@pecot/visual-mcp 1.0.0 → 1.1.0

package/cli/dist/infra/slidev-to-pptx/pipeline.js

@@ -22,7 +22,7 @@ import { readSlidesTitle } from './dom-converter.js';
 import { buildOnlySteps, scanSlideSteps } from './scanner.js';
 import { DEPENDENCY_RECOVERY_HINT, resolveDependency } from '../_shared/dependency-root.js';
 import { chromiumLaunchError } from '../playwright/launch.js';
-import { resolveBoundPort, startServer } from './server.js';
+import { LOOPBACK_HOST, resolveBoundPort, startServer } from './server.js';
 import { runWithConcurrency } from './concurrency.js';
 import { convertStepsSinglePass, removeStepArtifacts } from './single-pass-worker.js';
 import { convertSingleSlideWithRetry } from './slide-worker.js';
@@ -354,7 +354,7 @@ export async function convertToPptx(config, deps = {}) {
     // baseUrl は、要求ポートでなく実際に bind されたポートで組む。
     // port=0 (ephemeral、既定) では OS が空きポートを採番する。
     // そのため、並行する別プロセスの convert と衝突しない。
-    const baseUrl = `http://localhost:${resolveBoundPort(server, port).toString()}`;
+    const baseUrl = `http://${LOOPBACK_HOST}:${resolveBoundPort(server, port).toString()}`;
     logger.info(`HTTPサーバー起動: ${baseUrl}`);
     let browser;
     try {

package/cli/dist/infra/slidev-to-pptx/server.d.ts

@@ -1,10 +1,11 @@
 import { type Server } from 'node:http';
+export declare const LOOPBACK_HOST = "127.0.0.1";
 /**
 dist 配信サーバが実際に bind したポートを解決する。
 listen 後の `address()` が AddressInfo を返せば、その port を使う。
 返さない場合 (address() が null / パイプ名を返す stub 等) は、要求ポートへフォールバックする。
 要求ポートが 0 (ephemeral) のまま実ポートを取れないときは throw する。
-`http://localhost:0` という到達不能な baseUrl を組ませないため。
+`http://127.0.0.1:0` という到達不能な baseUrl を組ませないため。
 */
 export declare function resolveBoundPort(server: Server, fallbackPort: number): number;
 /**

package/cli/dist/infra/slidev-to-pptx/server.js

@@ -3,15 +3,16 @@
 /* eslint-disable security/detect-non-literal-fs-filename */
 import { createServer } from 'node:http';
 import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, resolve as resolvePath, sep } from 'node:path';
 import * as mimeTypes from 'mime-types';
 const lookup = mimeTypes.lookup.bind(mimeTypes);
+export const LOOPBACK_HOST = '127.0.0.1';
 /**
 dist 配信サーバが実際に bind したポートを解決する。
 listen 後の `address()` が AddressInfo を返せば、その port を使う。
 返さない場合 (address() が null / パイプ名を返す stub 等) は、要求ポートへフォールバックする。
 要求ポートが 0 (ephemeral) のまま実ポートを取れないときは throw する。
-`http://localhost:0` という到達不能な baseUrl を組ませないため。
+`http://127.0.0.1:0` という到達不能な baseUrl を組ませないため。
 */
 // eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types -- Server は mutable 型
 export function resolveBoundPort(server, fallbackPort) {
@@ -35,7 +36,14 @@ export function startServer(distDir, port) {
             void (async () => {
                 const urlPath = (request.url ?? '/').split('?', 1)[0];
                 const safePath = urlPath ?? '/';
-                const filePath = join(distDir, safePath === '/' ? 'index.html' : safePath);
+                const root = resolvePath(distDir);
+                const filePath = resolvePath(root, '.' + (safePath === '/' ? '/index.html' : safePath));
+                // `..` を含む要求で dist の外を読ませない。dist 自身に正規化される要求 (`/.`・`//` など) も、この判定で 404 にする
+                if (!filePath.startsWith(root + sep)) {
+                    res.writeHead(404);
+                    res.end('Not found');
+                    return;
+                }
                 try {
                     const content = await readFile(filePath);
                     const contentType = lookup(filePath) || 'application/octet-stream';
@@ -66,7 +74,8 @@ export function startServer(distDir, port) {
         // リスナーは dom-to-pptx の Emscripten ランタイムが登録する。
         // すると Promise は永遠に pending のままになり、CLI が無限ハングする。
         server.once('error', reject);
-        server.listen(port, () => {
+        // ループバックだけで待ち受け、同じネットワークの他の端末から届かないようにする
+        server.listen(port, LOOPBACK_HOST, () => {
             // listen 成功後は Promise が settled 済みで reject が無効になる。
             // そのため reject リスナーを外し、stderr 出力へ差し替える。
             // 以後のサーバエラー (配信中の socket error 等) は通知なしで捨てず、変換ログから観測できるようにする。

package/cli/dist/infra/slidev-to-pptx/single-pass-worker.d.ts

@@ -38,7 +38,7 @@ export declare function otherContainersHiddenCss(containerIds: readonly string[]
 export interface SinglePassRequest {
     readonly browser: Browser;
     /**
-    dist 配信サーバの origin（`http://localhost:<port>`）
+    dist 配信サーバの origin（`http://127.0.0.1:<port>`）
     */
     readonly baseUrl: string;
     /**

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@pecot/visual-mcp",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@pecot/visual-mcp",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "license": "MIT",
       "dependencies": {
         "@cffnpwr/textlint-plugin-comments": "1.0.0",
@@ -18,7 +18,7 @@
         "@textlint/textlint-plugin-markdown": "^15.8.0",
         "@xmldom/xmldom": "^0.9.12",
         "ajv": "^6.15.0",
-        "commander": "^14.0.3",
+        "commander": "^15.0.0",
         "eslint": "^10.13.0",
         "js-yaml": "^4.3.2",
         "mime-types": "^2.1.35",
@@ -71,9 +71,9 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.29.11",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.11.tgz",
-      "integrity": "sha512-snZbO7MEDOof+hvNa97EjEY7qD7h2kwvQr5AJC3ZhQudKW5dnej6k3kP9NQV88hJwaS8vDqRLFo9rivLEhle2g==",
+      "version": "7.29.13",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.13.tgz",
+      "integrity": "sha512-fWegr+WsEsiMVW4KUNdIIzzMTZSzNiqhy0//6+2MRi2d5NFNsL/AYwBQW8eBnRbTBVRnDVzjaJEUqKaCWjMMdQ==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -89,9 +89,9 @@
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.12",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.12.tgz",
-      "integrity": "sha512-WJ7JBp/Q4+z/ImydtI7jS6NVco5++632ExBemSX+Ysb+G1lCwQ5BVo3SY+jGGOcZXI4ZccbZSUSJLNBW6eEpJg==",
+      "version": "7.29.13",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.13.tgz",
+      "integrity": "sha512-fJM50YYjlTiBhgdkGmC1tBpv+FMAyo4annf2X6Aks+0yRlaiVkYW/3f07xAfVVkYIoZ9fFZp+mEThUFnuybhkQ==",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.29.11"
@@ -192,9 +192,9 @@
       }
     },
     "node_modules/@eslint-community/regexpp": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
-      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.3.tgz",
+      "integrity": "sha512-R76UKbvsqI68DJJVTVyqFKqU98CN4+B+acxNfEA2IFarSzP0SjtKf/3+fFiXzTyv5Fj3PxLkGHe2wnVWWMxobQ==",
       "license": "MIT",
       "engines": {
         "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
@@ -1161,12 +1161,12 @@
       }
     },
     "node_modules/commander": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
-      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
+      "version": "15.1.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-15.1.0.tgz",
+      "integrity": "sha512-cgnQ88TRrWcC7pVq46RzJVRMktu3W2RcbnoidnfBsl1bmDCBwJS/udcIZpKoCrbAYYaCqsz1yZCVIgbIaU3ddQ==",
       "license": "MIT",
       "engines": {
-        "node": ">=20"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/commandpost": {
@@ -1984,9 +1984,9 @@
       "license": "ISC"
     },
     "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "version": "13.0.7",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.7.tgz",
+      "integrity": "sha512-wfsFgXQ8A3SEI9XGf7Nl3Y9l7ffSrGh7SUCT7vU/2CzYPep9kjxAn1S40F9OPKxAMGCVl7HtNlJhrCJUeUq83g==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "minimatch": "^10.2.2",
@@ -3257,9 +3257,9 @@
       }
     },
     "node_modules/mdast-util-gfm-task-list-item": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-gfm-task-list-item/-/mdast-util-gfm-task-list-item-2.0.0.tgz",
-      "integrity": "sha512-IrtvNvjxC1o06taBAVJznEnkiHxLFTzgonUdy8hzFVeDun0uTjxxrRGVaNFqkU1wJR3RBPEfsxmU6jDWPofrTQ==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-task-list-item/-/mdast-util-gfm-task-list-item-2.0.1.tgz",
+      "integrity": "sha512-jXVO1hvB2hs82g1esi7I9nIJDqiijbQLIyH2jDUb5s7jIAZMr/79h0VHSq7XHKTqpLARRm+DDNjduB7S9+6XZA==",
       "license": "MIT",
       "dependencies": {
         "@types/mdast": "^4.0.0",
@@ -3311,9 +3311,9 @@
       }
     },
     "node_modules/mdast-util-gfm/node_modules/mdast-util-gfm-autolink-literal": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-2.0.1.tgz",
-      "integrity": "sha512-5HVP2MKaP6L+G6YaxPNjuL0BPrq9orG3TsrZ9YXbA3vDw/ACI4MEsnoDpn6ZNm7GnZgtAcONJyPhOP8tNJQavQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-2.1.0.tgz",
+      "integrity": "sha512-Jx6QSK8wDo558Bcf7q+1pe0v81g2PVs09Hlvu9xJHmCFRF3sAPW7vXFVIAwBncs3sde92WbsVqNxwdqViA2XnQ==",
       "license": "MIT",
       "dependencies": {
         "@types/mdast": "^4.0.0",
@@ -3401,9 +3401,9 @@
       }
     },
     "node_modules/mdast-util-to-markdown": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-2.2.2.tgz",
-      "integrity": "sha512-ELNT5jYDUdx0B/hlUSSAiAEtvqkY3Oriwkp1KEYseF1Ccu4MnKkmE5yK3oE3WGT/Pq8VTE+XwP0GLL5pafY8yA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-2.2.3.tgz",
+      "integrity": "sha512-dImdB6VZRMRac1SwAW6o1c0ESk/7pFFAMCMuKM+9v7LpTSthMM5nzXpqKw4Mjo66aXVKhNkyrP4bMB9MurPyWg==",
       "license": "MIT",
       "dependencies": {
         "@types/mdast": "^4.0.0",
@@ -4433,12 +4433,12 @@
       "license": "ISC"
     },
     "node_modules/playwright": {
-      "version": "1.64.1",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.64.1.tgz",
-      "integrity": "sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA==",
+      "version": "1.65.0",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.65.0.tgz",
+      "integrity": "sha512-F3AMWcR44qMBt4kq+6Kb6mX7bjGXshktKFOPULd7reED6ZJWevjbNRqysP7q+AATE9kdPEZBibex1BYsvpVoeA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.64.1"
+        "playwright-core": "1.65.0"
       },
       "bin": {
         "playwright": "cli.js"
@@ -4448,9 +4448,9 @@
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.64.1",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.64.1.tgz",
-      "integrity": "sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ==",
+      "version": "1.65.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.65.0.tgz",
+      "integrity": "sha512-vNSKgH6YqtN7cdT/L334zo0a+YwkrpicyrHJlWWPIm/Q+Nn2SWInil01oT0mbu96U4GgoRtCYQD9CzJQgju+lA==",
       "license": "Apache-2.0",
       "bin": {
         "playwright-core": "cli.js"
@@ -6014,6 +6014,15 @@
       "integrity": "sha512-4YPL7IRAuaZflE10+BVhKr6k5KQl/DiLeNCIF7ISqKr0ogM2hqm9ztRNCPqL/xYDI7hfuIHR8T+U7mIDRLQNXw==",
       "license": "MIT"
     },
+    "node_modules/textlint-rule-preset-jtf-style/node_modules/commander": {
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
+      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/textlint-rule-preset-jtf-style/node_modules/diff": {
       "version": "9.0.0",
       "resolved": "https://registry.npmjs.org/diff/-/diff-9.0.0.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pecot/visual-mcp",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "type": "module",
   "description": "pecotv MCP server (standalone distribution)",
   "license": "MIT",
@@ -18,7 +18,7 @@
   "dependencies": {
     "@modelcontextprotocol/server": "^2.4.0",
     "@xmldom/xmldom": "^0.9.12",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "mime-types": "^2.1.35",
     "playwright": "^1.64.1",
     "xpath": "^0.0.34",

package/vendor/text-rules/dist/source-hash

@@ -1 +1 @@
-9ea131d250c0fbc923b5c1320c9f15795653279ec92188ccd4e5e5098821f18c
+ec820409145799b4c3a658fe56e75da77f7c867333b9e04bd617c584d5abd8cf