mcp-jira-stdio 1.12.0 → 1.12.1

package/dist/index.js

@@ -440,7 +440,7 @@ var require_package2 = __commonJS({
   "package.json"(exports$1, module) {
     module.exports = {
       name: "mcp-jira-stdio",
-      version: "1.12.0",
+      version: "1.12.1",
       mcpName: "io.github.freema/mcp-jira-stdio",
       description: "Model Context Protocol (MCP) server for Jira API integration",
       author: "graslt",
@@ -546,6 +546,8 @@ var JIRA_CONFIG = {
 var ERROR_MESSAGES = {
   AUTH_REQUIRED: "Jira authentication required. Set JIRA_BASE_URL, JIRA_EMAIL, and JIRA_API_TOKEN environment variables.",
   INVALID_CREDENTIALS: "Invalid Jira credentials. Please check your email and API token.",
+  PROJECT_NOT_FOUND: "Project not found or you don't have permission to access it.",
+  ISSUE_NOT_FOUND: "Issue not found or you don't have permission to access it.",
   RATE_LIMIT_EXCEEDED: "Jira API rate limit exceeded. Please wait and try again.",
   NETWORK_ERROR: "Network error occurred while connecting to Jira.",
   VALIDATION_ERROR: "Input validation failed."
@@ -597,23 +599,75 @@ function getLevel() {
     return env;
   return "info";
 }
+var REDACTED = "[REDACTED]";
+var SECRET_KEYS = /^(auth|authorization|proxy-authorization|password|apitoken|api_token|token|cookie|set-cookie)$/i;
+function describeError(err) {
+  const e = err;
+  const out = {
+    name: e?.name ?? "Error",
+    message: e?.message ?? String(err)
+  };
+  if (e?.code) out.code = e.code;
+  const status = e?.response?.status ?? e?.status;
+  if (status) out.status = status;
+  const config = e?.config;
+  if (config?.method) out.method = String(config.method).toUpperCase();
+  if (config?.url) out.url = `${config.baseURL ?? ""}${config.url}`;
+  const data = e?.response?.data;
+  if (Array.isArray(data?.errorMessages) && data.errorMessages.length > 0) {
+    out.errorMessages = data.errorMessages;
+  }
+  if (data?.errors && typeof data.errors === "object" && Object.keys(data.errors).length > 0) {
+    out.errors = data.errors;
+  }
+  return out;
+}
+function redactDeep(value, seen, depth) {
+  if (value instanceof Error) return describeError(value);
+  if (value === null || typeof value !== "object") return value;
+  if (seen.has(value) || depth > 8) return "[Circular]";
+  seen.add(value);
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, seen, depth + 1));
+  const out = {};
+  for (const [key, v] of Object.entries(value)) {
+    out[key] = SECRET_KEYS.test(key) ? REDACTED : redactDeep(v, seen, depth + 1);
+  }
+  return out;
+}
+function scrubSecrets(text) {
+  let out = text.replace(/(\/\/)[^/@\s]+@/g, `$1${REDACTED}@`).replace(/\b(Basic|Bearer)\s+[A-Za-z0-9+/=._~-]{16,}/g, `$1 ${REDACTED}`);
+  const token = process.env.JIRA_API_TOKEN;
+  if (token && token.length >= 8) {
+    out = out.split(token).join(REDACTED);
+  }
+  return out;
+}
+function formatLogArg(arg) {
+  if (typeof arg === "string") return scrubSecrets(arg);
+  let text;
+  try {
+    text = JSON.stringify(redactDeep(arg, /* @__PURE__ */ new WeakSet(), 0)) ?? String(arg);
+  } catch {
+    text = String(arg);
+  }
+  return scrubSecrets(text);
+}
 function createLogger(scope) {
   const level = getLevel();
   const min = levels[level];
-  const fmt = (msg) => typeof msg === "string" ? msg : JSON.stringify(msg);
   const prefix = (lvl) => `[${lvl.toUpperCase()}] ${scope}:`;
   return {
     debug: (...args) => {
-      if (min <= levels.debug) console.error(prefix("debug"), ...args.map(fmt));
+      if (min <= levels.debug) console.error(prefix("debug"), ...args.map(formatLogArg));
     },
     info: (...args) => {
-      if (min <= levels.info) console.error(prefix("info"), ...args.map(fmt));
+      if (min <= levels.info) console.error(prefix("info"), ...args.map(formatLogArg));
     },
     warn: (...args) => {
-      if (min <= levels.warn) console.error(prefix("warn"), ...args.map(fmt));
+      if (min <= levels.warn) console.error(prefix("warn"), ...args.map(formatLogArg));
     },
     error: (...args) => {
-      if (min <= levels.error) console.error(prefix("error"), ...args.map(fmt));
+      if (min <= levels.error) console.error(prefix("error"), ...args.map(formatLogArg));
     }
   };
 }
@@ -934,7 +988,7 @@ var GetProjectInfoInputSchema = z.object({
   expand: z.array(z.string()).optional().describe("Additional project details to include")
 });
 var CreateSubtaskInputSchema = z.object({
-  parentIssueKey: z.string().describe("Parent issue key"),
+  parentIssueKey: z.string().describe("Parent issue key").refine((v) => isValidIssueKey(v), "Invalid issue key format"),
   summary: z.string().min(1).describe("Subtask summary/title"),
   description: z.union([z.string(), z.any()]).optional().describe("Subtask description. Accepts plain text or ADF object."),
   priority: z.string().optional().describe("Subtask priority"),
@@ -990,7 +1044,7 @@ var GetAttachmentsInputSchema = z.object({
   issueKey: z.string().describe("Issue key to get attachments for (e.g., PROJECT-123)").refine((v) => isValidIssueKey(v), "Invalid issue key format")
 });
 var DeleteAttachmentInputSchema = z.object({
-  attachmentId: z.string().min(1).describe("ID of the attachment to delete")
+  attachmentId: z.string().regex(/^\d+$/, "Attachment ID must be numeric").describe("ID of the attachment to delete")
 });
 var GetTransitionsInputSchema = z.object({
   issueKey: z.string().describe("Issue key to get available transitions for (e.g., PROJECT-123)").refine((v) => isValidIssueKey(v), "Invalid issue key format")
@@ -1023,6 +1077,12 @@ var GetIssueGraphInputSchema = z.object({
   ),
   direction: z.enum(["all", "inward", "outward"]).default("all").describe('Which link directions to follow: "all", "inward", or "outward" (default: "all")')
 });
+function pathSegment(value) {
+  if (typeof value !== "string" || value === "" || value === "." || value === "..") {
+    throw new Error(`Invalid identifier: ${JSON.stringify(value)}`);
+  }
+  return encodeURIComponent(value);
+}
 function ensureAdfDescription(desc, format = "markdown") {
   if (!desc) return desc;
   if (typeof desc === "object") return desc;
@@ -1198,7 +1258,7 @@ async function getIssue(issueKey, options = {}) {
   }
   const config = {
     method: "GET",
-    url: `/issue/${issueKey}`,
+    url: `/issue/${pathSegment(issueKey)}`,
     params
   };
   return await makeJiraRequest(config);
@@ -1296,7 +1356,7 @@ async function updateIssue(issueKey, updates) {
   }
   const config = {
     method: "PUT",
-    url: `/issue/${issueKey}`,
+    url: `/issue/${pathSegment(issueKey)}`,
     data: { fields }
   };
   await makeJiraRequest(config);
@@ -1315,7 +1375,7 @@ async function getMyIssues(options = {}) {
 async function getIssueTypes(projectKey) {
   let url = "/issuetype";
   if (projectKey) {
-    url = `/project/${projectKey}/issuetype`;
+    url = `/project/${pathSegment(projectKey)}/issuetype`;
   }
   const config = {
     method: "GET",
@@ -1357,9 +1417,9 @@ async function getPriorities() {
 async function getStatuses(options = {}) {
   let url = "/status";
   if (options.projectKey && options.issueTypeId) {
-    url = `/project/${options.projectKey}/statuses`;
+    url = `/project/${pathSegment(options.projectKey)}/statuses`;
   } else if (options.projectKey) {
-    url = `/project/${options.projectKey}/statuses`;
+    url = `/project/${pathSegment(options.projectKey)}/statuses`;
   }
   const config = {
     method: "GET",
@@ -1387,7 +1447,7 @@ async function addComment(issueKey, body, visibility, format) {
   }
   const config = {
     method: "POST",
-    url: `/issue/${issueKey}/comment`,
+    url: `/issue/${pathSegment(issueKey)}/comment`,
     data
   };
   return await makeJiraRequest(config);
@@ -1405,7 +1465,7 @@ async function getComments(issueKey, options = {}) {
   }
   const config = {
     method: "GET",
-    url: `/issue/${issueKey}/comment`,
+    url: `/issue/${pathSegment(issueKey)}/comment`,
     params
   };
   return await makeJiraRequest(config);
@@ -1417,7 +1477,7 @@ async function getProjectDetails(projectKey, expand) {
   }
   const config = {
     method: "GET",
-    url: `/project/${projectKey}`,
+    url: `/project/${pathSegment(projectKey)}`,
     params
   };
   return await makeJiraRequest(config);
@@ -1533,7 +1593,10 @@ async function addAttachment(issueKey, filename, content, isBase64 = true) {
     filename,
     contentType: "application/octet-stream"
   });
-  return await makeMultipartRequest(`/issue/${issueKey}/attachments`, formData);
+  return await makeMultipartRequest(
+    `/issue/${pathSegment(issueKey)}/attachments`,
+    formData
+  );
 }
 async function addAttachmentFromUrl(issueKey, fileUrl, filename) {
   const axios2 = (await import('axios')).default;
@@ -1564,7 +1627,10 @@ async function addAttachmentFromUrl(issueKey, fileUrl, filename) {
     filename,
     contentType: typeof response.headers["content-type"] === "string" ? response.headers["content-type"] : "application/octet-stream"
   });
-  return await makeMultipartRequest(`/issue/${issueKey}/attachments`, formData);
+  return await makeMultipartRequest(
+    `/issue/${pathSegment(issueKey)}/attachments`,
+    formData
+  );
 }
 async function getAttachments(issueKey) {
   const issue = await getIssue(issueKey, { fields: ["attachment"] });
@@ -1574,14 +1640,14 @@ async function getAttachments(issueKey) {
 async function deleteAttachment(attachmentId) {
   const config = {
     method: "DELETE",
-    url: `/attachment/${attachmentId}`
+    url: `/attachment/${pathSegment(attachmentId)}`
   };
   await makeJiraRequest(config);
 }
 async function getTransitions(issueKey) {
   const config = {
     method: "GET",
-    url: `/issue/${issueKey}/transitions`
+    url: `/issue/${pathSegment(issueKey)}/transitions`
   };
   const response = await makeJiraRequest(config);
   return response.transitions;
@@ -1609,7 +1675,7 @@ async function transitionIssue(issueKey, transitionId, options = {}) {
   }
   const config = {
     method: "POST",
-    url: `/issue/${issueKey}/transitions`,
+    url: `/issue/${pathSegment(issueKey)}/transitions`,
     data
   };
   await makeJiraRequest(config);
@@ -2266,6 +2332,10 @@ async function handleGetIssue(input) {
     const validated = validateInput(GetIssueInputSchema, input);
     const trimmedInput = (validated.issueKey || "").trim();
     const key = extractIssueKey(trimmedInput) || trimmedInput;
+    if (!/^[A-Za-z][A-Za-z0-9_]*-\d+$/.test(key) && !/^\d+$/.test(key)) {
+      throw new Error(`${ERROR_MESSAGES.VALIDATION_ERROR}
+issueKey: Invalid issue key format`);
+    }
     log4.info(`Getting issue ${key}...`);
     const getParams = {};
     if (validated.expand !== void 0) getParams.expand = validated.expand;