nworks 1.2.1 → 1.3.0

package/dist/index.js

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import { Command as Command14 } from "commander";
+
+// src/version.ts
 import { createRequire } from "module";
-import { Command as Command13 } from "commander";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var VERSION = pkg.version;
 
 // src/commands/login.ts
 import { Command } from "commander";
@@ -11,10 +16,11 @@ import { existsSync as existsSync2 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/auth/config.ts
-import { readFile, writeFile, mkdir } from "fs/promises";
+import { readFile, writeFile, mkdir, chmod, rename } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+import { z } from "zod";
 
 // src/utils/error.ts
 var AuthError = class extends Error {
@@ -38,15 +44,45 @@ var ApiError = class extends Error {
 function hasServiceAccountCreds(creds) {
   return !!(creds.serviceAccount && creds.privateKeyPath && creds.botId);
 }
+var IS_UNIX = process.platform !== "win32";
 var CONFIG_DIR = join(homedir(), ".config", "nworks");
 var CREDENTIALS_PATH = join(CONFIG_DIR, "credentials.json");
 var TOKEN_PATH = join(CONFIG_DIR, "token.json");
 var USER_TOKEN_PATH = join(CONFIG_DIR, "user-token.json");
+var PROFILE_NAME_PATTERN = /^[\w.-]+$/;
+var FORBIDDEN_PROFILE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var DOTS_ONLY = /^\.+$/;
+function validateProfileName(profile) {
+  if (!PROFILE_NAME_PATTERN.test(profile) || FORBIDDEN_PROFILE_KEYS.has(profile) || DOTS_ONLY.test(profile)) {
+    throw new AuthError(
+      `Invalid profile name "${profile}". Use only letters, digits, ".", "_", or "-" (and not "." / ".." alone).`
+    );
+  }
+}
+var credentialsSchema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  serviceAccount: z.string().optional(),
+  privateKeyPath: z.string().optional(),
+  botId: z.string().optional(),
+  domainId: z.string().optional()
+}).passthrough();
 async function ensureConfigDir() {
   if (!existsSync(CONFIG_DIR)) {
-    await mkdir(CONFIG_DIR, { recursive: true });
+    await mkdir(CONFIG_DIR, { recursive: true, ...IS_UNIX && { mode: 448 } });
+  } else if (IS_UNIX) {
+    await chmod(CONFIG_DIR, 448);
   }
 }
+var tempFileCounter = 0;
+async function writeSecureFile(path, data) {
+  const tempPath = `${path}.${process.pid}.${tempFileCounter++}.tmp`;
+  await writeFile(tempPath, data, { encoding: "utf-8", ...IS_UNIX && { mode: 384 } });
+  if (IS_UNIX) {
+    await chmod(tempPath, 384);
+  }
+  await rename(tempPath, path);
+}
 function getCredentialsFromEnv() {
   const clientId = process.env["NWORKS_CLIENT_ID"];
   const clientSecret = process.env["NWORKS_CLIENT_SECRET"];
@@ -63,6 +99,7 @@ function getCredentialsFromEnv() {
 async function loadCredentials(profile = "default") {
   const envCreds = getCredentialsFromEnv();
   if (envCreds) return envCreds;
+  validateProfileName(profile);
   if (!existsSync(CREDENTIALS_PATH)) {
     throw new AuthError(
       "Not logged in. Run `nworks login` or set environment variables."
@@ -74,9 +111,16 @@ async function loadCredentials(profile = "default") {
   if (!creds) {
     throw new AuthError(`Profile "${profile}" not found in credentials.`);
   }
-  return creds;
+  const parsed = credentialsSchema.safeParse(creds);
+  if (!parsed.success) {
+    throw new AuthError(
+      `Credentials for profile "${profile}" are malformed. Run \`nworks login\` to reconfigure.`
+    );
+  }
+  return parsed.data;
 }
 async function saveCredentials(creds, profile = "default") {
+  validateProfileName(profile);
   await ensureConfigDir();
   let profiles = {};
   if (existsSync(CREDENTIALS_PATH)) {
@@ -84,9 +128,10 @@ async function saveCredentials(creds, profile = "default") {
     profiles = JSON.parse(raw);
   }
   profiles[profile] = creds;
-  await writeFile(CREDENTIALS_PATH, JSON.stringify(profiles, null, 2), "utf-8");
+  await writeSecureFile(CREDENTIALS_PATH, JSON.stringify(profiles, null, 2));
 }
 async function loadToken(profile = "default") {
+  validateProfileName(profile);
   if (!existsSync(TOKEN_PATH)) return null;
   const raw = await readFile(TOKEN_PATH, "utf-8");
   const tokens = JSON.parse(raw);
@@ -98,6 +143,7 @@ async function loadToken(profile = "default") {
   };
 }
 async function saveToken(token, profile = "default") {
+  validateProfileName(profile);
   await ensureConfigDir();
   let tokens = {};
   if (existsSync(TOKEN_PATH)) {
@@ -105,9 +151,10 @@ async function saveToken(token, profile = "default") {
     tokens = JSON.parse(raw);
   }
   tokens[profile] = token;
-  await writeFile(TOKEN_PATH, JSON.stringify(tokens, null, 2), "utf-8");
+  await writeSecureFile(TOKEN_PATH, JSON.stringify(tokens, null, 2));
 }
 async function loadUserToken(profile = "default") {
+  validateProfileName(profile);
   if (!existsSync(USER_TOKEN_PATH)) return null;
   const raw = await readFile(USER_TOKEN_PATH, "utf-8");
   const tokens = JSON.parse(raw);
@@ -121,6 +168,7 @@ async function loadUserToken(profile = "default") {
   };
 }
 async function saveUserToken(token, profile = "default") {
+  validateProfileName(profile);
   await ensureConfigDir();
   let tokens = {};
   if (existsSync(USER_TOKEN_PATH)) {
@@ -128,35 +176,32 @@ async function saveUserToken(token, profile = "default") {
     tokens = JSON.parse(raw);
   }
   tokens[profile] = token;
-  await writeFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2), "utf-8");
+  await writeSecureFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2));
 }
 async function clearCredentials(profile = "default") {
+  validateProfileName(profile);
   if (existsSync(CREDENTIALS_PATH)) {
     const raw = await readFile(CREDENTIALS_PATH, "utf-8");
     const profiles = JSON.parse(raw);
     delete profiles[profile];
-    await writeFile(
-      CREDENTIALS_PATH,
-      JSON.stringify(profiles, null, 2),
-      "utf-8"
-    );
+    await writeSecureFile(CREDENTIALS_PATH, JSON.stringify(profiles, null, 2));
   }
   if (existsSync(TOKEN_PATH)) {
     const raw = await readFile(TOKEN_PATH, "utf-8");
     const tokens = JSON.parse(raw);
     delete tokens[profile];
-    await writeFile(TOKEN_PATH, JSON.stringify(tokens, null, 2), "utf-8");
+    await writeSecureFile(TOKEN_PATH, JSON.stringify(tokens, null, 2));
   }
   if (existsSync(USER_TOKEN_PATH)) {
     const raw = await readFile(USER_TOKEN_PATH, "utf-8");
     const tokens = JSON.parse(raw);
     delete tokens[profile];
-    await writeFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2), "utf-8");
+    await writeSecureFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2));
   }
 }
 
 // src/auth/jwt.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile2, stat } from "fs/promises";
 import jwt from "jsonwebtoken";
 async function createJWT(creds) {
   if (!creds.serviceAccount || !creds.privateKeyPath) {
@@ -165,6 +210,15 @@ async function createJWT(creds) {
     );
   }
   const privateKey = await readFile2(creds.privateKeyPath, "utf-8");
+  if (process.platform !== "win32") {
+    const fileStat = await stat(creds.privateKeyPath);
+    const mode = fileStat.mode & 511;
+    if (mode & 63) {
+      console.error(
+        `[nworks] Warning: Private key file has permissions ${mode.toString(8)}. Recommended: 600`
+      );
+    }
+  }
   const now = Math.floor(Date.now() / 1e3);
   const payload = {
     iss: creds.clientId,
@@ -201,7 +255,8 @@ async function refreshToken(profile = "default") {
   });
   if (!res.ok) {
     const text = await res.text();
-    throw new AuthError(`Token exchange failed (${res.status}): ${text}`);
+    const truncated = text.length > 200 ? text.substring(0, 200) + "..." : text;
+    throw new AuthError(`Token exchange failed (${res.status}): ${truncated}`);
   }
   const data = await res.json();
   const expiresIn = Number(data.expires_in);
@@ -215,7 +270,7 @@ async function refreshToken(profile = "default") {
 
 // src/auth/oauth-user.ts
 import { createServer } from "http";
-import { URL } from "url";
+import { URL as URL2 } from "url";
 var AUTH_URL2 = "https://auth.worksmobile.com/oauth2/v2.0/authorize";
 var TOKEN_URL = "https://auth.worksmobile.com/oauth2/v2.0/token";
 var REDIRECT_PORT = 9876;
@@ -230,19 +285,19 @@ function buildAuthorizeUrl(clientId, scope, state) {
   });
   return `${AUTH_URL2}?${params.toString()}`;
 }
-async function startUserOAuthFlow(_scope, profile = "default") {
+async function startUserOAuthFlow(_scope, profile, expectedState) {
   const creds = await loadCredentials(profile);
-  const code = await waitForAuthCode();
+  const code = await waitForAuthCode(expectedState);
   return exchangeCodeForToken(code, creds.clientId, creds.clientSecret);
 }
-function waitForAuthCode() {
-  return new Promise((resolve, reject) => {
+function waitForAuthCode(expectedState) {
+  return new Promise((resolve3, reject) => {
     const timeout = setTimeout(() => {
       server.close();
       reject(new AuthError("OAuth login timed out (120s). Try again."));
     }, 12e4);
     const server = createServer((req, res) => {
-      const url = new URL(req.url ?? "/", `http://localhost:${REDIRECT_PORT}`);
+      const url = new URL2(req.url ?? "/", `http://localhost:${REDIRECT_PORT}`);
       if (url.pathname !== "/callback") {
         res.writeHead(404);
         res.end("Not found");
@@ -250,6 +305,12 @@ function waitForAuthCode() {
       }
       const code = url.searchParams.get("code");
       const error = url.searchParams.get("error");
+      const state = url.searchParams.get("state");
+      if (state !== expectedState) {
+        res.writeHead(403, { "Content-Type": "text/html; charset=utf-8" });
+        res.end("<h2>\uBCF4\uC548 \uC624\uB958</h2><p>state \uBD88\uC77C\uCE58. \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uB85C\uADF8\uC778\uC744 \uB2E4\uC2DC \uC9C4\uD589\uD558\uC138\uC694.</p>");
+        return;
+      }
       if (error) {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end("<h2>\uB85C\uADF8\uC778 \uC2E4\uD328</h2><p>\uC774 \uCC3D\uC744 \uB2EB\uC544\uB3C4 \uB429\uB2C8\uB2E4.</p>");
@@ -270,9 +331,9 @@ function waitForAuthCode() {
       res.end("<h2>\uB85C\uADF8\uC778 \uC131\uACF5!</h2><p>\uC774 \uCC3D\uC744 \uB2EB\uACE0 \uD130\uBBF8\uB110\uB85C \uB3CC\uC544\uAC00\uC138\uC694.</p>");
       clearTimeout(timeout);
       server.close();
-      resolve(code);
+      resolve3(code);
     });
-    server.listen(REDIRECT_PORT, () => {
+    server.listen(REDIRECT_PORT, "127.0.0.1", () => {
     });
     server.on("error", (err) => {
       clearTimeout(timeout);
@@ -280,6 +341,17 @@ function waitForAuthCode() {
     });
   });
 }
+async function safeErrorSummary(res) {
+  const text = await res.text();
+  try {
+    const body = JSON.parse(text);
+    if (body.error || body.error_description) {
+      return [body.error, body.error_description].filter(Boolean).join(": ");
+    }
+  } catch {
+  }
+  return text.length > 200 ? text.slice(0, 200) + "..." : text;
+}
 async function exchangeCodeForToken(code, clientId, clientSecret) {
   const body = new URLSearchParams({
     grant_type: "authorization_code",
@@ -294,8 +366,7 @@ async function exchangeCodeForToken(code, clientId, clientSecret) {
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text();
-    throw new AuthError(`Token exchange failed (${res.status}): ${text}`);
+    throw new AuthError(`Token exchange failed (${res.status}): ${await safeErrorSummary(res)}`);
   }
   const data = await res.json();
   return {
@@ -319,8 +390,7 @@ async function refreshUserToken(refreshToken2, profile = "default") {
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text();
-    throw new AuthError(`Token refresh failed (${res.status}): ${text}`);
+    throw new AuthError(`Token refresh failed (${res.status}): ${await safeErrorSummary(res)}`);
   }
   const data = await res.json();
   return {
@@ -330,11 +400,91 @@ async function refreshUserToken(refreshToken2, profile = "default") {
     scope: data.scope
   };
 }
-function startOAuthCallbackServer(clientId, clientSecret) {
-  return waitForAuthCode().then(
+function startOAuthCallbackServer(clientId, clientSecret, expectedState) {
+  return waitForAuthCode(expectedState).then(
     (code) => exchangeCodeForToken(code, clientId, clientSecret)
   );
 }
+async function revokeToken(token, clientId, clientSecret) {
+  try {
+    const res = await fetch("https://auth.worksmobile.com/oauth2/v2.0/revoke", {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        token,
+        client_id: clientId,
+        client_secret: clientSecret
+      }).toString()
+    });
+    if (!res.ok && process.env["NWORKS_VERBOSE"] === "1") {
+      console.error(`[nworks] Token revoke returned ${res.status}`);
+    }
+  } catch {
+  }
+}
+
+// src/auth/scopes.ts
+var READ_SCOPES = [
+  "calendar.read",
+  "file.read",
+  "mail.read",
+  "task.read",
+  "user.read",
+  "board.read",
+  "contact.read"
+];
+var ALL_SCOPES = [
+  "calendar",
+  "calendar.read",
+  "file",
+  "file.read",
+  "mail",
+  "mail.read",
+  "task",
+  "task.read",
+  "user.read",
+  "board",
+  "board.read",
+  "contact",
+  "contact.read"
+];
+var SCOPE_DEPENDENCIES = {
+  calendar: ["calendar.read"],
+  file: ["file.read"],
+  mail: ["mail.read"],
+  task: ["task.read", "user.read"],
+  "task.read": ["user.read"],
+  board: ["board.read"],
+  contact: ["contact.read"]
+};
+var SCOPE_PRESETS = {
+  readonly: READ_SCOPES,
+  // default를 all로 두는 이유: 현재 제품의 "한 번 로그인으로 전체 기능" 약속을 보존한다.
+  // 읽기 전용을 기본값으로 하면 신규 사용자가 쓰기 기능(일정 생성 등)을 쓸 때 재로그인해야 한다.
+  // 안전을 최우선하려면 readonly로 바꾸면 되지만, 삭제류 도구는 이미 destructiveHint
+  // annotation으로 클라이언트 승인 게이트가 걸린다.
+  default: ALL_SCOPES,
+  all: ALL_SCOPES
+};
+function isPreset(value) {
+  return value === "readonly" || value === "default" || value === "all";
+}
+function expandScopeDependencies(scopes) {
+  const expanded = new Set(scopes);
+  for (const scope of scopes) {
+    const deps = SCOPE_DEPENDENCIES[scope];
+    if (deps) deps.forEach((d) => expanded.add(d));
+  }
+  return [...expanded];
+}
+function resolveScopes(input) {
+  if (!input) return SCOPE_PRESETS.default;
+  if (isPreset(input)) return SCOPE_PRESETS[input];
+  return expandScopeDependencies(input.split(" ").filter(Boolean));
+}
+function mergeScopes(existing, requested) {
+  return [.../* @__PURE__ */ new Set([...existing, ...requested])].join(" ");
+}
 
 // src/output/format.ts
 function output(data, opts = {}) {
@@ -422,11 +572,24 @@ async function prompt(question) {
     rl.close();
   }
 }
-var loginCommand = new Command("login").description("Authenticate with NAVER WORKS").option("--user", "User OAuth login (opens browser)").option("--scope <scope>", "OAuth scope for user login", "calendar.read").option("--client-id <id>", "Client ID").option("--client-secret <secret>", "Client Secret").option("--service-account <account>", "Service Account ID").option("--private-key <path>", "Path to private key file (.key)").option("--bot-id <id>", "Bot ID").option("--domain-id <id>", "Domain ID (optional)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+async function promptSecret(question) {
+  process.stdout.write(question);
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  rl._writeToOutput = () => {
+  };
+  try {
+    const answer = await rl.question("");
+    process.stdout.write("\n");
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+var loginCommand = new Command("login").description("Authenticate with NAVER WORKS").option("--user", "User OAuth login (opens browser)").option("--preset <preset>", "Scope preset: readonly | default | all (default: all)").option("--scope <scope>", "Advanced: raw space-separated scopes (overrides --preset)").option("--client-id <id>", "Client ID").option("--client-secret <secret>", "Client Secret").option("--service-account <account>", "Service Account ID").option("--private-key <path>", "Path to private key file (.key)").option("--bot-id <id>", "Bot ID").option("--domain-id <id>", "Domain ID (optional)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
   try {
     const profile = opts.profile;
     if (opts.user) {
-      await handleUserLogin(opts.scope, profile, opts);
+      await handleUserLogin(profile, opts);
     } else {
       await handleServiceAccountLogin(opts);
     }
@@ -436,7 +599,7 @@ var loginCommand = new Command("login").description("Authenticate with NAVER WOR
     process.exitCode = 1;
   }
 });
-async function handleUserLogin(scope, profile, opts) {
+async function handleUserLogin(profile, opts) {
   let clientId = opts.clientId;
   let clientSecret = opts.clientSecret;
   try {
@@ -447,7 +610,7 @@ async function handleUserLogin(scope, profile, opts) {
   }
   if (process.stdin.isTTY) {
     if (!clientId) clientId = await prompt("Client ID: ");
-    if (!clientSecret) clientSecret = await prompt("Client Secret: ");
+    if (!clientSecret) clientSecret = await promptSecret("Client Secret: ");
   }
   if (!clientId || !clientSecret) {
     throw new Error(
@@ -460,22 +623,31 @@ async function handleUserLogin(scope, profile, opts) {
   } catch {
     await saveCredentials({ clientId, clientSecret }, profile);
   }
+  const requestedScopes = resolveScopes(opts.preset ?? opts.scope);
+  let existingScopes = [];
+  try {
+    const existingToken = await loadUserToken(profile);
+    existingScopes = existingToken?.scope?.split(" ").filter(Boolean) ?? [];
+  } catch {
+  }
+  const mergedScope = mergeScopes(existingScopes, requestedScopes);
   const state = randomBytes(16).toString("hex");
-  const authorizeUrl = buildAuthorizeUrl(clientId, scope, state);
+  const authorizeUrl = buildAuthorizeUrl(clientId, mergedScope, state);
   console.error(`
 Opening browser for NAVER WORKS login...`);
   console.error(`If the browser does not open, visit this URL:
 `);
   console.error(`  ${authorizeUrl}
 `);
-  const { exec } = await import("child_process");
-  const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  if (process.platform === "win32") {
-    exec(`start "" "${authorizeUrl}"`);
+  const { execFile } = await import("child_process");
+  if (process.platform === "darwin") {
+    execFile("open", [authorizeUrl]);
+  } else if (process.platform === "win32") {
+    execFile("cmd", ["/c", "start", "", authorizeUrl]);
   } else {
-    exec(`${openCmd} "${authorizeUrl}"`);
+    execFile("xdg-open", [authorizeUrl]);
   }
-  const tokenData = await startUserOAuthFlow(scope, profile);
+  const tokenData = await startUserOAuthFlow(mergedScope, profile, state);
   await saveUserToken(tokenData, profile);
   output(
     {
@@ -502,7 +674,7 @@ async function handleServiceAccountLogin(opts) {
   if (!botId) botId = process.env["NWORKS_BOT_ID"];
   if (process.stdin.isTTY) {
     if (!clientId) clientId = await prompt("Client ID: ");
-    if (!clientSecret) clientSecret = await prompt("Client Secret: ");
+    if (!clientSecret) clientSecret = await promptSecret("Client Secret: ");
     if (!serviceAccount)
       serviceAccount = await prompt("Service Account: ");
     if (!privateKeyPath)
@@ -564,10 +736,10 @@ var REQUIRED_SCOPES = {
   "board.create": "board"
 };
 var ERROR_HINTS_CLI = {
-  FORBIDDEN: "\uAD8C\uD55C\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4. Developer Console\uC5D0\uC11C OAuth Scope\uB97C \uD655\uC778\uD558\uC138\uC694.",
-  ACCESS_DENIED: "\uC811\uADFC\uC774 \uAC70\uBD80\uB410\uC2B5\uB2C8\uB2E4. Admin\uC5D0\uC11C Bot\uC744 \uCD94\uAC00\uD588\uB294\uC9C0 \uD655\uC778\uD558\uC138\uC694.",
-  SERVICE_ACCOUNT_NOT_ALLOWED: "\uC11C\uBE44\uC2A4 \uACC4\uC815\uC73C\uB85C\uB294 \uC774 API\uB97C \uC0AC\uC6A9\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. `nworks login --user`\uB85C User OAuth \uB85C\uADF8\uC778\uD558\uC138\uC694.",
-  UNAUTHORIZED: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. `nworks login`\uC73C\uB85C \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694."
+  FORBIDDEN: "Insufficient permission. Check the OAuth scopes in the Developer Console.",
+  ACCESS_DENIED: "Access denied. Make sure the Bot is added in the Admin console.",
+  SERVICE_ACCOUNT_NOT_ALLOWED: "This API is not available with a Service Account. Log in with User OAuth via `nworks login --user`.",
+  UNAUTHORIZED: "Authentication expired. Log in again with `nworks login`."
 };
 var ERROR_HINTS_MCP = {
   FORBIDDEN: "\uAD8C\uD55C\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4. Developer Console\uC5D0\uC11C OAuth Scope\uB97C \uD655\uC778\uD558\uC138\uC694.",
@@ -615,7 +787,7 @@ function buildScopeHint(area, mode) {
   const scopes = scope.split(" ").join(", ");
   if (mode === "cli") {
     return `
-  \u2192 \uC774 \uBA85\uB839\uC5B4\uB294 ${scopes} scope\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \`nworks login --user --scope "${scope}"\`\uB97C \uC2E4\uD589\uD558\uC138\uC694.`;
+  \u2192 This command requires the ${scopes} scope(s). Run \`nworks login --user --scope "${scope}"\`.`;
   }
   return `
   \u2192 \uC774 API\uB294 ${scopes} scope\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. nworks_login_user tool\uB85C \uB85C\uADF8\uC778\uD558\uC138\uC694 (scope\uB97C \uC9C0\uC815\uD558\uC9C0 \uC54A\uC73C\uBA74 \uC804\uCCB4 \uAD8C\uD55C\uC774 \uC790\uB3D9 \uD3EC\uD568\uB429\uB2C8\uB2E4).`;
@@ -652,6 +824,18 @@ function cliError(err, opts = {}, area) {
 var logoutCommand = new Command2("logout").description("Remove stored credentials and tokens").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
   try {
     const profile = opts.profile;
+    try {
+      const creds = await loadCredentials(profile);
+      const token = await loadToken(profile);
+      const userToken = await loadUserToken(profile);
+      if (token?.accessToken) {
+        await revokeToken(token.accessToken, creds.clientId, creds.clientSecret);
+      }
+      if (userToken?.refreshToken) {
+        await revokeToken(userToken.refreshToken, creds.clientId, creds.clientSecret);
+      }
+    } catch {
+    }
     await clearCredentials(profile);
     output({ success: true, message: `Logged out (profile: ${profile})` }, opts);
   } catch (err) {
@@ -696,7 +880,7 @@ import { Command as Command4 } from "commander";
 var BASE_URL = "https://www.worksapis.com/v1.0";
 var MAX_RETRIES = 3;
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function request(opts, _retryCount = 0) {
   const { method, path, body, profile = "default" } = opts;
@@ -718,7 +902,9 @@ async function request(opts, _retryCount = 0) {
     return request(opts, _retryCount + 1);
   }
   if (res.status === 429 && _retryCount < MAX_RETRIES) {
-    const retryAfter = parseInt(res.headers.get("Retry-After") ?? "5", 10);
+    const MAX_RETRY_AFTER = 60;
+    const rawRetry = parseInt(res.headers.get("Retry-After") ?? "5", 10);
+    const retryAfter = Math.min(Number.isNaN(rawRetry) ? 5 : rawRetry, MAX_RETRY_AFTER);
     await sleep(retryAfter * 1e3);
     return request(opts, _retryCount + 1);
   }
@@ -743,6 +929,59 @@ async function request(opts, _retryCount = 0) {
   return JSON.parse(text);
 }
 
+// src/utils/sanitize.ts
+import { resolve, sep } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+function sanitizePathSegment(value) {
+  if (!value || typeof value !== "string") {
+    throw new Error("Path segment must be a non-empty string");
+  }
+  if (value === "me") return value;
+  if (/[/\\]/.test(value) || value.includes("..")) {
+    throw new Error(`Invalid path segment: "${value}"`);
+  }
+  return encodeURIComponent(value);
+}
+function sanitizeFileName(name) {
+  if (!name || typeof name !== "string") {
+    throw new Error("File name must be a non-empty string");
+  }
+  const segments = name.split(/[/\\]/).filter((s) => s.length > 0);
+  const base = segments[segments.length - 1] ?? "";
+  return base.replace(/[\r\n"]/g, "_");
+}
+function validateLocalPath(filePath, allowedBase) {
+  const resolved = resolve(filePath);
+  if (allowedBase) {
+    const resolvedBase = resolve(allowedBase);
+    if (resolved !== resolvedBase && !resolved.startsWith(resolvedBase + sep)) {
+      throw new Error(`Path "${filePath}" escapes the allowed directory "${allowedBase}"`);
+    }
+  }
+  return resolved;
+}
+function validateRedirectUrl(location, allowedHosts) {
+  let parsed;
+  try {
+    parsed = new URL(location);
+  } catch {
+    throw new Error(`Invalid redirect URL: "${location}"`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Redirect URL must use HTTPS: "${location}"`);
+  }
+  const isAllowed = allowedHosts.some(
+    (host) => parsed.hostname === host || parsed.hostname.endsWith("." + host)
+  );
+  if (!isAllowed) {
+    throw new Error(`Redirect to untrusted host: "${parsed.hostname}"`);
+  }
+  return location;
+}
+function generateSecureState() {
+  return randomBytes2(32).toString("hex");
+}
+
 // src/api/message.ts
 function buildContent(opts) {
   const type = opts.type ?? "text";
@@ -750,7 +989,11 @@ function buildContent(opts) {
     return { type: "text", text: opts.text };
   }
   if (type === "button") {
-    const actions = opts.actions ? JSON.parse(opts.actions) : [];
+    const actions = opts.actions ? (() => {
+      const parsed = JSON.parse(opts.actions);
+      if (!Array.isArray(parsed)) throw new Error("actions must be a JSON array");
+      return parsed;
+    })() : [];
     return {
       type: "button_template",
       contentText: opts.text,
@@ -758,7 +1001,11 @@ function buildContent(opts) {
     };
   }
   if (type === "list") {
-    const elements = opts.elements ? JSON.parse(opts.elements) : [];
+    const elements = opts.elements ? (() => {
+      const parsed = JSON.parse(opts.elements);
+      if (!Array.isArray(parsed)) throw new Error("elements must be a JSON array");
+      return parsed;
+    })() : [];
     return {
       type: "list_template",
       coverData: { text: opts.text },
@@ -780,7 +1027,7 @@ async function send(opts) {
   if (opts.to) {
     const result = await request({
       method: "POST",
-      path: `/bots/${creds.botId}/users/${opts.to}/messages`,
+      path: `/bots/${sanitizePathSegment(creds.botId)}/users/${sanitizePathSegment(opts.to)}/messages`,
       body,
       profile
     });
@@ -789,7 +1036,7 @@ async function send(opts) {
   if (opts.channel) {
     const result = await request({
       method: "POST",
-      path: `/bots/${creds.botId}/channels/${opts.channel}/messages`,
+      path: `/bots/${sanitizePathSegment(creds.botId)}/channels/${sanitizePathSegment(opts.channel)}/messages`,
       body,
       profile
     });
@@ -806,7 +1053,7 @@ async function listMembers(channelId, profile = "default") {
   }
   const result = await request({
     method: "GET",
-    path: `/bots/${creds.botId}/channels/${channelId}/members`,
+    path: `/bots/${sanitizePathSegment(creds.botId)}/channels/${sanitizePathSegment(channelId)}/members`,
     profile
   });
   return { members: result.members ?? [], responseMetaData: result.responseMetaData };
@@ -854,20 +1101,25 @@ var messageCommand = new Command4("message").description("Bot message operations
 import { Command as Command5 } from "commander";
 
 // src/api/directory.ts
-async function listUsers(profile = "default") {
+async function listUsers(count = 100, cursor, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
   const result = await request({
     method: "GET",
-    path: "/users",
+    path: `/users?${params.toString()}`,
     profile
   });
   return { users: result.users ?? [], responseMetaData: result.responseMetaData };
 }
 
 // src/commands/directory.ts
-var membersCommand2 = new Command5("members").description("List organization members (requires directory.read scope)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+var membersCommand2 = new Command5("members").description("List organization members (requires directory.read scope)").option("--count <n>", "Items per page (default: 100)").option("--cursor <cursor>", "Pagination cursor from a previous response").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
   try {
-    const result = await listUsers(opts.profile);
+    const count = opts.count ? Number(opts.count) : 100;
+    const result = await listUsers(count, opts.cursor, opts.profile);
     const formatted = {
+      nextCursor: result.responseMetaData?.nextCursor ?? null,
       users: result.users.map((u) => ({
         userId: u.userId,
         userName: [u.userName?.lastName, u.userName?.firstName].filter(Boolean).join(" ") || "",
@@ -890,6 +1142,7 @@ import { Command as Command6 } from "commander";
 import { randomUUID } from "crypto";
 
 // src/auth/token-user.ts
+var inFlightRefresh = /* @__PURE__ */ new Map();
 async function getValidUserToken(profile = "default") {
   const cached = await loadUserToken(profile);
   if (!cached) {
@@ -900,22 +1153,106 @@ async function getValidUserToken(profile = "default") {
   if (cached.expiresAt > Date.now() / 1e3 + 300) {
     return cached.accessToken;
   }
+  return refreshValidUserToken(profile);
+}
+function refreshValidUserToken(profile = "default") {
+  const existing = inFlightRefresh.get(profile);
+  if (existing) return existing;
+  const run = doRefresh(profile);
+  inFlightRefresh.set(profile, run);
+  void run.finally(() => inFlightRefresh.delete(profile)).catch(() => {
+  });
+  return run;
+}
+async function doRefresh(profile) {
+  const cached = await loadUserToken(profile);
+  if (!cached) {
+    throw new AuthError(
+      "User OAuth token not found. Run `nworks login --user` first."
+    );
+  }
   const refreshed = await refreshUserToken(cached.refreshToken, profile);
   await saveUserToken(refreshed, profile);
   return refreshed.accessToken;
 }
 
-// src/api/calendar.ts
-var BASE_URL2 = "https://www.worksapis.com/v1.0";
-async function authedFetch(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
+// src/api/user-client.ts
+var MAX_RETRIES2 = 3;
+var MAX_RETRY_AFTER_SECONDS = 60;
+var MAX_CONCURRENT_PER_HOST = 5;
+function sleep2(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+var HostSemaphore = class {
+  constructor(max) {
+    this.max = max;
+  }
+  active = 0;
+  waiters = [];
+  async acquire() {
+    if (this.active < this.max) {
+      this.active++;
+      return;
+    }
+    await new Promise((resolve3) => this.waiters.push(resolve3));
+  }
+  release() {
+    const next = this.waiters.shift();
+    if (next) {
+      next();
+    } else {
+      this.active--;
+    }
+  }
+};
+var semaphores = /* @__PURE__ */ new Map();
+function semaphoreFor(host) {
+  let semaphore = semaphores.get(host);
+  if (!semaphore) {
+    semaphore = new HostSemaphore(MAX_CONCURRENT_PER_HOST);
+    semaphores.set(host, semaphore);
+  }
+  return semaphore;
 }
-async function handleError(res) {
+async function userFetch(url, init, profile) {
+  let refreshedOn401 = false;
+  for (let attempt = 0; ; attempt++) {
+    const res = await fetchOnce(url, init, profile);
+    if (res.status === 401 && !refreshedOn401) {
+      refreshedOn401 = true;
+      await refreshValidUserToken(profile);
+      continue;
+    }
+    if (res.status === 429 && attempt < MAX_RETRIES2) {
+      await sleep2(retryAfterMs(res));
+      continue;
+    }
+    return res;
+  }
+}
+async function fetchOnce(url, init, profile) {
+  const host = new URL(url).host;
+  const semaphore = semaphoreFor(host);
+  await semaphore.acquire();
+  try {
+    const token = await getValidUserToken(profile);
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return await fetch(url, { ...init, headers });
+  } finally {
+    semaphore.release();
+  }
+}
+function retryAfterMs(res) {
+  const raw = parseInt(res.headers.get("Retry-After") ?? "5", 10);
+  const seconds = Math.min(Number.isNaN(raw) ? 5 : raw, MAX_RETRY_AFTER_SECONDS);
+  return seconds * 1e3;
+}
+async function handleUserApiError(res) {
   if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope calendar` again.");
+    throw new AuthError(
+      "User token expired or revoked. Run `nworks login --user` again."
+    );
   }
   let code = "UNKNOWN";
   let description = `HTTP ${res.status}`;
@@ -927,6 +1264,9 @@ async function handleError(res) {
   }
   throw new ApiError(code, description, res.status);
 }
+
+// src/api/calendar.ts
+var BASE_URL2 = "https://www.worksapis.com/v1.0";
 function generateEventId() {
   return `event-${randomUUID()}`;
 }
@@ -940,12 +1280,12 @@ function normalizeDateTime(dt) {
 async function listEvents(fromDateTime, untilDateTime, userId = "me", profile = "default") {
   const from = encodeURIComponent(fromDateTime);
   const until = encodeURIComponent(untilDateTime);
-  const url = `${BASE_URL2}/users/${userId}/calendar/events?fromDateTime=${from}&untilDateTime=${until}`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events?fromDateTime=${from}&untilDateTime=${until}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return { events: data.events ?? [] };
 }
@@ -977,12 +1317,12 @@ async function createEvent(opts) {
     eventComponents: [eventComponent],
     sendNotification: opts.sendNotification ?? false
   };
-  const url = `${BASE_URL2}/users/${userId}/calendar/events`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${url}`);
-    console.error(`[nworks] Body: ${JSON.stringify(body, null, 2)}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch(
+  const res = await userFetch(
     url,
     {
       method: "POST",
@@ -994,16 +1334,16 @@ async function createEvent(opts) {
   if (res.status === 201) {
     return await res.json();
   }
-  if (!res.ok) return handleError(res);
+  if (!res.ok) return handleUserApiError(res);
   return await res.json();
 }
 async function getEvent(eventId, userId = "me", profile = "default") {
-  const url = `${BASE_URL2}/users/${userId}/calendar/events/${eventId}`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events/${sanitizePathSegment(eventId)}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   const event = data.eventComponents[0];
   if (!event) throw new ApiError("NOT_FOUND", "Event not found", 404);
@@ -1041,12 +1381,12 @@ async function updateEvent(opts) {
     eventComponents: [eventComponent],
     sendNotification: opts.sendNotification ?? false
   };
-  const url = `${BASE_URL2}/users/${userId}/calendar/events/${opts.eventId}`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events/${sanitizePathSegment(opts.eventId)}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] PUT ${url}`);
-    console.error(`[nworks] Body: ${JSON.stringify(body, null, 2)}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch(
+  const res = await userFetch(
     url,
     {
       method: "PUT",
@@ -1055,18 +1395,18 @@ async function updateEvent(opts) {
     },
     profile
   );
-  if (!res.ok) return handleError(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 async function deleteEvent(eventId, userId = "me", sendNotification = false, profile = "default") {
   const params = new URLSearchParams();
   params.set("sendNotification", String(sendNotification));
-  const url = `${BASE_URL2}/users/${userId}/calendar/events/${eventId}?${params.toString()}`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events/${sanitizePathSegment(eventId)}?${params.toString()}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] DELETE ${url}`);
   }
-  const res = await authedFetch(url, { method: "DELETE" }, profile);
+  const res = await userFetch(url, { method: "DELETE" }, profile);
   if (res.status === 204) return;
-  if (!res.ok) return handleError(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 
 // src/commands/calendar.ts
@@ -1186,32 +1526,19 @@ import { join as join2 } from "path";
 import { Command as Command7 } from "commander";
 
 // src/api/drive.ts
-import { readFile as readFile4, stat } from "fs/promises";
+import { readFile as readFile4, stat as stat2 } from "fs/promises";
 import { basename } from "path";
 var BASE_URL3 = "https://www.worksapis.com/v1.0";
-async function authedFetch2(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError2(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope file` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
+var MAX_UPLOAD_SIZE = 100 * 1024 * 1024;
+var ALLOWED_HOSTS = [
+  "storage.worksmobile.com",
+  "apis-storage.worksmobile.com",
+  "www.worksapis.com",
+  "worksapis.com"
+];
 async function listFiles(userId = "me", folderId, count = 20, cursor, profile = "default") {
-  const base = `${BASE_URL3}/users/${userId}/drive/files`;
-  const path = folderId ? `${base}/${folderId}/children` : base;
+  const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
+  const path = folderId ? `${base}/${sanitizePathSegment(folderId)}/children` : base;
   const params = new URLSearchParams();
   params.set("count", String(count));
   if (cursor) params.set("cursor", cursor);
@@ -1219,21 +1546,25 @@ async function listFiles(userId = "me", folderId, count = 20, cursor, profile =
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch2(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError2(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return { files: data.files ?? [], responseMetaData: data.responseMetaData };
 }
 async function uploadFile(localPath, userId = "me", folderId, overwrite = false, profile = "default") {
   const fileName = basename(localPath);
-  const fileStat = await stat(localPath);
+  const safeName = sanitizeFileName(fileName);
+  const fileStat = await stat2(localPath);
   const fileSize = fileStat.size;
-  const base = `${BASE_URL3}/users/${userId}/drive/files`;
-  const createUrl = folderId ? `${base}/${folderId}` : base;
+  if (fileSize > MAX_UPLOAD_SIZE) {
+    throw new ApiError("FILE_TOO_LARGE", `File size (${fileSize} bytes) exceeds maximum allowed (${MAX_UPLOAD_SIZE} bytes)`, 413);
+  }
+  const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
+  const createUrl = folderId ? `${base}/${sanitizePathSegment(folderId)}` : base;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${createUrl} (create upload URL)`);
   }
-  const createRes = await authedFetch2(
+  const createRes = await userFetch(
     createUrl,
     {
       method: "POST",
@@ -1242,13 +1573,14 @@ async function uploadFile(localPath, userId = "me", folderId, overwrite = false,
     },
     profile
   );
-  if (!createRes.ok) return handleError2(createRes);
+  if (!createRes.ok) return handleUserApiError(createRes);
   const { uploadUrl } = await createRes.json();
+  validateRedirectUrl(uploadUrl, ALLOWED_HOSTS);
   const fileBuffer = await readFile4(localPath);
   const boundary = `----nworks${Date.now()}`;
   const header = Buffer.from(
     `--${boundary}\r
-Content-Disposition: form-data; name="Filedata"; filename="${fileName}"\r
+Content-Disposition: form-data; name="Filedata"; filename="${safeName}"\r
 Content-Type: application/octet-stream\r
 \r
 `
@@ -1260,7 +1592,7 @@ Content-Type: application/octet-stream\r
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${uploadUrl} (upload content, ${fileSize} bytes)`);
   }
-  const uploadRes = await authedFetch2(
+  const uploadRes = await userFetch(
     uploadUrl,
     {
       method: "POST",
@@ -1269,17 +1601,20 @@ Content-Type: application/octet-stream\r
     },
     profile
   );
-  if (!uploadRes.ok) return handleError2(uploadRes);
+  if (!uploadRes.ok) return handleUserApiError(uploadRes);
   return await uploadRes.json();
 }
 async function uploadBuffer(fileBuffer, fileName, userId = "me", folderId, overwrite = false, profile = "default") {
   const fileSize = fileBuffer.length;
-  const base = `${BASE_URL3}/users/${userId}/drive/files`;
-  const createUrl = folderId ? `${base}/${folderId}` : base;
+  if (fileSize > MAX_UPLOAD_SIZE) {
+    throw new ApiError("FILE_TOO_LARGE", `File size (${fileSize} bytes) exceeds maximum allowed (${MAX_UPLOAD_SIZE} bytes)`, 413);
+  }
+  const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
+  const createUrl = folderId ? `${base}/${sanitizePathSegment(folderId)}` : base;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${createUrl} (create upload URL for buffer)`);
   }
-  const createRes = await authedFetch2(
+  const createRes = await userFetch(
     createUrl,
     {
       method: "POST",
@@ -1288,12 +1623,13 @@ async function uploadBuffer(fileBuffer, fileName, userId = "me", folderId, overw
     },
     profile
   );
-  if (!createRes.ok) return handleError2(createRes);
+  if (!createRes.ok) return handleUserApiError(createRes);
   const { uploadUrl } = await createRes.json();
+  validateRedirectUrl(uploadUrl, ALLOWED_HOSTS);
   const boundary = `----nworks${Date.now()}`;
   const header = Buffer.from(
     `--${boundary}\r
-Content-Disposition: form-data; name="Filedata"; filename="${fileName}"\r
+Content-Disposition: form-data; name="Filedata"; filename="${sanitizeFileName(fileName)}"\r
 Content-Type: application/octet-stream\r
 \r
 `
@@ -1305,7 +1641,7 @@ Content-Type: application/octet-stream\r
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${uploadUrl} (upload buffer, ${fileSize} bytes)`);
   }
-  const uploadRes = await authedFetch2(
+  const uploadRes = await userFetch(
     uploadUrl,
     {
       method: "POST",
@@ -1314,32 +1650,29 @@ Content-Type: application/octet-stream\r
     },
     profile
   );
-  if (!uploadRes.ok) return handleError2(uploadRes);
+  if (!uploadRes.ok) return handleUserApiError(uploadRes);
   return await uploadRes.json();
 }
-async function downloadFile(fileId, userId = "me", profile = "default") {
-  const url = `${BASE_URL3}/users/${userId}/drive/files/${fileId}/download`;
+async function downloadViaRedirect(url, profile) {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url} (get download URL)`);
   }
-  const redirectRes = await authedFetch2(
+  const redirectRes = await userFetch(
     url,
     { method: "GET", redirect: "manual" },
     profile
   );
-  if (redirectRes.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope file` again.");
-  }
   const location = redirectRes.headers.get("location");
   if (!location) {
-    if (!redirectRes.ok) return handleError2(redirectRes);
+    if (!redirectRes.ok) return handleUserApiError(redirectRes);
     throw new ApiError("NO_REDIRECT", "No download URL returned", redirectRes.status);
   }
+  const safeLocation = validateRedirectUrl(location, ALLOWED_HOSTS);
   if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] GET ${location} (download content)`);
+    console.error(`[nworks] GET ${safeLocation} (download content)`);
   }
-  const downloadRes = await authedFetch2(location, { method: "GET" }, profile);
-  if (!downloadRes.ok) return handleError2(downloadRes);
+  const downloadRes = await userFetch(safeLocation, { method: "GET" }, profile);
+  if (!downloadRes.ok) return handleUserApiError(downloadRes);
   const arrayBuffer = await downloadRes.arrayBuffer();
   const buffer = Buffer.from(arrayBuffer);
   const disposition = downloadRes.headers.get("content-disposition");
@@ -1352,6 +1685,42 @@ async function downloadFile(fileId, userId = "me", profile = "default") {
   }
   return { buffer, fileName };
 }
+async function downloadFile(fileId, userId = "me", profile = "default") {
+  const url = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files/${sanitizePathSegment(fileId)}/download`;
+  return downloadViaRedirect(url, profile);
+}
+async function listSharedDrives(count = 20, cursor, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${BASE_URL3}/sharedrives?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { sharedDrives: data.sharedrives ?? [], responseMetaData: data.responseMetaData };
+}
+async function listSharedDriveFiles(sharedriveId, folderId, count = 20, cursor, profile = "default") {
+  const base = `${BASE_URL3}/sharedrives/${sanitizePathSegment(sharedriveId)}/files`;
+  const path = folderId ? `${base}/${sanitizePathSegment(folderId)}/children` : base;
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${path}?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { files: data.files ?? [], responseMetaData: data.responseMetaData };
+}
+async function downloadSharedDriveFile(sharedriveId, fileId, profile = "default") {
+  const url = `${BASE_URL3}/sharedrives/${sanitizePathSegment(sharedriveId)}/files/${sanitizePathSegment(fileId)}/download`;
+  return downloadViaRedirect(url, profile);
+}
 
 // src/commands/drive.ts
 var listCommand2 = new Command7("list").description("List files in Drive (requires User OAuth with file or file.read scope)").option("--user <userId>", "Target user ID (default: me)").option("--folder <folderId>", "Folder ID to list (default: root)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
@@ -1445,37 +1814,90 @@ var downloadCommand = new Command7("download").description("Download a file from
     cliError(err, opts, "drive");
   }
 });
-var driveCommand = new Command7("drive").description("Drive operations (requires User OAuth with file scope)").addCommand(listCommand2).addCommand(uploadCommand).addCommand(downloadCommand);
+var sharedriveListCommand = new Command7("sharedrive-list").description("List shared drives (requires User OAuth with file or file.read scope)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await listSharedDrives(
+      parseInt(opts.count, 10),
+      opts.cursor,
+      opts.profile
+    );
+    output(
+      {
+        sharedDrives: result.sharedDrives,
+        count: result.sharedDrives.length,
+        nextCursor: result.responseMetaData?.nextCursor ?? null
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "drive");
+  }
+});
+var sharedriveFilesCommand = new Command7("sharedrive-files").description("List files in a shared drive (requires User OAuth with file or file.read scope)").requiredOption("--sharedrive <sharedriveId>", "Shared drive ID (from sharedrive-list)").option("--folder <fileId>", "Folder ID to list (default: root)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await listSharedDriveFiles(
+      opts.sharedrive,
+      opts.folder,
+      parseInt(opts.count, 10),
+      opts.cursor,
+      opts.profile
+    );
+    const files = result.files.map((f) => ({
+      name: f.fileName,
+      type: f.fileType,
+      size: f.fileSize,
+      modified: f.modifiedTime,
+      fileId: f.fileId
+    }));
+    output(
+      {
+        files,
+        count: files.length,
+        nextCursor: result.responseMetaData?.nextCursor ?? null
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "drive");
+  }
+});
+var sharedriveDownloadCommand = new Command7("sharedrive-download").description("Download a file from a shared drive (requires User OAuth with file or file.read scope)").requiredOption("--sharedrive <sharedriveId>", "Shared drive ID (from sharedrive-list)").requiredOption("--file-id <fileId>", "File ID to download").option("--out <path>", "Output directory (default: current directory)").option("--name <filename>", "Output filename (default: original name)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await downloadSharedDriveFile(
+      opts.sharedrive,
+      opts.fileId,
+      opts.profile
+    );
+    const fileName = opts.name ?? result.fileName ?? opts.fileId;
+    const outDir = opts.out ?? process.cwd();
+    const outPath = join2(outDir, fileName);
+    await writeFile2(outPath, result.buffer);
+    output(
+      {
+        success: true,
+        fileName,
+        path: outPath,
+        size: result.buffer.length
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "drive");
+  }
+});
+var driveCommand = new Command7("drive").description("Drive operations (requires User OAuth with file scope)").addCommand(listCommand2).addCommand(uploadCommand).addCommand(downloadCommand).addCommand(sharedriveListCommand).addCommand(sharedriveFilesCommand).addCommand(sharedriveDownloadCommand);
 
 // src/commands/mail.ts
+import { writeFile as writeFile3 } from "fs/promises";
+import { join as join3 } from "path";
 import { Command as Command8 } from "commander";
 
 // src/api/mail.ts
 var BASE_URL4 = "https://www.worksapis.com/v1.0";
-async function authedFetch3(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError3(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope mail` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
 async function sendMail(opts) {
   const userId = opts.userId ?? "me";
   const profile = opts.profile ?? "default";
-  const url = `${BASE_URL4}/users/${userId}/mail`;
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${url}`);
   }
@@ -1487,7 +1909,7 @@ async function sendMail(opts) {
   if (opts.cc) body.cc = opts.cc;
   if (opts.bcc) body.bcc = opts.bcc;
   if (opts.contentType) body.contentType = opts.contentType;
-  const res = await authedFetch3(
+  const res = await userFetch(
     url,
     {
       method: "POST",
@@ -1497,19 +1919,19 @@ async function sendMail(opts) {
     profile
   );
   if (res.status === 202) return;
-  if (!res.ok) return handleError3(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 async function listMails(folderId = 0, userId = "me", count = 30, cursor, isUnread, profile = "default") {
   const params = new URLSearchParams();
   params.set("count", String(count));
   if (cursor) params.set("cursor", cursor);
   if (isUnread) params.set("isUnread", "true");
-  const url = `${BASE_URL4}/users/${userId}/mail/mailfolders/${folderId}/children?${params.toString()}`;
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/mailfolders/${sanitizePathSegment(String(folderId))}/children?${params.toString()}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch3(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError3(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return {
     mails: data.mails ?? [],
@@ -1520,14 +1942,26 @@ async function listMails(folderId = 0, userId = "me", count = 30, cursor, isUnre
   };
 }
 async function readMail(mailId, userId = "me", profile = "default") {
-  const url = `${BASE_URL4}/users/${userId}/mail/${mailId}`;
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/${sanitizePathSegment(String(mailId))}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch3(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError3(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   return await res.json();
 }
+async function downloadAttachment(mailId, attachmentId, userId = "me", profile = "default") {
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/${sanitizePathSegment(
+    String(mailId)
+  )}/attachments/${sanitizePathSegment(String(attachmentId))}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { buffer: Buffer.from(data.data, "base64"), filename: data.filename };
+}
 
 // src/commands/mail.ts
 var sendCommand2 = new Command8("send").description("Send a mail (requires User OAuth with mail scope)").requiredOption("--to <emails>", "Recipient email addresses (separate with ;)").requiredOption("--subject <subject>", "Mail subject").option("--body <body>", "Mail body content").option("--cc <emails>", "CC email addresses (separate with ;)").option("--bcc <emails>", "BCC email addresses (separate with ;)").option("--content-type <type>", "Body format: html or text", "html").option("--user <userId>", "Sender user ID (default: me)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").option("--dry-run", "Print request without sending").action(async (opts) => {
@@ -1615,41 +2049,46 @@ var readCommand = new Command8("read").description("Read a specific mail (requir
     cliError(err, opts, "mail");
   }
 });
-var mailCommand = new Command8("mail").description("Mail operations (requires User OAuth with mail scope)").addCommand(sendCommand2).addCommand(listCommand3).addCommand(readCommand);
+var downloadAttachmentCommand = new Command8("download-attachment").description("Download a mail attachment (requires User OAuth with mail or mail.read scope)").requiredOption("--id <mailId>", "Mail ID (from mail list)").requiredOption("--attachment-id <attachmentId>", "Attachment ID (from mail read)").option("--out <path>", "Output directory (default: current directory)").option("--name <filename>", "Output filename (default: original name)").option("--user <userId>", "Target user ID (default: me)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await downloadAttachment(
+      parseInt(opts.id, 10),
+      parseInt(opts.attachmentId, 10),
+      opts.user ?? "me",
+      opts.profile
+    );
+    const fileName = opts.name ?? result.filename;
+    const outDir = opts.out ?? process.cwd();
+    const outPath = join3(outDir, fileName);
+    await writeFile3(outPath, result.buffer);
+    output(
+      {
+        success: true,
+        fileName,
+        path: outPath,
+        size: result.buffer.length
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "mail");
+  }
+});
+var mailCommand = new Command8("mail").description("Mail operations (requires User OAuth with mail scope)").addCommand(sendCommand2).addCommand(listCommand3).addCommand(readCommand).addCommand(downloadAttachmentCommand);
 
 // src/commands/task.ts
 import { Command as Command9 } from "commander";
 
 // src/api/task.ts
 var BASE_URL5 = "https://www.worksapis.com/v1.0";
-async function authedFetch4(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError4(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope task` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
-async function resolveUserId(userId, profile) {
-  if (userId !== "me") return userId;
-  const url = `${BASE_URL5}/users/me`;
-  const res = await authedFetch4(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError4(res);
-  const data = await res.json();
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] Resolved "me" \u2192 ${data.userId}`);
+async function resolveUserId(userId, profile) {
+  if (userId !== "me") return userId;
+  const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}`;
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] Resolved "me" \u2192 ${data.userId}`);
   }
   return data.userId;
 }
@@ -1659,12 +2098,12 @@ async function listTasks(categoryId = "default", userId = "me", count = 50, curs
   params.set("count", String(count));
   params.set("status", status);
   if (cursor) params.set("cursor", cursor);
-  const url = `${BASE_URL5}/users/${userId}/tasks?${params.toString()}`;
+  const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}/tasks?${params.toString()}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch4(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError4(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return { tasks: data.tasks ?? [], responseMetaData: data.responseMetaData };
 }
@@ -1683,12 +2122,12 @@ async function createTask(opts) {
   };
   if (opts.dueDate) body.dueDate = opts.dueDate;
   if (opts.categoryId) body.categoryId = opts.categoryId;
-  const url = `${BASE_URL5}/users/${userId}/tasks`;
+  const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}/tasks`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${url}`);
-    console.error(`[nworks] Body: ${JSON.stringify(body, null, 2)}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     {
       method: "POST",
@@ -1700,7 +2139,7 @@ async function createTask(opts) {
   if (res.status === 201) {
     return await res.json();
   }
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
   return await res.json();
 }
 async function updateTask(opts) {
@@ -1709,11 +2148,11 @@ async function updateTask(opts) {
   if (opts.title !== void 0) body.title = opts.title;
   if (opts.content !== void 0) body.content = opts.content;
   if (opts.dueDate !== void 0) body.dueDate = opts.dueDate;
-  const url = `${BASE_URL5}/tasks/${opts.taskId}`;
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(opts.taskId)}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] PATCH ${url}`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     {
       method: "PATCH",
@@ -1722,47 +2161,47 @@ async function updateTask(opts) {
     },
     profile
   );
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
   return await res.json();
 }
 async function completeTask(taskId, profile = "default") {
-  const url = `${BASE_URL5}/tasks/${taskId}/complete`;
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}/complete`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${url}`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     { method: "POST" },
     profile
   );
   if (res.status === 204) return;
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 async function incompleteTask(taskId, profile = "default") {
-  const url = `${BASE_URL5}/tasks/${taskId}/incomplete`;
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}/incomplete`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${url}`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     { method: "POST" },
     profile
   );
   if (res.status === 204) return;
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 async function deleteTask(taskId, profile = "default") {
-  const url = `${BASE_URL5}/tasks/${taskId}`;
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] DELETE ${url}`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     { method: "DELETE" },
     profile
   );
   if (res.status === 204) return;
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 
 // src/commands/task.ts
@@ -1885,26 +2324,6 @@ import { Command as Command10 } from "commander";
 
 // src/api/board.ts
 var BASE_URL6 = "https://www.worksapis.com/v1.0";
-async function authedFetch5(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError5(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope board` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
 function safeParseJson(text) {
   const safe = text.replace(
     /"((?:board|post|domain|user)Id)"\s*:\s*(\d{16,})/g,
@@ -1920,11 +2339,11 @@ async function listBoards(count = 20, cursor, profile = "default") {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch5(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError5(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const text = await res.text();
   if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] Response: ${text}`);
+    console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
   }
   const data = safeParseJson(text);
   return { boards: data.boards ?? [], responseMetaData: data.responseMetaData };
@@ -1933,29 +2352,29 @@ async function listPosts(boardId, count = 20, cursor, profile = "default") {
   const params = new URLSearchParams();
   params.set("count", String(count));
   if (cursor) params.set("cursor", cursor);
-  const url = `${BASE_URL6}/boards/${boardId}/posts?${params.toString()}`;
+  const url = `${BASE_URL6}/boards/${sanitizePathSegment(boardId)}/posts?${params.toString()}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch5(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError5(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const text = await res.text();
   if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] Response: ${text}`);
+    console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
   }
   const data = safeParseJson(text);
   return { posts: data.posts ?? [], responseMetaData: data.responseMetaData };
 }
 async function readPost(boardId, postId, profile = "default") {
-  const url = `${BASE_URL6}/boards/${boardId}/posts/${postId}`;
+  const url = `${BASE_URL6}/boards/${sanitizePathSegment(boardId)}/posts/${sanitizePathSegment(postId)}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch5(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError5(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const text = await res.text();
   if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] Response: ${text}`);
+    console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
   }
   return safeParseJson(text);
 }
@@ -1967,12 +2386,12 @@ async function createPost(opts) {
   };
   if (opts.enableComment !== void 0) body.enableComment = opts.enableComment;
   if (opts.sendNotifications !== void 0) body.sendNotifications = opts.sendNotifications;
-  const url = `${BASE_URL6}/boards/${opts.boardId}/posts`;
+  const url = `${BASE_URL6}/boards/${sanitizePathSegment(opts.boardId)}/posts`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${url}`);
-    console.error(`[nworks] Body: ${JSON.stringify(body, null, 2)}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch5(
+  const res = await userFetch(
     url,
     {
       method: "POST",
@@ -1984,11 +2403,11 @@ async function createPost(opts) {
   if (res.status === 201 || res.ok) {
     const text = await res.text();
     if (process.env["NWORKS_VERBOSE"] === "1") {
-      console.error(`[nworks] Response: ${text}`);
+      console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
     }
     return safeParseJson(text);
   }
-  return handleError5(res);
+  return handleUserApiError(res);
 }
 
 // src/commands/board.ts
@@ -2086,128 +2505,256 @@ var createCommand3 = new Command10("create").description("Create a post in a boa
 });
 var boardCommand = new Command10("board").description("Board operations (requires User OAuth)").addCommand(listCommand5).addCommand(postsCommand).addCommand(readCommand2).addCommand(createCommand3);
 
-// src/commands/mcp-cmd.ts
-import { Command as Command12 } from "commander";
-
-// src/mcp/server.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-
-// src/mcp/tools.ts
-import { z } from "zod";
-
-// src/commands/doctor.ts
+// src/commands/contact.ts
 import { Command as Command11 } from "commander";
-import { existsSync as existsSync3 } from "fs";
-import { readFile as readFile5 } from "fs/promises";
-async function runChecks(profile) {
-  const results = [];
-  let creds;
-  try {
-    creds = await loadCredentials(profile);
-    results.push({ check: "credentials", status: "OK", detail: `clientId: ${creds.clientId}` });
-  } catch {
-    results.push({ check: "credentials", status: "FAIL", detail: "\uC778\uC99D \uC815\uBCF4 \uC5C6\uC74C. CLI: `nworks login --user` / MCP: nworks_setup tool \uC0AC\uC6A9 (\uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET \uD544\uC694)" });
-    return results;
+
+// src/api/contact.ts
+var BASE_URL7 = "https://www.worksapis.com/v1.0";
+async function listContacts(opts = {}) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const params = new URLSearchParams();
+  params.set("count", String(opts.count ?? 20));
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  if (opts.accessibleRange) params.set("accessibleRange", opts.accessibleRange);
+  if (opts.contactTagId) params.set("contactTagId", opts.contactTagId);
+  if (opts.email) params.set("email", opts.email);
+  if (opts.telephone) params.set("telephone", opts.telephone);
+  if (opts.orderBy) params.set("orderBy", opts.orderBy);
+  if (opts.searchDateType) params.set("searchDateType", opts.searchDateType);
+  if (opts.startDateTime) params.set("startDateTime", opts.startDateTime);
+  if (opts.endDateTime) params.set("endDateTime", opts.endDateTime);
+  const url = `${BASE_URL7}/users/${sanitizePathSegment(userId)}/contacts?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
   }
-  if (hasServiceAccountCreds(creds)) {
-    results.push({ check: "serviceAccount", status: "OK", detail: creds.serviceAccount });
-  } else {
-    results.push({ check: "serviceAccount", status: "SKIP", detail: "\uBBF8\uC124\uC815 (\uBD07 \uBA54\uC2DC\uC9C0 \uC0AC\uC6A9 \uC2DC \uD544\uC694)" });
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { contacts: data.contacts ?? [], responseMetaData: data.responseMetaData };
+}
+async function getContact(contactId, profile = "default") {
+  const url = `${BASE_URL7}/contacts/${sanitizePathSegment(contactId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
   }
-  if (creds.privateKeyPath) {
-    if (existsSync3(creds.privateKeyPath)) {
-      try {
-        await readFile5(creds.privateKeyPath, "utf-8");
-        results.push({ check: "privateKey", status: "OK", detail: creds.privateKeyPath });
-      } catch {
-        results.push({ check: "privateKey", status: "FAIL", detail: `\uC77D\uAE30 \uBD88\uAC00: ${creds.privateKeyPath}` });
-      }
-    } else {
-      results.push({ check: "privateKey", status: "FAIL", detail: `\uD30C\uC77C \uC5C6\uC74C: ${creds.privateKeyPath}` });
-    }
-  } else {
-    results.push({ check: "privateKey", status: "SKIP", detail: "\uBBF8\uC124\uC815" });
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function createContact(payload, profile = "default") {
+  const url = `${BASE_URL7}/contacts`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
   }
-  if (creds.botId) {
-    results.push({ check: "botId", status: "OK", detail: creds.botId });
-  } else {
-    results.push({ check: "botId", status: "SKIP", detail: "\uBBF8\uC124\uC815 (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)" });
+  const res = await userFetch(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    },
+    profile
+  );
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function updateContact(contactId, payload, partial = true, profile = "default") {
+  const url = `${BASE_URL7}/contacts/${sanitizePathSegment(contactId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] ${partial ? "PATCH" : "PUT"} ${url}`);
   }
-  const token = await loadToken(profile);
-  if (token) {
-    const valid = token.expiresAt > Date.now() / 1e3;
-    results.push({
-      check: "serviceToken",
-      status: valid ? "OK" : "EXPIRED",
-      detail: valid ? `\uB9CC\uB8CC: ${new Date(token.expiresAt * 1e3).toISOString()}` : `\uB9CC\uB8CC\uB428: ${new Date(token.expiresAt * 1e3).toISOString()}`
-    });
-  } else {
-    results.push({ check: "serviceToken", status: "SKIP", detail: "\uD1A0\uD070 \uC5C6\uC74C" });
+  const res = await userFetch(
+    url,
+    {
+      method: partial ? "PATCH" : "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    },
+    profile
+  );
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function deleteContact(contactId, profile = "default") {
+  const url = `${BASE_URL7}/contacts/${sanitizePathSegment(contactId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] DELETE ${url}`);
   }
-  const userToken = await loadUserToken(profile);
-  if (userToken) {
-    const valid = userToken.expiresAt > Date.now() / 1e3;
-    results.push({
-      check: "userOAuth",
-      status: valid ? "OK" : "EXPIRED",
-      detail: valid ? `scope: ${userToken.scope} | \uB9CC\uB8CC: ${new Date(userToken.expiresAt * 1e3).toISOString()}` : `\uB9CC\uB8CC\uB428 | scope: ${userToken.scope}`
+  const res = await userFetch(url, { method: "DELETE" }, profile);
+  if (res.status === 204) return;
+  if (!res.ok) return handleUserApiError(res);
+}
+async function listContactTags(opts = {}) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const params = new URLSearchParams();
+  params.set("count", String(opts.count ?? 20));
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  const url = `${BASE_URL7}/users/${sanitizePathSegment(userId)}/contact-tags?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { contactTags: data.contactTags ?? [], responseMetaData: data.responseMetaData };
+}
+
+// src/commands/contact.ts
+var listCommand6 = new Command11("list").description("List contacts (requires User OAuth with contact or contact.read scope)").option("--user <userId>", "Target user ID (default: me)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--tag <contactTagId>", "Filter by contact tag ID").option("--email <email>", "Filter by email").option("--tel <telephone>", "Filter by phone number").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await listContacts({
+      userId: opts.user ?? "me",
+      count: parseInt(opts.count, 10),
+      cursor: opts.cursor,
+      contactTagId: opts.tag,
+      email: opts.email,
+      telephone: opts.tel,
+      profile: opts.profile
     });
-  } else {
-    results.push({ check: "userOAuth", status: "SKIP", detail: "\uD1A0\uD070 \uC5C6\uC74C. `nworks login --user` \uD544\uC694" });
+    output(
+      {
+        contacts: result.contacts,
+        count: result.contacts.length,
+        nextCursor: result.responseMetaData?.nextCursor ?? null
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "contact");
   }
-  if (hasServiceAccountCreds(creds) && token && token.expiresAt > Date.now() / 1e3) {
-    try {
-      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
-        headers: { Authorization: `Bearer ${token.accessToken}` }
-      });
-      if (res.ok) {
-        results.push({ check: "apiConnection", status: "OK", detail: "NAVER WORKS API \uC5F0\uACB0 \uC131\uACF5" });
-      } else {
-        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
-      }
-    } catch (e) {
-      results.push({ check: "apiConnection", status: "FAIL", detail: `\uC5F0\uACB0 \uC2E4\uD328: ${e.message}` });
-    }
-  } else if (userToken && userToken.expiresAt > Date.now() / 1e3) {
-    try {
-      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
-        headers: { Authorization: `Bearer ${userToken.accessToken}` }
-      });
-      if (res.ok) {
-        results.push({ check: "apiConnection", status: "OK", detail: "NAVER WORKS API \uC5F0\uACB0 \uC131\uACF5" });
-      } else {
-        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
-      }
-    } catch (e) {
-      results.push({ check: "apiConnection", status: "FAIL", detail: `\uC5F0\uACB0 \uC2E4\uD328: ${e.message}` });
-    }
-  } else {
-    results.push({ check: "apiConnection", status: "SKIP", detail: "\uC720\uD6A8\uD55C \uD1A0\uD070 \uC5C6\uC74C \u2014 API \uD14C\uC2A4\uD2B8 \uAC74\uB108\uB700" });
+});
+var getCommand = new Command11("get").description("Get a contact by ID (requires User OAuth with contact or contact.read scope)").requiredOption("--id <contactId>", "Contact ID (from contact list)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await getContact(opts.id, opts.profile);
+    output(result, opts);
+  } catch (err) {
+    cliError(err, opts, "contact");
   }
-  return results;
-}
-var doctorCommand = new Command11("doctor").description("Check nworks configuration and connectivity").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+});
+var createCommand4 = new Command11("create").description("Create a contact (requires User OAuth with contact scope)").requiredOption("--payload <json>", "Contact fields as JSON (passed through to the NAVER WORKS API)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").option("--dry-run", "Print request without creating").action(async (opts) => {
   try {
-    const results = await runChecks(opts.profile);
-    if (opts.json || !process.stdout.isTTY) {
-      output(results, opts);
-    } else {
-      console.log("\n  nworks doctor\n");
-      for (const r of results) {
-        const icon = r.status === "OK" ? "\u2705" : r.status === "SKIP" ? "\u2796" : "\u274C";
-        console.log(`  ${icon} ${r.check.padEnd(16)} ${r.detail}`);
-      }
-      console.log();
+    const payload = JSON.parse(opts.payload);
+    if (opts.dryRun) {
+      output({ dryRun: true, request: payload }, opts);
+      return;
     }
+    const result = await createContact(payload, opts.profile);
+    output({ success: true, ...result }, opts);
   } catch (err) {
-    cliError(err, opts);
+    cliError(err, opts, "contact");
+  }
+});
+var updateCommand3 = new Command11("update").description("Update a contact (requires User OAuth with contact scope)").requiredOption("--id <contactId>", "Contact ID (from contact list)").requiredOption("--payload <json>", "Fields to update as JSON (passed through to the NAVER WORKS API)").option("--replace", "Use PUT instead of PATCH (replace entire contact)", false).option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const payload = JSON.parse(opts.payload);
+    const result = await updateContact(
+      opts.id,
+      payload,
+      !opts.replace,
+      opts.profile
+    );
+    output({ success: true, ...result }, opts);
+  } catch (err) {
+    cliError(err, opts, "contact");
+  }
+});
+var deleteCommand3 = new Command11("delete").description("Delete a contact (requires User OAuth with contact scope)").requiredOption("--id <contactId>", "Contact ID (from contact list)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    await deleteContact(opts.id, opts.profile);
+    output({ success: true, contactId: opts.id, message: "Contact deleted" }, opts);
+  } catch (err) {
+    cliError(err, opts, "contact");
+  }
+});
+var listTagsCommand = new Command11("list-tags").description("List contact tags (requires User OAuth with contact or contact.read scope)").option("--user <userId>", "Target user ID (default: me)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await listContactTags({
+      userId: opts.user ?? "me",
+      count: parseInt(opts.count, 10),
+      cursor: opts.cursor,
+      profile: opts.profile
+    });
+    output(
+      {
+        contactTags: result.contactTags,
+        count: result.contactTags.length,
+        nextCursor: result.responseMetaData?.nextCursor ?? null
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "contact");
   }
 });
+var contactCommand = new Command11("contact").description("Contact operations (requires User OAuth with contact scope)").addCommand(listCommand6).addCommand(getCommand).addCommand(createCommand4).addCommand(updateCommand3).addCommand(deleteCommand3).addCommand(listTagsCommand);
 
-// src/mcp/tools.ts
-function registerTools(server) {
-  server.tool(
+// src/commands/mcp-cmd.ts
+import { Command as Command13 } from "commander";
+import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/mcp/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/mcp/tools/setup.ts
+import { z as z2 } from "zod";
+
+// src/mcp/tool-registry.ts
+var TOOL_ANNOTATIONS = {
+  nworks_setup: { title: "Save credentials", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  nworks_message_send: { title: "Send message", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_message_members: { title: "List channel members", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_directory_members: { title: "List organization members", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_calendar_list: { title: "List calendar events", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_calendar_create: { title: "Create calendar event", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_calendar_update: { title: "Update calendar event", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_calendar_delete: { title: "Delete calendar event", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_drive_list: { title: "List drive files", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_drive_upload: { title: "Upload file to drive", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  // download는 outputDir 지정 시 로컬 파일을 쓰므로 순수 읽기가 아니다(readOnlyHint=false).
+  nworks_drive_download: { title: "Download drive file", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  nworks_sharedrive_list: { title: "List shared drives", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_sharedrive_files: { title: "List shared drive files", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_sharedrive_download: { title: "Download shared drive file", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  nworks_mail_send: { title: "Send mail", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_mail_list: { title: "List mail", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_mail_read: { title: "Read mail", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  // drive_download와 같은 이유로 outputDir 지정 시 로컬 파일을 쓴다(readOnlyHint=false).
+  nworks_mail_download_attachment: { title: "Download mail attachment", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  nworks_task_list: { title: "List tasks", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_task_create: { title: "Create task", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_task_update: { title: "Update task", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_task_delete: { title: "Delete task", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_list: { title: "List boards", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_posts: { title: "List board posts", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_read: { title: "Read board post", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_create: { title: "Create board post", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_contact_list: { title: "List contacts", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_get: { title: "Get contact", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_create: { title: "Create contact", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_contact_update: { title: "Update contact", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_delete: { title: "Delete contact", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_list_tags: { title: "List contact tags", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_login_user: { title: "Log in with User OAuth", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_whoami: { title: "Show auth status", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_logout: { title: "Log out", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_doctor: { title: "Diagnose connection", readOnlyHint: true, idempotentHint: true, openWorldHint: true }
+};
+function defineTool(server, name, description, inputSchema, handler) {
+  const annotations = TOOL_ANNOTATIONS[name];
+  server.registerTool(
+    name,
+    { description, inputSchema, ...annotations ? { annotations } : {} },
+    handler
+  );
+}
+
+// src/mcp/tools/setup.ts
+function registerSetupTools(server) {
+  defineTool(
+    server,
     "nworks_setup",
     `NAVER WORKS API \uC778\uC99D \uC815\uBCF4\uB97C \uC124\uC815\uD569\uB2C8\uB2E4.
 
@@ -2230,10 +2777,10 @@ function registerTools(server) {
 
 OAuth Redirect URI: http://localhost:9876/callback`,
     {
-      clientId: z.string().describe("Client ID (Developer Console\uC5D0\uC11C \uBC1C\uAE09)"),
-      serviceAccount: z.string().optional().describe("Service Account ID (\uC608: xxxxx.serviceaccount@domain)"),
-      botId: z.string().optional().describe("Bot ID (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)"),
-      domainId: z.string().optional().describe("Domain ID")
+      clientId: z2.string().describe("Client ID (Developer Console\uC5D0\uC11C \uBC1C\uAE09)"),
+      serviceAccount: z2.string().optional().describe("Service Account ID (\uC608: xxxxx.serviceaccount@domain)"),
+      botId: z2.string().optional().describe("Bot ID (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)"),
+      domainId: z2.string().optional().describe("Domain ID")
     },
     async ({ clientId, serviceAccount, botId, domainId }) => {
       try {
@@ -2271,7 +2818,7 @@ OAuth Redirect URI: http://localhost:9876/callback`,
           nextSteps.push('NWORKS_PRIVATE_KEY_PATH \uD658\uACBD\uBCC0\uC218\uAC00 \uC124\uC815\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4. Service Account \uC778\uC99D\uC5D0\uB294 Private Key \uD30C\uC77C \uACBD\uB85C\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC548\uB0B4\uD558\uC138\uC694: (1) Developer Console(https://dev.worksmobile.com)\uC5D0\uC11C Private Key\uB97C \uB2E4\uC6B4\uB85C\uB4DC (2) MCP \uC124\uC815 \uD30C\uC77C\uC758 env\uC5D0 NWORKS_PRIVATE_KEY_PATH\uB97C \uCD94\uAC00 (\uC608: "NWORKS_PRIVATE_KEY_PATH": "C:/keys/private.key") (3) MCP \uD074\uB77C\uC774\uC5B8\uD2B8 \uC7AC\uC2DC\uC791');
         }
         nextSteps.push("User OAuth\uAC00 \uD544\uC694\uD55C API\uB294 nworks_login_user tool\uB85C \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778\uC744 \uC9C4\uD589\uD558\uC138\uC694");
-        const mask = (s) => s.length <= 4 ? "****" : `****${s.slice(-Math.min(4, Math.floor(s.length / 3)))}`;
+        const mask2 = (s) => s.length <= 4 ? "****" : `****${s.slice(-Math.min(4, Math.floor(s.length / 3)))}`;
         return {
           content: [
             {
@@ -2280,10 +2827,10 @@ OAuth Redirect URI: http://localhost:9876/callback`,
                 success: true,
                 message: "\uC778\uC99D \uC815\uBCF4\uAC00 \uC800\uC7A5\uB418\uC5C8\uC2B5\uB2C8\uB2E4.",
                 nextSteps,
-                clientId,
-                clientSecret: `${mask(resolvedSecret)} (\uD658\uACBD\uBCC0\uC218)`,
+                clientId: mask2(clientId),
+                clientSecret: `${mask2(resolvedSecret)} (\uD658\uACBD\uBCC0\uC218)`,
                 serviceAccount: serviceAccount ?? null,
-                privateKeyPath: resolvedPrivateKeyPath ? `${mask(resolvedPrivateKeyPath)} (\uD658\uACBD\uBCC0\uC218)` : null,
+                privateKeyPath: resolvedPrivateKeyPath ? `${mask2(resolvedPrivateKeyPath)} (\uD658\uACBD\uBCC0\uC218)` : null,
                 botId: botId ?? null
               })
             }
@@ -2297,16 +2844,22 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/message.ts
+import { z as z3 } from "zod";
+function registerMessageTools(server) {
+  defineTool(
+    server,
     "nworks_message_send",
     "NAVER WORKS \uBA54\uC2DC\uC9C0\uB97C \uC804\uC1A1\uD569\uB2C8\uB2E4 (\uBD07\uC774 \uC0AC\uC6A9\uC790 \uB610\uB294 \uCC44\uB110\uC5D0 \uBC1C\uC1A1). Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup\uC5D0\uC11C serviceAccount, botId \uC124\uC815 + \uD658\uACBD\uBCC0\uC218 NWORKS_PRIVATE_KEY_PATH \uD544\uC694. User OAuth \uBD88\uD544\uC694)",
     {
-      to: z.string().optional().describe("\uC218\uC2E0\uC790 userId (channel\uACFC \uD0DD 1). nworks_directory_members\uB85C userId \uC870\uD68C \uAC00\uB2A5"),
-      channel: z.string().optional().describe("\uCC44\uB110 channelId (to\uC640 \uD0DD 1). nworks_message_members\uB85C \uCC44\uB110 \uAD6C\uC131\uC6D0 \uD655\uC778 \uAC00\uB2A5"),
-      text: z.string().describe("\uBA54\uC2DC\uC9C0 \uBCF8\uBB38"),
-      type: z.enum(["text", "button", "list"]).optional().describe("\uBA54\uC2DC\uC9C0 \uD0C0\uC785 (\uAE30\uBCF8: text)"),
-      actions: z.string().optional().describe("\uBC84\uD2BC \uC561\uC158 JSON (type=button\uC77C \uB54C)"),
-      elements: z.string().optional().describe("\uB9AC\uC2A4\uD2B8 \uD56D\uBAA9 JSON (type=list\uC77C \uB54C)")
+      to: z3.string().optional().describe("\uC218\uC2E0\uC790 userId (channel\uACFC \uD0DD 1). nworks_directory_members\uB85C userId \uC870\uD68C \uAC00\uB2A5"),
+      channel: z3.string().optional().describe("\uCC44\uB110 channelId (to\uC640 \uD0DD 1). nworks_message_members\uB85C \uCC44\uB110 \uAD6C\uC131\uC6D0 \uD655\uC778 \uAC00\uB2A5"),
+      text: z3.string().describe("\uBA54\uC2DC\uC9C0 \uBCF8\uBB38"),
+      type: z3.enum(["text", "button", "list"]).optional().describe("\uBA54\uC2DC\uC9C0 \uD0C0\uC785 (\uAE30\uBCF8: text)"),
+      actions: z3.string().optional().describe("\uBC84\uD2BC \uC561\uC158 JSON (type=button\uC77C \uB54C)"),
+      elements: z3.string().optional().describe("\uB9AC\uC2A4\uD2B8 \uD56D\uBAA9 JSON (type=list\uC77C \uB54C)")
     },
     async ({ to, channel, text, type, actions, elements }) => {
       try {
@@ -2329,11 +2882,12 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_message_members",
     "\uD2B9\uC815 \uCC44\uB110\uC758 \uAD6C\uC131\uC6D0 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC774 \uCC44\uB110\uC5D0 \uB204\uAC00 \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694)",
     {
-      channel: z.string().describe("\uCC44\uB110 channelId")
+      channel: z3.string().describe("\uCC44\uB110 channelId")
     },
     async ({ channel }) => {
       try {
@@ -2349,15 +2903,29 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/directory.ts
+import { z as z4 } from "zod";
+function registerDirectoryTools(server) {
+  defineTool(
+    server,
     "nworks_directory_members",
-    "NAVER WORKS \uC870\uC9C1 \uAD6C\uC131\uC6D0(\uC9C1\uC6D0) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAD6C\uC131\uC6D0 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uD300\uC6D0 \uCC3E\uC544\uC918', '\uB204\uAD6C\uD55C\uD14C \uBA54\uC2DC\uC9C0 \uBCF4\uB0BC\uC9C0 userId \uCC3E\uAE30' \uB4F1\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694). \uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uC218\uC2E0\uC790 userId\uB97C \uC5EC\uAE30\uC11C \uC870\uD68C \uAC00\uB2A5",
-    {},
-    async () => {
+    "NAVER WORKS \uC870\uC9C1 \uAD6C\uC131\uC6D0(\uC9C1\uC6D0) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAD6C\uC131\uC6D0 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uD300\uC6D0 \uCC3E\uC544\uC918', '\uB204\uAD6C\uD55C\uD14C \uBA54\uC2DC\uC9C0 \uBCF4\uB0BC\uC9C0 userId \uCC3E\uAE30' \uB4F1\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694). \uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uC218\uC2E0\uC790 userId\uB97C \uC5EC\uAE30\uC11C \uC870\uD68C \uAC00\uB2A5. \uAD6C\uC131\uC6D0\uC774 \uB9CE\uC73C\uBA74 nextCursor\uB85C \uB2E4\uC74C \uD398\uC774\uC9C0\uB97C \uC774\uC5B4\uC11C \uC870\uD68C",
+    {
+      count: z4.number().int().min(1).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 100)"),
+      cursor: z4.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C (\uC774\uC804 \uC751\uB2F5\uC758 nextCursor \uAC12)")
+    },
+    async ({ count, cursor }) => {
       try {
-        const result = await listUsers();
+        const result = await listUsers(count ?? 100, cursor);
         return {
-          content: [{ type: "text", text: JSON.stringify(result) }]
+          content: [{ type: "text", text: JSON.stringify({
+            users: result.users,
+            count: result.users.length,
+            hasMore: !!result.responseMetaData?.nextCursor,
+            nextCursor: result.responseMetaData?.nextCursor ?? null
+          }) }]
         };
       } catch (err) {
         return {
@@ -2367,13 +2935,19 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/calendar.ts
+import { z as z5 } from "zod";
+function registerCalendarTools(server) {
+  defineTool(
+    server,
     "nworks_calendar_list",
     "\uC0AC\uC6A9\uC790\uC758 \uCE98\uB9B0\uB354 \uC77C\uC815/\uC2A4\uCF00\uC904\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC624\uB298 \uC77C\uC815 \uC54C\uB824\uC918', '\uC774\uBC88 \uC8FC \uC2A4\uCF00\uC904 \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar.read scope). \uBBF8\uB85C\uADF8\uC778 \uC2DC nworks_login_user\uB85C \uB85C\uADF8\uC778 \uD544\uC694",
     {
-      fromDateTime: z.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
-      untilDateTime: z.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      fromDateTime: z5.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
+      untilDateTime: z5.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ fromDateTime, untilDateTime, userId }) => {
       try {
@@ -2402,21 +2976,32 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_calendar_create",
     "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0C8\uB85C \uB9CC\uB4ED\uB2C8\uB2E4. '\uD68C\uC758 \uC7A1\uC544\uC918', '\uC77C\uC815 \uB4F1\uB85D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope)",
     {
-      summary: z.string().describe("\uC77C\uC815 \uC81C\uBAA9"),
-      start: z.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      end: z.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      timeZone: z.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
-      description: z.string().optional().describe("\uC77C\uC815 \uC124\uBA85"),
-      location: z.string().optional().describe("\uC7A5\uC18C"),
-      attendees: z.array(z.object({ email: z.string(), displayName: z.string().optional() })).optional().describe("\uCC38\uC11D\uC790 \uBAA9\uB85D"),
-      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      summary: z5.string().describe("\uC77C\uC815 \uC81C\uBAA9"),
+      start: z5.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      end: z5.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      timeZone: z5.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
+      description: z5.string().optional().describe("\uC77C\uC815 \uC124\uBA85"),
+      location: z5.string().optional().describe("\uC7A5\uC18C"),
+      attendees: z5.array(z5.object({ email: z5.string(), displayName: z5.string().optional() })).optional().describe("\uCC38\uC11D\uC790 \uBAA9\uB85D"),
+      sendNotification: z5.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
-    async ({ summary, start, end, timeZone, description, location, attendees, sendNotification, userId }) => {
+    async ({
+      summary,
+      start,
+      end,
+      timeZone,
+      description,
+      location,
+      attendees,
+      sendNotification,
+      userId
+    }) => {
       try {
         const result = await createEvent({
           summary,
@@ -2441,21 +3026,32 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_calendar_update",
     "\uAE30\uC874 \uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC218\uC815\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uC2DC\uAC04 \uBCC0\uACBD\uD574\uC918', '\uD68C\uC758 \uC81C\uBAA9 \uBC14\uAFD4\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
     {
-      eventId: z.string().describe("\uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      summary: z.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
-      start: z.string().optional().describe("\uC0C8 \uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      end: z.string().optional().describe("\uC0C8 \uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      timeZone: z.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
-      description: z.string().optional().describe("\uC0C8 \uC124\uBA85"),
-      location: z.string().optional().describe("\uC0C8 \uC7A5\uC18C"),
-      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      eventId: z5.string().describe("\uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      summary: z5.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
+      start: z5.string().optional().describe("\uC0C8 \uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      end: z5.string().optional().describe("\uC0C8 \uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      timeZone: z5.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
+      description: z5.string().optional().describe("\uC0C8 \uC124\uBA85"),
+      location: z5.string().optional().describe("\uC0C8 \uC7A5\uC18C"),
+      sendNotification: z5.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
-    async ({ eventId, summary, start, end, timeZone, description, location, sendNotification, userId }) => {
+    async ({
+      eventId,
+      summary,
+      start,
+      end,
+      timeZone,
+      description,
+      location,
+      sendNotification,
+      userId
+    }) => {
       try {
         await updateEvent({
           eventId,
@@ -2479,13 +3075,14 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_calendar_delete",
     "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0AD\uC81C\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uCDE8\uC18C\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
     {
-      eventId: z.string().describe("\uC0AD\uC81C\uD560 \uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      eventId: z5.string().describe("\uC0AD\uC81C\uD560 \uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      sendNotification: z5.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ eventId, sendNotification, userId }) => {
       try {
@@ -2505,14 +3102,20 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/drive.ts
+import { z as z6 } from "zod";
+function registerDriveTools(server) {
+  defineTool(
+    server,
     "nworks_drive_list",
     "NAVER WORKS \uB4DC\uB77C\uC774\uBE0C\uC758 \uD30C\uC77C/\uD3F4\uB354 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C \uBCF4\uC5EC\uC918', '\uB0B4 \uD30C\uC77C \uBAA9\uB85D' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
     {
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
-      folderId: z.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+      userId: z6.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      folderId: z6.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      count: z6.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z6.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
     async ({ userId, folderId, count, cursor }) => {
       try {
@@ -2541,16 +3144,17 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_drive_upload",
     "\uD30C\uC77C\uC744 \uB4DC\uB77C\uC774\uBE0C\uC5D0 \uC5C5\uB85C\uB4DC\uD569\uB2C8\uB2E4 (User OAuth file scope \uD544\uC694). content(base64)\uC640 fileName\uC73C\uB85C \uC804\uB2EC\uD558\uAC70\uB098, filePath\uB85C \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C\uB97C \uC9C0\uC815\uD569\uB2C8\uB2E4. MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC5D0\uC11C\uB294 content+fileName \uBC29\uC2DD\uC744 \uAD8C\uC7A5\uD569\uB2C8\uB2E4.",
     {
-      content: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD30C\uC77C \uB0B4\uC6A9 (base64 \uC778\uCF54\uB529). filePath \uB300\uC2E0 \uC0AC\uC6A9"),
-      fileName: z.string().optional().describe("\uD30C\uC77C\uBA85 (content \uC0AC\uC6A9 \uC2DC \uD544\uC218)"),
-      filePath: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C (content \uB300\uC2E0 \uC0AC\uC6A9, \uB85C\uCEEC \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
-      folderId: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
-      overwrite: z.boolean().optional().describe("\uB3D9\uC77C \uD30C\uC77C\uBA85 \uB36E\uC5B4\uC4F0\uAE30 (\uAE30\uBCF8: false)")
+      content: z6.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD30C\uC77C \uB0B4\uC6A9 (base64 \uC778\uCF54\uB529). filePath \uB300\uC2E0 \uC0AC\uC6A9"),
+      fileName: z6.string().optional().describe("\uD30C\uC77C\uBA85 (content \uC0AC\uC6A9 \uC2DC \uD544\uC218)"),
+      filePath: z6.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C (content \uB300\uC2E0 \uC0AC\uC6A9, \uB85C\uCEEC \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791)"),
+      userId: z6.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      folderId: z6.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      overwrite: z6.boolean().optional().describe("\uB3D9\uC77C \uD30C\uC77C\uBA85 \uB36E\uC5B4\uC4F0\uAE30 (\uAE30\uBCF8: false)")
     },
     async ({ content, fileName, filePath, userId, folderId, overwrite }) => {
       try {
@@ -2568,11 +3172,12 @@ OAuth Redirect URI: http://localhost:9876/callback`,
             overwrite ?? false
           );
         } else if (filePath) {
+          const safePath = validateLocalPath(filePath);
           if (process.env["NWORKS_VERBOSE"] === "1") {
-            console.error(`[nworks] MCP upload: filePath=${filePath}`);
+            console.error(`[nworks] MCP upload: filePath=${safePath}`);
           }
           result = await uploadFile(
-            filePath,
+            safePath,
             userId ?? "me",
             folderId,
             overwrite ?? false
@@ -2587,23 +3192,25 @@ OAuth Redirect URI: http://localhost:9876/callback`,
           content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
         };
       } catch (err) {
-        const error = err;
-        const detail = process.env["NWORKS_VERBOSE"] === "1" ? ` | stack: ${error.stack}` : "";
+        if (process.env["NWORKS_VERBOSE"] === "1") {
+          console.error(`[nworks] drive upload error: ${err.stack}`);
+        }
         return {
-          content: [{ type: "text", text: `${mcpErrorHint(err, "drive.upload")}${detail}` }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.upload") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_drive_download",
     "\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
     {
-      fileId: z.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_drive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      outputDir: z.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
-      outputName: z.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      fileId: z6.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_drive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z6.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z6.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
+      userId: z6.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ fileId, outputDir, outputName, userId }) => {
       try {
@@ -2613,10 +3220,13 @@ OAuth Redirect URI: http://localhost:9876/callback`,
         );
         const fileName = outputName ?? result.fileName ?? fileId;
         if (outputDir) {
-          const { writeFile: writeFile3 } = await import("fs/promises");
-          const { join: join3 } = await import("path");
-          const outPath = join3(outputDir, fileName);
-          await writeFile3(outPath, result.buffer);
+          const { writeFile: writeFile4 } = await import("fs/promises");
+          const { join: join5 } = await import("path");
+          const safeDir = validateLocalPath(outputDir);
+          const safeName = sanitizeFileName(fileName);
+          const outPath = join5(safeDir, safeName);
+          validateLocalPath(outPath, safeDir);
+          await writeFile4(outPath, result.buffer);
           return {
             content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
           };
@@ -2649,60 +3259,180 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
-    "nworks_mail_send",
-    "NAVER WORKS \uBA54\uC77C\uC744 \uC804\uC1A1\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uBCF4\uB0B4\uC918', '\uC774\uBA54\uC77C \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uBE44\uB3D9\uAE30 \uC804\uC1A1(\uC131\uACF5 \uC2DC 202). User OAuth \uC778\uC99D \uD544\uC694 (mail scope)",
+  defineTool(
+    server,
+    "nworks_sharedrive_list",
+    "NAVER WORKS \uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uBB50 \uC788\uC5B4?', '\uD300 \uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uCC3E\uC544\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
     {
-      to: z.string().describe("\uC218\uC2E0\uC790 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
-      subject: z.string().describe("\uBA54\uC77C \uC81C\uBAA9"),
-      body: z.string().optional().describe("\uBA54\uC77C \uBCF8\uBB38"),
-      cc: z.string().optional().describe("\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
-      bcc: z.string().optional().describe("\uC228\uC740\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
-      contentType: z.enum(["html", "text"]).optional().describe("\uBCF8\uBB38 \uD615\uC2DD (\uAE30\uBCF8: html)"),
-      userId: z.string().optional().describe("\uBC1C\uC2E0\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      count: z6.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z6.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
-    async ({ to, subject, body, cc, bcc, contentType, userId }) => {
+    async ({ count, cursor }) => {
       try {
-        await sendMail({
-          to,
-          subject,
-          body,
-          cc,
-          bcc,
-          contentType,
-          userId: userId ?? "me"
-        });
+        const result = await listSharedDrives(count ?? 20, cursor);
         return {
-          content: [{ type: "text", text: JSON.stringify({ success: true, message: "\uBA54\uC77C\uC774 \uC804\uC1A1\uB418\uC5C8\uC2B5\uB2C8\uB2E4 (\uBE44\uB3D9\uAE30 \uCC98\uB9AC)" }) }]
+          content: [{ type: "text", text: JSON.stringify({ sharedDrives: result.sharedDrives, count: result.sharedDrives.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "mail.send") }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.sharedrive_list") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
-    "nworks_mail_list",
-    "\uBC1B\uC740 \uBA54\uC77C \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uD655\uC778\uD574\uC918', '\uBC1B\uC740\uD3B8\uC9C0\uD568 \uBCF4\uC5EC\uC918', '\uC548 \uC77D\uC740 \uBA54\uC77C \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
+  defineTool(
+    server,
+    "nworks_sharedrive_files",
+    "\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C\uC758 \uD30C\uC77C/\uD3F4\uB354 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. sharedriveId\uB294 nworks_sharedrive_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
     {
-      folderId: z.number().optional().describe("\uBA54\uC77C \uD3F4\uB354 ID (\uAE30\uBCF8: 0 = \uBC1B\uC740\uD3B8\uC9C0\uD568)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 30, \uCD5C\uB300: 200)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
-      isUnread: z.boolean().optional().describe("\uC77D\uC9C0 \uC54A\uC740 \uBA54\uC77C\uB9CC \uC870\uD68C"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      sharedriveId: z6.string().describe("\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C ID (nworks_sharedrive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      folderId: z6.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      count: z6.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z6.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
-    async ({ folderId, count, cursor, isUnread, userId }) => {
+    async ({ sharedriveId, folderId, count, cursor }) => {
       try {
-        const result = await listMails(
-          folderId ?? 0,
-          userId ?? "me",
-          count ?? 30,
-          cursor,
-          isUnread
-        );
-        const mails = result.mails.map((m) => ({
+        const result = await listSharedDriveFiles(
+          sharedriveId,
+          folderId,
+          count ?? 20,
+          cursor
+        );
+        const files = result.files.map((f) => ({
+          fileId: f.fileId,
+          name: f.fileName,
+          type: f.fileType,
+          size: f.fileSize,
+          modified: f.modifiedTime,
+          path: f.filePath
+        }));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ files, count: files.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.sharedrive_files") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_sharedrive_download",
+    "\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
+    {
+      sharedriveId: z6.string().describe("\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C ID (nworks_sharedrive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      fileId: z6.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_sharedrive_files\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z6.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z6.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)")
+    },
+    async ({ sharedriveId, fileId, outputDir, outputName }) => {
+      try {
+        const result = await downloadSharedDriveFile(sharedriveId, fileId);
+        const fileName = outputName ?? result.fileName ?? fileId;
+        if (outputDir) {
+          const { writeFile: writeFile4 } = await import("fs/promises");
+          const { join: join5 } = await import("path");
+          const safeDir = validateLocalPath(outputDir);
+          const safeName = sanitizeFileName(fileName);
+          const outPath = join5(safeDir, safeName);
+          validateLocalPath(outPath, safeDir);
+          await writeFile4(outPath, result.buffer);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
+          };
+        }
+        const MAX_INLINE_SIZE = 5 * 1024 * 1024;
+        if (result.buffer.length > MAX_INLINE_SIZE) {
+          const sizeMB = (result.buffer.length / (1024 * 1024)).toFixed(1);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: true, message: `\uD30C\uC77C\uC774 \uB108\uBB34 \uD07D\uB2C8\uB2E4 (${sizeMB}MB). outputDir\uB97C \uC9C0\uC815\uD574\uC11C \uB85C\uCEEC\uC5D0 \uC800\uC7A5\uD558\uC138\uC694.`, fileName, size: result.buffer.length }) }],
+            isError: true
+          };
+        }
+        const textExtensions = /\.(txt|md|csv|json|xml|html|htm|css|js|ts|jsx|tsx|yaml|yml|toml|ini|cfg|conf|log|sh|bash|zsh|py|rb|java|go|rs|c|cpp|h|hpp|sql|graphql|env|gitignore|dockerignore|editorconfig)$/i;
+        const isText = textExtensions.test(fileName);
+        if (isText) {
+          const text = result.buffer.toString("utf-8");
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "text", content: text }) }]
+          };
+        }
+        const base64 = result.buffer.toString("base64");
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "base64", content: base64 }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.sharedrive_download") }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/tools/mail.ts
+import { z as z7 } from "zod";
+function registerMailTools(server) {
+  defineTool(
+    server,
+    "nworks_mail_send",
+    "NAVER WORKS \uBA54\uC77C\uC744 \uC804\uC1A1\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uBCF4\uB0B4\uC918', '\uC774\uBA54\uC77C \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uBE44\uB3D9\uAE30 \uC804\uC1A1(\uC131\uACF5 \uC2DC 202). User OAuth \uC778\uC99D \uD544\uC694 (mail scope)",
+    {
+      to: z7.string().describe("\uC218\uC2E0\uC790 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      subject: z7.string().describe("\uBA54\uC77C \uC81C\uBAA9"),
+      body: z7.string().optional().describe("\uBA54\uC77C \uBCF8\uBB38"),
+      cc: z7.string().optional().describe("\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      bcc: z7.string().optional().describe("\uC228\uC740\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      contentType: z7.enum(["html", "text"]).optional().describe("\uBCF8\uBB38 \uD615\uC2DD (\uAE30\uBCF8: html)"),
+      userId: z7.string().optional().describe("\uBC1C\uC2E0\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ to, subject, body, cc, bcc, contentType, userId }) => {
+      try {
+        await sendMail({
+          to,
+          subject,
+          body,
+          cc,
+          bcc,
+          contentType,
+          userId: userId ?? "me"
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, message: "\uBA54\uC77C\uC774 \uC804\uC1A1\uB418\uC5C8\uC2B5\uB2C8\uB2E4 (\uBE44\uB3D9\uAE30 \uCC98\uB9AC)" }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "mail.send") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_mail_list",
+    "\uBC1B\uC740 \uBA54\uC77C \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uD655\uC778\uD574\uC918', '\uBC1B\uC740\uD3B8\uC9C0\uD568 \uBCF4\uC5EC\uC918', '\uC548 \uC77D\uC740 \uBA54\uC77C \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
+    {
+      folderId: z7.number().int().min(0).optional().describe("\uBA54\uC77C \uD3F4\uB354 ID (\uAE30\uBCF8: 0 = \uBC1B\uC740\uD3B8\uC9C0\uD568)"),
+      count: z7.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 30, \uCD5C\uB300: 200)"),
+      cursor: z7.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      isUnread: z7.boolean().optional().describe("\uC77D\uC9C0 \uC54A\uC740 \uBA54\uC77C\uB9CC \uC870\uD68C"),
+      userId: z7.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ folderId, count, cursor, isUnread, userId }) => {
+      try {
+        const result = await listMails(
+          folderId ?? 0,
+          userId ?? "me",
+          count ?? 30,
+          cursor,
+          isUnread
+        );
+        const mails = result.mails.map((m) => ({
           mailId: m.mailId,
           from: m.from.email,
           subject: m.subject,
@@ -2721,12 +3451,13 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_mail_read",
     "\uD2B9\uC815 \uBA54\uC77C\uC758 \uC0C1\uC138 \uB0B4\uC6A9(\uBCF8\uBB38, \uCCA8\uBD80\uD30C\uC77C \uB4F1)\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC774 \uBA54\uC77C \uB0B4\uC6A9 \uBCF4\uC5EC\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. mailId\uB294 nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
     {
-      mailId: z.number().describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      mailId: z7.number().int().min(0).describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      userId: z7.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ mailId, userId }) => {
       try {
@@ -2760,15 +3491,80 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
+    "nworks_mail_download_attachment",
+    "\uBA54\uC77C \uCCA8\uBD80\uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. mailId\uC640 attachmentId\uB294 nworks_mail_read\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
+    {
+      mailId: z7.number().int().min(0).describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      attachmentId: z7.number().int().min(0).describe("\uCCA8\uBD80\uD30C\uC77C ID (nworks_mail_read\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z7.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z7.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
+      userId: z7.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ mailId, attachmentId, outputDir, outputName, userId }) => {
+      try {
+        const result = await downloadAttachment(
+          mailId,
+          attachmentId,
+          userId ?? "me"
+        );
+        const fileName = outputName ?? result.filename;
+        if (outputDir) {
+          const { writeFile: writeFile4 } = await import("fs/promises");
+          const { join: join5 } = await import("path");
+          const safeDir = validateLocalPath(outputDir);
+          const safeName = sanitizeFileName(fileName);
+          const outPath = join5(safeDir, safeName);
+          validateLocalPath(outPath, safeDir);
+          await writeFile4(outPath, result.buffer);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
+          };
+        }
+        const MAX_INLINE_SIZE = 5 * 1024 * 1024;
+        if (result.buffer.length > MAX_INLINE_SIZE) {
+          const sizeMB = (result.buffer.length / (1024 * 1024)).toFixed(1);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: true, message: `\uD30C\uC77C\uC774 \uB108\uBB34 \uD07D\uB2C8\uB2E4 (${sizeMB}MB). outputDir\uB97C \uC9C0\uC815\uD574\uC11C \uB85C\uCEEC\uC5D0 \uC800\uC7A5\uD558\uC138\uC694.`, fileName, size: result.buffer.length }) }],
+            isError: true
+          };
+        }
+        const textExtensions = /\.(txt|md|csv|json|xml|html|htm|css|js|ts|jsx|tsx|yaml|yml|toml|ini|cfg|conf|log|sh|bash|zsh|py|rb|java|go|rs|c|cpp|h|hpp|sql|graphql|env|gitignore|dockerignore|editorconfig)$/i;
+        const isText = textExtensions.test(fileName);
+        if (isText) {
+          const text = result.buffer.toString("utf-8");
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "text", content: text }) }]
+          };
+        }
+        const base64 = result.buffer.toString("base64");
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "base64", content: base64 }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "mail.download_attachment") }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/tools/task.ts
+import { z as z8 } from "zod";
+function registerTaskTools(server) {
+  defineTool(
+    server,
     "nworks_task_list",
     "\uD560 \uC77C(TODO) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uD560 \uC77C \uD655\uC778\uD574\uC918', 'TODO \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uB0A8\uC740 \uC5C5\uBB34 \uBB50 \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (task.read scope)",
     {
-      categoryId: z.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID (\uAE30\uBCF8: default)"),
-      status: z.enum(["TODO", "ALL"]).optional().describe("\uD544\uD130: TODO \uB610\uB294 ALL (\uAE30\uBCF8: ALL)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 50, \uCD5C\uB300: 100)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      categoryId: z8.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID (\uAE30\uBCF8: default)"),
+      status: z8.enum(["TODO", "ALL"]).optional().describe("\uD544\uD130: TODO \uB610\uB294 ALL (\uAE30\uBCF8: ALL)"),
+      count: z8.number().int().min(1).max(100).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 50, \uCD5C\uB300: 100)"),
+      cursor: z8.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      userId: z8.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ categoryId, status, count, cursor, userId }) => {
       try {
@@ -2798,16 +3594,17 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_task_create",
     "\uD560 \uC77C(TODO)\uC744 \uC0C8\uB85C \uB9CC\uB4ED\uB2C8\uB2E4. '\uD560 \uC77C \uCD94\uAC00\uD574\uC918', 'TODO \uB4F1\uB85D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uAE30\uBCF8\uC801\uC73C\uB85C \uC790\uAE30 \uC790\uC2E0\uC5D0\uAC8C \uD560\uB2F9. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
     {
-      title: z.string().describe("\uD560 \uC77C \uC81C\uBAA9"),
-      content: z.string().optional().describe("\uD560 \uC77C \uB0B4\uC6A9"),
-      dueDate: z.string().optional().describe("\uB9C8\uAC10\uC77C (YYYY-MM-DD)"),
-      categoryId: z.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID"),
-      assigneeIds: z.array(z.string()).optional().describe("\uB2F4\uB2F9\uC790 user ID \uBAA9\uB85D (\uBBF8\uC9C0\uC815 \uC2DC \uC790\uAE30 \uC790\uC2E0)"),
-      userId: z.string().optional().describe("\uC0DD\uC131\uC790 user ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      title: z8.string().describe("\uD560 \uC77C \uC81C\uBAA9"),
+      content: z8.string().optional().describe("\uD560 \uC77C \uB0B4\uC6A9"),
+      dueDate: z8.string().optional().describe("\uB9C8\uAC10\uC77C (YYYY-MM-DD)"),
+      categoryId: z8.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID"),
+      assigneeIds: z8.array(z8.string()).optional().describe("\uB2F4\uB2F9\uC790 user ID \uBAA9\uB85D (\uBBF8\uC9C0\uC815 \uC2DC \uC790\uAE30 \uC790\uC2E0)"),
+      userId: z8.string().optional().describe("\uC0DD\uC131\uC790 user ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ title, content, dueDate, categoryId, assigneeIds, userId }) => {
       try {
@@ -2830,15 +3627,16 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_task_update",
     "\uD560 \uC77C\uC744 \uC218\uC815\uD558\uAC70\uB098 \uC644\uB8CC \uCC98\uB9AC\uD569\uB2C8\uB2E4. '\uD560 \uC77C \uC644\uB8CC \uCC98\uB9AC\uD574\uC918', '\uB9C8\uAC10\uC77C \uBCC0\uACBD\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. taskId\uB294 nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
     {
-      taskId: z.string().describe("\uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      status: z.enum(["done", "todo"]).optional().describe("\uC0C1\uD0DC \uBCC0\uACBD: done(\uC644\uB8CC) \uB610\uB294 todo(\uBBF8\uC644\uB8CC)"),
-      title: z.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
-      content: z.string().optional().describe("\uC0C8 \uB0B4\uC6A9"),
-      dueDate: z.string().optional().describe("\uC0C8 \uB9C8\uAC10\uC77C (YYYY-MM-DD)")
+      taskId: z8.string().describe("\uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      status: z8.enum(["done", "todo"]).optional().describe("\uC0C1\uD0DC \uBCC0\uACBD: done(\uC644\uB8CC) \uB610\uB294 todo(\uBBF8\uC644\uB8CC)"),
+      title: z8.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
+      content: z8.string().optional().describe("\uC0C8 \uB0B4\uC6A9"),
+      dueDate: z8.string().optional().describe("\uC0C8 \uB9C8\uAC10\uC77C (YYYY-MM-DD)")
     },
     async ({ taskId, status, title, content, dueDate }) => {
       try {
@@ -2872,11 +3670,12 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_task_delete",
     "\uD560 \uC77C\uC744 \uC0AD\uC81C\uD569\uB2C8\uB2E4. taskId\uB294 nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
     {
-      taskId: z.string().describe("\uC0AD\uC81C\uD560 \uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
+      taskId: z8.string().describe("\uC0AD\uC81C\uD560 \uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
     },
     async ({ taskId }) => {
       try {
@@ -2892,12 +3691,18 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/board.ts
+import { z as z9 } from "zod";
+function registerBoardTools(server) {
+  defineTool(
+    server,
     "nworks_board_list",
     "NAVER WORKS \uAC8C\uC2DC\uD310 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310 \uBB50 \uC788\uC5B4?', '\uACF5\uC9C0\uC0AC\uD56D \uAC8C\uC2DC\uD310 \uCC3E\uC544\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
     {
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+      count: z9.number().int().min(1).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20)"),
+      cursor: z9.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
     async ({ count, cursor }) => {
       try {
@@ -2918,13 +3723,14 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_board_posts",
     "\uAC8C\uC2DC\uD310\uC758 \uAE00 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310 \uAE00 \uBCF4\uC5EC\uC918', '\uACF5\uC9C0\uC0AC\uD56D \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. boardId\uB294 nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
     {
-      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 40)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+      boardId: z9.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      count: z9.number().int().min(1).max(40).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 40)"),
+      cursor: z9.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
     async ({ boardId, count, cursor }) => {
       try {
@@ -2948,12 +3754,13 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_board_read",
     "\uAC8C\uC2DC\uD310 \uAE00\uC758 \uC0C1\uC138 \uB0B4\uC6A9\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. postId\uB294 nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
     {
-      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      postId: z.string().describe("\uAE00 ID (nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5)")
+      boardId: z9.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      postId: z9.string().describe("\uAE00 ID (nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5)")
     },
     async ({ boardId, postId }) => {
       try {
@@ -2979,15 +3786,16 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_board_create",
     "\uAC8C\uC2DC\uD310\uC5D0 \uAE00\uC744 \uC791\uC131\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310\uC5D0 \uAE00 \uC62C\uB824\uC918', '\uACF5\uC9C0 \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. boardId\uB294 nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board scope)",
     {
-      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      title: z.string().describe("\uAE00 \uC81C\uBAA9"),
-      body: z.string().optional().describe("\uAE00 \uBCF8\uBB38"),
-      enableComment: z.boolean().optional().describe("\uB313\uAE00 \uD5C8\uC6A9 (\uAE30\uBCF8: true)"),
-      sendNotifications: z.boolean().optional().describe("\uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)")
+      boardId: z9.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      title: z9.string().describe("\uAE00 \uC81C\uBAA9"),
+      body: z9.string().optional().describe("\uAE00 \uBCF8\uBB38"),
+      enableComment: z9.boolean().optional().describe("\uB313\uAE00 \uD5C8\uC6A9 (\uAE30\uBCF8: true)"),
+      sendNotifications: z9.boolean().optional().describe("\uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)")
     },
     async ({ boardId, title, body, enableComment, sendNotifications }) => {
       try {
@@ -3009,36 +3817,176 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/contact.ts
+import { z as z10 } from "zod";
+function registerContactTools(server) {
+  defineTool(
+    server,
+    "nworks_contact_list",
+    "NAVER WORKS \uAC1C\uC778 \uC5F0\uB77D\uCC98 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC5F0\uB77D\uCC98 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uB0B4 \uBA85\uD568\uCCA9 \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (contact.read scope)",
+    {
+      userId: z10.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      count: z10.number().int().min(1).max(500).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 500)"),
+      cursor: z10.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      contactTagId: z10.string().optional().describe("\uC5F0\uB77D\uCC98 \uD0DC\uADF8 ID\uB85C \uD544\uD130\uB9C1 (nworks_contact_list_tags\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      email: z10.string().optional().describe("\uC774\uBA54\uC77C\uB85C \uD544\uD130\uB9C1"),
+      telephone: z10.string().optional().describe("\uC804\uD654\uBC88\uD638\uB85C \uD544\uD130\uB9C1")
+    },
+    async ({ userId, count, cursor, contactTagId, email, telephone }) => {
+      try {
+        const result = await listContacts({
+          userId: userId ?? "me",
+          count: count ?? 20,
+          cursor,
+          contactTagId,
+          email,
+          telephone
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ contacts: result.contacts, count: result.contacts.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_get",
+    "\uD2B9\uC815 \uC5F0\uB77D\uCC98\uC758 \uC0C1\uC138 \uC815\uBCF4\uB97C \uC870\uD68C\uD569\uB2C8\uB2E4. contactId\uB294 nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (contact.read scope)",
+    {
+      contactId: z10.string().describe("\uC5F0\uB77D\uCC98 ID (nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
+    },
+    async ({ contactId }) => {
+      try {
+        const result = await getContact(contactId);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.get") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_create",
+    `\uC0C8 \uC5F0\uB77D\uCC98\uB97C \uB9CC\uB4ED\uB2C8\uB2E4. '\uC5F0\uB77D\uCC98 \uCD94\uAC00\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. payload\uB294 NAVER WORKS \uC5F0\uB77D\uCC98 API \uC2A4\uD399\uC5D0 \uB9DE\uB294 JSON \uAC1D\uCCB4\uB97C \uADF8\uB300\uB85C \uC804\uB2EC\uD569\uB2C8\uB2E4. contactName\uACFC permission\uC740 \uD544\uC218\uC774\uBA70, permission.accessibleMembers\uC5D0\uB294 \uCD5C\uC18C 1\uBA85\uC774 \uC788\uC5B4\uC57C \uD569\uB2C8\uB2E4(\uBCF4\uD1B5 \uBCF8\uC778). \uC608: {"contactName":{"lastName":"\uAE40","firstName":"\uCCA0\uC218"},"emails":[{"email":"a@b.com","primary":true}],"permission":{"accessibleRange":"MEMBER","isCoEditing":false,"accessibleMembers":[{"id":"<userId>","type":"USER"}]}}. User OAuth \uC778\uC99D \uD544\uC694 (contact scope)`,
+    {
+      payload: z10.record(z10.string(), z10.unknown()).describe("\uC5F0\uB77D\uCC98 \uD544\uB4DC. \uD544\uC218: contactName, permission(accessibleRange\xB7isCoEditing\xB7accessibleMembers \uCD5C\uC18C 1\uBA85). \uC120\uD0DD: emails[], telephones[], organizations[], memo")
+    },
+    async ({ payload }) => {
+      try {
+        const result = await createContact(payload);
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.create") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_update",
+    "\uAE30\uC874 \uC5F0\uB77D\uCC98\uB97C \uC218\uC815\uD569\uB2C8\uB2E4. contactId\uB294 nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5. payload\uB294 \uC218\uC815\uD560 \uD544\uB4DC\uB9CC \uB2F4\uC740 JSON \uAC1D\uCCB4\uC785\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (contact scope)",
+    {
+      contactId: z10.string().describe("\uC5F0\uB77D\uCC98 ID (nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      payload: z10.record(z10.string(), z10.unknown()).describe("\uC218\uC815\uD560 \uD544\uB4DC (name, email, tel, company \uB4F1)"),
+      replace: z10.boolean().optional().describe("\uC804\uCCB4 \uAD50\uCCB4(PUT) \uC5EC\uBD80 (\uAE30\uBCF8: false, \uBD80\uBD84 \uC218\uC815 PATCH)")
+    },
+    async ({ contactId, payload, replace }) => {
+      try {
+        const result = await updateContact(contactId, payload, !(replace ?? false));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.update") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_delete",
+    "\uC5F0\uB77D\uCC98\uB97C \uC0AD\uC81C\uD569\uB2C8\uB2E4. contactId\uB294 nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (contact scope)",
+    {
+      contactId: z10.string().describe("\uC0AD\uC81C\uD560 \uC5F0\uB77D\uCC98 ID (nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
+    },
+    async ({ contactId }) => {
+      try {
+        await deleteContact(contactId);
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, contactId, message: "\uC5F0\uB77D\uCC98\uAC00 \uC0AD\uC81C\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.delete") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_list_tags",
+    "\uC5F0\uB77D\uCC98 \uD0DC\uADF8(\uADF8\uB8F9) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC5F0\uB77D\uCC98 \uD0DC\uADF8 \uBAA9\uB85D \uBCF4\uC5EC\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (contact.read scope)",
+    {
+      userId: z10.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      count: z10.number().int().min(1).max(500).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 500)"),
+      cursor: z10.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+    },
+    async ({ userId, count, cursor }) => {
+      try {
+        const result = await listContactTags({ userId: userId ?? "me", count: count ?? 20, cursor });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ contactTags: result.contactTags, count: result.contactTags.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.list_tags") }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/tools/auth.ts
+import { z as z11 } from "zod";
+function registerAuthTools(server) {
+  defineTool(
+    server,
     "nworks_login_user",
-    "User OAuth \uB85C\uADF8\uC778\uC744 \uC2DC\uC791\uD569\uB2C8\uB2E4. \uBC18\uD658\uB41C URL\uC744 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5B4 NAVER WORKS\uC5D0 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uB85C\uADF8\uC778 \uC644\uB8CC \uD6C4 \uC790\uB3D9\uC73C\uB85C \uD1A0\uD070\uC774 \uC800\uC7A5\uB429\uB2C8\uB2E4. \uC911\uC694: scope\uB97C \uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694. \uAE30\uBCF8\uAC12\uC774 \uBAA8\uB4E0 API(\uCE98\uB9B0\uB354, \uBA54\uC77C, \uD560\uC77C, \uB4DC\uB77C\uC774\uBE0C, \uAC8C\uC2DC\uD310)\uB97C \uD3EC\uD568\uD558\uBBC0\uB85C \uD55C \uBC88 \uB85C\uADF8\uC778\uC73C\uB85C \uC804\uCCB4 \uAE30\uB2A5\uC744 \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4. scope\uB97C \uC881\uAC8C \uC9C0\uC815\uD558\uBA74 \uB2E4\uB978 \uAE30\uB2A5 \uC0AC\uC6A9 \uC2DC \uC7AC\uB85C\uADF8\uC778\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.",
+    "User OAuth \uB85C\uADF8\uC778\uC744 \uC2DC\uC791\uD569\uB2C8\uB2E4. \uBC18\uD658\uB41C URL\uC744 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5B4 NAVER WORKS\uC5D0 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uB85C\uADF8\uC778 \uC644\uB8CC \uD6C4 \uC790\uB3D9\uC73C\uB85C \uD1A0\uD070\uC774 \uC800\uC7A5\uB429\uB2C8\uB2E4. \uC911\uC694: preset\uC744 \uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694. \uAE30\uBCF8\uAC12(default=all)\uC774 \uBAA8\uB4E0 API(\uCE98\uB9B0\uB354, \uBA54\uC77C, \uD560\uC77C, \uB4DC\uB77C\uC774\uBE0C, \uAC8C\uC2DC\uD310)\uB97C \uD3EC\uD568\uD558\uBBC0\uB85C \uD55C \uBC88 \uB85C\uADF8\uC778\uC73C\uB85C \uC804\uCCB4 \uAE30\uB2A5\uC744 \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4. \uC77D\uAE30 \uC804\uC6A9\uC73C\uB85C \uC81C\uD55C\uD558\uB824\uBA74 preset='readonly'\uB97C \uC9C0\uC815\uD558\uC138\uC694(\uC774 \uACBD\uC6B0 \uC0DD\uC131/\uC218\uC815/\uC0AD\uC81C \uB3C4\uAD6C\uB294 \uC7AC\uB85C\uADF8\uC778 \uD544\uC694).",
     {
-      scope: z.string().optional().describe("\uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694 (\uAE30\uBCF8\uAC12\uC774 \uC804\uCCB4 scope \uD3EC\uD568). \uD2B9\uC218\uD55C \uACBD\uC6B0\uC5D0\uB9CC \uC0AC\uC6A9")
+      preset: z11.enum(["readonly", "default", "all"]).optional().describe("scope \uD504\uB9AC\uC14B. \uAE30\uBCF8 default(=all, \uC804\uCCB4 \uAE30\uB2A5). readonly\uB294 \uC77D\uAE30 \uC804\uC6A9."),
+      scope: z11.string().optional().describe("\uACE0\uAE09: \uACF5\uBC31 \uAD6C\uBD84 raw scope \uC9C1\uC811 \uC9C0\uC815(preset \uB300\uC2E0). \uD2B9\uC218\uD55C \uACBD\uC6B0\uC5D0\uB9CC \uC0AC\uC6A9")
     },
-    async ({ scope }) => {
-      const DEFAULT_SCOPE = "calendar calendar.read file file.read mail mail.read task task.read user.read board board.read";
+    async ({ preset, scope }) => {
       try {
         const creds = await loadCredentials();
-        const SCOPE_DEPS = {
-          calendar: ["calendar.read"],
-          task: ["user.read"],
-          "task.read": ["user.read"]
-        };
-        const expandScopes = (scopes) => {
-          const expanded = new Set(scopes);
-          for (const s of scopes) {
-            const deps = SCOPE_DEPS[s];
-            if (deps) deps.forEach((d) => expanded.add(d));
-          }
-          return [...expanded];
-        };
         const existingToken = await loadUserToken();
         const existingScopes = existingToken?.scope?.split(" ").filter(Boolean) ?? [];
-        const requestedScopes = expandScopes((scope ?? DEFAULT_SCOPE).split(" ").filter(Boolean));
-        const mergedScopes = [.../* @__PURE__ */ new Set([...existingScopes, ...requestedScopes])].join(" ");
-        const state = Math.random().toString(36).substring(2);
+        const requestedScopes = resolveScopes(preset ?? scope);
+        const mergedScopes = mergeScopes(existingScopes, requestedScopes);
+        const state = generateSecureState();
         const authorizeUrl = buildAuthorizeUrl(creds.clientId, mergedScopes, state);
-        startOAuthCallbackServer(creds.clientId, creds.clientSecret).then(
+        startOAuthCallbackServer(creds.clientId, creds.clientSecret, state).then(
           (token) => saveUserToken({
             accessToken: token.accessToken,
             refreshToken: token.refreshToken,
@@ -3072,7 +4020,8 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_whoami",
     "\uD604\uC7AC \uC778\uC99D\uB41C NAVER WORKS \uACC4\uC815 \uC815\uBCF4\uC640 \uD1A0\uD070 \uC720\uD6A8 \uC0C1\uD0DC\uB97C \uD655\uC778\uD569\uB2C8\uB2E4. \uC778\uC99D \uBB38\uC81C \uC9C4\uB2E8 \uC2DC \uBA3C\uC800 \uD638\uCD9C",
     {},
@@ -3083,9 +4032,10 @@ OAuth Redirect URI: http://localhost:9876/callback`,
         const userToken = await loadUserToken();
         const isValid = token ? token.expiresAt > Date.now() / 1e3 : false;
         const userTokenValid = userToken ? userToken.expiresAt > Date.now() / 1e3 : false;
+        const mask2 = (s) => s.length <= 4 ? "****" : `****${s.slice(-4)}`;
         const info = {
           serviceAccount: creds.serviceAccount ?? null,
-          clientId: creds.clientId,
+          clientId: mask2(creds.clientId),
           botId: creds.botId ?? null,
           tokenValid: isValid,
           userOAuth: userToken ? { valid: userTokenValid, scope: userToken.scope } : null
@@ -3101,12 +4051,25 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_logout",
     "\uC800\uC7A5\uB41C NAVER WORKS \uC778\uC99D \uC815\uBCF4\uC640 \uD1A0\uD070\uC744 \uBAA8\uB450 \uC0AD\uC81C\uD569\uB2C8\uB2E4",
     {},
     async () => {
       try {
+        try {
+          const creds = await loadCredentials();
+          const token = await loadToken();
+          const userToken = await loadUserToken();
+          if (token?.accessToken) {
+            await revokeToken(token.accessToken, creds.clientId, creds.clientSecret);
+          }
+          if (userToken?.refreshToken) {
+            await revokeToken(userToken.refreshToken, creds.clientId, creds.clientSecret);
+          }
+        } catch {
+        }
         await clearCredentials();
         return {
           content: [
@@ -3127,15 +4090,162 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/commands/doctor.ts
+import { Command as Command12 } from "commander";
+import { existsSync as existsSync3 } from "fs";
+import { readFile as readFile5 } from "fs/promises";
+import { resolve as resolve2, join as join4, sep as sep2 } from "path";
+function mask(value) {
+  return value.length <= 4 ? "****" : `****${value.slice(-4)}`;
+}
+async function runChecks(profile) {
+  const results = [];
+  let creds;
+  try {
+    creds = await loadCredentials(profile);
+    results.push({ check: "credentials", status: "OK", detail: `clientId: ${mask(creds.clientId)}` });
+  } catch {
+    results.push({ check: "credentials", status: "FAIL", detail: "No credentials found. CLI: run `nworks login --user`. MCP: use the nworks_setup tool (env NWORKS_CLIENT_SECRET required)." });
+    return results;
+  }
+  if (hasServiceAccountCreds(creds)) {
+    results.push({ check: "serviceAccount", status: "OK", detail: creds.serviceAccount });
+  } else {
+    results.push({ check: "serviceAccount", status: "SKIP", detail: "Not set (required for bot messaging)" });
+  }
+  if (creds.privateKeyPath) {
+    if (existsSync3(creds.privateKeyPath)) {
+      try {
+        await readFile5(creds.privateKeyPath, "utf-8");
+        results.push({ check: "privateKey", status: "OK", detail: creds.privateKeyPath });
+      } catch {
+        results.push({ check: "privateKey", status: "FAIL", detail: `Cannot read: ${creds.privateKeyPath}` });
+      }
+    } else {
+      results.push({ check: "privateKey", status: "FAIL", detail: `File not found: ${creds.privateKeyPath}` });
+    }
+  } else {
+    results.push({ check: "privateKey", status: "SKIP", detail: "Not set" });
+  }
+  if (creds.privateKeyPath && existsSync3(creds.privateKeyPath)) {
+    const resolvedKey = resolve2(creds.privateKeyPath);
+    const cwd = resolve2(process.cwd());
+    const insideCwd = resolvedKey === cwd || resolvedKey.startsWith(cwd + sep2);
+    const looksLikeProject = existsSync3(join4(cwd, ".git")) || existsSync3(join4(cwd, "package.json"));
+    if (insideCwd && looksLikeProject) {
+      results.push({
+        check: "keyLocation",
+        status: "WARN",
+        detail: "Private key is inside a project directory. Risk of exposure via editor plugins, AI tools, or `npm pack` \u2014 move it outside (e.g. your home directory) and update the path."
+      });
+    }
+  }
+  if (creds.botId) {
+    results.push({ check: "botId", status: "OK", detail: creds.botId });
+  } else {
+    results.push({ check: "botId", status: "SKIP", detail: "Not set (required to send messages)" });
+  }
+  const token = await loadToken(profile);
+  if (token) {
+    const valid = token.expiresAt > Date.now() / 1e3;
+    results.push({
+      check: "serviceToken",
+      status: valid ? "OK" : "EXPIRED",
+      detail: valid ? `expires: ${new Date(token.expiresAt * 1e3).toISOString()}` : `expired: ${new Date(token.expiresAt * 1e3).toISOString()}`
+    });
+  } else {
+    results.push({ check: "serviceToken", status: "SKIP", detail: "No token" });
+  }
+  const userToken = await loadUserToken(profile);
+  if (userToken) {
+    const valid = userToken.expiresAt > Date.now() / 1e3;
+    results.push({
+      check: "userOAuth",
+      status: valid ? "OK" : "EXPIRED",
+      detail: valid ? `scope: ${userToken.scope} | expires: ${new Date(userToken.expiresAt * 1e3).toISOString()}` : `expired | scope: ${userToken.scope}`
+    });
+  } else {
+    results.push({ check: "userOAuth", status: "SKIP", detail: "No token. Run `nworks login --user`." });
+  }
+  if (hasServiceAccountCreds(creds) && token && token.expiresAt > Date.now() / 1e3) {
+    try {
+      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
+        headers: { Authorization: `Bearer ${token.accessToken}` }
+      });
+      if (res.ok) {
+        results.push({ check: "apiConnection", status: "OK", detail: "Connected to NAVER WORKS API" });
+      } else {
+        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
+      }
+    } catch (e) {
+      results.push({ check: "apiConnection", status: "FAIL", detail: `Connection failed: ${e.message}` });
+    }
+  } else if (userToken && userToken.expiresAt > Date.now() / 1e3) {
+    try {
+      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
+        headers: { Authorization: `Bearer ${userToken.accessToken}` }
+      });
+      if (res.ok) {
+        results.push({ check: "apiConnection", status: "OK", detail: "Connected to NAVER WORKS API" });
+      } else {
+        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
+      }
+    } catch (e) {
+      results.push({ check: "apiConnection", status: "FAIL", detail: `Connection failed: ${e.message}` });
+    }
+  } else {
+    results.push({ check: "apiConnection", status: "SKIP", detail: "No valid token \u2014 skipping API test" });
+  }
+  return results;
+}
+var doctorCommand = new Command12("doctor").description("Check nworks configuration and connectivity").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const results = await runChecks(opts.profile);
+    if (opts.json || !process.stdout.isTTY) {
+      output(results, opts);
+    } else {
+      console.log("\n  nworks doctor\n");
+      for (const r of results) {
+        const icon = r.status === "OK" ? "\u2705" : r.status === "SKIP" ? "\u2796" : r.status === "WARN" ? "\u26A0\uFE0F" : "\u274C";
+        console.log(`  ${icon} ${r.check.padEnd(16)} ${r.detail}`);
+      }
+      console.log();
+    }
+    if (results.some((r) => r.status === "FAIL")) {
+      process.exitCode = 1;
+    }
+  } catch (err) {
+    cliError(err, opts);
+  }
+});
+
+// src/mcp/tools/diagnostics.ts
+function registerDiagnosticsTools(server) {
+  defineTool(
+    server,
     "nworks_doctor",
     "NAVER WORKS \uC5F0\uACB0 \uC0C1\uD0DC\uB97C \uC9C4\uB2E8\uD569\uB2C8\uB2E4. \uC778\uC99D \uC815\uBCF4, \uD1A0\uD070, Private Key, API \uC5F0\uACB0\uC744 \uC810\uAC80\uD569\uB2C8\uB2E4.",
     {},
     async () => {
       try {
         const results = await runChecks("default");
+        const maskedResults = results.map((r) => {
+          if (r.check === "credentials" && r.status === "OK") {
+            return { ...r, detail: r.detail.replace(/clientId: .+/, "clientId: ****") };
+          }
+          if (r.check === "privateKey" && r.status === "OK") {
+            return { ...r, detail: "OK (path hidden)" };
+          }
+          if (r.check === "serviceAccount" && r.status === "OK") {
+            const masked = r.detail.length <= 4 ? "****" : `****${r.detail.slice(-4)}`;
+            return { ...r, detail: masked };
+          }
+          return r;
+        });
         return {
-          content: [{ type: "text", text: JSON.stringify(results) }]
+          content: [{ type: "text", text: JSON.stringify(maskedResults) }]
         };
       } catch (err) {
         return {
@@ -3147,6 +4257,21 @@ OAuth Redirect URI: http://localhost:9876/callback`,
   );
 }
 
+// src/mcp/tools.ts
+function registerTools(server) {
+  registerSetupTools(server);
+  registerMessageTools(server);
+  registerDirectoryTools(server);
+  registerCalendarTools(server);
+  registerDriveTools(server);
+  registerMailTools(server);
+  registerTaskTools(server);
+  registerBoardTools(server);
+  registerContactTools(server);
+  registerAuthTools(server);
+  registerDiagnosticsTools(server);
+}
+
 // src/mcp/server.ts
 async function startMcpServer() {
   try {
@@ -3167,7 +4292,7 @@ async function startMcpServer() {
   }
   const server = new McpServer({
     name: "nworks",
-    version: "1.0.0"
+    version: VERSION
   });
   registerTools(server);
   const transport = new StdioServerTransport();
@@ -3175,22 +4300,31 @@ async function startMcpServer() {
 }
 
 // src/commands/mcp-cmd.ts
-var mcpCommand = new Command12("mcp").description("Start MCP server (stdio transport)").option("--list-tools", "List available MCP tools").action(async (opts) => {
+function listRegisteredTools() {
+  const server = new McpServer2({ name: "nworks", version: "0.0.0" });
+  registerTools(server);
+  const registered = server._registeredTools;
+  return Object.entries(registered).map(([name, tool]) => ({
+    name,
+    summary: (tool.description ?? "").split("\n")[0]?.trim() ?? ""
+  }));
+}
+var mcpCommand = new Command13("mcp").description("Start MCP server (stdio transport)").option("--list-tools", "List available MCP tools").action(async (opts) => {
   if (opts.listTools) {
-    console.log("nworks_message_send     \u2014 Send message to user or channel");
-    console.log("nworks_message_members  \u2014 List channel members");
-    console.log("nworks_directory_members \u2014 List organization members");
-    console.log("nworks_calendar_list    \u2014 List calendar events (User OAuth)");
-    console.log("nworks_whoami           \u2014 Show auth status");
+    const tools = listRegisteredTools();
+    const width = tools.length ? Math.max(...tools.map((t) => t.name.length)) : 0;
+    for (const { name, summary } of tools) {
+      console.log(`${name.padEnd(width)}  ${summary}`);
+    }
+    console.log(`
+${tools.length} tools`);
     return;
   }
   await startMcpServer();
 });
 
 // src/index.ts
-var require2 = createRequire(import.meta.url);
-var { version } = require2("../package.json");
-var program = new Command13().name("nworks").description("NAVER WORKS CLI \u2014 built for humans and AI agents").version(version).option("--json", "Always output JSON").option("-v, --verbose", "Debug logging").option("--dry-run", "Print request without calling API").option("-p, --profile <name>", "Profile name", "default");
+var program = new Command14().name("nworks").description("NAVER WORKS CLI \u2014 built for humans and AI agents").version(VERSION);
 program.addCommand(loginCommand);
 program.addCommand(logoutCommand);
 program.addCommand(whoamiCommand);
@@ -3201,6 +4335,7 @@ program.addCommand(driveCommand);
 program.addCommand(mailCommand);
 program.addCommand(taskCommand);
 program.addCommand(boardCommand);
+program.addCommand(contactCommand);
 program.addCommand(mcpCommand);
 program.addCommand(doctorCommand);
 program.parse();