@vitalyostanin/youtrack-mcp 0.13.2 → 0.14.0

package/README-ru.md

@@ -1,6 +1,7 @@
 # YouTrack MCP Server
 
 [![CI](https://github.com/VitalyOstanin/youtrack-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/VitalyOstanin/youtrack-mcp/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/VitalyOstanin/youtrack-mcp/graph/badge.svg?branch=master)](https://codecov.io/gh/VitalyOstanin/youtrack-mcp)
 [![npm version](https://img.shields.io/npm/v/@vitalyostanin/youtrack-mcp.svg)](https://www.npmjs.com/package/@vitalyostanin/youtrack-mcp)
 
 MCP сервер для полноценной интеграции с YouTrack со следующими возможностями:

package/README.md

@@ -3,6 +3,7 @@
 Also available in Russian: [README-ru.md](README-ru.md)
 
 [![CI](https://github.com/VitalyOstanin/youtrack-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/VitalyOstanin/youtrack-mcp/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/VitalyOstanin/youtrack-mcp/graph/badge.svg?branch=master)](https://codecov.io/gh/VitalyOstanin/youtrack-mcp)
 [![npm version](https://img.shields.io/npm/v/@vitalyostanin/youtrack-mcp.svg)](https://www.npmjs.com/package/@vitalyostanin/youtrack-mcp)
 
 MCP server for comprehensive YouTrack integration with the following capabilities:
@@ -72,6 +73,7 @@ MCP server for comprehensive YouTrack integration with the following capabilitie
 - `YOUTRACK_DEFAULT_PROJECT` — optional project code used for manual verification tasks and default parent issues in docs/examples (use `PROJ` in documentation examples)
 - `YOUTRACK_OUTPUT_DIR` — optional root directory for files produced by `saveToFile` and `downloadToFile`. Defaults to the current working directory. Absolute paths and parent-traversal segments (`..`) are rejected for safety
 - `YOUTRACK_UPLOAD_DIR` — optional whitelist root for source files used by `issue_attachment_upload`. Defaults to `YOUTRACK_OUTPUT_DIR`. Paths whose realpath escapes this directory (including via symlinks) are rejected to prevent reading arbitrary files (`/etc/passwd`, `~/.ssh/id_rsa`, etc.)
+- `YOUTRACK_SILENT_COMMANDS` — optional, set to `true` to apply command-based fallbacks (link create/delete via `/api/commands`) silently. Silent apply requires the YouTrack "Apply Commands Silently" permission; accounts without it get HTTP 403. Defaults to `false` (normal apply) so link operations work for any account that can run commands
 
 
 ## Installation
@@ -352,6 +354,7 @@ Tools that delete data require an explicit `confirmation: true` literal in their
 | `issue_comment_update` | Update existing comment | `issueId`, `commentId`, optionally `text`, `usesMarkdown`, `muteUpdateNotifications` |
 | `issue_activities` | Get issue change history | `issueId` — issue code, optionally `author` (login), `startDate` (YYYY-MM-DD, timestamp, or Date), `endDate`, `categories` (comma-separated: `CustomFieldCategory` for field changes, `CommentsCategory` for comments, `AttachmentsCategory` for attachments, `LinksCategory` for links, `VcsChangeActivityCategory` for VCS changes, `WorkItemsActivityCategory` for work items), `limit` (max 200), `skip` for pagination; `saveToFile`, `filePath`, `format`, `overwrite` — file storage options. Returns activity items with timestamps (ISO datetime), authors, categories, and change details (added/removed values). Useful for tracking field modifications, reviewing comment history, and analyzing collaboration patterns |
 | `issue_change_state` | Change issue state/status through workflow transitions | `issueId` — issue code, `stateName` — target state name (e.g., 'In Progress', 'Open', 'Fixed', 'Verified'). Case-insensitive. Automatically discovers available transitions and validates requested state change. Returns information about previous state, new state, and transition used. Use for moving issues through workflow states |
+| `issue_change_type` | Change the issue Type custom field | `issueId` — issue code, `typeName` — target Type value by canonical or localized name (e.g., 'Bug', 'Task', 'Feature'). Returns previous and new type. Unknown types fail with a descriptive error |
 | `issue_attachments_list` | Get list of attachments | `issueId` — issue code; `saveToFile`, `filePath`, `format`, `overwrite` — file storage options |
 | `issue_attachment_get` | Get attachment info | `issueId`, `attachmentId`; `saveToFile`, `filePath`, `format`, `overwrite` — file storage options |
 | `issue_attachment_download` | Get download URL for attachment or download file directly to local filesystem | `issueId`, `attachmentId` — returns signed download URL when downloadToFile=false; `downloadToFile` — boolean, download file directly to local system (default: false); `downloadPath` — custom path to save file (auto-generated if not provided); `overwrite` — allow overwriting existing files (default: false, throws error if file exists); `saveToFile`, `filePath`, `format`, `overwrite` — file storage options for metadata |

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vitalyostanin/youtrack-mcp",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "postbuild": "chmod +x dist/index.js && cp package.json dist/package.json",

package/dist/src/config.js

@@ -11,6 +11,7 @@ const configSchema = z.object({
     YOUTRACK_DEFAULT_PROJECT: z.string().optional(),
     YOUTRACK_OUTPUT_DIR: z.string().optional(),
     YOUTRACK_UPLOAD_DIR: z.string().optional(),
+    YOUTRACK_SILENT_COMMANDS: z.string().optional(),
 });
 const SETUP_DOC_URL = "https://github.com/VitalyOstanin/youtrack-mcp#requirements";
 export function loadConfig(env = process.env) {
@@ -52,6 +53,7 @@ export function loadConfig(env = process.env) {
         defaultProject: parsed.data.YOUTRACK_DEFAULT_PROJECT,
         outputDir,
         uploadDir,
+        silentCommands: parsed.data.YOUTRACK_SILENT_COMMANDS === "true",
     };
 }
 export function enrichConfigWithRedaction(config) {

package/dist/src/tools/issue-search-tools.js

@@ -7,7 +7,7 @@ import { createToolHandler } from "../utils/tool-handler.js";
 export const issuesSearchArgs = {
     query: yqlQuerySchema
         .optional()
-        .describe("Search string for issues (e.g., 'login error'). If not provided or empty, all issues will be returned. You can also use YouTrack Query Language (e.g., 'State: Open', 'Type: Bug')"),
+        .describe("Search string for issues (e.g., 'login error'). If not provided or empty, all issues will be returned. You can use YouTrack Query Language, including {curly braces} to enclose multi-word attribute values (e.g., 'State: {In Progress}', 'tag: {Technical debt}', 'Type: Bug')."),
     limit: z.number().int().positive().max(200).default(50).describe("Max results per page"),
     skip: z.number().int().nonnegative().default(0).describe("Offset for pagination"),
     projects: z.array(yqlIdentifierSchema).optional().describe("Filter by project short names (e.g., ['PROJ', 'TEST'])"),

package/dist/src/tools/issue-tools.js

@@ -118,6 +118,14 @@ const issueChangeStateArgs = {
         .describe("Target state name (e.g., 'In Progress', 'Open', 'Fixed', 'Verified'). Case-insensitive."),
 };
 const issueChangeStateSchema = z.object(issueChangeStateArgs);
+const issueChangeTypeArgs = {
+    issueId: issueIdValidator.describe("Issue code (e.g., BC-9205)"),
+    typeName: z
+        .string()
+        .min(1)
+        .describe("Target Type value, by canonical or localized name (e.g., 'Bug', 'Task', 'Feature', 'Fonctionnalité')."),
+};
+const issueChangeTypeSchema = z.object(issueChangeTypeArgs);
 const issuesCountArgs = {
     projectIds: z.array(yqlIdentifierSchema).optional().describe("Filter by project IDs or short names"),
     createdAfter: dateInputSchema.optional().describe("Filter by creation date (YYYY-MM-DD or timestamp)"),
@@ -407,6 +415,22 @@ export function registerIssueTools(server, client) {
         issueId: payload.issueId,
         stateName: payload.stateName,
     })));
+    server.registerTool("issue_change_type", {
+        description: [
+            "Set the issue Type custom field (e.g., Bug -> Task -> Feature).",
+            "Use cases:",
+            "- Reclassify a misfiled issue (Bug -> Task) from automation.",
+            "- Promote a request to a Feature/Fonctionnalité.",
+            "Parameter examples: see schema descriptions.",
+            "Response fields: issueId, previousType, newType.",
+            "Limitations: accepts the canonical or localized value name; unknown types fail with a descriptive error. Re-fetch via issue_details to verify.",
+        ].join("\n"),
+        inputSchema: issueChangeTypeArgs,
+        annotations: WRITE_IDEMPOTENT_ANNOTATIONS,
+    }, createToolHandler(issueChangeTypeSchema, async (payload) => client.changeIssueType({
+        issueId: payload.issueId,
+        typeName: payload.typeName,
+    })));
     server.registerTool("issues_count", {
         description: [
             "Count issues across one or many projects with date/state/type/assignee filters.",

package/dist/src/types.d.ts

@@ -10,7 +10,9 @@ export declare const YOUTRACK_ENTITY_TYPE: {
     readonly stateField: "StateIssueCustomField";
     readonly stateMachineField: "StateMachineIssueCustomField";
     readonly singleUserField: "SingleUserIssueCustomField";
+    readonly singleEnumField: "SingleEnumIssueCustomField";
     readonly stateBundleElement: "StateBundleElement";
+    readonly enumBundleElement: "EnumBundleElement";
     readonly event: "Event";
 };
 export type YoutrackEntityType = (typeof YOUTRACK_ENTITY_TYPE)[keyof typeof YOUTRACK_ENTITY_TYPE];
@@ -34,6 +36,13 @@ export interface YoutrackConfig {
      * `outputDir` when not provided. Files outside this directory are rejected.
      */
     uploadDir?: string | undefined;
+    /**
+     * Whether command-based fallbacks (link create/delete via `/api/commands`)
+     * apply silently. Silent apply requires the YouTrack "Apply Commands
+     * Silently" permission; accounts without it get HTTP 403. Defaults to false
+     * so link operations work for any account that can run commands.
+     */
+    silentCommands?: boolean | undefined;
 }
 export interface DurationValue {
     minutes?: number | undefined;
@@ -675,6 +684,15 @@ export interface IssueChangeStatePayload {
     newState: string;
     transitionUsed?: string | undefined;
 }
+export interface IssueChangeTypeInput {
+    issueId: string;
+    typeName: string;
+}
+export interface IssueChangeTypePayload {
+    issueId: string;
+    previousType?: string | undefined;
+    newType: string;
+}
 export interface MappedYoutrackActivityItem {
     id: string;
     timestamp: string;

package/dist/src/types.js

@@ -9,7 +9,9 @@ export const YOUTRACK_ENTITY_TYPE = {
     stateField: "StateIssueCustomField",
     stateMachineField: "StateMachineIssueCustomField",
     singleUserField: "SingleUserIssueCustomField",
+    singleEnumField: "SingleEnumIssueCustomField",
     stateBundleElement: "StateBundleElement",
+    enumBundleElement: "EnumBundleElement",
     event: "Event",
 };
 //# sourceMappingURL=types.js.map

package/dist/src/utils/validators.d.ts

@@ -22,9 +22,12 @@ export declare const articleIdSchema: z.ZodString;
  */
 export declare const yqlIdentifierSchema: z.ZodString;
 /**
- * Free-text YQL fragment used as a search query. Forbids `{` and `}` so the
- * value cannot break out of the surrounding `({...})` wrapping or smuggle a
- * literal field-value clause.
+ * Free-text YQL fragment used as a search query. Allows `{` and `}` because
+ * they are valid YQL syntax for multi-word attribute values. Only ASCII
+ * control characters are rejected.
+ *
+ * Callers MUST NOT interpolate this value inside another `{...}` wrapper —
+ * use yqlIdentifierSchema for that.
  */
 export declare const yqlQuerySchema: z.ZodString;
 //# sourceMappingURL=validators.d.ts.map

package/dist/src/utils/validators.js

@@ -44,12 +44,19 @@ export const articleIdSchema = z
     .min(1)
     .regex(internalIdRegex, "Article id must be alphanumeric with . _ -");
 /**
- * Reject `{`, `}` and ASCII control characters (NUL..US, DEL) in YQL inputs.
- * This is the single source of truth for YQL injection defense across query
- * fragments, field values and identifiers.
+ * Reject `{`, `}` and ASCII control characters in values that are interpolated
+ * inside a `{...}` wrapper. Used by yqlIdentifierSchema.
  */
 // eslint-disable-next-line no-control-regex
-const YQL_FORBIDDEN = /[{}\x00-\x1F\x7F]/;
+const YQL_IDENTIFIER_FORBIDDEN = /[{}\x00-\x1F\x7F]/;
+/**
+ * Reject only ASCII control characters in free-text YQL queries. `{` and `}`
+ * are part of the YouTrack Query Language — they enclose attribute values
+ * that contain spaces (e.g. `tag: {Technical debt}`, `State: {In Progress}`).
+ * See: https://www.jetbrains.com/help/youtrack/server/search-and-command-attributes.html
+ */
+// eslint-disable-next-line no-control-regex
+const YQL_QUERY_FORBIDDEN = /[\x00-\x1F\x7F]/;
 /**
  * YQL identifier value used inside `{...}` wrappers (state/type names,
  * project short names, login-like ids). Permits spaces, hyphens, dots and
@@ -59,17 +66,20 @@ const YQL_FORBIDDEN = /[{}\x00-\x1F\x7F]/;
 export const yqlIdentifierSchema = z
     .string()
     .min(1)
-    .refine((value) => !YQL_FORBIDDEN.test(value), {
+    .refine((value) => !YQL_IDENTIFIER_FORBIDDEN.test(value), {
     message: "YQL identifier must not contain { } or control characters",
 });
 /**
- * Free-text YQL fragment used as a search query. Forbids `{` and `}` so the
- * value cannot break out of the surrounding `({...})` wrapping or smuggle a
- * literal field-value clause.
+ * Free-text YQL fragment used as a search query. Allows `{` and `}` because
+ * they are valid YQL syntax for multi-word attribute values. Only ASCII
+ * control characters are rejected.
+ *
+ * Callers MUST NOT interpolate this value inside another `{...}` wrapper —
+ * use yqlIdentifierSchema for that.
  */
 export const yqlQuerySchema = z
     .string()
-    .refine((value) => !YQL_FORBIDDEN.test(value), {
-    message: "Search query must not contain { } or control characters",
+    .refine((value) => !YQL_QUERY_FORBIDDEN.test(value), {
+    message: "Search query must not contain control characters",
 });
 //# sourceMappingURL=validators.js.map

package/dist/src/youtrack-client/links.js

@@ -158,7 +158,10 @@ export function withIssueLinks(Base) {
             const commandBody = {
                 query: commandQuery,
                 issues: [{ idReadable: sourceId }],
-                silent: true,
+                // Silent apply requires the "Apply Commands Silently" permission, which
+                // many accounts lack (HTTP 403). Gated behind config (YOUTRACK_SILENT_COMMANDS),
+                // defaulting to a normal, non-silent apply.
+                silent: this.config.silentCommands ?? false,
             };
             try {
                 await this.http.post("/api/commands", commandBody);
@@ -261,7 +264,8 @@ export function withIssueLinks(Base) {
                 const commandBody = {
                     query: commandQuery,
                     issues: [{ idReadable: input.issueId }],
-                    silent: true,
+                    // See note in addIssueLink: gated behind config, defaults to non-silent.
+                    silent: this.config.silentCommands ?? false,
                 };
                 await this.http.post("/api/commands", commandBody);
                 this.cachedCommandSupport = true;

package/dist/src/youtrack-client/state.d.ts

@@ -1,4 +1,4 @@
-import { type IssueChangeStateInput, type IssueChangeStatePayload, type IssueError, type IssueStatePayload, type YoutrackCustomField } from "../types.js";
+import { type IssueChangeStateInput, type IssueChangeStatePayload, type IssueChangeTypeInput, type IssueChangeTypePayload, type IssueError, type IssueStatePayload, type YoutrackCustomField } from "../types.js";
 import { type Constructor, type YoutrackClientBase } from "./base.js";
 export interface IssueStateMixin {
     getIssueState: (issueId: string) => Promise<IssueStatePayload>;
@@ -8,6 +8,7 @@ export interface IssueStateMixin {
     }>;
     getIssueCustomFields: (issueId: string) => Promise<YoutrackCustomField[]>;
     changeIssueState: (input: IssueChangeStateInput) => Promise<IssueChangeStatePayload>;
+    changeIssueType: (input: IssueChangeTypeInput) => Promise<IssueChangeTypePayload>;
 }
 export declare function withIssueState<TBase extends Constructor<YoutrackClientBase>>(Base: TBase): TBase & Constructor<IssueStateMixin>;
 //# sourceMappingURL=state.d.ts.map

package/dist/src/youtrack-client/state.js

@@ -157,6 +157,53 @@ export function withIssueState(Base) {
                 throw this.normalizeError(error);
             }
         }
+        /**
+         * Set the single-enum "Type" custom field (e.g. Bug -> Task -> Feature).
+         *
+         * Uses the same REST path as the StateIssueCustomField branch of
+         * changeIssueState (POST /api/issues/{id} with a customFields payload).
+         * YouTrack resolves the value by either its canonical name (e.g. "Feature")
+         * or its localized name (e.g. "Fonctionnalité"); unknown names fail with
+         * 400/422 and are surfaced with a descriptive error.
+         */
+        async changeIssueType(input) {
+            const resolvedId = this.resolveIssueId(input.issueId);
+            try {
+                const customFields = await this.getIssueCustomFields(resolvedId);
+                const typeField = customFields.find((field) => field.name === "Type");
+                const previousType = typeField?.value?.presentation ?? typeField?.value?.name ?? undefined;
+                const body = {
+                    customFields: [
+                        {
+                            name: "Type",
+                            $type: YOUTRACK_ENTITY_TYPE.singleEnumField,
+                            value: {
+                                name: input.typeName,
+                                $type: YOUTRACK_ENTITY_TYPE.enumBundleElement,
+                            },
+                        },
+                    ],
+                };
+                try {
+                    await this.http.post(`/api/issues/${encId(resolvedId)}`, body);
+                }
+                catch (error) {
+                    const normalized = this.normalizeError(error);
+                    if (normalized.status === 400 || normalized.status === 422) {
+                        throw new YoutrackClientError(`Failed to set type to '${input.typeName}'. The type may not exist for this project. Original error: ${normalized.message}`, normalized.status, normalized.details);
+                    }
+                    throw normalized;
+                }
+                return {
+                    issueId: resolvedId,
+                    previousType,
+                    newType: input.typeName,
+                };
+            }
+            catch (error) {
+                throw this.normalizeError(error);
+            }
+        }
     };
 }
 //# sourceMappingURL=state.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vitalyostanin/youtrack-mcp",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "postbuild": "chmod +x dist/index.js && cp package.json dist/package.json",