clokio-mcp 0.1.1 → 0.1.2

package/dist/client.js

@@ -30,7 +30,16 @@ export function loadConfig() {
  * but passing them through is harmless.
  */
 export function seg(value) {
-    return encodeURIComponent(String(value));
+    const s = String(value);
+    // encodeURIComponent leaves `.` alone, so a bare `.` or `..` would survive
+    // as a real dot-segment and be normalised away by new URL(). The prefix
+    // guard in request() already catches the escape; refusing here keeps the
+    // error at the argument that caused it, and an empty segment would silently
+    // collapse `/a//b` into `/a/b` and hit a neighbouring route.
+    if (s === '' || s === '.' || s === '..') {
+        throw new ClokioApiError(0, `Invalid path argument ${JSON.stringify(s)}.`);
+    }
+    return encodeURIComponent(s);
 }
 /** A Clokio API error, carrying the HTTP status and the server's message. */
 export class ClokioApiError extends Error {
@@ -88,7 +97,12 @@ export async function request(config, path, options = {}) {
     }
     let res;
     try {
-        res = await fetch(url, { method, headers, body: payload });
+        // redirect: 'error' - Node's fetch follows redirects and RESENDS the
+        // request headers, including X-API-Key, to wherever Location points, on
+        // any origin. The API never redirects an /api/v1 call, so a redirect here
+        // means something between us and it is not the API, and the key must not
+        // be handed over. Failing closed costs nothing on the happy path.
+        res = await fetch(url, { method, headers, body: payload, redirect: 'error' });
     }
     catch (e) {
         throw new ClokioApiError(0, `Network error reaching Clokio: ${e.message}`);

package/dist/index.js

@@ -10,6 +10,7 @@
  * Or register with: claude mcp add clokio -- npx -y clokio-mcp
  * (set CLOKIO_API_KEY, and optionally CLOKIO_BASE_URL, in the MCP env).
  */
+import { createRequire } from 'node:module';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { loadConfig } from './client.js';
@@ -17,11 +18,14 @@ import { registerTaskTools } from './tools/tasks.js';
 import { registerProjectTools } from './tools/projects.js';
 import { registerEmployeeTools } from './tools/employees.js';
 import { registerAttendanceTools } from './tools/attendance.js';
+// The version the MCP handshake announces is package.json's, read at runtime -
+// a literal here went stale on the first patch release (0.1.1 said 0.1.0).
+const { version } = createRequire(import.meta.url)('../package.json');
 async function main() {
     const config = loadConfig();
     const server = new McpServer({
         name: 'clokio-mcp',
-        version: '0.1.0',
+        version,
     });
     registerTaskTools(server, config);
     registerProjectTools(server, config);

package/dist/tools/helpers.js

@@ -16,7 +16,13 @@ export function registerTool(server, config, def) {
                 content: [
                     {
                         type: 'text',
-                        text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                        // A 204 (delete) has no body, so request() resolves undefined and
+                        // JSON.stringify(undefined) is undefined - not a valid text block.
+                        text: result === undefined
+                            ? 'OK (no content)'
+                            : typeof result === 'string'
+                                ? result
+                                : JSON.stringify(result, null, 2),
                     },
                 ],
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clokio-mcp",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Model Context Protocol (MCP) server for Clokio — manage tasks, projects, clients, employees and attendance from Claude and any MCP client.",
   "type": "module",
   "bin": {