kordoc 4.7.0 → 4.7.2

package/dist/mcp.js

@@ -37,25 +37,30 @@ import {
   readBuiltinTemplate,
   resolveBuiltinTemplate,
   unknownFontWarnings
-} from "./chunk-6PIR74EA.js";
+} from "./chunk-QXC5NPO2.js";
 import "./chunk-7FCNOKOR.js";
-import "./chunk-MVTX6ODZ.js";
+import "./chunk-4VNUQYUE.js";
 import "./chunk-MOL7MDBG.js";
-import "./chunk-IDHBO6AG.js";
+import "./chunk-IN2AOMX6.js";
 import "./chunk-DZIXKL7E.js";
-import "./chunk-XZDJXYUC.js";
+import "./chunk-BSWJCSG7.js";
 import {
   blocksToMarkdown
-} from "./chunk-3VTMSSDW.js";
-import "./chunk-PV2EXXGI.js";
-import "./chunk-AFPD74JJ.js";
+} from "./chunk-P7HPLWEP.js";
+import "./chunk-FJBOVJAG.js";
+import "./chunk-LJW5EQXS.js";
+import {
+  assertWithinRoot,
+  getAccessRoot,
+  isOfflineMode
+} from "./chunk-TYIFZT5H.js";
 import {
   KordocError,
   VERSION,
   classifyError,
   sanitizeError,
   toArrayBuffer
-} from "./chunk-ZYVULRYF.js";
+} from "./chunk-VXB52EWX.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -82,6 +87,7 @@ function safePath(filePath, allowedExts = ALLOWED_EXTENSIONS) {
     throw new KordocError(`\uACBD\uB85C \uCC98\uB9AC \uC624\uB958 [${err?.code ?? "UNKNOWN"}]`);
   }
   if (!isAbsolute(real)) throw new KordocError("\uC808\uB300 \uACBD\uB85C\uB9CC \uD5C8\uC6A9\uB429\uB2C8\uB2E4");
+  assertWithinRoot(real);
   const ext = extname(real).toLowerCase();
   if (!allowedExts.has(ext)) throw new KordocError(`\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 \uD655\uC7A5\uC790\uC785\uB2C8\uB2E4: ${ext} (\uD5C8\uC6A9: ${[...allowedExts].join(", ")})`);
   return real;
@@ -95,12 +101,16 @@ function safeOutputPath(outputPath, allowedExts) {
   }
   const parent = dirname(resolved);
   if (existsSync(parent)) {
+    let real;
     try {
-      return resolve(realpathSync(parent), basename(resolved));
+      real = resolve(realpathSync(parent), basename(resolved));
     } catch (err) {
       throw new KordocError(`\uCD9C\uB825 \uACBD\uB85C \uCC98\uB9AC \uC624\uB958 [${err?.code ?? "UNKNOWN"}]: ${parent}`);
     }
+    assertWithinRoot(real);
+    return real;
   }
+  assertWithinRoot(resolved);
   return resolved;
 }
 function describeError(err) {
@@ -300,7 +310,7 @@ server.tool(
           break;
         case "pdf":
           try {
-            const { extractPdfMetadataOnly } = await import("./parser-EIVCD4NS.js");
+            const { extractPdfMetadataOnly } = await import("./parser-QPMTNRPU.js");
             metadata = await extractPdfMetadataOnly(buffer);
           } catch {
             metadata = void 0;
@@ -681,7 +691,7 @@ server.tool(
       }
       const image = new Uint8Array(await readFile(imgResolved));
       const ext = extname(imgResolved).slice(1).toLowerCase();
-      const { placeSealHwpx } = await import("./seal-ESAC3IZR.js");
+      const { placeSealHwpx } = await import("./seal-NB2YJ5F4.js");
       const result = await placeSealHwpx(buffer, [{
         anchor,
         occurrence,
@@ -783,7 +793,7 @@ server.tool(
       }
       const outPath = output_path ? safeOutputPath(output_path, /* @__PURE__ */ new Set([format === "png" ? ".png" : ".svg"])) : void 0;
       const { buffer } = await readValidatedFile(file_path, MAX_FILE_SIZE, /* @__PURE__ */ new Set([".hwpx"]));
-      const { renderHwpxToSvg } = await import("./render-CAFQT7S4.js");
+      const { renderHwpxToSvg } = await import("./render-HEQX5DII.js");
       const result = await renderHwpxToSvg(buffer, { highlights, reflow: true, reflowMode: reflow_mode });
       const summary = [
         `\uB80C\uB354 \uC644\uB8CC: ${result.pageCount}\uD398\uC774\uC9C0, ${Math.round(result.width)}x${Math.round(result.height)}pt (\uD14D\uC2A4\uD2B8 ${result.stats.texts}\xB7\uC774\uBBF8\uC9C0 ${result.stats.images}\xB7\uD45C ${result.stats.tables})`,
@@ -795,7 +805,7 @@ server.tool(
         summary.push(`\uC800\uC7A5: ${outPath}`);
         return { content: [{ type: "text", text: summary.join("\n") }] };
       }
-      const { rasterizeSvg } = await import("./rasterize-7AR662AL.js");
+      const { rasterizeSvg } = await import("./rasterize-QY3XJKCH.js");
       const raster = await rasterizeSvg(result.svg, result.width, result.height);
       if (outPath) {
         await mkdir(dirname(outPath), { recursive: true });
@@ -893,7 +903,7 @@ server.tool(
       if (!parsed.success) {
         return { content: [{ type: "text", text: `\uD30C\uC2F1 \uC2E4\uD328: ${parsed.error}` }], isError: true };
       }
-      const { blocksToChunks } = await import("./chunks-4HEG6ZPG.js");
+      const { blocksToChunks } = await import("./chunks-RNP6VLGK.js");
       const chunks = blocksToChunks(parsed.blocks, { granularity, includeTableCells: include_table_cells });
       return { content: [{ type: "text", text: capResponseText(JSON.stringify(chunks, null, 2)) }] };
     } catch (err) {
@@ -912,7 +922,7 @@ server.tool(
     try {
       const out = safeOutputPath(output_path, PROFILE_EXTENSIONS);
       const { buffer } = await readValidatedFile(hwpx_path);
-      const { hwpxToProfile } = await import("./-MK2223RL.js");
+      const { hwpxToProfile } = await import("./-CVPGGSAB.js");
       const profile = await hwpxToProfile(buffer);
       await mkdir(dirname(out), { recursive: true });
       await writeFile(out, JSON.stringify(profile, null, 2));
@@ -1001,7 +1011,7 @@ server.tool(
       }
       let profile;
       if (profile_path) {
-        const { parseFormatProfileJson } = await import("./profile-io-L5EH4JAD.js");
+        const { parseFormatProfileJson } = await import("./profile-io-I4UGTNP6.js");
         profile = parseFormatProfileJson(await readFile(safePath(profile_path, PROFILE_EXTENSIONS), "utf-8"));
       }
       const out = safeOutputPath(output_path, /* @__PURE__ */ new Set([".hwpx"]));
@@ -1015,6 +1025,7 @@ server.tool(
       let images;
       if (image_dir) {
         const dir = await realpath(resolve(image_dir));
+        assertWithinRoot(dir);
         for (const m of markdown.matchAll(/!\[[^\]]*\]\(([^)\s]+)\)/g)) {
           const url = m[1];
           if (!/^[A-Za-z0-9._-]+\.[A-Za-z0-9]+$/.test(url) || url.includes("..")) continue;
@@ -1056,6 +1067,12 @@ var serverStarted = false;
 async function startMcpServer() {
   if (serverStarted) return;
   serverStarted = true;
+  const root = getAccessRoot();
+  if (isOfflineMode() || root) {
+    const flags = [isOfflineMode() ? "offline" : null, root ? `root=${root}` : null].filter(Boolean);
+    process.stderr.write(`[kordoc-mcp] \uC81C\uD55C \uBAA8\uB4DC: ${flags.join(", ")}
+`);
+  }
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }