aiquila-mcp 0.3.31 → 0.3.32

package/dist/client/caldav.js

@@ -27,6 +27,20 @@ export function decodeXmlEntities(text) {
         // `
` rather than being decoded twice into a carriage return.
         .replace(/&/g, '&'));
 }
+/**
+ * Encode text for interpolation into an XML request body.
+ * Counterpart to decodeXmlEntities — used when building CalDAV/CardDAV REPORT
+ * filters from user-supplied values (GH #402).
+ */
+export function encodeXmlEntities(text) {
+    return (text
+        // `&` first, otherwise the ampersands introduced below get re-encoded.
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;'));
+}
 /**
  * Fetch data from CalDAV endpoint using basic authentication
  */

package/dist/tools/apps/aiquila.js

@@ -72,7 +72,7 @@ export const configureTool = {
         model: z
             .string()
             .optional()
-            .describe("Claude model to use (e.g., 'claude-fable-5', 'claude-opus-4-8', 'claude-sonnet-4-6')"),
+            .describe("Claude model to use (e.g., 'claude-fable-5', 'claude-opus-5', 'claude-sonnet-5')"),
         maxTokens: z.number().optional().describe('Maximum tokens for responses (default: 4096)'),
         timeout: z.number().optional().describe('Request timeout in seconds (default: 60)'),
     }),

package/dist/tools/apps/calendar.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 import { z } from 'zod';
-import { decodeXmlEntities, fetchCalDAV, nsTagContent } from '../../client/caldav.js';
+import { decodeXmlEntities, encodeXmlEntities, fetchCalDAV, nsTagContent, } from '../../client/caldav.js';
 import { escapeICalValue, unescapeICalValue } from '../dav-utils.js';
 import { getNextcloudConfig } from '../types.js';
 // ---------------------------------------------------------------------------
@@ -579,7 +579,7 @@ async function resolveEventByUid(calendarName, uid) {
     <c:comp-filter name="VCALENDAR">
       <c:comp-filter name="VEVENT">
         <c:prop-filter name="UID">
-          <c:text-match collation="i;octet">${uid}</c:text-match>
+          <c:text-match collation="i;octet">${encodeXmlEntities(uid)}</c:text-match>
         </c:prop-filter>
       </c:comp-filter>
     </c:comp-filter>

package/dist/tools/apps/contacts.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 import { z } from 'zod';
-import { decodeXmlEntities, fetchCalDAV, nsTagContent } from '../../client/caldav.js';
+import { decodeXmlEntities, encodeXmlEntities, fetchCalDAV, nsTagContent, } from '../../client/caldav.js';
 import { escapeVCardValue, sanitizeVCardUriValue, unescapeVCardValue } from '../dav-utils.js';
 import { getParamValues, getProperty, parseVCard, property, replaceAll, serializeVCard, setProperty, } from '../vcard.js';
 import { getNextcloudConfig } from '../types.js';
@@ -272,7 +272,7 @@ async function resolveContactByUid(addressBookName, uid) {
   </d:prop>
   <cr:filter>
     <cr:prop-filter name="UID">
-      <cr:text-match collation="i;octet">${uid}</cr:text-match>
+      <cr:text-match collation="i;octet">${encodeXmlEntities(uid)}</cr:text-match>
     </cr:prop-filter>
   </cr:filter>
 </cr:addressbook-query>`;
@@ -408,7 +408,7 @@ export const listContactsTool = {
                 filterXml = `
   <cr:filter>
     <cr:prop-filter name="FN">
-      <cr:text-match collation="i;unicode-casemap" match-type="contains">${args.search}</cr:text-match>
+      <cr:text-match collation="i;unicode-casemap" match-type="contains">${encodeXmlEntities(args.search)}</cr:text-match>
     </cr:prop-filter>
   </cr:filter>`;
             }

package/dist/tools/apps/tasks.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 import { z } from 'zod';
-import { decodeXmlEntities, fetchCalDAV, nsTagContent } from '../../client/caldav.js';
+import { decodeXmlEntities, encodeXmlEntities, fetchCalDAV, nsTagContent, } from '../../client/caldav.js';
 import { escapeICalValue } from '../dav-utils.js';
 import { getNextcloudConfig } from '../types.js';
 // ---------------------------------------------------------------------------
@@ -240,7 +240,7 @@ async function resolveTaskByUid(calendarName, uid) {
     <c:comp-filter name="VCALENDAR">
       <c:comp-filter name="VTODO">
         <c:prop-filter name="UID">
-          <c:text-match collation="i;octet">${uid}</c:text-match>
+          <c:text-match collation="i;octet">${encodeXmlEntities(uid)}</c:text-match>
         </c:prop-filter>
       </c:comp-filter>
     </c:comp-filter>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiquila-mcp",
-  "version": "0.3.31",
+  "version": "0.3.32",
   "description": "Nextcloud MCP server — files, calendar, contacts, mail, maps, notes, tasks & 120+ more tools",
   "type": "module",
   "main": "dist/index.js",