kordoc 4.7.1 → 4.7.3

package/dist/mcp.js

@@ -37,25 +37,30 @@ import {
   readBuiltinTemplate,
   resolveBuiltinTemplate,
   unknownFontWarnings
-} from "./chunk-5KPNXBNR.js";
+} from "./chunk-W5NZYPRQ.js";
 import "./chunk-7FCNOKOR.js";
-import "./chunk-4VNUQYUE.js";
+import "./chunk-4KGGVCYX.js";
 import "./chunk-MOL7MDBG.js";
-import "./chunk-VECVLIWE.js";
+import "./chunk-NYLYIN55.js";
 import "./chunk-DZIXKL7E.js";
-import "./chunk-AFX6ZXER.js";
+import "./chunk-CGJDCZA3.js";
 import {
   blocksToMarkdown
-} from "./chunk-YWDN5PQC.js";
-import "./chunk-JEX5P66D.js";
-import "./chunk-7ZIOZ6PU.js";
+} from "./chunk-KEGAEHWO.js";
+import "./chunk-XOO6YEZE.js";
+import "./chunk-VZ3AQVBN.js";
+import {
+  assertWithinRoot,
+  getAccessRoot,
+  isOfflineMode
+} from "./chunk-RQVFFSAO.js";
 import {
   KordocError,
   VERSION,
   classifyError,
   sanitizeError,
   toArrayBuffer
-} from "./chunk-J3W6Q3AX.js";
+} from "./chunk-IMFIACHP.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -82,6 +87,7 @@ function safePath(filePath, allowedExts = ALLOWED_EXTENSIONS) {
     throw new KordocError(`\uACBD\uB85C \uCC98\uB9AC \uC624\uB958 [${err?.code ?? "UNKNOWN"}]`);
   }
   if (!isAbsolute(real)) throw new KordocError("\uC808\uB300 \uACBD\uB85C\uB9CC \uD5C8\uC6A9\uB429\uB2C8\uB2E4");
+  assertWithinRoot(real);
   const ext = extname(real).toLowerCase();
   if (!allowedExts.has(ext)) throw new KordocError(`\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 \uD655\uC7A5\uC790\uC785\uB2C8\uB2E4: ${ext} (\uD5C8\uC6A9: ${[...allowedExts].join(", ")})`);
   return real;
@@ -95,12 +101,16 @@ function safeOutputPath(outputPath, allowedExts) {
   }
   const parent = dirname(resolved);
   if (existsSync(parent)) {
+    let real;
     try {
-      return resolve(realpathSync(parent), basename(resolved));
+      real = resolve(realpathSync(parent), basename(resolved));
     } catch (err) {
       throw new KordocError(`\uCD9C\uB825 \uACBD\uB85C \uCC98\uB9AC \uC624\uB958 [${err?.code ?? "UNKNOWN"}]: ${parent}`);
     }
+    assertWithinRoot(real);
+    return real;
   }
+  assertWithinRoot(resolved);
   return resolved;
 }
 function describeError(err) {
@@ -300,7 +310,7 @@ server.tool(
           break;
         case "pdf":
           try {
-            const { extractPdfMetadataOnly } = await import("./parser-UMFBJG2D.js");
+            const { extractPdfMetadataOnly } = await import("./parser-HT7GZOF2.js");
             metadata = await extractPdfMetadataOnly(buffer);
           } catch {
             metadata = void 0;
@@ -332,7 +342,7 @@ server.tool(
 );
 server.tool(
   "parse_pages",
-  "\uBB38\uC11C\uC758 \uD2B9\uC815 \uD398\uC774\uC9C0/\uC139\uC158 \uBC94\uC704\uB9CC \uD30C\uC2F1\uD569\uB2C8\uB2E4. PDF\uB294 \uC815\uD655\uD55C \uD398\uC774\uC9C0, HWP/HWPX\uB294 \uC139\uC158 \uB2E8\uC704 \uADFC\uC0AC\uCE58\uC785\uB2C8\uB2E4.",
+  "\uBB38\uC11C\uC758 \uD2B9\uC815 \uD398\uC774\uC9C0 \uBC94\uC704\uB9CC \uD30C\uC2F1\uD569\uB2C8\uB2E4. PDF\uC640 \uD55C\uCEF4 \uC800\uC7A5\uBCF8 HWP/HWPX\uB294 \uC2E4\uC81C \uD398\uC774\uC9C0 \uAE30\uC900(metadata.pageMode=layout), \uC870\uD310 \uCE90\uC2DC\uAC00 \uC5C6\uB294 \uC0DD\uC131 \uD30C\uC77C\uC740 \uC139\uC158 \uB2E8\uC704 \uADFC\uC0AC(pageMode=section)\uC785\uB2C8\uB2E4.",
   {
     file_path: z.string().min(1).describe("\uD30C\uC2F1\uD560 \uBB38\uC11C \uD30C\uC77C\uC758 \uC808\uB300 \uACBD\uB85C"),
     pages: z.string().min(1).describe("\uD398\uC774\uC9C0 \uBC94\uC704 (\uC608: '1-3', '1,3,5-7')")
@@ -358,7 +368,8 @@ server.tool(
       const meta = [
         `\uD3EC\uB9F7: ${result.fileType.toUpperCase()}`,
         `\uBC94\uC704: ${pages}`,
-        result.pageCount ? `\uD398\uC774\uC9C0: ${result.pageCount}` : null
+        result.pageCount ? `\uD398\uC774\uC9C0: ${result.pageCount}` : null,
+        result.metadata?.pageMode === "section" ? "\uAE30\uC900: \uC139\uC158 \uADFC\uC0AC" : null
       ].filter(Boolean).join(" | ");
       return {
         content: [{ type: "text", text: `[${meta}]
@@ -681,7 +692,7 @@ server.tool(
       }
       const image = new Uint8Array(await readFile(imgResolved));
       const ext = extname(imgResolved).slice(1).toLowerCase();
-      const { placeSealHwpx } = await import("./seal-AGSZ6MUR.js");
+      const { placeSealHwpx } = await import("./seal-VU6JS2QD.js");
       const result = await placeSealHwpx(buffer, [{
         anchor,
         occurrence,
@@ -783,7 +794,7 @@ server.tool(
       }
       const outPath = output_path ? safeOutputPath(output_path, /* @__PURE__ */ new Set([format === "png" ? ".png" : ".svg"])) : void 0;
       const { buffer } = await readValidatedFile(file_path, MAX_FILE_SIZE, /* @__PURE__ */ new Set([".hwpx"]));
-      const { renderHwpxToSvg } = await import("./render-IQ4IZLY4.js");
+      const { renderHwpxToSvg } = await import("./render-5Y2US4IM.js");
       const result = await renderHwpxToSvg(buffer, { highlights, reflow: true, reflowMode: reflow_mode });
       const summary = [
         `\uB80C\uB354 \uC644\uB8CC: ${result.pageCount}\uD398\uC774\uC9C0, ${Math.round(result.width)}x${Math.round(result.height)}pt (\uD14D\uC2A4\uD2B8 ${result.stats.texts}\xB7\uC774\uBBF8\uC9C0 ${result.stats.images}\xB7\uD45C ${result.stats.tables})`,
@@ -795,7 +806,7 @@ server.tool(
         summary.push(`\uC800\uC7A5: ${outPath}`);
         return { content: [{ type: "text", text: summary.join("\n") }] };
       }
-      const { rasterizeSvg } = await import("./rasterize-GL67HQC7.js");
+      const { rasterizeSvg } = await import("./rasterize-QYCLEH2J.js");
       const raster = await rasterizeSvg(result.svg, result.width, result.height);
       if (outPath) {
         await mkdir(dirname(outPath), { recursive: true });
@@ -893,7 +904,7 @@ server.tool(
       if (!parsed.success) {
         return { content: [{ type: "text", text: `\uD30C\uC2F1 \uC2E4\uD328: ${parsed.error}` }], isError: true };
       }
-      const { blocksToChunks } = await import("./chunks-C7DJL4RE.js");
+      const { blocksToChunks } = await import("./chunks-LWAOHTK2.js");
       const chunks = blocksToChunks(parsed.blocks, { granularity, includeTableCells: include_table_cells });
       return { content: [{ type: "text", text: capResponseText(JSON.stringify(chunks, null, 2)) }] };
     } catch (err) {
@@ -912,7 +923,7 @@ server.tool(
     try {
       const out = safeOutputPath(output_path, PROFILE_EXTENSIONS);
       const { buffer } = await readValidatedFile(hwpx_path);
-      const { hwpxToProfile } = await import("./-O42BMYNX.js");
+      const { hwpxToProfile } = await import("./-WYNJOQ6P.js");
       const profile = await hwpxToProfile(buffer);
       await mkdir(dirname(out), { recursive: true });
       await writeFile(out, JSON.stringify(profile, null, 2));
@@ -1001,7 +1012,7 @@ server.tool(
       }
       let profile;
       if (profile_path) {
-        const { parseFormatProfileJson } = await import("./profile-io-HT62OAEU.js");
+        const { parseFormatProfileJson } = await import("./profile-io-ACYRLCSR.js");
         profile = parseFormatProfileJson(await readFile(safePath(profile_path, PROFILE_EXTENSIONS), "utf-8"));
       }
       const out = safeOutputPath(output_path, /* @__PURE__ */ new Set([".hwpx"]));
@@ -1015,6 +1026,7 @@ server.tool(
       let images;
       if (image_dir) {
         const dir = await realpath(resolve(image_dir));
+        assertWithinRoot(dir);
         for (const m of markdown.matchAll(/!\[[^\]]*\]\(([^)\s]+)\)/g)) {
           const url = m[1];
           if (!/^[A-Za-z0-9._-]+\.[A-Za-z0-9]+$/.test(url) || url.includes("..")) continue;
@@ -1056,6 +1068,12 @@ var serverStarted = false;
 async function startMcpServer() {
   if (serverStarted) return;
   serverStarted = true;
+  const root = getAccessRoot();
+  if (isOfflineMode() || root) {
+    const flags = [isOfflineMode() ? "offline" : null, root ? `root=${root}` : null].filter(Boolean);
+    process.stderr.write(`[kordoc-mcp] \uC81C\uD55C \uBAA8\uB4DC: ${flags.join(", ")}
+`);
+  }
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }