mcp-word-bridge 4.1.2 → 4.1.3

package/README.md

@@ -300,6 +300,7 @@ Platform constraints in the Word JavaScript API that cannot be resolved in this
 | Highlight Colors | `highlightColor` only supports 17 named colors (Yellow, Green, Cyan, Magenta, Blue, Red, DarkBlue, DarkCyan, DarkGreen, DarkMagenta, DarkRed, DarkYellow, Gray25, Gray50, Black, White, NoHighlight). The Word API documentation claims `#RRGGBB` is accepted, but Desktop silently maps hex values to the nearest named color. This tool rejects hex to prevent silent mismatch — use `color` for arbitrary RGB. | [office-js#4638](https://github.com/OfficeDev/office-js/issues/4638) |
 | Paragraph Style | TOC field entries and certain table paragraphs return `style: ""` (empty string) instead of the actual style name. Paragraphs are flagged with `isTocEntry: true` when detected as TOC entries. Use this flag rather than the style field for identification. | [office-js#5934](https://github.com/OfficeDev/office-js/issues/5934) |
 | Mixed Formatting | `word_get_paragraph_by_index` returns `null` for font properties (`bold`, `italic`, `size`, etc.) when the paragraph contains mixed formatting (e.g. partially bold text). This is the Word API's way of indicating "no single value" — treat `null` as "mixed". | [Word.Font docs](https://learn.microsoft.com/en-us/javascript/api/word/word.font?view=word-js-preview) |
+| TOC Search | `body.search()` matches text inside TOC field entries as well as body content. Heading text appears in both locations, so search results return TOC matches first. Use `occurrence` to skip past TOC entries and target the body instance. |  |
 | Page Info | `word_get_page_info` requires WordApiDesktop 1.2+ (Word for Windows/Mac desktop). Not available on Word for the web. | [WordApiDesktop 1.2](https://learn.microsoft.com/en-us/javascript/api/requirement-sets/word/word-api-desktop-1-2-requirement-set) |
 | Undo | The Word JavaScript API does not expose a programmatic `undo()` method. Changes made by the add-in appear in Word's undo stack (Ctrl+Z works for the user), but there is no way to trigger undo from code. | [Stack Overflow](https://stackoverflow.com/questions/58440921/accessing-the-undo-stack-from-word-javascript-api) |
 

package/dist/server.js

@@ -18646,6 +18646,7 @@ var HEAVY_OPERATIONS = /* @__PURE__ */ new Set([
   "batchExecute"
 ]);
 var MAX_PAYLOAD = 10 * 1024 * 1024;
+var HIGHLIGHT_COLORS = ["Yellow", "Green", "Cyan", "Magenta", "Blue", "Red", "DarkBlue", "DarkCyan", "DarkGreen", "DarkMagenta", "DarkRed", "DarkYellow", "Gray25", "Gray50", "Black", "White", "NoHighlight"];
 
 // src/server/bridge.ts
 var Bridge = class {
@@ -18742,6 +18743,7 @@ function forwardTool(name, description, schema, action, validate) {
     description,
     schema,
     bridgeAction: action,
+    validate,
     async handler(args, bridge2) {
       if (validate) validate(args);
       const result = await bridge2.send(action, args);
@@ -18935,6 +18937,14 @@ function checkHexColor(color, name) {
     throw new ToolError(`${name} must be a valid hex color (e.g. #FF0000).`);
   }
 }
+function checkUrl(url) {
+  if (!/^https?:\/\/.+/i.test(url)) {
+    throw new ToolError("URL must be a valid HTTP or HTTPS URL (e.g. https://example.com).");
+  }
+  if (/[<>"{}|\\^`]/.test(url)) {
+    throw new ToolError(`Malformed URL: "${url}". URL contains invalid characters that must be percent-encoded.`);
+  }
+}
 
 // src/server/tools/paragraphs.ts
 var getParagraphs = forwardTool(
@@ -19123,10 +19133,8 @@ var moveParagraph = {
       }
     }
     const adjustedTo = fromIndex < toIndex ? toIndex - count : toIndex;
-    if (toIndex === fromIndex + count && location === "After") {
-      return jsonResult({ success: true, warning: "No move performed \u2014 destination is equivalent to source position.", moved: null });
-    }
-    if (adjustedTo === fromIndex && location === "After") {
+    const effectiveInsertPos = location === "Before" ? adjustedTo : adjustedTo + 1;
+    if (effectiveInsertPos === fromIndex) {
       return jsonResult({ success: true, warning: "No move performed \u2014 destination is equivalent to source position.", moved: null });
     }
     const ooxmlResult = await bridge2.send("getParaOoxml", { index: fromIndex, count });
@@ -19221,7 +19229,10 @@ var search = forwardTool(
     },
     required: ["query"]
   },
-  "search"
+  "search",
+  (args) => {
+    checkNonEmpty(args.query, "query");
+  }
 );
 var searchAndReplace = {
   name: "word_search_and_replace",
@@ -19300,7 +19311,10 @@ var insertLineBreak = forwardTool(
     },
     required: ["anchorText"]
   },
-  "insertLineBreak"
+  "insertLineBreak",
+  (args) => {
+    checkNonEmpty(args.anchorText, "anchorText");
+  }
 );
 var searchTools = [
   search,
@@ -19312,7 +19326,6 @@ var searchTools = [
 ];
 
 // src/server/tools/formatting.ts
-var HIGHLIGHT_COLORS = ["Yellow", "Green", "Cyan", "Magenta", "Blue", "Red", "DarkBlue", "DarkCyan", "DarkGreen", "DarkMagenta", "DarkRed", "DarkYellow", "Gray25", "Gray50", "Black", "White", "NoHighlight"];
 function validateFormatText(args) {
   checkNonEmpty(args.text, "text");
   const hasFormatting = args.bold !== void 0 || args.italic !== void 0 || args.underline !== void 0 || args.strikeThrough !== void 0 || args.color !== void 0 || args.highlightColor !== void 0 || args.size !== void 0 || args.name !== void 0;
@@ -19674,7 +19687,11 @@ var insertFootnote = forwardTool(
     },
     required: ["anchorText", "text"]
   },
-  "insertFootnote"
+  "insertFootnote",
+  (args) => {
+    checkNonEmpty(args.anchorText, "anchorText");
+    checkNonEmpty(args.text, "text");
+  }
 );
 var insertFootnoteAtIndex = forwardTool(
   "word_insert_footnote_at_index",
@@ -19686,7 +19703,10 @@ var insertFootnoteAtIndex = forwardTool(
     },
     required: ["paragraphIndex", "text"]
   },
-  "insertFootnoteAtIndex"
+  "insertFootnoteAtIndex",
+  (args) => {
+    checkNonEmpty(args.text, "text");
+  }
 );
 var insertEndnote = forwardTool(
   "word_insert_endnote",
@@ -19700,7 +19720,11 @@ var insertEndnote = forwardTool(
     },
     required: ["anchorText", "text"]
   },
-  "insertEndnote"
+  "insertEndnote",
+  (args) => {
+    checkNonEmpty(args.anchorText, "anchorText");
+    checkNonEmpty(args.text, "text");
+  }
 );
 var getFootnotes = forwardTool(
   "word_get_footnotes",
@@ -19765,7 +19789,11 @@ var insertBookmark = forwardTool(
     },
     required: ["name", "anchorText"]
   },
-  "insertBookmark"
+  "insertBookmark",
+  (args) => {
+    checkNonEmpty(args.name, "name");
+    checkNonEmpty(args.anchorText, "anchorText");
+  }
 );
 var deleteBookmark = forwardTool(
   "word_delete_bookmark",
@@ -19776,7 +19804,10 @@ var deleteBookmark = forwardTool(
     },
     required: ["name"]
   },
-  "deleteBookmark"
+  "deleteBookmark",
+  (args) => {
+    checkNonEmpty(args.name, "name");
+  }
 );
 var goToBookmark = forwardTool(
   "word_go_to_bookmark",
@@ -19787,7 +19818,10 @@ var goToBookmark = forwardTool(
     },
     required: ["name"]
   },
-  "goToBookmark"
+  "goToBookmark",
+  (args) => {
+    checkNonEmpty(args.name, "name");
+  }
 );
 var getBookmarkText = forwardTool(
   "word_get_bookmark_text",
@@ -19798,7 +19832,10 @@ var getBookmarkText = forwardTool(
     },
     required: ["name"]
   },
-  "getBookmarkText"
+  "getBookmarkText",
+  (args) => {
+    checkNonEmpty(args.name, "name");
+  }
 );
 var bookmarkTools = [
   getBookmarks,
@@ -19821,7 +19858,12 @@ var insertHyperlink = forwardTool(
     },
     required: ["anchorText", "url"]
   },
-  "insertHyperlink"
+  "insertHyperlink",
+  (args) => {
+    checkNonEmpty(args.anchorText, "anchorText");
+    checkNonEmpty(args.url, "url");
+    checkUrl(args.url);
+  }
 );
 var getHyperlinks = forwardTool(
   "word_get_hyperlinks",
@@ -19840,7 +19882,10 @@ var removeHyperlink = forwardTool(
     },
     required: ["anchorText"]
   },
-  "removeHyperlink"
+  "removeHyperlink",
+  (args) => {
+    checkNonEmpty(args.anchorText, "anchorText");
+  }
 );
 var hyperlinkTools = [
   insertHyperlink,
@@ -19869,7 +19914,10 @@ var insertContentControl = forwardTool(
       matchCase: { type: "boolean", description: "Default: false" }
     }
   },
-  "insertContentControl"
+  "insertContentControl",
+  (args) => {
+    checkNonEmpty(args.anchorText, "anchorText");
+  }
 );
 var setContentControlText = {
   name: "word_set_content_control_text",
@@ -20259,7 +20307,7 @@ var equationTools = [
 ];
 
 // src/server/tools/batch.ts
-function createBatchTool(registry, actionMap) {
+function createBatchTool(registry, actionMap, validators) {
   return {
     name: "word_batch",
     description: "[Batch] Execute multiple operations in a single call. Operations execute sequentially \u2014 if one fails, subsequent are skipped. Note: paragraph indices are NOT auto-adjusted between operations. Multiple inserts at the same index will produce reversed order (last inserted appears first).",
@@ -20328,6 +20376,16 @@ function createBatchTool(registry, actionMap) {
           break;
         }
         if (actionMap.has(op.tool)) {
+          const validate = validators.get(op.tool);
+          if (validate) {
+            try {
+              validate(op.args || {});
+            } catch (e) {
+              results.push({ index: i, tool: op.tool, success: false, error: e.message });
+              stopped = true;
+              break;
+            }
+          }
           nativeBuf.push({ tool: op.tool, args: op.args || {}, originalIndex: i });
         } else {
           const ok = await flushNative();
@@ -20387,13 +20445,17 @@ function buildToolRegistry() {
   ];
   const handlers = /* @__PURE__ */ new Map();
   const actionMap = /* @__PURE__ */ new Map();
+  const validators = /* @__PURE__ */ new Map();
   for (const tool of allTools) {
     handlers.set(tool.name, tool.handler);
     if ("bridgeAction" in tool && typeof tool.bridgeAction === "string") {
       actionMap.set(tool.name, tool.bridgeAction);
     }
+    if ("validate" in tool && typeof tool.validate === "function") {
+      validators.set(tool.name, tool.validate);
+    }
   }
-  const batchTool = createBatchTool(handlers, actionMap);
+  const batchTool = createBatchTool(handlers, actionMap, validators);
   allTools.push(batchTool);
   handlers.set(batchTool.name, batchTool.handler);
   return { tools: allTools, handlers };
@@ -20534,7 +20596,7 @@ Output always uses canonical form: "Left", "Center", "Right", "Justified".
 // package.json
 var package_default = {
   name: "mcp-word-bridge",
-  version: "4.1.2",
+  version: "4.1.3",
   description: "MCP server for live Word document editing via Office Add-in",
   main: "dist/server.js",
   bin: {
@@ -20705,7 +20767,7 @@ function createHttpsServer() {
   };
   const rootDir = import_path.default.join(__dirname, "..");
   return import_https.default.createServer(options, (req, res) => {
-    let urlPath = (req.url || "/").split("?")[0];
+    const urlPath = (req.url || "/").split("?")[0];
     let filePath = urlPath === "/" ? "/taskpane.html" : urlPath;
     filePath = import_path.default.resolve(rootDir, "." + filePath);
     if (!filePath.startsWith(rootDir + import_path.default.sep) && filePath !== rootDir) {