@stubbedev/atlassian-mcp 0.5.26 → 0.5.28

package/README.md

@@ -206,7 +206,7 @@ there is nothing to install up front. `npm install -g` does the same once and pu
 
 The Composer package `stubbedev/atlassian-mcp` is for PHP projects, or machines with PHP
 but no Node. It is a Composer plugin: on `composer install` / `update` it downloads the
-prebuilt binary for your OS and architecture (the same 14 targets as npm), from the release
+prebuilt binary for your OS and architecture (the same 13 targets as npm), from the release
 matching the installed version, so a pinned version pins the binary. Your MCP client then
 runs that native binary directly, and PHP is never in the request path:
 
@@ -241,12 +241,13 @@ Clients start the server from their own working directory, so use absolute paths
 
 #### Binary cache
 
-npm and Composer download each release's binary once per user, into
-`$XDG_CACHE_HOME/atlassian-mcp/<version>/` (by default `~/.cache` on Linux and FreeBSD,
-`~/Library/Caches` on macOS, `%LOCALAPPDATA%` on Windows), and hardlink it into every
-install, or copy it where the install is on another filesystem. Further projects and git
-worktrees on the same version install without downloading anything. Delete old version
-directories to reclaim their space; installs keep their own link.
+npm and Composer download each release's binary once per user, verify it against the
+release's `checksums.txt`, and keep it in `$XDG_CACHE_HOME/atlassian-mcp/<version>/` (by
+default `~/.cache` on Linux and FreeBSD, `~/Library/Caches` on macOS, `%LOCALAPPDATA%` on
+Windows), and hardlink it into every install, or copy it where the install is on another
+filesystem. Further projects and git worktrees on the same version install without
+downloading anything. Delete old version directories to reclaim their space; installs keep
+their own link.
 
 #### Standalone binary (Go, Nix, release download)
 
@@ -303,10 +304,9 @@ claude mcp add atlassian -- npx -y @stubbedev/atlassian-mcp@latest --config ~/.a
 
 **One-click (recommended).** Grab the `.mcpb` bundle for your platform from the
 [latest release](https://github.com/stubbedev/atlassian-mcp/releases/latest) —
-`atlassian-mcp_darwin_arm64.mcpb` (Apple Silicon), `atlassian-mcp_darwin_amd64.mcpb`
-(Intel Mac), `atlassian-mcp_windows_amd64.mcpb` — then **double-click it**, drag it onto the
-Claude Desktop window, or use **Settings → Extensions → Advanced settings → Install
-Extension…**. The install dialog asks for Jira/Bitbucket URL and token (tokens are stored
+`atlassian-mcp_darwin_arm64.mcpb` (Apple Silicon), `atlassian-mcp_windows_amd64.mcpb` — then
+**double-click it**, drag it onto the Claude Desktop window, or use **Settings → Extensions →
+Advanced settings → Install Extension…**. The install dialog asks for Jira/Bitbucket URL and token (tokens are stored
 by Claude Desktop, not in a file) plus **Repository**, the working tree the git and PR tools
 default to. Leaving URL/token blank reuses an existing `~/.atlassian-mcp.json`.
 
@@ -727,11 +727,11 @@ This package is published to npm as `@stubbedev/atlassian-mcp` and to Packagist
 
 Use semantic versioning for releases. Breaking tool-surface changes should bump the minor version while `<1.0.0` (for example `0.0.x` -> `0.1.0`).
 
-On a pushed `v*` tag, `.github/workflows/publish.yml` cross-compiles the Go binary for 14
-OS/arch targets, packs six of them into `.mcpb` bundles for one-click desktop install
-(`packaging/mcpb/pack.sh`, macOS/Windows/Linux × amd64/arm64), attaches everything to a
-GitHub release, and publishes the npm wrapper (which downloads the matching binary on
-install). `just bundle` builds a bundle for the host platform locally.
+On a pushed `v*` tag, `.github/workflows/publish.yml` cross-compiles the Go binary for 13
+OS/arch targets, packs five of them into `.mcpb` bundles for one-click desktop install
+(`packaging/mcpb/pack.sh`, macOS arm64 and Windows/Linux × amd64/arm64), attaches
+everything to a GitHub release, and publishes the npm wrapper (which downloads the matching
+binary on install). `just bundle` builds a bundle for the host platform locally.
 
 Release flow (`just` drives it; it refuses to run on a dirty tree):
 
@@ -745,7 +745,7 @@ just release-patch         # or release-minor / release-major
 pushes both the branch and the tag. The tag push triggers `publish.yml`.
 
 `package.json` is the single source of truth for the version: the binary embeds it via
-`go:embed` (no `-ldflags`) and `flake.nix` reads it, so one bump moves everything.
+`go:embed` (no `-ldflags`) and `nix/package.nix` reads it, so one bump moves everything.
 The equivalent npm scripts (`npm run release:patch` / `:minor` / `:major`) still work.
 
 - The workflow is configured for npm Trusted Publisher (OIDC), so no `NPM_TOKEN` secret is required

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stubbedev/atlassian-mcp",
-  "version": "0.5.26",
+  "version": "0.5.28",
   "description": "MCP server for self-hosted Jira and Bitbucket (Go, distributed as a prebuilt binary)",
   "license": "MIT",
   "type": "module",

package/scripts/download.mjs

@@ -1,9 +1,7 @@
-import { randomBytes } from 'node:crypto';
-import { createWriteStream, readFileSync } from 'node:fs';
-import { chmod, copyFile, link, mkdir, rename, rm, stat } from 'node:fs/promises';
+import { createHash, randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { chmod, copyFile, link, mkdir, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { Readable } from 'node:stream';
-import { pipeline } from 'node:stream/promises';
 import { fileURLToPath } from 'node:url';
 
 const NAME = 'atlassian-mcp';
@@ -21,7 +19,6 @@ const PLATFORMS = {
   'linux:ppc64': { os: 'linux', arch: 'ppc64le', ext: '' },
   'linux:s390x': { os: 'linux', arch: 's390x', ext: '' },
   'linux:riscv64': { os: 'linux', arch: 'riscv64', ext: '' },
-  'darwin:x64': { os: 'darwin', arch: 'amd64', ext: '' },
   'darwin:arm64': { os: 'darwin', arch: 'arm64', ext: '' },
   'win32:x64': { os: 'windows', arch: 'amd64', ext: '.exe' },
   'win32:arm64': { os: 'windows', arch: 'arm64', ext: '.exe' },
@@ -54,21 +51,7 @@ function asset() {
 }
 
 async function fetchInto(cached) {
-  const url = `https://github.com/${REPO}/releases/download/v${pkg.version}/${asset()}`;
-  const res = await fetch(url, { redirect: 'follow' });
-  if (!res.ok || !res.body) {
-    throw new Error(`Failed to download ${url}: HTTP ${res.status}`);
-  }
-  const tmp = await tmpBeside(cached);
-  try {
-    await pipeline(Readable.fromWeb(res.body), createWriteStream(tmp));
-    if ((await stat(tmp)).size === 0) {
-      throw new Error(`Failed to download ${url}: empty response`);
-    }
-    await commit(tmp, cached);
-  } finally {
-    await rm(tmp, { force: true });
-  }
+  await store(await fetchRelease(`v${pkg.version}`, asset()), cached);
 }
 
 function cacheDir() {
@@ -115,3 +98,34 @@ async function tmpBeside(file) {
   await mkdir(dirname(file), { recursive: true });
   return `${file}.${randomBytes(6).toString('hex')}.tmp`;
 }
+
+async function fetchRelease(tag, asset) {
+  const base = `https://github.com/${REPO}/releases/download/${tag}`;
+  const sums = (await get(`${base}/checksums.txt`)).toString('utf8');
+  const want = sums
+    .split('\n')
+    .map((line) => line.trim().split(/\s+\*?/))
+    .find(([, file]) => file === asset)?.[0];
+  if (!want) throw new Error(`${asset} is not listed in ${tag} checksums.txt`);
+  const data = await get(`${base}/${asset}`);
+  if (createHash('sha256').update(data).digest('hex') !== want) {
+    throw new Error(`Checksum mismatch for ${asset} from ${tag}`);
+  }
+  return data;
+}
+
+async function get(url) {
+  const res = await fetch(url, { redirect: 'follow' });
+  if (!res.ok) throw new Error(`Failed to download ${url}: HTTP ${res.status}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
+async function store(data, cached) {
+  const tmp = await tmpBeside(cached);
+  try {
+    await writeFile(tmp, data);
+    await commit(tmp, cached);
+  } finally {
+    await rm(tmp, { force: true });
+  }
+}