@vitalyostanin/youtrack-mcp 0.13.2 → 0.13.3

package/README-ru.md

@@ -1,6 +1,7 @@
 # YouTrack MCP Server
 
 [![CI](https://github.com/VitalyOstanin/youtrack-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/VitalyOstanin/youtrack-mcp/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/VitalyOstanin/youtrack-mcp/graph/badge.svg?branch=master)](https://codecov.io/gh/VitalyOstanin/youtrack-mcp)
 [![npm version](https://img.shields.io/npm/v/@vitalyostanin/youtrack-mcp.svg)](https://www.npmjs.com/package/@vitalyostanin/youtrack-mcp)
 
 MCP сервер для полноценной интеграции с YouTrack со следующими возможностями:

package/README.md

@@ -3,6 +3,7 @@
 Also available in Russian: [README-ru.md](README-ru.md)
 
 [![CI](https://github.com/VitalyOstanin/youtrack-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/VitalyOstanin/youtrack-mcp/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/VitalyOstanin/youtrack-mcp/graph/badge.svg?branch=master)](https://codecov.io/gh/VitalyOstanin/youtrack-mcp)
 [![npm version](https://img.shields.io/npm/v/@vitalyostanin/youtrack-mcp.svg)](https://www.npmjs.com/package/@vitalyostanin/youtrack-mcp)
 
 MCP server for comprehensive YouTrack integration with the following capabilities:

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vitalyostanin/youtrack-mcp",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "postbuild": "chmod +x dist/index.js && cp package.json dist/package.json",

package/dist/src/tools/issue-search-tools.js

@@ -7,7 +7,7 @@ import { createToolHandler } from "../utils/tool-handler.js";
 export const issuesSearchArgs = {
     query: yqlQuerySchema
         .optional()
-        .describe("Search string for issues (e.g., 'login error'). If not provided or empty, all issues will be returned. You can also use YouTrack Query Language (e.g., 'State: Open', 'Type: Bug')"),
+        .describe("Search string for issues (e.g., 'login error'). If not provided or empty, all issues will be returned. You can use YouTrack Query Language, including {curly braces} to enclose multi-word attribute values (e.g., 'State: {In Progress}', 'tag: {Technical debt}', 'Type: Bug')."),
     limit: z.number().int().positive().max(200).default(50).describe("Max results per page"),
     skip: z.number().int().nonnegative().default(0).describe("Offset for pagination"),
     projects: z.array(yqlIdentifierSchema).optional().describe("Filter by project short names (e.g., ['PROJ', 'TEST'])"),

package/dist/src/utils/validators.d.ts

@@ -22,9 +22,12 @@ export declare const articleIdSchema: z.ZodString;
  */
 export declare const yqlIdentifierSchema: z.ZodString;
 /**
- * Free-text YQL fragment used as a search query. Forbids `{` and `}` so the
- * value cannot break out of the surrounding `({...})` wrapping or smuggle a
- * literal field-value clause.
+ * Free-text YQL fragment used as a search query. Allows `{` and `}` because
+ * they are valid YQL syntax for multi-word attribute values. Only ASCII
+ * control characters are rejected.
+ *
+ * Callers MUST NOT interpolate this value inside another `{...}` wrapper —
+ * use yqlIdentifierSchema for that.
  */
 export declare const yqlQuerySchema: z.ZodString;
 //# sourceMappingURL=validators.d.ts.map

package/dist/src/utils/validators.js

@@ -44,12 +44,19 @@ export const articleIdSchema = z
     .min(1)
     .regex(internalIdRegex, "Article id must be alphanumeric with . _ -");
 /**
- * Reject `{`, `}` and ASCII control characters (NUL..US, DEL) in YQL inputs.
- * This is the single source of truth for YQL injection defense across query
- * fragments, field values and identifiers.
+ * Reject `{`, `}` and ASCII control characters in values that are interpolated
+ * inside a `{...}` wrapper. Used by yqlIdentifierSchema.
  */
 // eslint-disable-next-line no-control-regex
-const YQL_FORBIDDEN = /[{}\x00-\x1F\x7F]/;
+const YQL_IDENTIFIER_FORBIDDEN = /[{}\x00-\x1F\x7F]/;
+/**
+ * Reject only ASCII control characters in free-text YQL queries. `{` and `}`
+ * are part of the YouTrack Query Language — they enclose attribute values
+ * that contain spaces (e.g. `tag: {Technical debt}`, `State: {In Progress}`).
+ * See: https://www.jetbrains.com/help/youtrack/server/search-and-command-attributes.html
+ */
+// eslint-disable-next-line no-control-regex
+const YQL_QUERY_FORBIDDEN = /[\x00-\x1F\x7F]/;
 /**
  * YQL identifier value used inside `{...}` wrappers (state/type names,
  * project short names, login-like ids). Permits spaces, hyphens, dots and
@@ -59,17 +66,20 @@ const YQL_FORBIDDEN = /[{}\x00-\x1F\x7F]/;
 export const yqlIdentifierSchema = z
     .string()
     .min(1)
-    .refine((value) => !YQL_FORBIDDEN.test(value), {
+    .refine((value) => !YQL_IDENTIFIER_FORBIDDEN.test(value), {
     message: "YQL identifier must not contain { } or control characters",
 });
 /**
- * Free-text YQL fragment used as a search query. Forbids `{` and `}` so the
- * value cannot break out of the surrounding `({...})` wrapping or smuggle a
- * literal field-value clause.
+ * Free-text YQL fragment used as a search query. Allows `{` and `}` because
+ * they are valid YQL syntax for multi-word attribute values. Only ASCII
+ * control characters are rejected.
+ *
+ * Callers MUST NOT interpolate this value inside another `{...}` wrapper —
+ * use yqlIdentifierSchema for that.
  */
 export const yqlQuerySchema = z
     .string()
-    .refine((value) => !YQL_FORBIDDEN.test(value), {
-    message: "Search query must not contain { } or control characters",
+    .refine((value) => !YQL_QUERY_FORBIDDEN.test(value), {
+    message: "Search query must not contain control characters",
 });
 //# sourceMappingURL=validators.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vitalyostanin/youtrack-mcp",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "postbuild": "chmod +x dist/index.js && cp package.json dist/package.json",