@stubbedev/atlassian-mcp 0.2.6 → 0.2.8

package/atlassian-mcp.schema.json

@@ -4,7 +4,6 @@
   "title": "Atlassian MCP Config",
   "description": "Configuration file for the atlassian-mcp MCP server",
   "type": "object",
-  "required": ["jira", "bitbucket"],
   "additionalProperties": false,
   "properties": {
     "$schema": {

package/dist/bitbucket.js

@@ -37,7 +37,9 @@ function branchDisplayId(branch) {
 function formatDate(ms) {
     return new Date(ms).toISOString().slice(0, 10);
 }
-function formatCommentThread(comment, indent = '') {
+function formatCommentThread(comment, indent = '', depth = 0) {
+    if (depth > 20)
+        return [`${indent}... (deeply nested replies omitted)`];
     const author = comment.author?.displayName ?? comment.author?.name ?? 'Unknown';
     const date = comment.createdDate ? ` (${formatDate(comment.createdDate)})` : '';
     const state = comment.state ?? 'OPEN';
@@ -51,7 +53,7 @@ function formatCommentThread(comment, indent = '') {
     ];
     if (comment.comments && comment.comments.length > 0) {
         for (const reply of comment.comments) {
-            lines.push(...formatCommentThread(reply, `${indent}  `));
+            lines.push(...formatCommentThread(reply, `${indent}  `, depth + 1));
         }
     }
     return lines;
@@ -181,7 +183,7 @@ function validateCommentText(textValue) {
 export class BitbucketClient {
     baseUrl;
     headers;
-    currentUserCache;
+    currentUsernameCache;
     constructor(baseUrl, token) {
         this.baseUrl = baseUrl.replace(/\/$/, '');
         this.headers = {
@@ -190,6 +192,22 @@ export class BitbucketClient {
             Accept: 'application/json',
         };
     }
+    /** Returns the slug/username of the authenticated user via the X-AUSERNAME response header. */
+    async getCurrentUsername() {
+        if (this.currentUsernameCache)
+            return this.currentUsernameCache;
+        const url = `${this.baseUrl}/rest/api/1.0/application-properties`;
+        const res = await fetch(url, { method: 'GET', headers: this.headers });
+        const username = res.headers.get('X-AUSERNAME');
+        if (!username)
+            throw new Error('Could not determine current Bitbucket user. Check token permissions.');
+        this.currentUsernameCache = username;
+        return username;
+    }
+    /** Returns a URL-safe `/projects/.../repos/...` prefix for REST paths. */
+    rp(projectKey, repoSlug) {
+        return `/projects/${encodeURIComponent(projectKey)}/repos/${encodeURIComponent(repoSlug)}`;
+    }
     pullRequestUrl(projectKey, repoSlug, prId, pr) {
         const apiUrl = pr?.links?.self?.[0]?.href?.trim();
         if (apiUrl) {
@@ -232,7 +250,7 @@ export class BitbucketClient {
     }
     async request(method, path, body) {
         const url = `${this.baseUrl}/rest/api/1.0${path}`;
-        const opts = { method, headers: this.headers };
+        const opts = { method, headers: this.headers, signal: AbortSignal.timeout(30_000) };
         if (body !== undefined)
             opts.body = JSON.stringify(body);
         const res = await fetch(url, opts);
@@ -248,6 +266,7 @@ export class BitbucketClient {
         const res = await fetch(url, {
             method: 'GET',
             headers: { Authorization: this.headers.Authorization },
+            signal: AbortSignal.timeout(30_000),
         });
         if (!res.ok) {
             const errText = await res.text();
@@ -258,7 +277,7 @@ export class BitbucketClient {
     }
     async requestBuildStatus(method, path, body) {
         const url = `${this.baseUrl}/rest/build-status/1.0${path}`;
-        const opts = { method, headers: this.headers };
+        const opts = { method, headers: this.headers, signal: AbortSignal.timeout(30_000) };
         if (body !== undefined)
             opts.body = JSON.stringify(body);
         const res = await fetch(url, opts);
@@ -271,60 +290,23 @@ export class BitbucketClient {
         }
         return res.status === 204 ? null : res.json();
     }
-    normalizeIdentity(value) {
-        return (value ?? '').trim().toLowerCase();
-    }
-    async getCurrentUser() {
-        if (this.currentUserCache)
-            return this.currentUserCache;
-        const me = await this.request('GET', '/users/~self');
-        if (!me) {
-            throw new Error('Could not determine current Bitbucket user identity.');
-        }
-        this.currentUserCache = me;
-        return me;
-    }
-    async assertOwnComment(comment) {
-        const me = await this.getCurrentUser();
-        const commentAuthorName = this.normalizeIdentity(comment.author?.name);
-        const commentAuthorDisplayName = this.normalizeIdentity(comment.author?.displayName);
-        const meName = this.normalizeIdentity(me.name);
-        const meSlug = this.normalizeIdentity(me.slug);
-        const meDisplayName = this.normalizeIdentity(me.displayName);
-        const hasStrongCommentIdentity = commentAuthorName.length > 0;
-        const hasStrongUserIdentity = meName.length > 0 || meSlug.length > 0;
-        const matchesByName = commentAuthorName.length > 0 && (commentAuthorName === meName || commentAuthorName === meSlug);
-        const matchesByDisplayNameFallback = !hasStrongCommentIdentity
-            && !hasStrongUserIdentity
-            && commentAuthorDisplayName.length > 0
-            && commentAuthorDisplayName === meDisplayName;
-        if (matchesByName || matchesByDisplayNameFallback) {
-            return;
-        }
-        throw new Error(`You can only edit your own Bitbucket comments. Comment #${comment.id} is authored by ${comment.author?.displayName ?? comment.author?.name ?? 'another user'}.`);
-    }
     /** Returns true if the given remote URL belongs to this Bitbucket instance. */
     isRemoteForThisInstance(remoteUrl) {
         return this.remoteMatchesInstance(remoteUrl);
     }
-    // Used internally by context tools — finds the open PR for a given source branch
+    // Used internally by context tools — finds the open PR for a given source branch.
+    // Uses the `at` filter to avoid paginating all open PRs.
     async findOpenPrForBranch(projectKey, repoSlug, branch) {
-        const targetBranch = branchDisplayId(branch);
-        let start = 0;
-        while (true) {
-            const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests?state=OPEN&limit=50&start=${start}`);
-            const match = data?.values.find((pr) => branchDisplayId(pr.fromRef.displayId) === targetBranch) ?? null;
-            if (match)
-                return match;
-            if (!data || data.isLastPage || data.nextPageStart === undefined)
-                return null;
-            start = data.nextPageStart;
-        }
+        const atRef = encodeURIComponent(toBranchRef(branch));
+        const encodedProject = encodeURIComponent(projectKey);
+        const encodedRepo = encodeURIComponent(repoSlug);
+        const data = await this.request('GET', `/projects/${encodedProject}/repos/${encodedRepo}/pull-requests?state=OPEN&direction=OUTGOING&at=${atRef}&limit=1`);
+        return data?.values[0] ?? null;
     }
     // Fallback: search branches matching filterText and check each for an open PR.
     // Used when exact branch name lookup yields no result (e.g. LLM provides a partial branch name).
     async findOpenPrByBranchFilter(projectKey, repoSlug, filterText) {
-        const branches = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/branches?limit=25&filterText=${encodeURIComponent(filterText)}`);
+        const branches = await this.request('GET', `${this.rp(projectKey, repoSlug)}/branches?limit=25&filterText=${encodeURIComponent(filterText)}`);
         if (!branches?.values?.length)
             return null;
         for (const b of branches.values) {
@@ -338,7 +320,7 @@ export class BitbucketClient {
         const { limit = 50, start = 0 } = args;
         const qs = `?limit=${limit}&start=${start}`;
         const path = args.projectKey
-            ? `/projects/${args.projectKey}/repos${qs}`
+            ? `/projects/${encodeURIComponent(args.projectKey)}/repos${qs}`
             : `/repos${qs}`;
         const data = await this.request('GET', path);
         if (!data || data.values.length === 0)
@@ -356,7 +338,7 @@ export class BitbucketClient {
         }
         if (searchText)
             qs.set('filterText', searchText);
-        const path = `/projects/${projectKey}/repos/${repoSlug}/pull-requests?${qs}`;
+        const path = `/projects/${encodeURIComponent(projectKey)}/repos/${encodeURIComponent(repoSlug)}/pull-requests?${qs}`;
         const data = await this.request('GET', path);
         if (!data || data.values.length === 0)
             return text(`No ${state} pull requests found.`);
@@ -365,21 +347,22 @@ export class BitbucketClient {
     }
     async myPrs(args) {
         const { limit = 25, start = 0, role } = args;
-        const qs = new URLSearchParams({ limit: String(limit), start: String(start) });
+        const userSlug = await this.getCurrentUsername();
+        const qs = new URLSearchParams({ limit: String(limit), start: String(start), state: 'OPEN' });
         if (role)
-            qs.set('role', role);
-        const data = await this.request('GET', `/inbox/pull-requests?${qs}`);
+            qs.set('role', role.toUpperCase());
+        const data = await this.request('GET', `/users/${encodeURIComponent(userSlug)}/pull-requests?${qs}`);
         if (!data || data.values.length === 0)
-            return text('No pull requests in your inbox.');
+            return text('No pull requests found.');
         const lines = data.values.map((pr) => {
             const repo = `${pr.toRef.repository.project.key}/${pr.toRef.repository.slug}`;
             return `#${pr.id} [${pr.state}] ${pr.title} | ${repo} | ${pr.fromRef.displayId} → ${pr.toRef.displayId}`;
         });
-        return text(`${data.values.length} PR(s) in your inbox${pageHint(data)}:\n${lines.join('\n')}`);
+        return text(`${data.values.length} PR(s)${pageHint(data)}:\n${lines.join('\n')}`);
     }
     async getPullRequest(args) {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
-        const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}`);
+        const data = await this.request('GET', `/projects/${encodeURIComponent(projectKey)}/repos/${encodeURIComponent(repoSlug)}/pull-requests/${args.prId}`);
         if (!data)
             return text('Pull request not found.');
         const reviewers = data.reviewers
@@ -418,28 +401,12 @@ export class BitbucketClient {
                 throw new Error(`No open PR found for branch "${branchDisplayId(branch)}".`);
             prId = found.id;
         }
-        const [pr, me] = await Promise.all([
-            this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${prId}`),
-            this.getCurrentUser().catch(() => null),
-        ]);
+        const pr = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${prId}`);
         if (!pr)
             return text('Pull request not found.');
         const sections = [];
         const reviewers = pr.reviewers.map((r) => `${r.user.displayName}${r.approved ? ' ✓' : ''}`).join(', ');
         const url = pr.links?.self?.[0]?.href;
-        // Prefer slug (canonical unique identifier), fall back to username (name field).
-        // Display name is deliberately excluded — it is not unique.
-        const meSlug = this.normalizeIdentity(me?.slug);
-        const meName = this.normalizeIdentity(me?.name);
-        const authorSlug = this.normalizeIdentity(pr.author.user.slug);
-        const authorName = this.normalizeIdentity(pr.author.user.name);
-        const isAuthor = me
-            ? (meSlug && authorSlug ? meSlug === authorSlug : false) ||
-                (meName && authorName ? meName === authorName : false)
-            : false;
-        const viewingAs = me
-            ? `Viewing as: ${me.displayName} (${isAuthor ? 'you are the author' : 'you are a reviewer'})`
-            : '';
         const header = [
             `PR #${pr.id}: ${pr.title}`,
             `State:     ${pr.state}`,
@@ -447,7 +414,6 @@ export class BitbucketClient {
             `Branch:    ${pr.fromRef.displayId} → ${pr.toRef.displayId}`,
             `Reviewers: ${reviewers || 'None'}`,
             url ? `URL:       ${url}` : '',
-            viewingAs,
             '',
             'Description:',
             pr.description ?? '(no description)',
@@ -470,7 +436,7 @@ export class BitbucketClient {
         if (includeCommits) {
             const commitsLimit = args.commitsLimit ?? 25;
             const commitsStart = args.commitsStart ?? 0;
-            const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${prId}/commits?limit=${commitsLimit}&start=${commitsStart}`);
+            const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${prId}/commits?limit=${commitsLimit}&start=${commitsStart}`);
             if (!data || data.values.length === 0) {
                 sections.push('Commits:\n(no commits found)');
             }
@@ -489,7 +455,7 @@ export class BitbucketClient {
             }
             if (commentsSeverity === 'BLOCKER') {
                 const qs = new URLSearchParams({ limit: String(commentsLimit), start: String(commentsStart), state: commentsState });
-                const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${prId}/blocker-comments?${qs}`);
+                const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${prId}/blocker-comments?${qs}`);
                 if (!data || data.values.length === 0) {
                     sections.push(`Comments:\n(no ${commentsState} BLOCKER comments)`);
                 }
@@ -499,7 +465,7 @@ export class BitbucketClient {
                 }
             }
             else {
-                const activityData = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${prId}/activities?limit=${commentsLimit}&start=${commentsStart}`);
+                const activityData = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${prId}/activities?limit=${commentsLimit}&start=${commentsStart}`);
                 const comments = uniqueCommentsFromActivities(activityData?.values ?? []).filter((comment) => {
                     const matchesState = commentMatchesState(comment, commentsState);
                     return matchesState && commentMatchesSeverity(comment, commentsSeverity);
@@ -515,14 +481,14 @@ export class BitbucketClient {
             }
         }
         if (includeDiff) {
-            const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${prId}/diff`);
+            const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${prId}/diff`);
             sections.push(`Diff:\n${data ? formatDiff(data, args.diffMaxChars ?? 8000) : '(no diff found)'}`);
         }
         return text(sections.join('\n\n'));
     }
     async getPrDiff(args) {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
-        const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/diff`);
+        const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/diff`);
         if (!data)
             return text('No diff found.');
         return text(formatDiff(data));
@@ -531,7 +497,7 @@ export class BitbucketClient {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
         const limit = args.limit ?? 25;
         const start = args.start ?? 0;
-        const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/commits?limit=${limit}&start=${start}`);
+        const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/commits?limit=${limit}&start=${start}`);
         if (!data || data.values.length === 0)
             return text('No commits found.');
         const lines = data.values.map((c) => `${c.displayId} ${formatDate(c.authorTimestamp)} ${c.author.name}: ${c.message.split('\n')[0]}`);
@@ -549,15 +515,18 @@ export class BitbucketClient {
             const url = this.pullRequestUrl(projectKey, repoSlug, existing.id, existing);
             return text(`Open PR already exists for branch "${sourceBranchName}": #${existing.id} "${existing.title}"\n${url}`);
         }
-        const { title, description, toBranch = 'master', reviewers = [] } = args;
+        const { title, description, reviewers = [] } = args;
+        const toRef = args.toBranch
+            ? toBranchRef(args.toBranch)
+            : await this.getDefaultBranchRef(projectKey, repoSlug);
         const body = {
             title,
             description: description ?? '',
             fromRef: { id: toBranchRef(sourceBranch), repository: { slug: repoSlug, project: { key: projectKey } } },
-            toRef: { id: toBranchRef(toBranch), repository: { slug: repoSlug, project: { key: projectKey } } },
+            toRef: { id: toRef, repository: { slug: repoSlug, project: { key: projectKey } } },
             reviewers: reviewers.map((name) => ({ user: { name } })),
         };
-        const data = await this.request('POST', `/projects/${projectKey}/repos/${repoSlug}/pull-requests`, body);
+        const data = await this.request('POST', `${this.rp(projectKey, repoSlug)}/pull-requests`, body);
         if (!data)
             return text('Pull request created.');
         const url = this.pullRequestUrl(projectKey, repoSlug, data.id, data);
@@ -571,7 +540,7 @@ export class BitbucketClient {
             && args.reviewers === undefined) {
             throw new Error('At least one field is required: title, description, toBranch, or reviewers');
         }
-        const existing = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}`);
+        const existing = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}`);
         if (!existing)
             throw new Error(`PR #${args.prId} not found.`);
         const buildBody = (pr) => {
@@ -595,16 +564,16 @@ export class BitbucketClient {
         };
         let updated;
         try {
-            updated = await this.request('PUT', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}`, buildBody(existing));
+            updated = await this.request('PUT', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}`, buildBody(existing));
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             if (!message.includes('Bitbucket 409'))
                 throw error;
-            const latest = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}`);
+            const latest = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}`);
             if (!latest)
                 throw error;
-            updated = await this.request('PUT', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}`, buildBody(latest));
+            updated = await this.request('PUT', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}`, buildBody(latest));
         }
         if (!updated)
             return text(`Updated PR #${args.prId}.`);
@@ -670,7 +639,7 @@ export class BitbucketClient {
     }
     async approvePr(args) {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
-        const data = await this.request('POST', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/approve`);
+        const data = await this.request('POST', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/approve`);
         const url = this.pullRequestUrl(projectKey, repoSlug, args.prId);
         if (!data)
             return text(`Approved PR #${args.prId}.\n${url}`);
@@ -678,25 +647,25 @@ export class BitbucketClient {
     }
     async unapprovePr(args) {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
-        await this.request('DELETE', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/approve`);
+        await this.request('DELETE', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/approve`);
         return text(`Approval removed from PR #${args.prId}.\n${this.pullRequestUrl(projectKey, repoSlug, args.prId)}`);
     }
     async declinePr(args) {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
-        const pr = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}`);
+        const pr = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}`);
         if (!pr)
             throw new Error(`PR #${args.prId} not found.`);
         const body = { version: pr.version };
         if (args.message)
             body.message = args.message;
-        const data = await this.request('POST', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/decline`, body);
+        const data = await this.request('POST', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/decline`, body);
         if (!data)
             return text(`Declined PR #${args.prId}.\n${this.pullRequestUrl(projectKey, repoSlug, args.prId)}`);
         return text(`Declined PR #${data.id}: "${data.title}".\n${this.pullRequestUrl(projectKey, repoSlug, data.id, data)}`);
     }
     async mergePr(args) {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
-        const pr = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}`);
+        const pr = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}`);
         if (!pr)
             throw new Error(`PR #${args.prId} not found.`);
         const body = { version: pr.version };
@@ -704,13 +673,13 @@ export class BitbucketClient {
             body.strategyId = args.mergeStrategy;
         if (args.message)
             body.message = args.message;
-        const data = await this.request('POST', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/merge`, body);
+        const data = await this.request('POST', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/merge`, body);
         if (!data)
             return text(`Merged PR #${args.prId}.\n${this.pullRequestUrl(projectKey, repoSlug, args.prId)}`);
         return text(`Merged PR #${data.id}: "${data.title}" (${data.fromRef.displayId} → ${data.toRef.displayId}).\n${this.pullRequestUrl(projectKey, repoSlug, data.id, data)}`);
     }
     async getDefaultBranchRef(projectKey, repoSlug) {
-        const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/default-branch`);
+        const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/default-branch`);
         if (data?.displayId)
             return `refs/heads/${data.displayId}`;
         // Fallback: detect from local git
@@ -722,7 +691,7 @@ export class BitbucketClient {
     async createBranch(args) {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
         const startPoint = args.startPoint ?? await this.getDefaultBranchRef(projectKey, repoSlug);
-        const data = await this.request('POST', `/projects/${projectKey}/repos/${repoSlug}/branches`, { name: args.branchName, startPoint });
+        const data = await this.request('POST', `${this.rp(projectKey, repoSlug)}/branches`, { name: args.branchName, startPoint });
         if (!data)
             return text(`Branch "${args.branchName}" created.`);
         return text(`Created branch "${data.displayId}" at ${data.latestCommit.slice(0, 8)} in ${projectKey}/${repoSlug}.`);
@@ -732,7 +701,7 @@ export class BitbucketClient {
         const qs = new URLSearchParams({ limit: String(args.limit ?? 25), start: String(args.start ?? 0) });
         if (args.filter)
             qs.set('filterText', args.filter);
-        const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/branches?${qs}`);
+        const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/branches?${qs}`);
         if (!data || data.values.length === 0)
             return text('No branches found.');
         const lines = data.values.map((b) => `${b.displayId}${b.isDefault ? ' (default)' : ''} — ${b.latestCommit.slice(0, 8)}`);
@@ -742,7 +711,7 @@ export class BitbucketClient {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
         const qs = args.ref ? `?at=${encodeURIComponent(args.ref)}` : '';
         const encodedPath = args.path.split('/').map(encodeURIComponent).join('/');
-        const content = await this.requestText(`/projects/${projectKey}/repos/${repoSlug}/raw/${encodedPath}${qs}`);
+        const content = await this.requestText(`${this.rp(projectKey, repoSlug)}/raw/${encodedPath}${qs}`);
         const MAX_CHARS = 10000;
         if (content.length > MAX_CHARS) {
             return text(content.slice(0, MAX_CHARS) + `\n\n... (truncated, ${content.length - MAX_CHARS} more chars)`);
@@ -765,7 +734,7 @@ export class BitbucketClient {
             const qs = new URLSearchParams({ count: 'true' });
             if (state)
                 qs.set('state', state);
-            const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/blocker-comments?${qs}`);
+            const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/blocker-comments?${qs}`);
             let open = data?.open ?? 0;
             let resolved = data?.resolved ?? 0;
             if ((open === 0 && resolved === 0) && data?.values && data.values.length > 0) {
@@ -789,7 +758,7 @@ export class BitbucketClient {
             const qs = new URLSearchParams({ limit: String(limit), start: String(start) });
             if (state)
                 qs.set('state', state);
-            const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/blocker-comments?${qs}`);
+            const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/blocker-comments?${qs}`);
             if (!data || data.values.length === 0) {
                 return text(`No ${state ?? 'OPEN/RESOLVED'} BLOCKER comments on PR #${args.prId}.`);
             }
@@ -804,7 +773,7 @@ export class BitbucketClient {
             });
             if (state)
                 qs.set('state', state);
-            const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments?${qs}`);
+            const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/comments?${qs}`);
             const filtered = (data?.values ?? []).filter((comment) => {
                 const matchesState = state ? commentMatchesState(comment, state) : true;
                 return matchesState && commentMatchesSeverity(comment, severity);
@@ -816,7 +785,7 @@ export class BitbucketClient {
             const paging = data ? pageHint(data) : '';
             return text(`${filtered.length} comment thread(s) on PR #${args.prId} for ${args.path}${paging}:\n\n${blocks.join('\n\n')}`);
         }
-        const activityData = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/activities?limit=${limit}&start=${start}`);
+        const activityData = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/activities?limit=${limit}&start=${start}`);
         const comments = uniqueCommentsFromActivities(activityData?.values ?? []).filter((comment) => {
             const matchesState = state ? commentMatchesState(comment, state) : true;
             return matchesState && commentMatchesSeverity(comment, severity);
@@ -847,6 +816,8 @@ export class BitbucketClient {
             commentText = args.text ? `${args.text}\n\n${suggestionBlock}` : suggestionBlock;
         }
         const body = { text: validateCommentText(commentText) };
+        if (args.severity)
+            body.severity = args.severity;
         if (replyToCommentId !== undefined)
             body.parent = { id: replyToCommentId };
         let inlineAnchor;
@@ -854,7 +825,7 @@ export class BitbucketClient {
             if (args.filePath === undefined || args.line === undefined) {
                 throw new Error('filePath and line must be provided together for inline comments.');
             }
-            const pr = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}`);
+            const pr = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}`);
             inlineAnchor = {
                 diffType: 'EFFECTIVE',
                 fileType: args.fileType ?? 'TO',
@@ -879,7 +850,7 @@ export class BitbucketClient {
         }
         let created;
         try {
-            created = await this.request('POST', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments`, body);
+            created = await this.request('POST', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/comments`, body);
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -888,7 +859,7 @@ export class BitbucketClient {
             }
             const { fromHash: _fromHash, toHash: _toHash, ...anchorWithoutHashes } = inlineAnchor;
             body.anchor = anchorWithoutHashes;
-            created = await this.request('POST', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments`, body);
+            created = await this.request('POST', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/comments`, body);
         }
         if (!created)
             return text(`Comment added to PR #${args.prId}.`);
@@ -903,17 +874,10 @@ export class BitbucketClient {
         if (!args.text && !args.state && !args.severity && args.threadResolved === undefined) {
             throw new Error('At least one field is required: text, state, severity, or threadResolved');
         }
-        const current = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments/${args.commentId}`);
+        const current = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/comments/${args.commentId}`);
         if (!current)
             throw new Error(`Comment #${args.commentId} not found.`);
         const currentSeverity = current.severity ?? 'NORMAL';
-        const severityIsChanging = args.severity !== undefined && args.severity !== currentSeverity;
-        const isResolutionOnlyUpdate = (args.state !== undefined || args.threadResolved !== undefined)
-            && args.text === undefined
-            && !severityIsChanging;
-        if (!isResolutionOnlyUpdate) {
-            await this.assertOwnComment(current);
-        }
         const targetSeverity = args.severity ?? currentSeverity;
         if (args.state && targetSeverity !== 'BLOCKER') {
             throw new Error('state is only supported for BLOCKER comments (tasks). Use threadResolved for normal comment threads.');
@@ -922,8 +886,8 @@ export class BitbucketClient {
             throw new Error('threadResolved is only supported for normal comments. Use state for BLOCKER comment tasks.');
         }
         const commentPath = (targetSeverity === 'BLOCKER' || current.severity === 'BLOCKER')
-            ? `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/blocker-comments/${args.commentId}`
-            : `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments/${args.commentId}`;
+            ? `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/blocker-comments/${args.commentId}`
+            : `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/comments/${args.commentId}`;
         const buildBody = (version) => {
             const body = { version };
             if (args.text !== undefined)
@@ -960,20 +924,19 @@ export class BitbucketClient {
     }
     async deletePrComment(args) {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
-        const current = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments/${args.commentId}`);
+        const current = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/comments/${args.commentId}`);
         if (!current)
             throw new Error(`Comment #${args.commentId} not found.`);
-        await this.assertOwnComment(current);
         const commentPath = current.severity === 'BLOCKER'
-            ? `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/blocker-comments/${args.commentId}`
-            : `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments/${args.commentId}`;
+            ? `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/blocker-comments/${args.commentId}`
+            : `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/comments/${args.commentId}`;
         const path = `${commentPath}?version=${current.version}`;
         await this.request('DELETE', path);
         return text(`Comment #${args.commentId} deleted from PR #${args.prId}.`);
     }
     async getPrTasks(args) {
         const { projectKey, repoSlug } = this.resolveProjectAndRepo(args.projectKey, args.repoSlug);
-        const data = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/tasks`);
+        const data = await this.request('GET', `${this.rp(projectKey, repoSlug)}/pull-requests/${args.prId}/tasks`);
         if (!data || data.values.length === 0)
             return text(`No tasks on PR #${args.prId}.`);
         const lines = data.values.map((t) => {
@@ -1011,15 +974,22 @@ export class BitbucketClient {
             const task = await this.request('GET', `/tasks/${args.taskId}`);
             if (!task)
                 throw new Error(`Task #${args.taskId} not found.`);
-            await this.request('DELETE', `/tasks/${args.taskId}?version=${task.id}`);
+            // Verify the task belongs to the given PR (when anchor is a direct PR anchor)
+            if (args.prId !== undefined && task.anchor?.type === 'PULL_REQUEST' && task.anchor.id !== args.prId) {
+                throw new Error(`Task #${args.taskId} does not belong to PR #${args.prId}.`);
+            }
+            await this.request('DELETE', `/tasks/${args.taskId}?version=${task.version}`);
             return text(`Task #${args.taskId} deleted.`);
         }
         // resolve or reopen
         const task = await this.request('GET', `/tasks/${args.taskId}`);
         if (!task)
             throw new Error(`Task #${args.taskId} not found.`);
+        if (args.prId !== undefined && task.anchor?.type === 'PULL_REQUEST' && task.anchor.id !== args.prId) {
+            throw new Error(`Task #${args.taskId} does not belong to PR #${args.prId}.`);
+        }
         const newState = args.action === 'resolve' ? 'RESOLVED' : 'OPEN';
-        const updated = await this.request('PUT', `/tasks/${args.taskId}`, {
+        const updated = await this.request('PUT', `/tasks/${args.taskId}?version=${task.version}`, {
             id: task.id,
             state: newState,
             text: task.text,

package/dist/config.js

@@ -38,7 +38,8 @@ export function loadConfig() {
     if (jiraUrl && jiraToken) {
         config.jira = { url: jiraUrl, token: jiraToken };
     }
-    else {
+    else if (jiraUrl || jiraToken) {
+        // Partially configured — log which piece is missing so the user can fix it
         const missing = [];
         if (!jiraUrl)
             missing.push('jira.url (or JIRA_URL)');
@@ -49,7 +50,7 @@ export function loadConfig() {
     if (bitbucketUrl && bitbucketToken) {
         config.bitbucket = { url: bitbucketUrl, token: bitbucketToken };
     }
-    else {
+    else if (bitbucketUrl || bitbucketToken) {
         const missing = [];
         if (!bitbucketUrl)
             missing.push('bitbucket.url (or BITBUCKET_URL)');

package/dist/context.js

@@ -20,9 +20,25 @@ export async function getDevContext(args, jira, bitbucket) {
     const remote = safeExec('git remote get-url origin', repoPath) || '(no remote)';
     const recentCommits = safeExec('git log --oneline -5', repoPath) || '(none)';
     const status = safeExec('git status --short', repoPath) || '(clean)';
+    // Upstream ahead/behind
+    const upstream = safeExec('git rev-parse --abbrev-ref @{u}', repoPath);
+    let upstreamLine = '';
+    if (upstream) {
+        const ab = safeExec(`git rev-list --left-right --count ${upstream}...HEAD`, repoPath);
+        if (ab.includes('\t')) {
+            const [behind, ahead] = ab.split('\t').map(Number);
+            const parts = [];
+            if (ahead)
+                parts.push(`${ahead} ahead`);
+            if (behind)
+                parts.push(`${behind} behind`);
+            upstreamLine = `${upstream}${parts.length ? ` (${parts.join(', ')})` : ' (up to date)'}`;
+        }
+    }
     sections.push([
         `Repository: ${repoPath}`,
         `Branch:     ${branch}`,
+        ...(upstreamLine ? [`Upstream:   ${upstreamLine}`] : []),
         `Remote:     ${remote}`,
         '',
         'Recent commits:',
@@ -31,9 +47,9 @@ export async function getDevContext(args, jira, bitbucket) {
         'Working tree:',
         status,
     ].join('\n'));
-    // Jira — fetch overview for any tickets referenced in the branch name
+    // Jira — fetch overview for any tickets referenced in the branch name (parallel)
     const jiraKeys = jira ? [...new Set(branch.match(JIRA_KEY_RE) ?? [])] : [];
-    for (const key of jiraKeys) {
+    const jiraResults = await Promise.all(jiraKeys.map(async (key) => {
         try {
             const result = await jira.issueOverview({
                 issueKey: key,
@@ -42,12 +58,13 @@ export async function getDevContext(args, jira, bitbucket) {
                 includeTransitions: true,
                 includeSprint: true,
             });
-            sections.push(`── Jira ${key} ──\n${result.content[0].text}`);
+            return `── Jira ${key} ──\n${result.content[0].text}`;
         }
         catch {
-            sections.push(`── Jira ${key} ── (could not fetch)`);
+            return `── Jira ${key} ── (could not fetch)`;
         }
-    }
+    }));
+    sections.push(...jiraResults);
     // Bitbucket — find the open PR for this branch (only if remote points to this instance)
     const parsed = bitbucket?.isRemoteForThisInstance(remote) ? parseBitbucketRemote(remote) : null;
     if (parsed) {

package/dist/git.js

@@ -1,32 +1,55 @@
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 const JIRA_KEY_RE = /\b[A-Z][A-Z0-9]+-\d+\b/g;
+// Allowlist for git refs (commits, branches used as refs in diff commands)
+const SAFE_REF_RE = /^[a-zA-Z0-9/_.\-@{}~^:]+(\.\.\.[a-zA-Z0-9/_.\-@{}~^:]+)?$/;
+// Allowlist for branch names (stricter — no range syntax)
+const SAFE_BRANCH_RE = /^[a-zA-Z0-9/_.\-]+$/;
 function text(t) {
     return { content: [{ type: 'text', text: t }] };
 }
-function git(cmd, cwd) {
-    return execSync(`git ${cmd}`, { cwd, encoding: 'utf-8' }).trim();
+function git(args, cwd) {
+    return execFileSync('git', args, { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
 }
-function safeGit(cmd, cwd, fallback = '') {
+function safeGit(args, cwd, fallback = '') {
     try {
-        return git(cmd, cwd);
+        return git(args, cwd);
     }
     catch {
         return fallback;
     }
 }
+function validateRepoPath(repoPath) {
+    try {
+        execFileSync('git', ['rev-parse', '--git-dir'], { cwd: repoPath, encoding: 'utf-8', stdio: 'pipe' });
+    }
+    catch {
+        throw new Error(`Not a git repository: ${repoPath}`);
+    }
+}
+function validateBranch(branch, label) {
+    if (!SAFE_BRANCH_RE.test(branch)) {
+        throw new Error(`Invalid ${label} "${branch}". Use only letters, numbers, /, _, ., -`);
+    }
+}
+function validateRef(ref, label) {
+    if (!SAFE_REF_RE.test(ref)) {
+        throw new Error(`Invalid ${label} "${ref}". Use only safe git ref characters.`);
+    }
+}
 export function getContext(args) {
     const repoPath = args.repoPath ?? process.cwd();
-    const limit = args.commitLimit ?? 10;
+    const limit = Math.max(1, Math.min(args.commitLimit ?? 10, 100));
     try {
-        const branch = safeGit('rev-parse --abbrev-ref HEAD', repoPath, '(unknown)');
-        const remote = safeGit('remote get-url origin', repoPath, '(no remote)');
-        const commits = safeGit(`log --oneline -${limit}`, repoPath, '(no commits)');
-        const status = safeGit('status --short', repoPath, '');
+        validateRepoPath(repoPath);
+        const branch = safeGit(['rev-parse', '--abbrev-ref', 'HEAD'], repoPath, '(unknown)');
+        const remote = safeGit(['remote', 'get-url', 'origin'], repoPath, '(no remote)');
+        const commits = safeGit(['log', '--oneline', `-${limit}`], repoPath, '(no commits)');
+        const status = safeGit(['status', '--short'], repoPath, '');
         // Upstream tracking
-        const upstream = safeGit('rev-parse --abbrev-ref @{u}', repoPath, '');
+        const upstream = safeGit(['rev-parse', '--abbrev-ref', '@{u}'], repoPath, '');
         let upstreamLine = '';
         if (upstream) {
-            const ab = safeGit(`rev-list --left-right --count ${upstream}...HEAD`, repoPath, '');
+            const ab = safeGit(['rev-list', '--left-right', '--count', `${upstream}...HEAD`], repoPath, '');
             if (ab.includes('\t')) {
                 const [behind, ahead] = ab.split('\t').map(Number);
                 const parts = [];
@@ -38,7 +61,7 @@ export function getContext(args) {
             }
         }
         // Diff stat summary
-        const diffStatLines = safeGit('diff HEAD --stat', repoPath, '').split('\n').filter(Boolean);
+        const diffStatLines = safeGit(['diff', 'HEAD', '--stat'], repoPath, '').split('\n').filter(Boolean);
         const diffStat = diffStatLines[diffStatLines.length - 1]?.trim() ?? '';
         const jiraKeys = [...new Set(branch.match(JIRA_KEY_RE) ?? [])];
         const lines = [
@@ -62,7 +85,7 @@ export function getContext(args) {
             lines.push('(clean)');
         }
         if (args.includeDiff && status) {
-            const diff = safeGit('diff HEAD', repoPath, '');
+            const diff = safeGit(['diff', 'HEAD'], repoPath, '');
             if (diff) {
                 const MAX = 6000;
                 lines.push('', '── Uncommitted diff ──', diff.length > MAX ? diff.slice(0, MAX) + `\n\n... (truncated, ${diff.length - MAX} more chars)` : diff);
@@ -74,18 +97,22 @@ export function getContext(args) {
         return text(`Error reading git context: ${err.message}`);
     }
 }
+// Not exposed as an MCP tool — internal/experimental use only
 export function getCommits(args) {
     const repoPath = args.repoPath ?? process.cwd();
-    const limit = args.limit ?? 20;
+    const limit = Math.max(1, Math.min(args.limit ?? 20, 200));
     const branch = args.branch ?? '';
     try {
+        validateRepoPath(repoPath);
+        if (branch)
+            validateBranch(branch, 'branch');
         const format = '%H|%an|%ad|%s';
-        const cmd = `log --pretty=format:"${format}" --date=short -${limit}${branch ? ` ${branch}` : ''}`;
-        const raw = safeGit(cmd, repoPath, '');
+        const gitArgs = ['log', `--pretty=format:${format}`, '--date=short', `-${limit}`, ...(branch ? [branch] : [])];
+        const raw = safeGit(gitArgs, repoPath, '');
         if (!raw)
             return text('No commits found.');
         const lines = raw.split('\n').map((line) => {
-            const [hash, author, date, ...msgParts] = line.replace(/^"|"$/g, '').split('|');
+            const [hash, author, date, ...msgParts] = line.split('|');
             return `${hash?.slice(0, 8)} ${date} ${author}: ${msgParts.join('|')}`;
         });
         return text(`Last ${lines.length} commit(s)${branch ? ` on ${branch}` : ''}:\n${lines.join('\n')}`);
@@ -96,24 +123,24 @@ export function getCommits(args) {
 }
 export function getDiff(args) {
     const repoPath = args.repoPath ?? process.cwd();
-    const MAX_CHARS = 8000;
     try {
-        let cmd;
+        validateRepoPath(repoPath);
+        let gitArgs;
         if (args.fromRef && args.toRef) {
-            cmd = `diff ${args.fromRef} ${args.toRef}`;
+            validateRef(args.fromRef, 'fromRef');
+            validateRef(args.toRef, 'toRef');
+            gitArgs = ['diff', args.fromRef, args.toRef];
         }
         else if (args.fromRef) {
-            cmd = `diff ${args.fromRef}`;
+            validateRef(args.fromRef, 'fromRef');
+            gitArgs = ['diff', args.fromRef];
         }
         else {
-            cmd = 'diff HEAD';
+            gitArgs = ['diff', 'HEAD'];
         }
-        const diff = safeGit(cmd, repoPath, '');
+        const diff = safeGit(gitArgs, repoPath, '');
         if (!diff)
             return text('No differences found.');
-        if (diff.length > MAX_CHARS) {
-            return text(diff.slice(0, MAX_CHARS) + `\n\n... (truncated, ${diff.length - MAX_CHARS} more chars)`);
-        }
         return text(diff);
     }
     catch (err) {
@@ -121,13 +148,19 @@ export function getDiff(args) {
     }
 }
 export function checkRemoteBranch(branchName, repoPath) {
-    const lsRemote = safeGit(`ls-remote --heads origin refs/heads/${branchName}`, repoPath);
+    validateBranch(branchName, 'branchName');
+    const lsRemote = safeGit(['ls-remote', '--heads', 'origin', `refs/heads/${branchName}`], repoPath);
     if (!lsRemote)
         return { exists: false };
     const sha = lsRemote.split(/\s+/)[0]?.trim();
-    // Fetch so we can read the log
-    safeGit(`fetch origin ${branchName}`, repoPath);
-    const log = safeGit(`log origin/${branchName} -1 --format=%an%x09%ae%x09%ad%x09%s`, repoPath);
+    // Fetch so we can read the log — failure is non-fatal (network/credentials issue)
+    try {
+        git(['fetch', 'origin', branchName], repoPath);
+    }
+    catch {
+        return { exists: true, sha: sha?.slice(0, 8) };
+    }
+    const log = safeGit(['log', `origin/${branchName}`, '-1', '--format=%an%x09%ae%x09%ad%x09%s'], repoPath);
     if (!log)
         return { exists: true, sha: sha?.slice(0, 8) };
     const [author, email, date, ...msgParts] = log.split('\t');
@@ -140,22 +173,23 @@ export function checkRemoteBranch(branchName, repoPath) {
     };
 }
 function getDefaultBranch(repoPath) {
-    const head = safeGit('rev-parse --abbrev-ref origin/HEAD', repoPath);
+    const head = safeGit(['rev-parse', '--abbrev-ref', 'origin/HEAD'], repoPath);
     if (head && head.startsWith('origin/'))
         return head.slice('origin/'.length);
     // origin/HEAD not set — probe common defaults
-    if (safeGit('rev-parse --verify origin/main', repoPath))
+    if (safeGit(['rev-parse', '--verify', 'origin/main'], repoPath))
         return 'main';
     return 'master';
 }
 export function checkoutRemoteBranch(branchName, repoPath) {
     try {
-        const existing = safeGit(`branch --list ${branchName}`, repoPath);
+        validateBranch(branchName, 'branchName');
+        const existing = safeGit(['branch', '--list', branchName], repoPath);
         if (existing.trim()) {
-            git(`checkout ${branchName}`, repoPath);
+            git(['checkout', branchName], repoPath);
             return text(`Switched to existing local branch "${branchName}".`);
         }
-        git(`checkout --track origin/${branchName}`, repoPath);
+        git(['checkout', '--track', `origin/${branchName}`], repoPath);
         return text(`Checked out "${branchName}" tracking origin/${branchName}.`);
     }
     catch (err) {
@@ -165,20 +199,24 @@ export function checkoutRemoteBranch(branchName, repoPath) {
 export function createBranch(args) {
     const repoPath = args.repoPath ?? process.cwd();
     const { branchName, push = false } = args;
-    const baseBranch = args.baseBranch ?? getDefaultBranch(repoPath);
     try {
-        if (!/^[a-zA-Z0-9/_.\-]+$/.test(branchName)) {
+        validateRepoPath(repoPath);
+        if (!SAFE_BRANCH_RE.test(branchName)) {
             return text(`Invalid branch name "${branchName}". Use only letters, numbers, /, _, ., -`);
         }
-        const existing = safeGit(`branch --list ${branchName}`, repoPath);
+        const baseBranch = args.baseBranch ?? getDefaultBranch(repoPath);
+        if (!SAFE_BRANCH_RE.test(baseBranch)) {
+            return text(`Invalid base branch name "${baseBranch}". Use only letters, numbers, /, _, ., -`);
+        }
+        const existing = safeGit(['branch', '--list', branchName], repoPath);
         if (existing.trim()) {
             return text(`Branch "${branchName}" already exists locally. Switch with: git checkout ${branchName}`);
         }
-        safeGit(`fetch origin ${baseBranch}`, repoPath);
-        git(`checkout -b ${branchName} origin/${baseBranch}`, repoPath);
+        safeGit(['fetch', 'origin', baseBranch], repoPath);
+        git(['checkout', '-b', branchName, `origin/${baseBranch}`], repoPath);
         const lines = [`Created and switched to branch "${branchName}" from origin/${baseBranch}.`];
         if (push) {
-            git(`push -u origin ${branchName}`, repoPath);
+            git(['push', '-u', 'origin', branchName], repoPath);
             lines.push(`Pushed to origin/${branchName} and set upstream.`);
         }
         return text(lines.join('\n'));

package/dist/index.js

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 import 'dotenv/config';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
+import { readFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+const _pkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '../package.json'), 'utf-8'));
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, McpError, ErrorCode, } from '@modelcontextprotocol/sdk/types.js';
 import { loadConfig } from './config.js';
@@ -11,7 +15,7 @@ import { getContext, getDiff, createBranch, checkRemoteBranch, checkoutRemoteBra
 import { getDevContext } from './context.js';
 function currentGitRemote() {
     try {
-        return execSync('git remote get-url origin', { encoding: 'utf-8' }).trim();
+        return execFileSync('git', ['remote', 'get-url', 'origin'], { encoding: 'utf-8' }).trim();
     }
     catch {
         return '';
@@ -35,7 +39,7 @@ const bitbucket = (config.bitbucket && remoteMatchesBitbucketInstance(_remote, c
 if (config.bitbucket && !bitbucket) {
     console.error(`[atlassian-mcp] Bitbucket configured but remote "${_remote || '(none)'}" does not match ${config.bitbucket.url} — Bitbucket tools disabled for this repo.`);
 }
-const server = new Server({ name: 'atlassian-mcp', version: '1.0.0' }, { capabilities: { tools: {} } });
+const server = new Server({ name: 'atlassian-mcp', version: _pkg.version }, { capabilities: { tools: {} } });
 server.onerror = (error) => console.error('[MCP Error]', error);
 function normalizeBitbucketArgs(args) {
     const src = (args && typeof args === 'object') ? args : {};
@@ -495,17 +499,25 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                         if (result.action === 'cancel' || result.action === 'decline') {
                             return { content: [{ type: 'text', text: 'Cancelled.' }] };
                         }
-                        if (result.action === 'accept' && result.content?.action === 'checkout') {
-                            const checkout = checkoutRemoteBranch(branchName, repoPath);
-                            return { content: [{ type: 'text', text: `${message}\n\n${checkout.content[0].text}` }] };
+                        if (result.action === 'accept') {
+                            const chosen = result.content?.action;
+                            if (chosen === 'checkout') {
+                                const checkout = checkoutRemoteBranch(branchName, repoPath);
+                                return { content: [{ type: 'text', text: `${message}\n\n${checkout.content[0].text}` }] };
+                            }
+                            if (chosen === 'cancel') {
+                                return { content: [{ type: 'text', text: 'Cancelled.' }] };
+                            }
+                            // new_name — instruct the model to re-run with a custom name
+                            return {
+                                content: [{
+                                        type: 'text',
+                                        text: `${message}\n\nRe-run start_work with a custom branchName to proceed.`,
+                                    }],
+                            };
                         }
-                        // new_name — instruct the model to re-run with a custom name
-                        return {
-                            content: [{
-                                    type: 'text',
-                                    text: `${message}\n\nRe-run start_work with a custom branchName to proceed.`,
-                                }],
-                        };
+                        // Fallback: unknown action
+                        return { content: [{ type: 'text', text: 'Cancelled.' }] };
                     }
                     catch {
                         // Client doesn't support elicitation — fall back to informational text
@@ -656,9 +668,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 // Resolve PR — by prId or current branch
                 let resolvedPrId = a.prId;
                 if (resolvedPrId === undefined) {
-                    const { execSync } = await import('child_process');
                     const branch = (() => { try {
-                        return execSync('git rev-parse --abbrev-ref HEAD', { cwd: repoPath, encoding: 'utf-8' }).trim();
+                        return execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: repoPath, encoding: 'utf-8' }).trim();
                     }
                     catch {
                         return '';
@@ -667,7 +678,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                         throw new Error('Could not determine current branch. Provide prId or run from a checked-out branch.');
                     }
                     const remote = (() => { try {
-                        return execSync('git remote get-url origin', { cwd: repoPath, encoding: 'utf-8' }).trim();
+                        return execFileSync('git', ['remote', 'get-url', 'origin'], { cwd: repoPath, encoding: 'utf-8' }).trim();
                     }
                     catch {
                         return '';
@@ -730,9 +741,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         };
     }
 });
-process.on('SIGINT', async () => {
+async function shutdown() {
     await server.close();
     process.exit(0);
-});
+}
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/dist/jira.js

@@ -9,8 +9,11 @@ function pagination(total, startAt, count) {
     return total > end ? ` (showing ${startAt + 1}–${end} of ${total}, use startAt=${end} for next page)` : '';
 }
 function buildJQL(args) {
-    if (args.jql)
+    if (args.jql) {
+        if (args.jql.length > 2000)
+            throw new Error('JQL query too long (max 2000 characters).');
         return args.jql;
+    }
     const clauses = [];
     if (args.query)
         clauses.push(`text ~ ${JSON.stringify(args.query)}`);
@@ -91,6 +94,7 @@ export class JiraClient {
     baseUrl;
     headers;
     currentUserCache;
+    projectsCache;
     constructor(baseUrl, token) {
         this.baseUrl = baseUrl.replace(/\/$/, '');
         this.headers = {
@@ -113,7 +117,7 @@ export class JiraClient {
     }
     async requestWithBase(apiBase, method, path, body) {
         const url = `${this.baseUrl}${apiBase}${path}`;
-        const opts = { method, headers: this.headers };
+        const opts = { method, headers: this.headers, signal: AbortSignal.timeout(30_000) };
         if (body !== undefined)
             opts.body = JSON.stringify(body);
         const res = await fetch(url, opts);
@@ -195,7 +199,7 @@ export class JiraClient {
         if (args.description !== undefined)
             fields.description = args.description;
         if (args.assignee !== undefined)
-            fields.assignee = { name: args.assignee };
+            fields.assignee = args.assignee ? { name: args.assignee } : null;
         if (args.priority !== undefined)
             fields.priority = { name: args.priority };
         if (args.labels !== undefined)
@@ -204,7 +208,7 @@ export class JiraClient {
             fields.fixVersions = args.fixVersion ? [{ name: args.fixVersion }] : [];
         if (Object.keys(fields).length === 0)
             return false;
-        await this.request('PUT', `/issue/${args.issueKey}`, { fields });
+        await this.request('PUT', `/issue/${encodeURIComponent(args.issueKey)}`, { fields });
         return true;
     }
     async resolveTransitionId(issueKey, transitionId, transitionName) {
@@ -214,7 +218,7 @@ export class JiraClient {
         if (!requestedName) {
             throw new Error('Provide transitionId or transitionName');
         }
-        const data = await this.request('GET', `/issue/${issueKey}/transitions`);
+        const data = await this.request('GET', `/issue/${encodeURIComponent(issueKey)}/transitions`);
         const transitions = data?.transitions ?? [];
         const lowered = requestedName.toLowerCase();
         const match = transitions.find((t) => t.name.toLowerCase() === lowered);
@@ -225,14 +229,17 @@ export class JiraClient {
         return match.id;
     }
     async transitionIssueInternal(issueKey, transitionId) {
-        await this.request('POST', `/issue/${issueKey}/transitions`, {
+        await this.request('POST', `/issue/${encodeURIComponent(issueKey)}/transitions`, {
             transition: { id: transitionId },
         });
     }
     async resolveProjectKey(projectKey) {
         if (projectKey)
             return projectKey;
-        const projects = (await this.request('GET', '/project?maxResults=100')) ?? [];
+        if (!this.projectsCache) {
+            this.projectsCache = (await this.request('GET', '/project?maxResults=100')) ?? [];
+        }
+        const projects = this.projectsCache;
         if (projects.length === 0) {
             throw new Error('No Jira projects found for your account.');
         }
@@ -287,7 +294,7 @@ export class JiraClient {
     }
     async getIssueTypes(args) {
         const projectKey = await this.resolveProjectKey(args.projectKey);
-        const data = await this.request('GET', `/project/${projectKey}/statuses`);
+        const data = await this.request('GET', `/project/${encodeURIComponent(projectKey)}/statuses`);
         if (!data || data.length === 0)
             return text('No issue types found.');
         const lines = data.map((t) => {
@@ -330,7 +337,7 @@ export class JiraClient {
         return text(`${lines.length} user(s) found:\n${lines.join('\n')}`);
     }
     async getIssueFields(issueKey) {
-        const data = await this.request('GET', `/issue/${issueKey}?fields=summary,status,issuetype`);
+        const data = await this.request('GET', `/issue/${encodeURIComponent(issueKey)}?fields=summary,status,issuetype`);
         if (!data)
             throw new Error(`Issue ${issueKey} not found`);
         return {
@@ -341,7 +348,7 @@ export class JiraClient {
     }
     async getIssue(args) {
         const fields = 'summary,description,status,assignee,priority,issuetype,labels,components';
-        const data = await this.request('GET', `/issue/${args.issueKey}?fields=${fields}`);
+        const data = await this.request('GET', `/issue/${encodeURIComponent(args.issueKey)}?fields=${fields}`);
         if (!data)
             return text('Issue not found.');
         const f = data.fields;
@@ -367,7 +374,7 @@ export class JiraClient {
         const commentsMaxResults = args.commentsMaxResults ?? 10;
         const commentsStartAt = args.commentsStartAt ?? 0;
         const fields = 'summary,description,status,assignee,priority,issuetype,labels,components,parent,fixVersions,issuelinks,subtasks';
-        const issue = await this.request('GET', `/issue/${args.issueKey}?fields=${fields}`);
+        const issue = await this.request('GET', `/issue/${encodeURIComponent(args.issueKey)}?fields=${fields}`);
         if (!issue)
             return text('Issue not found.');
         const f = issue.fields;
@@ -395,7 +402,7 @@ export class JiraClient {
         ];
         if (includeSprint) {
             try {
-                const agileIssue = await this.requestAgile('GET', `/issue/${args.issueKey}?fields=sprint,closedSprints`);
+                const agileIssue = await this.requestAgile('GET', `/issue/${encodeURIComponent(args.issueKey)}?fields=sprint,closedSprints`);
                 const activeSprint = agileIssue?.fields?.sprint;
                 const closedSprints = agileIssue?.fields?.closedSprints ?? [];
                 if (activeSprint) {
@@ -415,13 +422,13 @@ export class JiraClient {
             }
         }
         if (includeTransitions) {
-            const transitions = await this.request('GET', `/issue/${args.issueKey}/transitions`);
+            const transitions = await this.request('GET', `/issue/${encodeURIComponent(args.issueKey)}/transitions`);
             const names = (transitions?.transitions ?? []).map((t) => `${t.name} -> ${t.to.name}`);
             lines.push(`Transitions: ${names.length > 0 ? names.join(', ') : '(none)'}`);
         }
         lines.push('', 'Description:', f.description ?? '(no description)');
         if (includeComments) {
-            const comments = await this.request('GET', `/issue/${args.issueKey}/comment?startAt=${commentsStartAt}&maxResults=${commentsMaxResults}`);
+            const comments = await this.request('GET', `/issue/${encodeURIComponent(args.issueKey)}/comment?startAt=${commentsStartAt}&maxResults=${commentsMaxResults}`);
             const items = comments?.comments ?? [];
             const total = comments?.total ?? 0;
             const page = comments ? pagination(total, commentsStartAt, items.length) : '';
@@ -592,7 +599,7 @@ export class JiraClient {
             actions.push(`transitioned via ${transitionId}`);
         }
         if (args.comment !== undefined) {
-            await this.request('POST', `/issue/${issueKey}/comment`, { body: validateCommentBody(args.comment) });
+            await this.request('POST', `/issue/${encodeURIComponent(issueKey)}/comment`, { body: validateCommentBody(args.comment) });
             actions.push('added comment');
         }
         if (args.link) {
@@ -610,7 +617,7 @@ export class JiraClient {
                 wBody.comment = args.worklog.comment;
             if (args.worklog.started)
                 wBody.started = args.worklog.started;
-            await this.request('POST', `/issue/${issueKey}/worklog`, wBody);
+            await this.request('POST', `/issue/${encodeURIComponent(issueKey)}/worklog`, wBody);
             actions.push(`logged ${args.worklog.timeSpent}`);
         }
         if (actions.length === 0) {
@@ -620,7 +627,7 @@ export class JiraClient {
     }
     async getComments(args) {
         const { issueKey, maxResults = 50, startAt = 0 } = args;
-        const data = await this.request('GET', `/issue/${issueKey}/comment?startAt=${startAt}&maxResults=${maxResults}`);
+        const data = await this.request('GET', `/issue/${encodeURIComponent(issueKey)}/comment?startAt=${startAt}&maxResults=${maxResults}`);
         if (!data || data.comments.length === 0)
             return text('No comments found.');
         const blocks = data.comments.map((c) => {
@@ -631,15 +638,15 @@ export class JiraClient {
         return text(`${data.total} comment(s) on ${issueKey}${page}:\n\n${blocks.join('\n\n')}`);
     }
     async addComment(args) {
-        await this.request('POST', `/issue/${args.issueKey}/comment`, { body: validateCommentBody(args.body) });
+        await this.request('POST', `/issue/${encodeURIComponent(args.issueKey)}/comment`, { body: validateCommentBody(args.body) });
         return text(`Comment added to ${args.issueKey}.`);
     }
     async editComment(args) {
-        const commentId = String(args.commentId).trim();
-        if (!commentId) {
+        const commentId = String(args.commentId ?? '').trim();
+        if (!commentId || commentId === 'undefined' || commentId === 'null') {
             throw new Error('commentId is required.');
         }
-        const path = `/issue/${args.issueKey}/comment/${commentId}`;
+        const path = `/issue/${encodeURIComponent(args.issueKey)}/comment/${encodeURIComponent(commentId)}`;
         const current = await this.request('GET', path);
         if (!current)
             throw new Error(`Comment ${commentId} not found on ${args.issueKey}.`);
@@ -648,11 +655,11 @@ export class JiraClient {
         return text(`Comment ${commentId} updated on ${args.issueKey}.`);
     }
     async deleteComment(args) {
-        const commentId = String(args.commentId).trim();
-        if (!commentId) {
+        const commentId = String(args.commentId ?? '').trim();
+        if (!commentId || commentId === 'undefined' || commentId === 'null') {
             throw new Error('commentId is required.');
         }
-        const path = `/issue/${args.issueKey}/comment/${commentId}`;
+        const path = `/issue/${encodeURIComponent(args.issueKey)}/comment/${encodeURIComponent(commentId)}`;
         const current = await this.request('GET', path);
         if (!current)
             throw new Error(`Comment ${commentId} not found on ${args.issueKey}.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stubbedev/atlassian-mcp",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "MCP server for self-hosted Jira and Bitbucket",
   "license": "MIT",
   "type": "module",