workflow transition | `task_key`, `status` |
-| `update_task` | Update existing issue fields (markdown → ADF) | `task_key`, `summary?`, `description?`, `priority?`, `labels?`, `original_estimate?` |
+| `update_task` | Update existing issue fields (markdown → ADF) | `task_key`, `summary?`, `description?`, `priority?`, `labels?`, `original_estimate?`, `remaining_estimate?` |
 | `add_task_comment` | Add a markdown comment (auto-converted to ADF) | `task_key`, `comment`, `user_approved` |
 | `delete_task` | Delete a task, only when the authenticated user is the task creator | `task_key`, `user_approved` |
 | `delete_comment` | Delete a comment, only when the authenticated user is the comment author | `task_key`, `comment_id`, `user_approved` |
@@ -183,7 +180,7 @@ Or copy `rules/jira-mcp.md` to your ai-toolkit rules directory manually. The rul
 - **Sync before read** -- cache may be stale
 - **Status transitions** -- check valid transitions before changing status
 - **Time format** -- `"2h 30m"`, never days
-- **All 19 MCP tools** and **20 CLI commands** reference
+- **All 19 MCP tools** and **21 CLI commands** reference
 
 ### AI Toolkit Hooks
 
@@ -252,17 +249,18 @@ src/
 
 **Per-instance credentials** -- different API tokens per Jira instance URL. Single-credential format still works (backward compatible). See [Configuration](kb/reference/configuration.md).
 
-**Supply chain protection** -- `ignore-scripts=true`, no axios, no dynamic requires. Self-contained 535KB bundle, 1 runtime dep (commander).
+**Supply chain protection** -- `ignore-scripts=true`, no axios, no dynamic requires. Self-contained 540KB library bundle, 1 runtime dep (commander).
 
 **Typed error hierarchy** -- 20 error classes with machine-readable codes. Every tool returns structured `{ success, error, code }` responses. No stack traces leak to MCP clients.
 
-**Strict TypeScript** -- `strict: true`, no `any`, `readonly` interfaces, Zod validation at all boundaries, 680 tests across 65 test files. Self-contained 535KB package.
+**Strict TypeScript** -- `strict: true`, no `any`, `readonly` interfaces, Zod validation at all boundaries, 710 tests across 67 test files.
 
 ## Documentation
 
 | Document | Description |
 |----------|-------------|
 | [Architecture](kb/reference/architecture.md) | System design and module overview |
+| [Local audit](kb/reference/audit.md) | JSON/SARIF formats, filesystem checks and hook permissions |
 | [API Reference](kb/reference/api.md) | All 19 MCP tools with schemas |
 | [Configuration](kb/reference/configuration.md) | Config files, env vars, multi-instance |
 | [ADF Format](kb/reference/adf.md) | Atlassian Document Format conversion |