@pan-sec/notebooklm-mcp 2026.3.2 → 2026.4.0

package/dist/gemini/pdf-chunker.js

@@ -22,6 +22,17 @@ export const GEMINI_LIMITS = {
     chunkPages: 500, // Pages per chunk
     chunkSizeBytes: 25 * 1024 * 1024, // 25MB target per chunk
 };
+/**
+ * Hard DoS-protection ceilings. These are distinct from the chunking thresholds
+ * above (which decide *whether* to split a legitimately large file). A file
+ * above these ceilings is REJECTED outright — never read fully into memory or
+ * parsed — because an untrusted PDF (decompression bomb, deeply-nested object
+ * graph, absurd page count) can OOM the process from a single upload.
+ */
+// Reject any file larger than this BEFORE reading it into memory.
+const MAX_ACCEPTED_FILE_SIZE_BYTES = 200 * 1024 * 1024; // 200MB
+// Reject any PDF with more pages than this AFTER load, before walking the graph.
+const MAX_ACCEPTED_PAGES = 10000;
 /**
  * Analyze a PDF to determine if it needs chunking
  */
@@ -29,7 +40,12 @@ export async function analyzePdf(filePath) {
     const stats = await fs.promises.stat(filePath);
     const fileName = path.basename(filePath);
     const fileSize = stats.size;
-    // Check file size first (quick check)
+    // DoS guard: reject absurdly large files BEFORE reading them into memory.
+    if (fileSize > MAX_ACCEPTED_FILE_SIZE_BYTES) {
+        throw new Error(`PDF rejected: file size ${formatBytes(fileSize)} exceeds the hard limit of ${formatBytes(MAX_ACCEPTED_FILE_SIZE_BYTES)}`);
+    }
+    // Files between the chunk threshold and the hard ceiling are legitimately
+    // large and get split into chunks (page count is unknown until read).
     if (fileSize > GEMINI_LIMITS.maxFileSizeBytes) {
         const estimatedChunks = Math.ceil(fileSize / GEMINI_LIMITS.chunkSizeBytes);
         return {
@@ -42,48 +58,48 @@ export async function analyzePdf(filePath) {
             reason: `File size ${formatBytes(fileSize)} exceeds 50MB limit`,
         };
     }
-    // Read PDF to get page count
+    // Read PDF to get page count. Do NOT ignore encryption: refuse to decrypt
+    // hostile input. PDFDocument.load throws on encrypted documents when
+    // ignoreEncryption is false, which we treat as a fail-closed rejection below.
+    let pdfDoc;
     try {
         const pdfBytes = await fs.promises.readFile(filePath);
-        const pdfDoc = await PDFDocument.load(pdfBytes, {
-            ignoreEncryption: true,
+        pdfDoc = await PDFDocument.load(pdfBytes, {
+            ignoreEncryption: false,
         });
-        const pageCount = pdfDoc.getPageCount();
-        if (pageCount > GEMINI_LIMITS.maxPages) {
-            const estimatedChunks = Math.ceil(pageCount / GEMINI_LIMITS.chunkPages);
-            return {
-                filePath,
-                fileName,
-                fileSize,
-                pageCount,
-                needsChunking: true,
-                estimatedChunks,
-                reason: `Page count ${pageCount} exceeds 1000 page limit`,
-            };
-        }
-        return {
-            filePath,
-            fileName,
-            fileSize,
-            pageCount,
-            needsChunking: false,
-            estimatedChunks: 1,
-        };
     }
     catch (error) {
-        // If we can't read the PDF, assume it doesn't need chunking
-        // and let Gemini handle the error
-        log.warning(`Could not analyze PDF ${fileName}: ${error}`);
+        // FAIL CLOSED: an unparseable/encrypted/malformed PDF is rejected rather
+        // than passed downstream for Gemini to "handle".
+        const msg = error instanceof Error ? error.message : String(error);
+        log.warning(`Rejecting PDF ${fileName}: could not parse (it may be encrypted or malformed): ${msg}`);
+        throw new Error(`PDF rejected: could not parse (it may be encrypted or malformed): ${msg}`);
+    }
+    const pageCount = pdfDoc.getPageCount();
+    // DoS guard: reject PDFs with an absurd page count.
+    if (pageCount > MAX_ACCEPTED_PAGES) {
+        throw new Error(`PDF rejected: page count ${pageCount} exceeds the hard limit of ${MAX_ACCEPTED_PAGES}`);
+    }
+    if (pageCount > GEMINI_LIMITS.maxPages) {
+        const estimatedChunks = Math.ceil(pageCount / GEMINI_LIMITS.chunkPages);
         return {
             filePath,
             fileName,
             fileSize,
-            pageCount: -1,
-            needsChunking: false,
-            estimatedChunks: 1,
-            reason: `Could not analyze: ${error}`,
+            pageCount,
+            needsChunking: true,
+            estimatedChunks,
+            reason: `Page count ${pageCount} exceeds 1000 page limit`,
         };
     }
+    return {
+        filePath,
+        fileName,
+        fileSize,
+        pageCount,
+        needsChunking: false,
+        estimatedChunks: 1,
+    };
 }
 /**
  * Split a PDF into chunks
@@ -93,12 +109,22 @@ export async function chunkPdf(filePath) {
     const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "pdf-chunks-"));
     try {
         log.info(`Chunking PDF: ${filePath}`);
-        // Read the original PDF
+        // DoS guard: reject absurdly large files BEFORE reading into memory.
+        const stats = await fs.promises.stat(filePath);
+        if (stats.size > MAX_ACCEPTED_FILE_SIZE_BYTES) {
+            throw new Error(`PDF rejected: file size ${formatBytes(stats.size)} exceeds the hard limit of ${formatBytes(MAX_ACCEPTED_FILE_SIZE_BYTES)}`);
+        }
+        // Read the original PDF. Do NOT ignore encryption: refuse to decrypt
+        // hostile input (load throws on encrypted PDFs when ignoreEncryption=false).
         const pdfBytes = await fs.promises.readFile(filePath);
         const pdfDoc = await PDFDocument.load(pdfBytes, {
-            ignoreEncryption: true,
+            ignoreEncryption: false,
         });
         const totalPages = pdfDoc.getPageCount();
+        // DoS guard: reject PDFs with an absurd page count before walking the graph.
+        if (totalPages > MAX_ACCEPTED_PAGES) {
+            throw new Error(`PDF rejected: page count ${totalPages} exceeds the hard limit of ${MAX_ACCEPTED_PAGES}`);
+        }
         log.info(`PDF has ${totalPages} pages, splitting into chunks...`);
         const chunks = [];
         let currentPage = 0;
@@ -194,4 +220,3 @@ function formatBytes(bytes) {
         return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
     return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
 }
-//# sourceMappingURL=pdf-chunker.js.map

package/dist/gemini/types.d.ts

@@ -264,4 +264,3 @@ export interface ListDocumentsResult {
     /** Next page token (if more results) */
     nextPageToken?: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/gemini/types.js

@@ -7,4 +7,3 @@
  * Deep Research agent ID
  */
 export const DEEP_RESEARCH_AGENT = "deep-research-pro-preview-12-2025";
-//# sourceMappingURL=types.js.map

package/dist/index.d.ts

@@ -80,4 +80,3 @@ export declare class NotebookLMMCPServer {
  * Main entry point
  */
 export declare function main(): Promise<void>;
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -33,6 +33,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { createRequire } from "module";
 import crypto from "node:crypto";
+import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { AuthManager } from "./auth/auth-manager.js";
 import { SessionManager } from "./session/session-manager.js";
@@ -557,8 +558,10 @@ export class NotebookLMMCPServer {
         try {
             const breachDetector = getBreachDetector();
             getAuditLogger().onEvent(async (event) => {
-                if (event.eventType !== "auth" && event.eventType !== "security")
-                    return;
+                // Forward ALL event types to checkEvent; it filters by event_pattern.
+                // A pre-filter on eventType dropped non-auth rules (secrets_detected in
+                // tool output, prompt_injection, data_export, encryption_error) before
+                // pattern matching, leaving those critical/high rules dead (M20).
                 try {
                     await breachDetector.checkEvent(event.eventName, event.details);
                 }
@@ -574,11 +577,63 @@ export class NotebookLMMCPServer {
         // Pipe audit events to SIEM when enabled (I247). exportToSIEM is a no-op
         // when NLMCP_SIEM_ENABLED is not true.
         try {
+            // Event types whose SUCCESSFUL operations must still reach the SIEM so the
+            // tamper-evident external copy is complete (M21). Without flooring these to
+            // at least "warning", successful grant_consent / request_data_erasure /
+            // submit_dsar / config / retention events would map to "info" and be dropped
+            // by the default min_severity ("warning").
+            const SIEM_FLOOR_TYPES = new Set(["compliance", "data_access", "configuration", "retention"]);
+            // SIEM export crosses the local-only boundary asserted by the privacy notice
+            // ("Local device only"). audit-logger only sanitizes by KEY name, so free-text
+            // VALUES (and args_summary content) would egress raw PII to the external SIEM
+            // endpoint (L52). Value-scrub here before forwarding: drop known free-text PII
+            // fields to a short content hash + length marker, and truncate other long
+            // free-text values, so raw PII does not leave the host.
+            const SIEM_FREE_TEXT_PII_FIELDS = new Set([
+                "description", "reason", "details", "title", "question", "answer", "args_summary",
+            ]);
+            const SIEM_MAX_VALUE_LEN = 120;
+            const scrubValueForSIEM = (key, value) => {
+                if (typeof value === "string") {
+                    if (SIEM_FREE_TEXT_PII_FIELDS.has(key.toLowerCase())) {
+                        const digest = crypto.createHash("sha256").update(value).digest("hex").slice(0, 12);
+                        return `[scrubbed sha256:${digest} len:${value.length}]`;
+                    }
+                    if (value.length > SIEM_MAX_VALUE_LEN) {
+                        return `${value.slice(0, SIEM_MAX_VALUE_LEN)}…[truncated len:${value.length}]`;
+                    }
+                    return value;
+                }
+                if (Array.isArray(value)) {
+                    return value.map((item) => scrubValueForSIEM(key, item));
+                }
+                if (value !== null && typeof value === "object") {
+                    return scrubDetailsForSIEM(value);
+                }
+                return value;
+            };
+            const scrubDetailsForSIEM = (details) => {
+                const scrubbed = {};
+                for (const [key, value] of Object.entries(details)) {
+                    scrubbed[key] = scrubValueForSIEM(key, value);
+                }
+                return scrubbed;
+            };
             getAuditLogger().onEvent(async (event) => {
-                const severity = event.eventType === "security" && typeof event.details.severity === "string"
-                    ? event.details.severity
-                    : event.success ? "info" : "error";
-                await exportToSIEM(event.eventType, event.eventName, severity, `${event.eventType}:${event.eventName}`, "audit-logger", event.details);
+                let severity;
+                if (event.eventType === "security" && typeof event.details.severity === "string") {
+                    severity = event.details.severity;
+                }
+                else if (!event.success) {
+                    severity = "error";
+                }
+                else if (SIEM_FLOOR_TYPES.has(event.eventType)) {
+                    severity = "warning";
+                }
+                else {
+                    severity = "info";
+                }
+                await exportToSIEM(event.eventType, event.eventName, severity, `${event.eventType}:${event.eventName}`, "audit-logger", scrubDetailsForSIEM(event.details));
             });
             log.info("📡 SIEM audit export bridge registered");
         }
@@ -713,10 +768,19 @@ export async function main() {
         process.exit(1);
     }
 }
-const isDirectRun = process.argv[1]
-    ? import.meta.url === pathToFileURL(process.argv[1]).href
-    : false;
+const isDirectRun = (() => {
+    if (!process.argv[1])
+        return false;
+    try {
+        return import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
+    }
+    catch {
+        return false;
+    }
+})();
 if (isDirectRun) {
     void main();
 }
-//# sourceMappingURL=index.js.map
+else if (process.argv[1] && process.env.NLMCP_DEBUG) {
+    log.debug(`entry-point guard: argv[1]=${process.argv[1]} did not resolve to ${import.meta.url} — main() skipped`);
+}

package/dist/library/notebook-library.d.ts

@@ -14,6 +14,8 @@ export declare class NotebookLibrary {
     private projectInfo;
     private useProjectLibrary;
     private saveTimer;
+    /** Pending use-count deltas keyed by notebook id, flushed by the debounced save. (M25) */
+    private pendingUseCounts;
     constructor(options?: {
         projectId?: string;
         useProjectLibrary?: boolean;
@@ -47,7 +49,24 @@ export declare class NotebookLibrary {
      */
     private saveLibrary;
     /**
-     * Generate a unique ID from a string (slug format)
+     * Read the library file from disk without mutating in-memory state.
+     * Used inside the lock to pick up changes made by concurrent sessions. (M25)
+     */
+    private readLibraryFromDisk;
+    /**
+     * Atomically apply a read-modify-write to the library file.
+     *
+     * Holds a cross-process lock, reloads the latest library from disk (so a
+     * concurrent session's notebooks aren't clobbered), applies `mutate` to a
+     * deep copy, persists it, and only then commits it to this.library. If the
+     * write throws, this.library is left untouched. (M25)
+     */
+    private mutateLibrary;
+    /**
+     * Generate a unique ID from a string (slug format).
+     * Uniqueness is checked against the supplied library (defaults to the
+     * in-memory one) so callers inside mutateLibrary can de-dupe against the
+     * freshly-reloaded disk state. (M25)
      */
     private generateId;
     /**
@@ -86,6 +105,16 @@ export declare class NotebookLibrary {
      * Debounced save — avoids writing to disk on every single query
      */
     private debouncedSave;
+    /**
+     * Synchronously flush any pending debounced use-count updates to disk under
+     * the cross-process lock, re-applying the accumulated deltas to the latest
+     * on-disk library so concurrent sessions' notebooks and counts survive. (M25)
+     */
+    flushSave(): void;
+    /**
+     * Release resources: flush pending writes and detach shutdown handlers. (M25)
+     */
+    close(): void;
     /**
      * Get library statistics
      */
@@ -95,4 +124,3 @@ export declare class NotebookLibrary {
      */
     searchNotebooks(query: string): NotebookEntry[];
 }
-//# sourceMappingURL=notebook-library.d.ts.map