nworks 1.2.1 → 1.3.0

package/dist/mcp.js

@@ -2,7 +2,14 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
-// src/mcp/tools.ts
+// src/mcp/tools/setup.ts
+import { z as z2 } from "zod";
+
+// src/auth/config.ts
+import { readFile, writeFile, mkdir, chmod, rename } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
 import { z } from "zod";
 
 // src/utils/error.ts
@@ -24,21 +31,47 @@ var ApiError = class extends Error {
 };
 
 // src/auth/config.ts
-import { readFile, writeFile, mkdir } from "fs/promises";
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
 function hasServiceAccountCreds(creds) {
   return !!(creds.serviceAccount && creds.privateKeyPath && creds.botId);
 }
+var IS_UNIX = process.platform !== "win32";
 var CONFIG_DIR = join(homedir(), ".config", "nworks");
 var CREDENTIALS_PATH = join(CONFIG_DIR, "credentials.json");
 var TOKEN_PATH = join(CONFIG_DIR, "token.json");
 var USER_TOKEN_PATH = join(CONFIG_DIR, "user-token.json");
+var PROFILE_NAME_PATTERN = /^[\w.-]+$/;
+var FORBIDDEN_PROFILE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var DOTS_ONLY = /^\.+$/;
+function validateProfileName(profile) {
+  if (!PROFILE_NAME_PATTERN.test(profile) || FORBIDDEN_PROFILE_KEYS.has(profile) || DOTS_ONLY.test(profile)) {
+    throw new AuthError(
+      `Invalid profile name "${profile}". Use only letters, digits, ".", "_", or "-" (and not "." / ".." alone).`
+    );
+  }
+}
+var credentialsSchema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  serviceAccount: z.string().optional(),
+  privateKeyPath: z.string().optional(),
+  botId: z.string().optional(),
+  domainId: z.string().optional()
+}).passthrough();
 async function ensureConfigDir() {
   if (!existsSync(CONFIG_DIR)) {
-    await mkdir(CONFIG_DIR, { recursive: true });
+    await mkdir(CONFIG_DIR, { recursive: true, ...IS_UNIX && { mode: 448 } });
+  } else if (IS_UNIX) {
+    await chmod(CONFIG_DIR, 448);
+  }
+}
+var tempFileCounter = 0;
+async function writeSecureFile(path, data) {
+  const tempPath = `${path}.${process.pid}.${tempFileCounter++}.tmp`;
+  await writeFile(tempPath, data, { encoding: "utf-8", ...IS_UNIX && { mode: 384 } });
+  if (IS_UNIX) {
+    await chmod(tempPath, 384);
   }
+  await rename(tempPath, path);
 }
 function getCredentialsFromEnv() {
   const clientId = process.env["NWORKS_CLIENT_ID"];
@@ -56,6 +89,7 @@ function getCredentialsFromEnv() {
 async function loadCredentials(profile = "default") {
   const envCreds = getCredentialsFromEnv();
   if (envCreds) return envCreds;
+  validateProfileName(profile);
   if (!existsSync(CREDENTIALS_PATH)) {
     throw new AuthError(
       "Not logged in. Run `nworks login` or set environment variables."
@@ -67,9 +101,16 @@ async function loadCredentials(profile = "default") {
   if (!creds) {
     throw new AuthError(`Profile "${profile}" not found in credentials.`);
   }
-  return creds;
+  const parsed = credentialsSchema.safeParse(creds);
+  if (!parsed.success) {
+    throw new AuthError(
+      `Credentials for profile "${profile}" are malformed. Run \`nworks login\` to reconfigure.`
+    );
+  }
+  return parsed.data;
 }
 async function saveCredentials(creds, profile = "default") {
+  validateProfileName(profile);
   await ensureConfigDir();
   let profiles = {};
   if (existsSync(CREDENTIALS_PATH)) {
@@ -77,9 +118,10 @@ async function saveCredentials(creds, profile = "default") {
     profiles = JSON.parse(raw);
   }
   profiles[profile] = creds;
-  await writeFile(CREDENTIALS_PATH, JSON.stringify(profiles, null, 2), "utf-8");
+  await writeSecureFile(CREDENTIALS_PATH, JSON.stringify(profiles, null, 2));
 }
 async function loadToken(profile = "default") {
+  validateProfileName(profile);
   if (!existsSync(TOKEN_PATH)) return null;
   const raw = await readFile(TOKEN_PATH, "utf-8");
   const tokens = JSON.parse(raw);
@@ -91,6 +133,7 @@ async function loadToken(profile = "default") {
   };
 }
 async function saveToken(token, profile = "default") {
+  validateProfileName(profile);
   await ensureConfigDir();
   let tokens = {};
   if (existsSync(TOKEN_PATH)) {
@@ -98,9 +141,10 @@ async function saveToken(token, profile = "default") {
     tokens = JSON.parse(raw);
   }
   tokens[profile] = token;
-  await writeFile(TOKEN_PATH, JSON.stringify(tokens, null, 2), "utf-8");
+  await writeSecureFile(TOKEN_PATH, JSON.stringify(tokens, null, 2));
 }
 async function loadUserToken(profile = "default") {
+  validateProfileName(profile);
   if (!existsSync(USER_TOKEN_PATH)) return null;
   const raw = await readFile(USER_TOKEN_PATH, "utf-8");
   const tokens = JSON.parse(raw);
@@ -114,6 +158,7 @@ async function loadUserToken(profile = "default") {
   };
 }
 async function saveUserToken(token, profile = "default") {
+  validateProfileName(profile);
   await ensureConfigDir();
   let tokens = {};
   if (existsSync(USER_TOKEN_PATH)) {
@@ -121,35 +166,264 @@ async function saveUserToken(token, profile = "default") {
     tokens = JSON.parse(raw);
   }
   tokens[profile] = token;
-  await writeFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2), "utf-8");
+  await writeSecureFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2));
 }
 async function clearCredentials(profile = "default") {
+  validateProfileName(profile);
   if (existsSync(CREDENTIALS_PATH)) {
     const raw = await readFile(CREDENTIALS_PATH, "utf-8");
     const profiles = JSON.parse(raw);
     delete profiles[profile];
-    await writeFile(
-      CREDENTIALS_PATH,
-      JSON.stringify(profiles, null, 2),
-      "utf-8"
-    );
+    await writeSecureFile(CREDENTIALS_PATH, JSON.stringify(profiles, null, 2));
   }
   if (existsSync(TOKEN_PATH)) {
     const raw = await readFile(TOKEN_PATH, "utf-8");
     const tokens = JSON.parse(raw);
     delete tokens[profile];
-    await writeFile(TOKEN_PATH, JSON.stringify(tokens, null, 2), "utf-8");
+    await writeSecureFile(TOKEN_PATH, JSON.stringify(tokens, null, 2));
   }
   if (existsSync(USER_TOKEN_PATH)) {
     const raw = await readFile(USER_TOKEN_PATH, "utf-8");
     const tokens = JSON.parse(raw);
     delete tokens[profile];
-    await writeFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2), "utf-8");
+    await writeSecureFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2));
+  }
+}
+
+// src/utils/error-hints.ts
+var REQUIRED_SCOPES = {
+  calendar: "calendar",
+  "calendar.list": "calendar.read",
+  "calendar.create": "calendar calendar.read",
+  "calendar.update": "calendar calendar.read",
+  "calendar.delete": "calendar calendar.read",
+  mail: "mail",
+  "mail.send": "mail",
+  "mail.list": "mail.read",
+  "mail.read": "mail.read",
+  task: "task",
+  "task.list": "task.read",
+  "task.create": "task user.read",
+  "task.update": "task user.read",
+  "task.delete": "task user.read",
+  drive: "file",
+  "drive.list": "file.read",
+  "drive.upload": "file",
+  "drive.download": "file.read",
+  board: "board",
+  "board.list": "board.read",
+  "board.posts": "board.read",
+  "board.read": "board.read",
+  "board.create": "board"
+};
+var ERROR_HINTS_CLI = {
+  FORBIDDEN: "Insufficient permission. Check the OAuth scopes in the Developer Console.",
+  ACCESS_DENIED: "Access denied. Make sure the Bot is added in the Admin console.",
+  SERVICE_ACCOUNT_NOT_ALLOWED: "This API is not available with a Service Account. Log in with User OAuth via `nworks login --user`.",
+  UNAUTHORIZED: "Authentication expired. Log in again with `nworks login`."
+};
+var ERROR_HINTS_MCP = {
+  FORBIDDEN: "\uAD8C\uD55C\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4. Developer Console\uC5D0\uC11C OAuth Scope\uB97C \uD655\uC778\uD558\uC138\uC694.",
+  ACCESS_DENIED: "\uC811\uADFC\uC774 \uAC70\uBD80\uB410\uC2B5\uB2C8\uB2E4. Admin\uC5D0\uC11C Bot\uC744 \uCD94\uAC00\uD588\uB294\uC9C0 \uD655\uC778\uD558\uC138\uC694.",
+  SERVICE_ACCOUNT_NOT_ALLOWED: "\uC11C\uBE44\uC2A4 \uACC4\uC815\uC73C\uB85C\uB294 \uC774 API\uB97C \uC0AC\uC6A9\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. nworks_login_user tool\uB85C User OAuth \uB85C\uADF8\uC778\uC744 \uBA3C\uC800 \uD574\uC8FC\uC138\uC694.",
+  UNAUTHORIZED: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. nworks_login_user tool\uB85C \uB2E4\uC2DC \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uADF8\uB798\uB3C4 \uC548 \uB418\uBA74 nworks_setup tool\uB85C \uC7AC\uC124\uC815 \uD6C4 \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694."
+};
+function cliErrorHint(err, area) {
+  if (err instanceof ApiError) {
+    const hint = ERROR_HINTS_CLI[err.code];
+    const scopeHint = area ? buildScopeHint(area, "cli") : "";
+    if (hint) {
+      return `[${err.code}] ${err.message}
+  \u2192 ${hint}${scopeHint}`;
+    }
+    return `[${err.code}] ${err.message}${scopeHint}`;
+  }
+  if (err instanceof AuthError) {
+    return `${err.message}
+  \u2192 ${ERROR_HINTS_CLI["UNAUTHORIZED"]}`;
+  }
+  return err.message;
+}
+function mcpErrorHint(err, area) {
+  if (err instanceof ApiError) {
+    const hint = ERROR_HINTS_MCP[err.code];
+    const scopeHint = area ? buildScopeHint(area, "mcp") : "";
+    if (hint) {
+      return `Error: [${err.code}] ${err.message}
+
+[\uC548\uB0B4] ${hint}${scopeHint}`;
+    }
+    return `Error: [${err.code}] ${err.message}${scopeHint}`;
+  }
+  if (err instanceof AuthError) {
+    return `Error: ${err.message}
+
+[\uC548\uB0B4] \uC778\uC99D \uC815\uBCF4\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4. nworks_setup tool\uC744 \uBA3C\uC800 \uD638\uCD9C\uD558\uC138\uC694 (Client ID \uD544\uC694, Client Secret\uC740 \uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC5D0\uC11C \uC77D\uC74C). \uD658\uACBD\uBCC0\uC218\uAC00 \uC5C6\uC73C\uBA74 \uC0AC\uC6A9\uC790\uC5D0\uAC8C MCP \uC124\uC815 \uD30C\uC77C\uC758 env \uD544\uB4DC\uC5D0 NWORKS_CLIENT_SECRET \uCD94\uAC00\uB97C \uC548\uB0B4\uD558\uC138\uC694.`;
+  }
+  return `Error: ${err.message}`;
+}
+function buildScopeHint(area, mode) {
+  const scope = REQUIRED_SCOPES[area];
+  if (!scope) return "";
+  const scopes = scope.split(" ").join(", ");
+  if (mode === "cli") {
+    return `
+  \u2192 This command requires the ${scopes} scope(s). Run \`nworks login --user --scope "${scope}"\`.`;
   }
+  return `
+  \u2192 \uC774 API\uB294 ${scopes} scope\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. nworks_login_user tool\uB85C \uB85C\uADF8\uC778\uD558\uC138\uC694 (scope\uB97C \uC9C0\uC815\uD558\uC9C0 \uC54A\uC73C\uBA74 \uC804\uCCB4 \uAD8C\uD55C\uC774 \uC790\uB3D9 \uD3EC\uD568\uB429\uB2C8\uB2E4).`;
+}
+
+// src/mcp/tool-registry.ts
+var TOOL_ANNOTATIONS = {
+  nworks_setup: { title: "Save credentials", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  nworks_message_send: { title: "Send message", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_message_members: { title: "List channel members", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_directory_members: { title: "List organization members", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_calendar_list: { title: "List calendar events", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_calendar_create: { title: "Create calendar event", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_calendar_update: { title: "Update calendar event", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_calendar_delete: { title: "Delete calendar event", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_drive_list: { title: "List drive files", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_drive_upload: { title: "Upload file to drive", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  // download는 outputDir 지정 시 로컬 파일을 쓰므로 순수 읽기가 아니다(readOnlyHint=false).
+  nworks_drive_download: { title: "Download drive file", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  nworks_sharedrive_list: { title: "List shared drives", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_sharedrive_files: { title: "List shared drive files", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_sharedrive_download: { title: "Download shared drive file", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  nworks_mail_send: { title: "Send mail", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_mail_list: { title: "List mail", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_mail_read: { title: "Read mail", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  // drive_download와 같은 이유로 outputDir 지정 시 로컬 파일을 쓴다(readOnlyHint=false).
+  nworks_mail_download_attachment: { title: "Download mail attachment", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  nworks_task_list: { title: "List tasks", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_task_create: { title: "Create task", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_task_update: { title: "Update task", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_task_delete: { title: "Delete task", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_list: { title: "List boards", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_posts: { title: "List board posts", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_read: { title: "Read board post", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_create: { title: "Create board post", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_contact_list: { title: "List contacts", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_get: { title: "Get contact", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_create: { title: "Create contact", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_contact_update: { title: "Update contact", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_delete: { title: "Delete contact", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_list_tags: { title: "List contact tags", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_login_user: { title: "Log in with User OAuth", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_whoami: { title: "Show auth status", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_logout: { title: "Log out", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_doctor: { title: "Diagnose connection", readOnlyHint: true, idempotentHint: true, openWorldHint: true }
+};
+function defineTool(server, name, description, inputSchema, handler) {
+  const annotations = TOOL_ANNOTATIONS[name];
+  server.registerTool(
+    name,
+    { description, inputSchema, ...annotations ? { annotations } : {} },
+    handler
+  );
+}
+
+// src/mcp/tools/setup.ts
+function registerSetupTools(server) {
+  defineTool(
+    server,
+    "nworks_setup",
+    `NAVER WORKS API \uC778\uC99D \uC815\uBCF4\uB97C \uC124\uC815\uD569\uB2C8\uB2E4.
+
+\u25A0 \uC0AC\uC804 \uC900\uBE44 (\uC0AC\uC6A9\uC790\uAC00 \uC9C1\uC811 \uD574\uC57C \uD568):
+  1. https://dev.worksmobile.com \uC5D0\uC11C \uC571 \uC0DD\uC131 \uD6C4 Client ID\uC640 Client Secret\uC744 \uBC1C\uAE09\uBC1B\uC2B5\uB2C8\uB2E4.
+  2. MCP \uC124\uC815 \uD30C\uC77C(\uC608: claude_desktop_config.json)\uC758 nworks \uC11C\uBC84\uC5D0 env \uD544\uB4DC\uB97C \uCD94\uAC00\uD569\uB2C8\uB2E4:
+     { "env": { "NWORKS_CLIENT_SECRET": "<\uBC1C\uAE09\uBC1B\uC740 Client Secret>" } }
+  3. MCP \uD074\uB77C\uC774\uC5B8\uD2B8(\uC608: Claude Desktop)\uB97C \uC7AC\uC2DC\uC791\uD569\uB2C8\uB2E4.
+
+\u25A0 \uC774 tool\uC758 \uC5ED\uD560:
+  - clientId(\uD544\uC218)\uC640 serviceAccount, botId, domainId(\uC120\uD0DD)\uB97C \uD30C\uB77C\uBBF8\uD130\uB85C \uBC1B\uC544 \uC800\uC7A5\uD569\uB2C8\uB2E4.
+  - Client Secret\uC740 \uBCF4\uC548\uC744 \uC704\uD574 \uD30C\uB77C\uBBF8\uD130\uB85C \uBC1B\uC9C0 \uC54A\uC73C\uBA70, \uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC5D0\uC11C \uC790\uB3D9\uC73C\uB85C \uC77D\uC2B5\uB2C8\uB2E4.
+  - Service Account \uC0AC\uC6A9 \uC2DC \uD658\uACBD\uBCC0\uC218 NWORKS_PRIVATE_KEY_PATH\uB3C4 \uD544\uC694\uD569\uB2C8\uB2E4.
+
+\u25A0 \uC124\uC815 \uD6C4 \uB2E4\uC74C \uB2E8\uACC4:
+  - \uCE98\uB9B0\uB354/\uBA54\uC77C/\uB4DC\uB77C\uC774\uBE0C/\uD560\uC77C/\uAC8C\uC2DC\uD310 \u2192 nworks_login_user tool\uB85C \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778 \uD544\uC694
+  - \uBA54\uC2DC\uC9C0/\uAD6C\uC131\uC6D0\uC870\uD68C \u2192 Service Account \uC778\uC99D (serviceAccount + botId + NWORKS_PRIVATE_KEY_PATH)
+
+\u25A0 \uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC774 \uC5C6\uC73C\uBA74 \uC774 tool\uC740 \uC2E4\uD328\uD569\uB2C8\uB2E4. \uC2E4\uD328 \uC2DC \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC704 \uC0AC\uC804 \uC900\uBE44 \uB2E8\uACC4\uB97C \uC548\uB0B4\uD558\uC138\uC694.
+
+OAuth Redirect URI: http://localhost:9876/callback`,
+    {
+      clientId: z2.string().describe("Client ID (Developer Console\uC5D0\uC11C \uBC1C\uAE09)"),
+      serviceAccount: z2.string().optional().describe("Service Account ID (\uC608: xxxxx.serviceaccount@domain)"),
+      botId: z2.string().optional().describe("Bot ID (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)"),
+      domainId: z2.string().optional().describe("Domain ID")
+    },
+    async ({ clientId, serviceAccount, botId, domainId }) => {
+      try {
+        const resolvedSecret = process.env["NWORKS_CLIENT_SECRET"];
+        if (!resolvedSecret) {
+          return {
+            content: [{ type: "text", text: JSON.stringify({
+              error: true,
+              message: "\uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC774 \uC124\uC815\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.",
+              userAction: [
+                "1. https://dev.worksmobile.com \uC5D0\uC11C \uC571\uC758 Client Secret\uC744 \uD655\uC778\uD569\uB2C8\uB2E4.",
+                "2. MCP \uC124\uC815 \uD30C\uC77C(\uC608: claude_desktop_config.json)\uC744 \uC5F4\uACE0, nworks \uC11C\uBC84 \uC124\uC815\uC5D0 \uB2E4\uC74C\uC744 \uCD94\uAC00\uD569\uB2C8\uB2E4:",
+                '   "env": { "NWORKS_CLIENT_SECRET": "<Client Secret>" }',
+                "3. MCP \uD074\uB77C\uC774\uC5B8\uD2B8(\uC608: Claude Desktop)\uB97C \uC7AC\uC2DC\uC791\uD569\uB2C8\uB2E4.",
+                "4. \uC7AC\uC2DC\uC791 \uD6C4 \uB2E4\uC2DC \uC2DC\uB3C4\uD574\uC8FC\uC138\uC694."
+              ],
+              configExample: '{ "mcpServers": { "nworks": { "command": "npx", "args": ["-y", "nworks", "mcp"], "env": { "NWORKS_CLIENT_SECRET": "<Client Secret>" } } } }'
+            }) }],
+            isError: true
+          };
+        }
+        const resolvedPrivateKeyPath = process.env["NWORKS_PRIVATE_KEY_PATH"];
+        await saveCredentials({
+          clientId,
+          clientSecret: resolvedSecret,
+          serviceAccount,
+          privateKeyPath: resolvedPrivateKeyPath,
+          botId,
+          domainId
+        });
+        const nextSteps = [];
+        if (serviceAccount && resolvedPrivateKeyPath && botId) {
+          nextSteps.push("Service Account \uC778\uC99D \uC900\uBE44 \uC644\uB8CC \u2014 \uBD07 \uBA54\uC2DC\uC9C0 \uB4F1 \uBC14\uB85C \uC0AC\uC6A9 \uAC00\uB2A5");
+        } else if (serviceAccount && botId && !resolvedPrivateKeyPath) {
+          nextSteps.push('NWORKS_PRIVATE_KEY_PATH \uD658\uACBD\uBCC0\uC218\uAC00 \uC124\uC815\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4. Service Account \uC778\uC99D\uC5D0\uB294 Private Key \uD30C\uC77C \uACBD\uB85C\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC548\uB0B4\uD558\uC138\uC694: (1) Developer Console(https://dev.worksmobile.com)\uC5D0\uC11C Private Key\uB97C \uB2E4\uC6B4\uB85C\uB4DC (2) MCP \uC124\uC815 \uD30C\uC77C\uC758 env\uC5D0 NWORKS_PRIVATE_KEY_PATH\uB97C \uCD94\uAC00 (\uC608: "NWORKS_PRIVATE_KEY_PATH": "C:/keys/private.key") (3) MCP \uD074\uB77C\uC774\uC5B8\uD2B8 \uC7AC\uC2DC\uC791');
+        }
+        nextSteps.push("User OAuth\uAC00 \uD544\uC694\uD55C API\uB294 nworks_login_user tool\uB85C \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778\uC744 \uC9C4\uD589\uD558\uC138\uC694");
+        const mask2 = (s) => s.length <= 4 ? "****" : `****${s.slice(-Math.min(4, Math.floor(s.length / 3)))}`;
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                success: true,
+                message: "\uC778\uC99D \uC815\uBCF4\uAC00 \uC800\uC7A5\uB418\uC5C8\uC2B5\uB2C8\uB2E4.",
+                nextSteps,
+                clientId: mask2(clientId),
+                clientSecret: `${mask2(resolvedSecret)} (\uD658\uACBD\uBCC0\uC218)`,
+                serviceAccount: serviceAccount ?? null,
+                privateKeyPath: resolvedPrivateKeyPath ? `${mask2(resolvedPrivateKeyPath)} (\uD658\uACBD\uBCC0\uC218)` : null,
+                botId: botId ?? null
+              })
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
 }
 
+// src/mcp/tools/message.ts
+import { z as z3 } from "zod";
+
 // src/auth/jwt.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile2, stat } from "fs/promises";
 import jwt from "jsonwebtoken";
 async function createJWT(creds) {
   if (!creds.serviceAccount || !creds.privateKeyPath) {
@@ -158,6 +432,15 @@ async function createJWT(creds) {
     );
   }
   const privateKey = await readFile2(creds.privateKeyPath, "utf-8");
+  if (process.platform !== "win32") {
+    const fileStat = await stat(creds.privateKeyPath);
+    const mode = fileStat.mode & 511;
+    if (mode & 63) {
+      console.error(
+        `[nworks] Warning: Private key file has permissions ${mode.toString(8)}. Recommended: 600`
+      );
+    }
+  }
   const now = Math.floor(Date.now() / 1e3);
   const payload = {
     iss: creds.clientId,
@@ -194,7 +477,8 @@ async function refreshToken(profile = "default") {
   });
   if (!res.ok) {
     const text = await res.text();
-    throw new AuthError(`Token exchange failed (${res.status}): ${text}`);
+    const truncated = text.length > 200 ? text.substring(0, 200) + "..." : text;
+    throw new AuthError(`Token exchange failed (${res.status}): ${truncated}`);
   }
   const data = await res.json();
   const expiresIn = Number(data.expires_in);
@@ -210,7 +494,7 @@ async function refreshToken(profile = "default") {
 var BASE_URL = "https://www.worksapis.com/v1.0";
 var MAX_RETRIES = 3;
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function request(opts, _retryCount = 0) {
   const { method, path, body, profile = "default" } = opts;
@@ -232,7 +516,9 @@ async function request(opts, _retryCount = 0) {
     return request(opts, _retryCount + 1);
   }
   if (res.status === 429 && _retryCount < MAX_RETRIES) {
-    const retryAfter = parseInt(res.headers.get("Retry-After") ?? "5", 10);
+    const MAX_RETRY_AFTER = 60;
+    const rawRetry = parseInt(res.headers.get("Retry-After") ?? "5", 10);
+    const retryAfter = Math.min(Number.isNaN(rawRetry) ? 5 : rawRetry, MAX_RETRY_AFTER);
     await sleep(retryAfter * 1e3);
     return request(opts, _retryCount + 1);
   }
@@ -257,6 +543,59 @@ async function request(opts, _retryCount = 0) {
   return JSON.parse(text);
 }
 
+// src/utils/sanitize.ts
+import { resolve, sep } from "path";
+import { randomBytes } from "crypto";
+function sanitizePathSegment(value) {
+  if (!value || typeof value !== "string") {
+    throw new Error("Path segment must be a non-empty string");
+  }
+  if (value === "me") return value;
+  if (/[/\\]/.test(value) || value.includes("..")) {
+    throw new Error(`Invalid path segment: "${value}"`);
+  }
+  return encodeURIComponent(value);
+}
+function sanitizeFileName(name) {
+  if (!name || typeof name !== "string") {
+    throw new Error("File name must be a non-empty string");
+  }
+  const segments = name.split(/[/\\]/).filter((s) => s.length > 0);
+  const base = segments[segments.length - 1] ?? "";
+  return base.replace(/[\r\n"]/g, "_");
+}
+function validateLocalPath(filePath, allowedBase) {
+  const resolved = resolve(filePath);
+  if (allowedBase) {
+    const resolvedBase = resolve(allowedBase);
+    if (resolved !== resolvedBase && !resolved.startsWith(resolvedBase + sep)) {
+      throw new Error(`Path "${filePath}" escapes the allowed directory "${allowedBase}"`);
+    }
+  }
+  return resolved;
+}
+function validateRedirectUrl(location, allowedHosts) {
+  let parsed;
+  try {
+    parsed = new URL(location);
+  } catch {
+    throw new Error(`Invalid redirect URL: "${location}"`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Redirect URL must use HTTPS: "${location}"`);
+  }
+  const isAllowed = allowedHosts.some(
+    (host) => parsed.hostname === host || parsed.hostname.endsWith("." + host)
+  );
+  if (!isAllowed) {
+    throw new Error(`Redirect to untrusted host: "${parsed.hostname}"`);
+  }
+  return location;
+}
+function generateSecureState() {
+  return randomBytes(32).toString("hex");
+}
+
 // src/api/message.ts
 function buildContent(opts) {
   const type = opts.type ?? "text";
@@ -264,7 +603,11 @@ function buildContent(opts) {
     return { type: "text", text: opts.text };
   }
   if (type === "button") {
-    const actions = opts.actions ? JSON.parse(opts.actions) : [];
+    const actions = opts.actions ? (() => {
+      const parsed = JSON.parse(opts.actions);
+      if (!Array.isArray(parsed)) throw new Error("actions must be a JSON array");
+      return parsed;
+    })() : [];
     return {
       type: "button_template",
       contentText: opts.text,
@@ -272,7 +615,11 @@ function buildContent(opts) {
     };
   }
   if (type === "list") {
-    const elements = opts.elements ? JSON.parse(opts.elements) : [];
+    const elements = opts.elements ? (() => {
+      const parsed = JSON.parse(opts.elements);
+      if (!Array.isArray(parsed)) throw new Error("elements must be a JSON array");
+      return parsed;
+    })() : [];
     return {
       type: "list_template",
       coverData: { text: opts.text },
@@ -294,7 +641,7 @@ async function send(opts) {
   if (opts.to) {
     const result = await request({
       method: "POST",
-      path: `/bots/${creds.botId}/users/${opts.to}/messages`,
+      path: `/bots/${sanitizePathSegment(creds.botId)}/users/${sanitizePathSegment(opts.to)}/messages`,
       body,
       profile
     });
@@ -303,7 +650,7 @@ async function send(opts) {
   if (opts.channel) {
     const result = await request({
       method: "POST",
-      path: `/bots/${creds.botId}/channels/${opts.channel}/messages`,
+      path: `/bots/${sanitizePathSegment(creds.botId)}/channels/${sanitizePathSegment(opts.channel)}/messages`,
       body,
       profile
     });
@@ -320,28 +667,126 @@ async function listMembers(channelId, profile = "default") {
   }
   const result = await request({
     method: "GET",
-    path: `/bots/${creds.botId}/channels/${channelId}/members`,
+    path: `/bots/${sanitizePathSegment(creds.botId)}/channels/${sanitizePathSegment(channelId)}/members`,
     profile
   });
   return { members: result.members ?? [], responseMetaData: result.responseMetaData };
 }
 
+// src/mcp/tools/message.ts
+function registerMessageTools(server) {
+  defineTool(
+    server,
+    "nworks_message_send",
+    "NAVER WORKS \uBA54\uC2DC\uC9C0\uB97C \uC804\uC1A1\uD569\uB2C8\uB2E4 (\uBD07\uC774 \uC0AC\uC6A9\uC790 \uB610\uB294 \uCC44\uB110\uC5D0 \uBC1C\uC1A1). Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup\uC5D0\uC11C serviceAccount, botId \uC124\uC815 + \uD658\uACBD\uBCC0\uC218 NWORKS_PRIVATE_KEY_PATH \uD544\uC694. User OAuth \uBD88\uD544\uC694)",
+    {
+      to: z3.string().optional().describe("\uC218\uC2E0\uC790 userId (channel\uACFC \uD0DD 1). nworks_directory_members\uB85C userId \uC870\uD68C \uAC00\uB2A5"),
+      channel: z3.string().optional().describe("\uCC44\uB110 channelId (to\uC640 \uD0DD 1). nworks_message_members\uB85C \uCC44\uB110 \uAD6C\uC131\uC6D0 \uD655\uC778 \uAC00\uB2A5"),
+      text: z3.string().describe("\uBA54\uC2DC\uC9C0 \uBCF8\uBB38"),
+      type: z3.enum(["text", "button", "list"]).optional().describe("\uBA54\uC2DC\uC9C0 \uD0C0\uC785 (\uAE30\uBCF8: text)"),
+      actions: z3.string().optional().describe("\uBC84\uD2BC \uC561\uC158 JSON (type=button\uC77C \uB54C)"),
+      elements: z3.string().optional().describe("\uB9AC\uC2A4\uD2B8 \uD56D\uBAA9 JSON (type=list\uC77C \uB54C)")
+    },
+    async ({ to, channel, text, type, actions, elements }) => {
+      try {
+        const result = await send({
+          to,
+          channel,
+          text,
+          type,
+          actions,
+          elements
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_message_members",
+    "\uD2B9\uC815 \uCC44\uB110\uC758 \uAD6C\uC131\uC6D0 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC774 \uCC44\uB110\uC5D0 \uB204\uAC00 \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694)",
+    {
+      channel: z3.string().describe("\uCC44\uB110 channelId")
+    },
+    async ({ channel }) => {
+      try {
+        const result = await listMembers(channel);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/tools/directory.ts
+import { z as z4 } from "zod";
+
 // src/api/directory.ts
-async function listUsers(profile = "default") {
+async function listUsers(count = 100, cursor, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
   const result = await request({
     method: "GET",
-    path: "/users",
+    path: `/users?${params.toString()}`,
     profile
   });
   return { users: result.users ?? [], responseMetaData: result.responseMetaData };
 }
 
-// src/api/calendar.ts
-import { randomUUID } from "crypto";
-
-// src/auth/oauth-user.ts
-import { createServer } from "http";
-import { URL } from "url";
+// src/mcp/tools/directory.ts
+function registerDirectoryTools(server) {
+  defineTool(
+    server,
+    "nworks_directory_members",
+    "NAVER WORKS \uC870\uC9C1 \uAD6C\uC131\uC6D0(\uC9C1\uC6D0) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAD6C\uC131\uC6D0 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uD300\uC6D0 \uCC3E\uC544\uC918', '\uB204\uAD6C\uD55C\uD14C \uBA54\uC2DC\uC9C0 \uBCF4\uB0BC\uC9C0 userId \uCC3E\uAE30' \uB4F1\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694). \uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uC218\uC2E0\uC790 userId\uB97C \uC5EC\uAE30\uC11C \uC870\uD68C \uAC00\uB2A5. \uAD6C\uC131\uC6D0\uC774 \uB9CE\uC73C\uBA74 nextCursor\uB85C \uB2E4\uC74C \uD398\uC774\uC9C0\uB97C \uC774\uC5B4\uC11C \uC870\uD68C",
+    {
+      count: z4.number().int().min(1).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 100)"),
+      cursor: z4.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C (\uC774\uC804 \uC751\uB2F5\uC758 nextCursor \uAC12)")
+    },
+    async ({ count, cursor }) => {
+      try {
+        const result = await listUsers(count ?? 100, cursor);
+        return {
+          content: [{ type: "text", text: JSON.stringify({
+            users: result.users,
+            count: result.users.length,
+            hasMore: !!result.responseMetaData?.nextCursor,
+            nextCursor: result.responseMetaData?.nextCursor ?? null
+          }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/tools/calendar.ts
+import { z as z5 } from "zod";
+
+// src/api/calendar.ts
+import { randomUUID } from "crypto";
+
+// src/auth/oauth-user.ts
+import { createServer } from "http";
+import { URL as URL2 } from "url";
 var AUTH_URL2 = "https://auth.worksmobile.com/oauth2/v2.0/authorize";
 var TOKEN_URL = "https://auth.worksmobile.com/oauth2/v2.0/token";
 var REDIRECT_PORT = 9876;
@@ -356,14 +801,14 @@ function buildAuthorizeUrl(clientId, scope, state) {
   });
   return `${AUTH_URL2}?${params.toString()}`;
 }
-function waitForAuthCode() {
-  return new Promise((resolve, reject) => {
+function waitForAuthCode(expectedState) {
+  return new Promise((resolve3, reject) => {
     const timeout = setTimeout(() => {
       server.close();
       reject(new AuthError("OAuth login timed out (120s). Try again."));
     }, 12e4);
     const server = createServer((req, res) => {
-      const url = new URL(req.url ?? "/", `http://localhost:${REDIRECT_PORT}`);
+      const url = new URL2(req.url ?? "/", `http://localhost:${REDIRECT_PORT}`);
       if (url.pathname !== "/callback") {
         res.writeHead(404);
         res.end("Not found");
@@ -371,6 +816,12 @@ function waitForAuthCode() {
       }
       const code = url.searchParams.get("code");
       const error = url.searchParams.get("error");
+      const state = url.searchParams.get("state");
+      if (state !== expectedState) {
+        res.writeHead(403, { "Content-Type": "text/html; charset=utf-8" });
+        res.end("<h2>\uBCF4\uC548 \uC624\uB958</h2><p>state \uBD88\uC77C\uCE58. \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uB85C\uADF8\uC778\uC744 \uB2E4\uC2DC \uC9C4\uD589\uD558\uC138\uC694.</p>");
+        return;
+      }
       if (error) {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end("<h2>\uB85C\uADF8\uC778 \uC2E4\uD328</h2><p>\uC774 \uCC3D\uC744 \uB2EB\uC544\uB3C4 \uB429\uB2C8\uB2E4.</p>");
@@ -391,9 +842,9 @@ function waitForAuthCode() {
       res.end("<h2>\uB85C\uADF8\uC778 \uC131\uACF5!</h2><p>\uC774 \uCC3D\uC744 \uB2EB\uACE0 \uD130\uBBF8\uB110\uB85C \uB3CC\uC544\uAC00\uC138\uC694.</p>");
       clearTimeout(timeout);
       server.close();
-      resolve(code);
+      resolve3(code);
     });
-    server.listen(REDIRECT_PORT, () => {
+    server.listen(REDIRECT_PORT, "127.0.0.1", () => {
     });
     server.on("error", (err) => {
       clearTimeout(timeout);
@@ -401,6 +852,17 @@ function waitForAuthCode() {
     });
   });
 }
+async function safeErrorSummary(res) {
+  const text = await res.text();
+  try {
+    const body = JSON.parse(text);
+    if (body.error || body.error_description) {
+      return [body.error, body.error_description].filter(Boolean).join(": ");
+    }
+  } catch {
+  }
+  return text.length > 200 ? text.slice(0, 200) + "..." : text;
+}
 async function exchangeCodeForToken(code, clientId, clientSecret) {
   const body = new URLSearchParams({
     grant_type: "authorization_code",
@@ -415,8 +877,7 @@ async function exchangeCodeForToken(code, clientId, clientSecret) {
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text();
-    throw new AuthError(`Token exchange failed (${res.status}): ${text}`);
+    throw new AuthError(`Token exchange failed (${res.status}): ${await safeErrorSummary(res)}`);
   }
   const data = await res.json();
   return {
@@ -440,8 +901,7 @@ async function refreshUserToken(refreshToken2, profile = "default") {
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text();
-    throw new AuthError(`Token refresh failed (${res.status}): ${text}`);
+    throw new AuthError(`Token refresh failed (${res.status}): ${await safeErrorSummary(res)}`);
   }
   const data = await res.json();
   return {
@@ -451,13 +911,31 @@ async function refreshUserToken(refreshToken2, profile = "default") {
     scope: data.scope
   };
 }
-function startOAuthCallbackServer(clientId, clientSecret) {
-  return waitForAuthCode().then(
+function startOAuthCallbackServer(clientId, clientSecret, expectedState) {
+  return waitForAuthCode(expectedState).then(
     (code) => exchangeCodeForToken(code, clientId, clientSecret)
   );
 }
+async function revokeToken(token, clientId, clientSecret) {
+  try {
+    const res = await fetch("https://auth.worksmobile.com/oauth2/v2.0/revoke", {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        token,
+        client_id: clientId,
+        client_secret: clientSecret
+      }).toString()
+    });
+    if (!res.ok && process.env["NWORKS_VERBOSE"] === "1") {
+      console.error(`[nworks] Token revoke returned ${res.status}`);
+    }
+  } catch {
+  }
+}
 
 // src/auth/token-user.ts
+var inFlightRefresh = /* @__PURE__ */ new Map();
 async function getValidUserToken(profile = "default") {
   const cached = await loadUserToken(profile);
   if (!cached) {
@@ -468,22 +946,106 @@ async function getValidUserToken(profile = "default") {
   if (cached.expiresAt > Date.now() / 1e3 + 300) {
     return cached.accessToken;
   }
+  return refreshValidUserToken(profile);
+}
+function refreshValidUserToken(profile = "default") {
+  const existing = inFlightRefresh.get(profile);
+  if (existing) return existing;
+  const run = doRefresh(profile);
+  inFlightRefresh.set(profile, run);
+  void run.finally(() => inFlightRefresh.delete(profile)).catch(() => {
+  });
+  return run;
+}
+async function doRefresh(profile) {
+  const cached = await loadUserToken(profile);
+  if (!cached) {
+    throw new AuthError(
+      "User OAuth token not found. Run `nworks login --user` first."
+    );
+  }
   const refreshed = await refreshUserToken(cached.refreshToken, profile);
   await saveUserToken(refreshed, profile);
   return refreshed.accessToken;
 }
 
-// src/api/calendar.ts
-var BASE_URL2 = "https://www.worksapis.com/v1.0";
-async function authedFetch(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
+// src/api/user-client.ts
+var MAX_RETRIES2 = 3;
+var MAX_RETRY_AFTER_SECONDS = 60;
+var MAX_CONCURRENT_PER_HOST = 5;
+function sleep2(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+var HostSemaphore = class {
+  constructor(max) {
+    this.max = max;
+  }
+  active = 0;
+  waiters = [];
+  async acquire() {
+    if (this.active < this.max) {
+      this.active++;
+      return;
+    }
+    await new Promise((resolve3) => this.waiters.push(resolve3));
+  }
+  release() {
+    const next = this.waiters.shift();
+    if (next) {
+      next();
+    } else {
+      this.active--;
+    }
+  }
+};
+var semaphores = /* @__PURE__ */ new Map();
+function semaphoreFor(host) {
+  let semaphore = semaphores.get(host);
+  if (!semaphore) {
+    semaphore = new HostSemaphore(MAX_CONCURRENT_PER_HOST);
+    semaphores.set(host, semaphore);
+  }
+  return semaphore;
+}
+async function userFetch(url, init, profile) {
+  let refreshedOn401 = false;
+  for (let attempt = 0; ; attempt++) {
+    const res = await fetchOnce(url, init, profile);
+    if (res.status === 401 && !refreshedOn401) {
+      refreshedOn401 = true;
+      await refreshValidUserToken(profile);
+      continue;
+    }
+    if (res.status === 429 && attempt < MAX_RETRIES2) {
+      await sleep2(retryAfterMs(res));
+      continue;
+    }
+    return res;
+  }
+}
+async function fetchOnce(url, init, profile) {
+  const host = new URL(url).host;
+  const semaphore = semaphoreFor(host);
+  await semaphore.acquire();
+  try {
+    const token = await getValidUserToken(profile);
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return await fetch(url, { ...init, headers });
+  } finally {
+    semaphore.release();
+  }
+}
+function retryAfterMs(res) {
+  const raw = parseInt(res.headers.get("Retry-After") ?? "5", 10);
+  const seconds = Math.min(Number.isNaN(raw) ? 5 : raw, MAX_RETRY_AFTER_SECONDS);
+  return seconds * 1e3;
 }
-async function handleError(res) {
+async function handleUserApiError(res) {
   if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope calendar` again.");
+    throw new AuthError(
+      "User token expired or revoked. Run `nworks login --user` again."
+    );
   }
   let code = "UNKNOWN";
   let description = `HTTP ${res.status}`;
@@ -495,6 +1057,9 @@ async function handleError(res) {
   }
   throw new ApiError(code, description, res.status);
 }
+
+// src/api/calendar.ts
+var BASE_URL2 = "https://www.worksapis.com/v1.0";
 function generateEventId() {
   return `event-${randomUUID()}`;
 }
@@ -508,12 +1073,12 @@ function normalizeDateTime(dt) {
 async function listEvents(fromDateTime, untilDateTime, userId = "me", profile = "default") {
   const from = encodeURIComponent(fromDateTime);
   const until = encodeURIComponent(untilDateTime);
-  const url = `${BASE_URL2}/users/${userId}/calendar/events?fromDateTime=${from}&untilDateTime=${until}`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events?fromDateTime=${from}&untilDateTime=${until}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return { events: data.events ?? [] };
 }
@@ -545,12 +1110,12 @@ async function createEvent(opts) {
     eventComponents: [eventComponent],
     sendNotification: opts.sendNotification ?? false
   };
-  const url = `${BASE_URL2}/users/${userId}/calendar/events`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${url}`);
-    console.error(`[nworks] Body: ${JSON.stringify(body, null, 2)}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch(
+  const res = await userFetch(
     url,
     {
       method: "POST",
@@ -562,16 +1127,16 @@ async function createEvent(opts) {
   if (res.status === 201) {
     return await res.json();
   }
-  if (!res.ok) return handleError(res);
+  if (!res.ok) return handleUserApiError(res);
   return await res.json();
 }
 async function getEvent(eventId, userId = "me", profile = "default") {
-  const url = `${BASE_URL2}/users/${userId}/calendar/events/${eventId}`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events/${sanitizePathSegment(eventId)}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   const event = data.eventComponents[0];
   if (!event) throw new ApiError("NOT_FOUND", "Event not found", 404);
@@ -609,12 +1174,12 @@ async function updateEvent(opts) {
     eventComponents: [eventComponent],
     sendNotification: opts.sendNotification ?? false
   };
-  const url = `${BASE_URL2}/users/${userId}/calendar/events/${opts.eventId}`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events/${sanitizePathSegment(opts.eventId)}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] PUT ${url}`);
-    console.error(`[nworks] Body: ${JSON.stringify(body, null, 2)}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch(
+  const res = await userFetch(
     url,
     {
       method: "PUT",
@@ -623,47 +1188,203 @@ async function updateEvent(opts) {
     },
     profile
   );
-  if (!res.ok) return handleError(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 async function deleteEvent(eventId, userId = "me", sendNotification = false, profile = "default") {
   const params = new URLSearchParams();
   params.set("sendNotification", String(sendNotification));
-  const url = `${BASE_URL2}/users/${userId}/calendar/events/${eventId}?${params.toString()}`;
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events/${sanitizePathSegment(eventId)}?${params.toString()}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] DELETE ${url}`);
   }
-  const res = await authedFetch(url, { method: "DELETE" }, profile);
+  const res = await userFetch(url, { method: "DELETE" }, profile);
   if (res.status === 204) return;
-  if (!res.ok) return handleError(res);
+  if (!res.ok) return handleUserApiError(res);
+}
+
+// src/mcp/tools/calendar.ts
+function registerCalendarTools(server) {
+  defineTool(
+    server,
+    "nworks_calendar_list",
+    "\uC0AC\uC6A9\uC790\uC758 \uCE98\uB9B0\uB354 \uC77C\uC815/\uC2A4\uCF00\uC904\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC624\uB298 \uC77C\uC815 \uC54C\uB824\uC918', '\uC774\uBC88 \uC8FC \uC2A4\uCF00\uC904 \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar.read scope). \uBBF8\uB85C\uADF8\uC778 \uC2DC nworks_login_user\uB85C \uB85C\uADF8\uC778 \uD544\uC694",
+    {
+      fromDateTime: z5.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
+      untilDateTime: z5.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ fromDateTime, untilDateTime, userId }) => {
+      try {
+        const result = await listEvents(
+          fromDateTime,
+          untilDateTime,
+          userId ?? "me"
+        );
+        const events = result.events.flatMap(
+          (e) => e.eventComponents.map((c) => ({
+            eventId: c.eventId,
+            summary: c.summary,
+            start: c.start.dateTime ?? c.start.date ?? "",
+            end: c.end.dateTime ?? c.end.date ?? "",
+            location: c.location ?? ""
+          }))
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify({ events, count: events.length }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "calendar.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_calendar_create",
+    "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0C8\uB85C \uB9CC\uB4ED\uB2C8\uB2E4. '\uD68C\uC758 \uC7A1\uC544\uC918', '\uC77C\uC815 \uB4F1\uB85D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope)",
+    {
+      summary: z5.string().describe("\uC77C\uC815 \uC81C\uBAA9"),
+      start: z5.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      end: z5.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      timeZone: z5.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
+      description: z5.string().optional().describe("\uC77C\uC815 \uC124\uBA85"),
+      location: z5.string().optional().describe("\uC7A5\uC18C"),
+      attendees: z5.array(z5.object({ email: z5.string(), displayName: z5.string().optional() })).optional().describe("\uCC38\uC11D\uC790 \uBAA9\uB85D"),
+      sendNotification: z5.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({
+      summary,
+      start,
+      end,
+      timeZone,
+      description,
+      location,
+      attendees,
+      sendNotification,
+      userId
+    }) => {
+      try {
+        const result = await createEvent({
+          summary,
+          start,
+          end,
+          timeZone,
+          description,
+          location,
+          attendees,
+          sendNotification,
+          userId: userId ?? "me"
+        });
+        const event = result.eventComponents?.[0];
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, eventId: event?.eventId, summary: event?.summary, start: event?.start, end: event?.end }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "calendar.create") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_calendar_update",
+    "\uAE30\uC874 \uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC218\uC815\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uC2DC\uAC04 \uBCC0\uACBD\uD574\uC918', '\uD68C\uC758 \uC81C\uBAA9 \uBC14\uAFD4\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
+    {
+      eventId: z5.string().describe("\uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      summary: z5.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
+      start: z5.string().optional().describe("\uC0C8 \uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      end: z5.string().optional().describe("\uC0C8 \uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      timeZone: z5.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
+      description: z5.string().optional().describe("\uC0C8 \uC124\uBA85"),
+      location: z5.string().optional().describe("\uC0C8 \uC7A5\uC18C"),
+      sendNotification: z5.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({
+      eventId,
+      summary,
+      start,
+      end,
+      timeZone,
+      description,
+      location,
+      sendNotification,
+      userId
+    }) => {
+      try {
+        await updateEvent({
+          eventId,
+          summary,
+          start,
+          end,
+          timeZone,
+          description,
+          location,
+          sendNotification,
+          userId: userId ?? "me"
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, eventId, message: "\uC77C\uC815\uC774 \uC218\uC815\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "calendar.update") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_calendar_delete",
+    "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0AD\uC81C\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uCDE8\uC18C\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
+    {
+      eventId: z5.string().describe("\uC0AD\uC81C\uD560 \uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      sendNotification: z5.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ eventId, sendNotification, userId }) => {
+      try {
+        await deleteEvent(
+          eventId,
+          userId ?? "me",
+          sendNotification ?? false
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, eventId, message: "\uC77C\uC815\uC774 \uC0AD\uC81C\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "calendar.delete") }],
+          isError: true
+        };
+      }
+    }
+  );
 }
 
+// src/mcp/tools/drive.ts
+import { z as z6 } from "zod";
+
 // src/api/drive.ts
-import { readFile as readFile3, stat } from "fs/promises";
+import { readFile as readFile3, stat as stat2 } from "fs/promises";
 import { basename } from "path";
 var BASE_URL3 = "https://www.worksapis.com/v1.0";
-async function authedFetch2(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError2(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope file` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
+var MAX_UPLOAD_SIZE = 100 * 1024 * 1024;
+var ALLOWED_HOSTS = [
+  "storage.worksmobile.com",
+  "apis-storage.worksmobile.com",
+  "www.worksapis.com",
+  "worksapis.com"
+];
 async function listFiles(userId = "me", folderId, count = 20, cursor, profile = "default") {
-  const base = `${BASE_URL3}/users/${userId}/drive/files`;
-  const path = folderId ? `${base}/${folderId}/children` : base;
+  const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
+  const path = folderId ? `${base}/${sanitizePathSegment(folderId)}/children` : base;
   const params = new URLSearchParams();
   params.set("count", String(count));
   if (cursor) params.set("cursor", cursor);
@@ -671,21 +1392,25 @@ async function listFiles(userId = "me", folderId, count = 20, cursor, profile =
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch2(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError2(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return { files: data.files ?? [], responseMetaData: data.responseMetaData };
 }
 async function uploadFile(localPath, userId = "me", folderId, overwrite = false, profile = "default") {
   const fileName = basename(localPath);
-  const fileStat = await stat(localPath);
+  const safeName = sanitizeFileName(fileName);
+  const fileStat = await stat2(localPath);
   const fileSize = fileStat.size;
-  const base = `${BASE_URL3}/users/${userId}/drive/files`;
-  const createUrl = folderId ? `${base}/${folderId}` : base;
+  if (fileSize > MAX_UPLOAD_SIZE) {
+    throw new ApiError("FILE_TOO_LARGE", `File size (${fileSize} bytes) exceeds maximum allowed (${MAX_UPLOAD_SIZE} bytes)`, 413);
+  }
+  const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
+  const createUrl = folderId ? `${base}/${sanitizePathSegment(folderId)}` : base;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${createUrl} (create upload URL)`);
   }
-  const createRes = await authedFetch2(
+  const createRes = await userFetch(
     createUrl,
     {
       method: "POST",
@@ -694,13 +1419,14 @@ async function uploadFile(localPath, userId = "me", folderId, overwrite = false,
     },
     profile
   );
-  if (!createRes.ok) return handleError2(createRes);
+  if (!createRes.ok) return handleUserApiError(createRes);
   const { uploadUrl } = await createRes.json();
+  validateRedirectUrl(uploadUrl, ALLOWED_HOSTS);
   const fileBuffer = await readFile3(localPath);
   const boundary = `----nworks${Date.now()}`;
   const header = Buffer.from(
     `--${boundary}\r
-Content-Disposition: form-data; name="Filedata"; filename="${fileName}"\r
+Content-Disposition: form-data; name="Filedata"; filename="${safeName}"\r
 Content-Type: application/octet-stream\r
 \r
 `
@@ -712,7 +1438,7 @@ Content-Type: application/octet-stream\r
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${uploadUrl} (upload content, ${fileSize} bytes)`);
   }
-  const uploadRes = await authedFetch2(
+  const uploadRes = await userFetch(
     uploadUrl,
     {
       method: "POST",
@@ -721,17 +1447,20 @@ Content-Type: application/octet-stream\r
     },
     profile
   );
-  if (!uploadRes.ok) return handleError2(uploadRes);
+  if (!uploadRes.ok) return handleUserApiError(uploadRes);
   return await uploadRes.json();
 }
 async function uploadBuffer(fileBuffer, fileName, userId = "me", folderId, overwrite = false, profile = "default") {
   const fileSize = fileBuffer.length;
-  const base = `${BASE_URL3}/users/${userId}/drive/files`;
-  const createUrl = folderId ? `${base}/${folderId}` : base;
+  if (fileSize > MAX_UPLOAD_SIZE) {
+    throw new ApiError("FILE_TOO_LARGE", `File size (${fileSize} bytes) exceeds maximum allowed (${MAX_UPLOAD_SIZE} bytes)`, 413);
+  }
+  const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
+  const createUrl = folderId ? `${base}/${sanitizePathSegment(folderId)}` : base;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${createUrl} (create upload URL for buffer)`);
   }
-  const createRes = await authedFetch2(
+  const createRes = await userFetch(
     createUrl,
     {
       method: "POST",
@@ -740,12 +1469,13 @@ async function uploadBuffer(fileBuffer, fileName, userId = "me", folderId, overw
     },
     profile
   );
-  if (!createRes.ok) return handleError2(createRes);
+  if (!createRes.ok) return handleUserApiError(createRes);
   const { uploadUrl } = await createRes.json();
+  validateRedirectUrl(uploadUrl, ALLOWED_HOSTS);
   const boundary = `----nworks${Date.now()}`;
   const header = Buffer.from(
     `--${boundary}\r
-Content-Disposition: form-data; name="Filedata"; filename="${fileName}"\r
+Content-Disposition: form-data; name="Filedata"; filename="${sanitizeFileName(fileName)}"\r
 Content-Type: application/octet-stream\r
 \r
 `
@@ -757,7 +1487,7 @@ Content-Type: application/octet-stream\r
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${uploadUrl} (upload buffer, ${fileSize} bytes)`);
   }
-  const uploadRes = await authedFetch2(
+  const uploadRes = await userFetch(
     uploadUrl,
     {
       method: "POST",
@@ -766,32 +1496,29 @@ Content-Type: application/octet-stream\r
     },
     profile
   );
-  if (!uploadRes.ok) return handleError2(uploadRes);
+  if (!uploadRes.ok) return handleUserApiError(uploadRes);
   return await uploadRes.json();
 }
-async function downloadFile(fileId, userId = "me", profile = "default") {
-  const url = `${BASE_URL3}/users/${userId}/drive/files/${fileId}/download`;
+async function downloadViaRedirect(url, profile) {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url} (get download URL)`);
   }
-  const redirectRes = await authedFetch2(
+  const redirectRes = await userFetch(
     url,
     { method: "GET", redirect: "manual" },
     profile
   );
-  if (redirectRes.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope file` again.");
-  }
   const location = redirectRes.headers.get("location");
   if (!location) {
-    if (!redirectRes.ok) return handleError2(redirectRes);
+    if (!redirectRes.ok) return handleUserApiError(redirectRes);
     throw new ApiError("NO_REDIRECT", "No download URL returned", redirectRes.status);
   }
+  const safeLocation = validateRedirectUrl(location, ALLOWED_HOSTS);
   if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] GET ${location} (download content)`);
+    console.error(`[nworks] GET ${safeLocation} (download content)`);
   }
-  const downloadRes = await authedFetch2(location, { method: "GET" }, profile);
-  if (!downloadRes.ok) return handleError2(downloadRes);
+  const downloadRes = await userFetch(safeLocation, { method: "GET" }, profile);
+  if (!downloadRes.ok) return handleUserApiError(downloadRes);
   const arrayBuffer = await downloadRes.arrayBuffer();
   const buffer = Buffer.from(arrayBuffer);
   const disposition = downloadRes.headers.get("content-disposition");
@@ -804,946 +1531,233 @@ async function downloadFile(fileId, userId = "me", profile = "default") {
   }
   return { buffer, fileName };
 }
-
-// src/api/mail.ts
-var BASE_URL4 = "https://www.worksapis.com/v1.0";
-async function authedFetch3(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError3(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope mail` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
-async function sendMail(opts) {
-  const userId = opts.userId ?? "me";
-  const profile = opts.profile ?? "default";
-  const url = `${BASE_URL4}/users/${userId}/mail`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] POST ${url}`);
-  }
-  const body = {
-    to: opts.to,
-    subject: opts.subject
-  };
-  if (opts.body !== void 0) body.body = opts.body;
-  if (opts.cc) body.cc = opts.cc;
-  if (opts.bcc) body.bcc = opts.bcc;
-  if (opts.contentType) body.contentType = opts.contentType;
-  const res = await authedFetch3(
-    url,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    },
-    profile
-  );
-  if (res.status === 202) return;
-  if (!res.ok) return handleError3(res);
+async function downloadFile(fileId, userId = "me", profile = "default") {
+  const url = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files/${sanitizePathSegment(fileId)}/download`;
+  return downloadViaRedirect(url, profile);
 }
-async function listMails(folderId = 0, userId = "me", count = 30, cursor, isUnread, profile = "default") {
+async function listSharedDrives(count = 20, cursor, profile = "default") {
   const params = new URLSearchParams();
   params.set("count", String(count));
   if (cursor) params.set("cursor", cursor);
-  if (isUnread) params.set("isUnread", "true");
-  const url = `${BASE_URL4}/users/${userId}/mail/mailfolders/${folderId}/children?${params.toString()}`;
+  const url = `${BASE_URL3}/sharedrives?${params.toString()}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch3(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError3(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
-  return {
-    mails: data.mails ?? [],
-    unreadCount: data.unreadCount,
-    folderName: data.folderName,
-    totalCount: data.totalCount,
-    responseMetaData: data.responseMetaData
-  };
+  return { sharedDrives: data.sharedrives ?? [], responseMetaData: data.responseMetaData };
 }
-async function readMail(mailId, userId = "me", profile = "default") {
-  const url = `${BASE_URL4}/users/${userId}/mail/${mailId}`;
+async function listSharedDriveFiles(sharedriveId, folderId, count = 20, cursor, profile = "default") {
+  const base = `${BASE_URL3}/sharedrives/${sanitizePathSegment(sharedriveId)}/files`;
+  const path = folderId ? `${base}/${sanitizePathSegment(folderId)}/children` : base;
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${path}?${params.toString()}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch3(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError3(res);
-  return await res.json();
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { files: data.files ?? [], responseMetaData: data.responseMetaData };
+}
+async function downloadSharedDriveFile(sharedriveId, fileId, profile = "default") {
+  const url = `${BASE_URL3}/sharedrives/${sanitizePathSegment(sharedriveId)}/files/${sanitizePathSegment(fileId)}/download`;
+  return downloadViaRedirect(url, profile);
 }
 
-// src/api/task.ts
-var BASE_URL5 = "https://www.worksapis.com/v1.0";
-async function authedFetch4(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError4(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope task` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
-async function resolveUserId(userId, profile) {
-  if (userId !== "me") return userId;
-  const url = `${BASE_URL5}/users/me`;
-  const res = await authedFetch4(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError4(res);
-  const data = await res.json();
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] Resolved "me" \u2192 ${data.userId}`);
-  }
-  return data.userId;
-}
-async function listTasks(categoryId = "default", userId = "me", count = 50, cursor, status = "ALL", profile = "default") {
-  const params = new URLSearchParams();
-  params.set("categoryId", categoryId);
-  params.set("count", String(count));
-  params.set("status", status);
-  if (cursor) params.set("cursor", cursor);
-  const url = `${BASE_URL5}/users/${userId}/tasks?${params.toString()}`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] GET ${url}`);
-  }
-  const res = await authedFetch4(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError4(res);
-  const data = await res.json();
-  return { tasks: data.tasks ?? [], responseMetaData: data.responseMetaData };
-}
-async function createTask(opts) {
-  const userId = opts.userId ?? "me";
-  const profile = opts.profile ?? "default";
-  const resolvedUserId = await resolveUserId(userId, profile);
-  const assignorId = opts.assignorId ?? resolvedUserId;
-  const assigneeIds = opts.assigneeIds ?? [resolvedUserId];
-  const body = {
-    assignorId,
-    assignees: assigneeIds.map((id) => ({ assigneeId: id, status: "TODO" })),
-    title: opts.title,
-    content: opts.content ?? "",
-    completionCondition: "ANY_ONE"
-  };
-  if (opts.dueDate) body.dueDate = opts.dueDate;
-  if (opts.categoryId) body.categoryId = opts.categoryId;
-  const url = `${BASE_URL5}/users/${userId}/tasks`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] POST ${url}`);
-    console.error(`[nworks] Body: ${JSON.stringify(body, null, 2)}`);
-  }
-  const res = await authedFetch4(
-    url,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    },
-    profile
-  );
-  if (res.status === 201) {
-    return await res.json();
-  }
-  if (!res.ok) return handleError4(res);
-  return await res.json();
-}
-async function updateTask(opts) {
-  const profile = opts.profile ?? "default";
-  const body = {};
-  if (opts.title !== void 0) body.title = opts.title;
-  if (opts.content !== void 0) body.content = opts.content;
-  if (opts.dueDate !== void 0) body.dueDate = opts.dueDate;
-  const url = `${BASE_URL5}/tasks/${opts.taskId}`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] PATCH ${url}`);
-  }
-  const res = await authedFetch4(
-    url,
-    {
-      method: "PATCH",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    },
-    profile
-  );
-  if (!res.ok) return handleError4(res);
-  return await res.json();
-}
-async function completeTask(taskId, profile = "default") {
-  const url = `${BASE_URL5}/tasks/${taskId}/complete`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] POST ${url}`);
-  }
-  const res = await authedFetch4(
-    url,
-    { method: "POST" },
-    profile
-  );
-  if (res.status === 204) return;
-  if (!res.ok) return handleError4(res);
-}
-async function incompleteTask(taskId, profile = "default") {
-  const url = `${BASE_URL5}/tasks/${taskId}/incomplete`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] POST ${url}`);
-  }
-  const res = await authedFetch4(
-    url,
-    { method: "POST" },
-    profile
-  );
-  if (res.status === 204) return;
-  if (!res.ok) return handleError4(res);
-}
-async function deleteTask(taskId, profile = "default") {
-  const url = `${BASE_URL5}/tasks/${taskId}`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] DELETE ${url}`);
-  }
-  const res = await authedFetch4(
-    url,
-    { method: "DELETE" },
-    profile
-  );
-  if (res.status === 204) return;
-  if (!res.ok) return handleError4(res);
-}
-
-// src/api/board.ts
-var BASE_URL6 = "https://www.worksapis.com/v1.0";
-async function authedFetch5(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError5(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope board` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
-function safeParseJson(text) {
-  const safe = text.replace(
-    /"((?:board|post|domain|user)Id)"\s*:\s*(\d{16,})/g,
-    '"$1":"$2"'
-  );
-  return JSON.parse(safe);
-}
-async function listBoards(count = 20, cursor, profile = "default") {
-  const params = new URLSearchParams();
-  params.set("count", String(count));
-  if (cursor) params.set("cursor", cursor);
-  const url = `${BASE_URL6}/boards?${params.toString()}`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] GET ${url}`);
-  }
-  const res = await authedFetch5(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError5(res);
-  const text = await res.text();
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] Response: ${text}`);
-  }
-  const data = safeParseJson(text);
-  return { boards: data.boards ?? [], responseMetaData: data.responseMetaData };
-}
-async function listPosts(boardId, count = 20, cursor, profile = "default") {
-  const params = new URLSearchParams();
-  params.set("count", String(count));
-  if (cursor) params.set("cursor", cursor);
-  const url = `${BASE_URL6}/boards/${boardId}/posts?${params.toString()}`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] GET ${url}`);
-  }
-  const res = await authedFetch5(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError5(res);
-  const text = await res.text();
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] Response: ${text}`);
-  }
-  const data = safeParseJson(text);
-  return { posts: data.posts ?? [], responseMetaData: data.responseMetaData };
-}
-async function readPost(boardId, postId, profile = "default") {
-  const url = `${BASE_URL6}/boards/${boardId}/posts/${postId}`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] GET ${url}`);
-  }
-  const res = await authedFetch5(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError5(res);
-  const text = await res.text();
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] Response: ${text}`);
-  }
-  return safeParseJson(text);
-}
-async function createPost(opts) {
-  const profile = opts.profile ?? "default";
-  const body = {
-    title: opts.title,
-    body: opts.body ?? ""
-  };
-  if (opts.enableComment !== void 0) body.enableComment = opts.enableComment;
-  if (opts.sendNotifications !== void 0) body.sendNotifications = opts.sendNotifications;
-  const url = `${BASE_URL6}/boards/${opts.boardId}/posts`;
-  if (process.env["NWORKS_VERBOSE"] === "1") {
-    console.error(`[nworks] POST ${url}`);
-    console.error(`[nworks] Body: ${JSON.stringify(body, null, 2)}`);
-  }
-  const res = await authedFetch5(
-    url,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    },
-    profile
-  );
-  if (res.status === 201 || res.ok) {
-    const text = await res.text();
-    if (process.env["NWORKS_VERBOSE"] === "1") {
-      console.error(`[nworks] Response: ${text}`);
-    }
-    return safeParseJson(text);
-  }
-  return handleError5(res);
-}
-
-// src/commands/doctor.ts
-import { Command } from "commander";
-import { existsSync as existsSync2 } from "fs";
-import { readFile as readFile4 } from "fs/promises";
-
-// src/output/format.ts
-function output(data, opts = {}) {
-  const useJson = opts.json || !process.stdout.isTTY;
-  if (useJson) {
-    console.log(JSON.stringify(data, null, 2));
-    return;
-  }
-  if (Array.isArray(data)) {
-    printTable(data);
-  } else if (typeof data === "object" && data !== null) {
-    const record = data;
-    for (const value of Object.values(record)) {
-      if (Array.isArray(value) && value.length > 0) {
-        printTable(value);
-        return;
-      }
-    }
-    for (const [key, value] of Object.entries(record)) {
-      console.log(`  ${key}: ${String(value)}`);
-    }
-  } else {
-    console.log(String(data));
-  }
-}
-function printTable(rows) {
-  if (rows.length === 0) {
-    console.log("  (no data)");
-    return;
-  }
-  const first = rows[0];
-  const keys = Object.keys(first);
-  const widths = {};
-  for (const key of keys) {
-    widths[key] = key.length;
-  }
-  for (const row of rows) {
-    const record = row;
-    for (const key of keys) {
-      const len = String(record[key] ?? "").length;
-      if (len > (widths[key] ?? 0)) {
-        widths[key] = len;
-      }
-    }
-  }
-  const header = keys.map((k) => k.padEnd(widths[k] ?? 0)).join("  ");
-  const separator = keys.map((k) => "\u2500".repeat(widths[k] ?? 0)).join("\u2500\u2500");
-  console.log(`  ${header}`);
-  console.log(`  ${separator}`);
-  for (const row of rows) {
-    const record = row;
-    const line = keys.map((k) => String(record[k] ?? "").padEnd(widths[k] ?? 0)).join("  ");
-    console.log(`  ${line}`);
-  }
-}
-function errorOutput(error, opts = {}) {
-  const payload = {
-    success: false,
-    error: { code: error.code ?? "ERROR", message: error.message, hint: error.hint }
-  };
-  if (opts.json || !process.stderr.isTTY) {
-    console.error(JSON.stringify(payload, null, 2));
-  } else {
-    console.error(`  Error: ${error.message}`);
-    if (error.code) {
-      console.error(`  Code: ${error.code}`);
-    }
-    if (error.hint) {
-      console.error(`  \u2192 ${error.hint}`);
-    }
-  }
-}
-
-// src/utils/error-hints.ts
-var REQUIRED_SCOPES = {
-  calendar: "calendar",
-  "calendar.list": "calendar.read",
-  "calendar.create": "calendar calendar.read",
-  "calendar.update": "calendar calendar.read",
-  "calendar.delete": "calendar calendar.read",
-  mail: "mail",
-  "mail.send": "mail",
-  "mail.list": "mail.read",
-  "mail.read": "mail.read",
-  task: "task",
-  "task.list": "task.read",
-  "task.create": "task user.read",
-  "task.update": "task user.read",
-  "task.delete": "task user.read",
-  drive: "file",
-  "drive.list": "file.read",
-  "drive.upload": "file",
-  "drive.download": "file.read",
-  board: "board",
-  "board.list": "board.read",
-  "board.posts": "board.read",
-  "board.read": "board.read",
-  "board.create": "board"
-};
-var ERROR_HINTS_CLI = {
-  FORBIDDEN: "\uAD8C\uD55C\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4. Developer Console\uC5D0\uC11C OAuth Scope\uB97C \uD655\uC778\uD558\uC138\uC694.",
-  ACCESS_DENIED: "\uC811\uADFC\uC774 \uAC70\uBD80\uB410\uC2B5\uB2C8\uB2E4. Admin\uC5D0\uC11C Bot\uC744 \uCD94\uAC00\uD588\uB294\uC9C0 \uD655\uC778\uD558\uC138\uC694.",
-  SERVICE_ACCOUNT_NOT_ALLOWED: "\uC11C\uBE44\uC2A4 \uACC4\uC815\uC73C\uB85C\uB294 \uC774 API\uB97C \uC0AC\uC6A9\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. `nworks login --user`\uB85C User OAuth \uB85C\uADF8\uC778\uD558\uC138\uC694.",
-  UNAUTHORIZED: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. `nworks login`\uC73C\uB85C \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694."
-};
-var ERROR_HINTS_MCP = {
-  FORBIDDEN: "\uAD8C\uD55C\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4. Developer Console\uC5D0\uC11C OAuth Scope\uB97C \uD655\uC778\uD558\uC138\uC694.",
-  ACCESS_DENIED: "\uC811\uADFC\uC774 \uAC70\uBD80\uB410\uC2B5\uB2C8\uB2E4. Admin\uC5D0\uC11C Bot\uC744 \uCD94\uAC00\uD588\uB294\uC9C0 \uD655\uC778\uD558\uC138\uC694.",
-  SERVICE_ACCOUNT_NOT_ALLOWED: "\uC11C\uBE44\uC2A4 \uACC4\uC815\uC73C\uB85C\uB294 \uC774 API\uB97C \uC0AC\uC6A9\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. nworks_login_user tool\uB85C User OAuth \uB85C\uADF8\uC778\uC744 \uBA3C\uC800 \uD574\uC8FC\uC138\uC694.",
-  UNAUTHORIZED: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. nworks_login_user tool\uB85C \uB2E4\uC2DC \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uADF8\uB798\uB3C4 \uC548 \uB418\uBA74 nworks_setup tool\uB85C \uC7AC\uC124\uC815 \uD6C4 \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694."
-};
-function cliErrorHint(err, area) {
-  if (err instanceof ApiError) {
-    const hint = ERROR_HINTS_CLI[err.code];
-    const scopeHint = area ? buildScopeHint(area, "cli") : "";
-    if (hint) {
-      return `[${err.code}] ${err.message}
-  \u2192 ${hint}${scopeHint}`;
-    }
-    return `[${err.code}] ${err.message}${scopeHint}`;
-  }
-  if (err instanceof AuthError) {
-    return `${err.message}
-  \u2192 ${ERROR_HINTS_CLI["UNAUTHORIZED"]}`;
-  }
-  return err.message;
-}
-function mcpErrorHint(err, area) {
-  if (err instanceof ApiError) {
-    const hint = ERROR_HINTS_MCP[err.code];
-    const scopeHint = area ? buildScopeHint(area, "mcp") : "";
-    if (hint) {
-      return `Error: [${err.code}] ${err.message}
-
-[\uC548\uB0B4] ${hint}${scopeHint}`;
-    }
-    return `Error: [${err.code}] ${err.message}${scopeHint}`;
-  }
-  if (err instanceof AuthError) {
-    return `Error: ${err.message}
-
-[\uC548\uB0B4] \uC778\uC99D \uC815\uBCF4\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4. nworks_setup tool\uC744 \uBA3C\uC800 \uD638\uCD9C\uD558\uC138\uC694 (Client ID \uD544\uC694, Client Secret\uC740 \uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC5D0\uC11C \uC77D\uC74C). \uD658\uACBD\uBCC0\uC218\uAC00 \uC5C6\uC73C\uBA74 \uC0AC\uC6A9\uC790\uC5D0\uAC8C MCP \uC124\uC815 \uD30C\uC77C\uC758 env \uD544\uB4DC\uC5D0 NWORKS_CLIENT_SECRET \uCD94\uAC00\uB97C \uC548\uB0B4\uD558\uC138\uC694.`;
-  }
-  return `Error: ${err.message}`;
-}
-function buildScopeHint(area, mode) {
-  const scope = REQUIRED_SCOPES[area];
-  if (!scope) return "";
-  const scopes = scope.split(" ").join(", ");
-  if (mode === "cli") {
-    return `
-  \u2192 \uC774 \uBA85\uB839\uC5B4\uB294 ${scopes} scope\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \`nworks login --user --scope "${scope}"\`\uB97C \uC2E4\uD589\uD558\uC138\uC694.`;
-  }
-  return `
-  \u2192 \uC774 API\uB294 ${scopes} scope\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. nworks_login_user tool\uB85C \uB85C\uADF8\uC778\uD558\uC138\uC694 (scope\uB97C \uC9C0\uC815\uD558\uC9C0 \uC54A\uC73C\uBA74 \uC804\uCCB4 \uAD8C\uD55C\uC774 \uC790\uB3D9 \uD3EC\uD568\uB429\uB2C8\uB2E4).`;
-}
-
-// src/output/cli-error.ts
-function cliError(err, opts = {}, area) {
-  const error = err;
-  if (error instanceof ApiError) {
-    errorOutput(
-      {
-        code: error.code,
-        message: error.message,
-        hint: cliErrorHint(err, area).split("\n").slice(1).map((l) => l.replace(/^\s+→\s*/, "")).join(" ")
-      },
-      opts
-    );
-  } else if (error instanceof AuthError) {
-    errorOutput(
-      {
-        code: "AUTH_ERROR",
-        message: error.message,
-        hint: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. `nworks login`\uC73C\uB85C \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694."
-      },
-      opts
-    );
-  } else {
-    errorOutput({ message: error.message }, opts);
-  }
-  process.exitCode = 1;
-}
-
-// src/commands/doctor.ts
-async function runChecks(profile) {
-  const results = [];
-  let creds;
-  try {
-    creds = await loadCredentials(profile);
-    results.push({ check: "credentials", status: "OK", detail: `clientId: ${creds.clientId}` });
-  } catch {
-    results.push({ check: "credentials", status: "FAIL", detail: "\uC778\uC99D \uC815\uBCF4 \uC5C6\uC74C. CLI: `nworks login --user` / MCP: nworks_setup tool \uC0AC\uC6A9 (\uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET \uD544\uC694)" });
-    return results;
-  }
-  if (hasServiceAccountCreds(creds)) {
-    results.push({ check: "serviceAccount", status: "OK", detail: creds.serviceAccount });
-  } else {
-    results.push({ check: "serviceAccount", status: "SKIP", detail: "\uBBF8\uC124\uC815 (\uBD07 \uBA54\uC2DC\uC9C0 \uC0AC\uC6A9 \uC2DC \uD544\uC694)" });
-  }
-  if (creds.privateKeyPath) {
-    if (existsSync2(creds.privateKeyPath)) {
-      try {
-        await readFile4(creds.privateKeyPath, "utf-8");
-        results.push({ check: "privateKey", status: "OK", detail: creds.privateKeyPath });
-      } catch {
-        results.push({ check: "privateKey", status: "FAIL", detail: `\uC77D\uAE30 \uBD88\uAC00: ${creds.privateKeyPath}` });
-      }
-    } else {
-      results.push({ check: "privateKey", status: "FAIL", detail: `\uD30C\uC77C \uC5C6\uC74C: ${creds.privateKeyPath}` });
-    }
-  } else {
-    results.push({ check: "privateKey", status: "SKIP", detail: "\uBBF8\uC124\uC815" });
-  }
-  if (creds.botId) {
-    results.push({ check: "botId", status: "OK", detail: creds.botId });
-  } else {
-    results.push({ check: "botId", status: "SKIP", detail: "\uBBF8\uC124\uC815 (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)" });
-  }
-  const token = await loadToken(profile);
-  if (token) {
-    const valid = token.expiresAt > Date.now() / 1e3;
-    results.push({
-      check: "serviceToken",
-      status: valid ? "OK" : "EXPIRED",
-      detail: valid ? `\uB9CC\uB8CC: ${new Date(token.expiresAt * 1e3).toISOString()}` : `\uB9CC\uB8CC\uB428: ${new Date(token.expiresAt * 1e3).toISOString()}`
-    });
-  } else {
-    results.push({ check: "serviceToken", status: "SKIP", detail: "\uD1A0\uD070 \uC5C6\uC74C" });
-  }
-  const userToken = await loadUserToken(profile);
-  if (userToken) {
-    const valid = userToken.expiresAt > Date.now() / 1e3;
-    results.push({
-      check: "userOAuth",
-      status: valid ? "OK" : "EXPIRED",
-      detail: valid ? `scope: ${userToken.scope} | \uB9CC\uB8CC: ${new Date(userToken.expiresAt * 1e3).toISOString()}` : `\uB9CC\uB8CC\uB428 | scope: ${userToken.scope}`
-    });
-  } else {
-    results.push({ check: "userOAuth", status: "SKIP", detail: "\uD1A0\uD070 \uC5C6\uC74C. `nworks login --user` \uD544\uC694" });
-  }
-  if (hasServiceAccountCreds(creds) && token && token.expiresAt > Date.now() / 1e3) {
-    try {
-      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
-        headers: { Authorization: `Bearer ${token.accessToken}` }
-      });
-      if (res.ok) {
-        results.push({ check: "apiConnection", status: "OK", detail: "NAVER WORKS API \uC5F0\uACB0 \uC131\uACF5" });
-      } else {
-        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
-      }
-    } catch (e) {
-      results.push({ check: "apiConnection", status: "FAIL", detail: `\uC5F0\uACB0 \uC2E4\uD328: ${e.message}` });
-    }
-  } else if (userToken && userToken.expiresAt > Date.now() / 1e3) {
-    try {
-      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
-        headers: { Authorization: `Bearer ${userToken.accessToken}` }
-      });
-      if (res.ok) {
-        results.push({ check: "apiConnection", status: "OK", detail: "NAVER WORKS API \uC5F0\uACB0 \uC131\uACF5" });
-      } else {
-        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
-      }
-    } catch (e) {
-      results.push({ check: "apiConnection", status: "FAIL", detail: `\uC5F0\uACB0 \uC2E4\uD328: ${e.message}` });
-    }
-  } else {
-    results.push({ check: "apiConnection", status: "SKIP", detail: "\uC720\uD6A8\uD55C \uD1A0\uD070 \uC5C6\uC74C \u2014 API \uD14C\uC2A4\uD2B8 \uAC74\uB108\uB700" });
-  }
-  return results;
-}
-var doctorCommand = new Command("doctor").description("Check nworks configuration and connectivity").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
-  try {
-    const results = await runChecks(opts.profile);
-    if (opts.json || !process.stdout.isTTY) {
-      output(results, opts);
-    } else {
-      console.log("\n  nworks doctor\n");
-      for (const r of results) {
-        const icon = r.status === "OK" ? "\u2705" : r.status === "SKIP" ? "\u2796" : "\u274C";
-        console.log(`  ${icon} ${r.check.padEnd(16)} ${r.detail}`);
-      }
-      console.log();
-    }
-  } catch (err) {
-    cliError(err, opts);
-  }
-});
-
-// src/mcp/tools.ts
-function registerTools(server) {
-  server.tool(
-    "nworks_setup",
-    `NAVER WORKS API \uC778\uC99D \uC815\uBCF4\uB97C \uC124\uC815\uD569\uB2C8\uB2E4.
-
-\u25A0 \uC0AC\uC804 \uC900\uBE44 (\uC0AC\uC6A9\uC790\uAC00 \uC9C1\uC811 \uD574\uC57C \uD568):
-  1. https://dev.worksmobile.com \uC5D0\uC11C \uC571 \uC0DD\uC131 \uD6C4 Client ID\uC640 Client Secret\uC744 \uBC1C\uAE09\uBC1B\uC2B5\uB2C8\uB2E4.
-  2. MCP \uC124\uC815 \uD30C\uC77C(\uC608: claude_desktop_config.json)\uC758 nworks \uC11C\uBC84\uC5D0 env \uD544\uB4DC\uB97C \uCD94\uAC00\uD569\uB2C8\uB2E4:
-     { "env": { "NWORKS_CLIENT_SECRET": "<\uBC1C\uAE09\uBC1B\uC740 Client Secret>" } }
-  3. MCP \uD074\uB77C\uC774\uC5B8\uD2B8(\uC608: Claude Desktop)\uB97C \uC7AC\uC2DC\uC791\uD569\uB2C8\uB2E4.
-
-\u25A0 \uC774 tool\uC758 \uC5ED\uD560:
-  - clientId(\uD544\uC218)\uC640 serviceAccount, botId, domainId(\uC120\uD0DD)\uB97C \uD30C\uB77C\uBBF8\uD130\uB85C \uBC1B\uC544 \uC800\uC7A5\uD569\uB2C8\uB2E4.
-  - Client Secret\uC740 \uBCF4\uC548\uC744 \uC704\uD574 \uD30C\uB77C\uBBF8\uD130\uB85C \uBC1B\uC9C0 \uC54A\uC73C\uBA70, \uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC5D0\uC11C \uC790\uB3D9\uC73C\uB85C \uC77D\uC2B5\uB2C8\uB2E4.
-  - Service Account \uC0AC\uC6A9 \uC2DC \uD658\uACBD\uBCC0\uC218 NWORKS_PRIVATE_KEY_PATH\uB3C4 \uD544\uC694\uD569\uB2C8\uB2E4.
-
-\u25A0 \uC124\uC815 \uD6C4 \uB2E4\uC74C \uB2E8\uACC4:
-  - \uCE98\uB9B0\uB354/\uBA54\uC77C/\uB4DC\uB77C\uC774\uBE0C/\uD560\uC77C/\uAC8C\uC2DC\uD310 \u2192 nworks_login_user tool\uB85C \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778 \uD544\uC694
-  - \uBA54\uC2DC\uC9C0/\uAD6C\uC131\uC6D0\uC870\uD68C \u2192 Service Account \uC778\uC99D (serviceAccount + botId + NWORKS_PRIVATE_KEY_PATH)
-
-\u25A0 \uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC774 \uC5C6\uC73C\uBA74 \uC774 tool\uC740 \uC2E4\uD328\uD569\uB2C8\uB2E4. \uC2E4\uD328 \uC2DC \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC704 \uC0AC\uC804 \uC900\uBE44 \uB2E8\uACC4\uB97C \uC548\uB0B4\uD558\uC138\uC694.
-
-OAuth Redirect URI: http://localhost:9876/callback`,
-    {
-      clientId: z.string().describe("Client ID (Developer Console\uC5D0\uC11C \uBC1C\uAE09)"),
-      serviceAccount: z.string().optional().describe("Service Account ID (\uC608: xxxxx.serviceaccount@domain)"),
-      botId: z.string().optional().describe("Bot ID (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)"),
-      domainId: z.string().optional().describe("Domain ID")
-    },
-    async ({ clientId, serviceAccount, botId, domainId }) => {
-      try {
-        const resolvedSecret = process.env["NWORKS_CLIENT_SECRET"];
-        if (!resolvedSecret) {
-          return {
-            content: [{ type: "text", text: JSON.stringify({
-              error: true,
-              message: "\uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC774 \uC124\uC815\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.",
-              userAction: [
-                "1. https://dev.worksmobile.com \uC5D0\uC11C \uC571\uC758 Client Secret\uC744 \uD655\uC778\uD569\uB2C8\uB2E4.",
-                "2. MCP \uC124\uC815 \uD30C\uC77C(\uC608: claude_desktop_config.json)\uC744 \uC5F4\uACE0, nworks \uC11C\uBC84 \uC124\uC815\uC5D0 \uB2E4\uC74C\uC744 \uCD94\uAC00\uD569\uB2C8\uB2E4:",
-                '   "env": { "NWORKS_CLIENT_SECRET": "<Client Secret>" }',
-                "3. MCP \uD074\uB77C\uC774\uC5B8\uD2B8(\uC608: Claude Desktop)\uB97C \uC7AC\uC2DC\uC791\uD569\uB2C8\uB2E4.",
-                "4. \uC7AC\uC2DC\uC791 \uD6C4 \uB2E4\uC2DC \uC2DC\uB3C4\uD574\uC8FC\uC138\uC694."
-              ],
-              configExample: '{ "mcpServers": { "nworks": { "command": "npx", "args": ["-y", "nworks", "mcp"], "env": { "NWORKS_CLIENT_SECRET": "<Client Secret>" } } } }'
-            }) }],
-            isError: true
-          };
-        }
-        const resolvedPrivateKeyPath = process.env["NWORKS_PRIVATE_KEY_PATH"];
-        await saveCredentials({
-          clientId,
-          clientSecret: resolvedSecret,
-          serviceAccount,
-          privateKeyPath: resolvedPrivateKeyPath,
-          botId,
-          domainId
-        });
-        const nextSteps = [];
-        if (serviceAccount && resolvedPrivateKeyPath && botId) {
-          nextSteps.push("Service Account \uC778\uC99D \uC900\uBE44 \uC644\uB8CC \u2014 \uBD07 \uBA54\uC2DC\uC9C0 \uB4F1 \uBC14\uB85C \uC0AC\uC6A9 \uAC00\uB2A5");
-        } else if (serviceAccount && botId && !resolvedPrivateKeyPath) {
-          nextSteps.push('NWORKS_PRIVATE_KEY_PATH \uD658\uACBD\uBCC0\uC218\uAC00 \uC124\uC815\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4. Service Account \uC778\uC99D\uC5D0\uB294 Private Key \uD30C\uC77C \uACBD\uB85C\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC548\uB0B4\uD558\uC138\uC694: (1) Developer Console(https://dev.worksmobile.com)\uC5D0\uC11C Private Key\uB97C \uB2E4\uC6B4\uB85C\uB4DC (2) MCP \uC124\uC815 \uD30C\uC77C\uC758 env\uC5D0 NWORKS_PRIVATE_KEY_PATH\uB97C \uCD94\uAC00 (\uC608: "NWORKS_PRIVATE_KEY_PATH": "C:/keys/private.key") (3) MCP \uD074\uB77C\uC774\uC5B8\uD2B8 \uC7AC\uC2DC\uC791');
-        }
-        nextSteps.push("User OAuth\uAC00 \uD544\uC694\uD55C API\uB294 nworks_login_user tool\uB85C \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778\uC744 \uC9C4\uD589\uD558\uC138\uC694");
-        const mask = (s) => s.length <= 4 ? "****" : `****${s.slice(-Math.min(4, Math.floor(s.length / 3)))}`;
-        return {
-          content: [
-            {
-              type: "text",
-              text: JSON.stringify({
-                success: true,
-                message: "\uC778\uC99D \uC815\uBCF4\uAC00 \uC800\uC7A5\uB418\uC5C8\uC2B5\uB2C8\uB2E4.",
-                nextSteps,
-                clientId,
-                clientSecret: `${mask(resolvedSecret)} (\uD658\uACBD\uBCC0\uC218)`,
-                serviceAccount: serviceAccount ?? null,
-                privateKeyPath: resolvedPrivateKeyPath ? `${mask(resolvedPrivateKeyPath)} (\uD658\uACBD\uBCC0\uC218)` : null,
-                botId: botId ?? null
-              })
-            }
-          ]
-        };
-      } catch (err) {
-        return {
-          content: [{ type: "text", text: mcpErrorHint(err) }],
-          isError: true
-        };
-      }
-    }
-  );
-  server.tool(
-    "nworks_message_send",
-    "NAVER WORKS \uBA54\uC2DC\uC9C0\uB97C \uC804\uC1A1\uD569\uB2C8\uB2E4 (\uBD07\uC774 \uC0AC\uC6A9\uC790 \uB610\uB294 \uCC44\uB110\uC5D0 \uBC1C\uC1A1). Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup\uC5D0\uC11C serviceAccount, botId \uC124\uC815 + \uD658\uACBD\uBCC0\uC218 NWORKS_PRIVATE_KEY_PATH \uD544\uC694. User OAuth \uBD88\uD544\uC694)",
+// src/mcp/tools/drive.ts
+function registerDriveTools(server) {
+  defineTool(
+    server,
+    "nworks_drive_list",
+    "NAVER WORKS \uB4DC\uB77C\uC774\uBE0C\uC758 \uD30C\uC77C/\uD3F4\uB354 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C \uBCF4\uC5EC\uC918', '\uB0B4 \uD30C\uC77C \uBAA9\uB85D' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
     {
-      to: z.string().optional().describe("\uC218\uC2E0\uC790 userId (channel\uACFC \uD0DD 1). nworks_directory_members\uB85C userId \uC870\uD68C \uAC00\uB2A5"),
-      channel: z.string().optional().describe("\uCC44\uB110 channelId (to\uC640 \uD0DD 1). nworks_message_members\uB85C \uCC44\uB110 \uAD6C\uC131\uC6D0 \uD655\uC778 \uAC00\uB2A5"),
-      text: z.string().describe("\uBA54\uC2DC\uC9C0 \uBCF8\uBB38"),
-      type: z.enum(["text", "button", "list"]).optional().describe("\uBA54\uC2DC\uC9C0 \uD0C0\uC785 (\uAE30\uBCF8: text)"),
-      actions: z.string().optional().describe("\uBC84\uD2BC \uC561\uC158 JSON (type=button\uC77C \uB54C)"),
-      elements: z.string().optional().describe("\uB9AC\uC2A4\uD2B8 \uD56D\uBAA9 JSON (type=list\uC77C \uB54C)")
+      userId: z6.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      folderId: z6.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      count: z6.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z6.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
-    async ({ to, channel, text, type, actions, elements }) => {
+    async ({ userId, folderId, count, cursor }) => {
       try {
-        const result = await send({
-          to,
-          channel,
-          text,
-          type,
-          actions,
-          elements
-        });
+        const result = await listFiles(
+          userId ?? "me",
+          folderId,
+          count ?? 20,
+          cursor
+        );
+        const files = result.files.map((f) => ({
+          fileId: f.fileId,
+          name: f.fileName,
+          type: f.fileType,
+          size: f.fileSize,
+          modified: f.modifiedTime,
+          path: f.filePath
+        }));
         return {
-          content: [{ type: "text", text: JSON.stringify(result) }]
+          content: [{ type: "text", text: JSON.stringify({ files, count: files.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err) }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.list") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
-    "nworks_message_members",
-    "\uD2B9\uC815 \uCC44\uB110\uC758 \uAD6C\uC131\uC6D0 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC774 \uCC44\uB110\uC5D0 \uB204\uAC00 \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694)",
+  defineTool(
+    server,
+    "nworks_drive_upload",
+    "\uD30C\uC77C\uC744 \uB4DC\uB77C\uC774\uBE0C\uC5D0 \uC5C5\uB85C\uB4DC\uD569\uB2C8\uB2E4 (User OAuth file scope \uD544\uC694). content(base64)\uC640 fileName\uC73C\uB85C \uC804\uB2EC\uD558\uAC70\uB098, filePath\uB85C \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C\uB97C \uC9C0\uC815\uD569\uB2C8\uB2E4. MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC5D0\uC11C\uB294 content+fileName \uBC29\uC2DD\uC744 \uAD8C\uC7A5\uD569\uB2C8\uB2E4.",
     {
-      channel: z.string().describe("\uCC44\uB110 channelId")
+      content: z6.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD30C\uC77C \uB0B4\uC6A9 (base64 \uC778\uCF54\uB529). filePath \uB300\uC2E0 \uC0AC\uC6A9"),
+      fileName: z6.string().optional().describe("\uD30C\uC77C\uBA85 (content \uC0AC\uC6A9 \uC2DC \uD544\uC218)"),
+      filePath: z6.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C (content \uB300\uC2E0 \uC0AC\uC6A9, \uB85C\uCEEC \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791)"),
+      userId: z6.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      folderId: z6.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      overwrite: z6.boolean().optional().describe("\uB3D9\uC77C \uD30C\uC77C\uBA85 \uB36E\uC5B4\uC4F0\uAE30 (\uAE30\uBCF8: false)")
     },
-    async ({ channel }) => {
-      try {
-        const result = await listMembers(channel);
-        return {
-          content: [{ type: "text", text: JSON.stringify(result) }]
-        };
-      } catch (err) {
-        return {
-          content: [{ type: "text", text: mcpErrorHint(err) }],
-          isError: true
-        };
-      }
-    }
-  );
-  server.tool(
-    "nworks_directory_members",
-    "NAVER WORKS \uC870\uC9C1 \uAD6C\uC131\uC6D0(\uC9C1\uC6D0) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAD6C\uC131\uC6D0 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uD300\uC6D0 \uCC3E\uC544\uC918', '\uB204\uAD6C\uD55C\uD14C \uBA54\uC2DC\uC9C0 \uBCF4\uB0BC\uC9C0 userId \uCC3E\uAE30' \uB4F1\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694). \uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uC218\uC2E0\uC790 userId\uB97C \uC5EC\uAE30\uC11C \uC870\uD68C \uAC00\uB2A5",
-    {},
-    async () => {
+    async ({ content, fileName, filePath, userId, folderId, overwrite }) => {
       try {
-        const result = await listUsers();
+        let result;
+        if (content && fileName) {
+          const buffer = Buffer.from(content, "base64");
+          if (process.env["NWORKS_VERBOSE"] === "1") {
+            console.error(`[nworks] MCP upload: fileName=${fileName}, bufferSize=${buffer.length}`);
+          }
+          result = await uploadBuffer(
+            buffer,
+            fileName,
+            userId ?? "me",
+            folderId,
+            overwrite ?? false
+          );
+        } else if (filePath) {
+          const safePath = validateLocalPath(filePath);
+          if (process.env["NWORKS_VERBOSE"] === "1") {
+            console.error(`[nworks] MCP upload: filePath=${safePath}`);
+          }
+          result = await uploadFile(
+            safePath,
+            userId ?? "me",
+            folderId,
+            overwrite ?? false
+          );
+        } else {
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: true, message: "content+fileName \uB610\uB294 filePath \uC911 \uD558\uB098\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4. MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC5D0\uC11C\uB294 \uD30C\uC77C \uB0B4\uC6A9\uC744 base64\uB85C \uC778\uCF54\uB529\uD558\uC5EC content \uD30C\uB77C\uBBF8\uD130\uC5D0 \uC804\uB2EC\uD558\uACE0, fileName\uC5D0 \uD30C\uC77C\uBA85\uC744 \uC9C0\uC815\uD558\uC138\uC694." }) }],
+            isError: true
+          };
+        }
         return {
-          content: [{ type: "text", text: JSON.stringify(result) }]
+          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
         };
       } catch (err) {
+        if (process.env["NWORKS_VERBOSE"] === "1") {
+          console.error(`[nworks] drive upload error: ${err.stack}`);
+        }
         return {
-          content: [{ type: "text", text: mcpErrorHint(err) }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.upload") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
-    "nworks_calendar_list",
-    "\uC0AC\uC6A9\uC790\uC758 \uCE98\uB9B0\uB354 \uC77C\uC815/\uC2A4\uCF00\uC904\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC624\uB298 \uC77C\uC815 \uC54C\uB824\uC918', '\uC774\uBC88 \uC8FC \uC2A4\uCF00\uC904 \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar.read scope). \uBBF8\uB85C\uADF8\uC778 \uC2DC nworks_login_user\uB85C \uB85C\uADF8\uC778 \uD544\uC694",
+  defineTool(
+    server,
+    "nworks_drive_download",
+    "\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
     {
-      fromDateTime: z.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
-      untilDateTime: z.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      fileId: z6.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_drive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z6.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z6.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
+      userId: z6.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
-    async ({ fromDateTime, untilDateTime, userId }) => {
+    async ({ fileId, outputDir, outputName, userId }) => {
       try {
-        const result = await listEvents(
-          fromDateTime,
-          untilDateTime,
+        const result = await downloadFile(
+          fileId,
           userId ?? "me"
         );
-        const events = result.events.flatMap(
-          (e) => e.eventComponents.map((c) => ({
-            eventId: c.eventId,
-            summary: c.summary,
-            start: c.start.dateTime ?? c.start.date ?? "",
-            end: c.end.dateTime ?? c.end.date ?? "",
-            location: c.location ?? ""
-          }))
-        );
-        return {
-          content: [{ type: "text", text: JSON.stringify({ events, count: events.length }) }]
-        };
-      } catch (err) {
-        return {
-          content: [{ type: "text", text: mcpErrorHint(err, "calendar.list") }],
-          isError: true
-        };
-      }
-    }
-  );
-  server.tool(
-    "nworks_calendar_create",
-    "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0C8\uB85C \uB9CC\uB4ED\uB2C8\uB2E4. '\uD68C\uC758 \uC7A1\uC544\uC918', '\uC77C\uC815 \uB4F1\uB85D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope)",
-    {
-      summary: z.string().describe("\uC77C\uC815 \uC81C\uBAA9"),
-      start: z.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      end: z.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      timeZone: z.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
-      description: z.string().optional().describe("\uC77C\uC815 \uC124\uBA85"),
-      location: z.string().optional().describe("\uC7A5\uC18C"),
-      attendees: z.array(z.object({ email: z.string(), displayName: z.string().optional() })).optional().describe("\uCC38\uC11D\uC790 \uBAA9\uB85D"),
-      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
-    },
-    async ({ summary, start, end, timeZone, description, location, attendees, sendNotification, userId }) => {
-      try {
-        const result = await createEvent({
-          summary,
-          start,
-          end,
-          timeZone,
-          description,
-          location,
-          attendees,
-          sendNotification,
-          userId: userId ?? "me"
-        });
-        const event = result.eventComponents?.[0];
-        return {
-          content: [{ type: "text", text: JSON.stringify({ success: true, eventId: event?.eventId, summary: event?.summary, start: event?.start, end: event?.end }) }]
-        };
-      } catch (err) {
-        return {
-          content: [{ type: "text", text: mcpErrorHint(err, "calendar.create") }],
-          isError: true
-        };
-      }
-    }
-  );
-  server.tool(
-    "nworks_calendar_update",
-    "\uAE30\uC874 \uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC218\uC815\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uC2DC\uAC04 \uBCC0\uACBD\uD574\uC918', '\uD68C\uC758 \uC81C\uBAA9 \uBC14\uAFD4\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
-    {
-      eventId: z.string().describe("\uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      summary: z.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
-      start: z.string().optional().describe("\uC0C8 \uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      end: z.string().optional().describe("\uC0C8 \uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      timeZone: z.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
-      description: z.string().optional().describe("\uC0C8 \uC124\uBA85"),
-      location: z.string().optional().describe("\uC0C8 \uC7A5\uC18C"),
-      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
-    },
-    async ({ eventId, summary, start, end, timeZone, description, location, sendNotification, userId }) => {
-      try {
-        await updateEvent({
-          eventId,
-          summary,
-          start,
-          end,
-          timeZone,
-          description,
-          location,
-          sendNotification,
-          userId: userId ?? "me"
-        });
+        const fileName = outputName ?? result.fileName ?? fileId;
+        if (outputDir) {
+          const { writeFile: writeFile2 } = await import("fs/promises");
+          const { join: join3 } = await import("path");
+          const safeDir = validateLocalPath(outputDir);
+          const safeName = sanitizeFileName(fileName);
+          const outPath = join3(safeDir, safeName);
+          validateLocalPath(outPath, safeDir);
+          await writeFile2(outPath, result.buffer);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
+          };
+        }
+        const MAX_INLINE_SIZE = 5 * 1024 * 1024;
+        if (result.buffer.length > MAX_INLINE_SIZE) {
+          const sizeMB = (result.buffer.length / (1024 * 1024)).toFixed(1);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: true, message: `\uD30C\uC77C\uC774 \uB108\uBB34 \uD07D\uB2C8\uB2E4 (${sizeMB}MB). outputDir\uB97C \uC9C0\uC815\uD574\uC11C \uB85C\uCEEC\uC5D0 \uC800\uC7A5\uD558\uC138\uC694.`, fileName, size: result.buffer.length }) }],
+            isError: true
+          };
+        }
+        const textExtensions = /\.(txt|md|csv|json|xml|html|htm|css|js|ts|jsx|tsx|yaml|yml|toml|ini|cfg|conf|log|sh|bash|zsh|py|rb|java|go|rs|c|cpp|h|hpp|sql|graphql|env|gitignore|dockerignore|editorconfig)$/i;
+        const isText = textExtensions.test(fileName);
+        if (isText) {
+          const text = result.buffer.toString("utf-8");
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "text", content: text }) }]
+          };
+        }
+        const base64 = result.buffer.toString("base64");
         return {
-          content: [{ type: "text", text: JSON.stringify({ success: true, eventId, message: "\uC77C\uC815\uC774 \uC218\uC815\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
+          content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "base64", content: base64 }) }]
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "calendar.update") }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.download") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
-    "nworks_calendar_delete",
-    "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0AD\uC81C\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uCDE8\uC18C\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
+  defineTool(
+    server,
+    "nworks_sharedrive_list",
+    "NAVER WORKS \uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uBB50 \uC788\uC5B4?', '\uD300 \uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uCC3E\uC544\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
     {
-      eventId: z.string().describe("\uC0AD\uC81C\uD560 \uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      count: z6.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z6.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
-    async ({ eventId, sendNotification, userId }) => {
+    async ({ count, cursor }) => {
       try {
-        await deleteEvent(
-          eventId,
-          userId ?? "me",
-          sendNotification ?? false
-        );
+        const result = await listSharedDrives(count ?? 20, cursor);
         return {
-          content: [{ type: "text", text: JSON.stringify({ success: true, eventId, message: "\uC77C\uC815\uC774 \uC0AD\uC81C\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
+          content: [{ type: "text", text: JSON.stringify({ sharedDrives: result.sharedDrives, count: result.sharedDrives.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "calendar.delete") }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.sharedrive_list") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
-    "nworks_drive_list",
-    "NAVER WORKS \uB4DC\uB77C\uC774\uBE0C\uC758 \uD30C\uC77C/\uD3F4\uB354 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C \uBCF4\uC5EC\uC918', '\uB0B4 \uD30C\uC77C \uBAA9\uB85D' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
+  defineTool(
+    server,
+    "nworks_sharedrive_files",
+    "\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C\uC758 \uD30C\uC77C/\uD3F4\uB354 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. sharedriveId\uB294 nworks_sharedrive_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
     {
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
-      folderId: z.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+      sharedriveId: z6.string().describe("\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C ID (nworks_sharedrive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      folderId: z6.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      count: z6.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z6.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
-    async ({ userId, folderId, count, cursor }) => {
+    async ({ sharedriveId, folderId, count, cursor }) => {
       try {
-        const result = await listFiles(
-          userId ?? "me",
+        const result = await listSharedDriveFiles(
+          sharedriveId,
           folderId,
           count ?? 20,
           cursor
@@ -1761,87 +1775,33 @@ OAuth Redirect URI: http://localhost:9876/callback`,
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "drive.list") }],
-          isError: true
-        };
-      }
-    }
-  );
-  server.tool(
-    "nworks_drive_upload",
-    "\uD30C\uC77C\uC744 \uB4DC\uB77C\uC774\uBE0C\uC5D0 \uC5C5\uB85C\uB4DC\uD569\uB2C8\uB2E4 (User OAuth file scope \uD544\uC694). content(base64)\uC640 fileName\uC73C\uB85C \uC804\uB2EC\uD558\uAC70\uB098, filePath\uB85C \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C\uB97C \uC9C0\uC815\uD569\uB2C8\uB2E4. MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC5D0\uC11C\uB294 content+fileName \uBC29\uC2DD\uC744 \uAD8C\uC7A5\uD569\uB2C8\uB2E4.",
-    {
-      content: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD30C\uC77C \uB0B4\uC6A9 (base64 \uC778\uCF54\uB529). filePath \uB300\uC2E0 \uC0AC\uC6A9"),
-      fileName: z.string().optional().describe("\uD30C\uC77C\uBA85 (content \uC0AC\uC6A9 \uC2DC \uD544\uC218)"),
-      filePath: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C (content \uB300\uC2E0 \uC0AC\uC6A9, \uB85C\uCEEC \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
-      folderId: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
-      overwrite: z.boolean().optional().describe("\uB3D9\uC77C \uD30C\uC77C\uBA85 \uB36E\uC5B4\uC4F0\uAE30 (\uAE30\uBCF8: false)")
-    },
-    async ({ content, fileName, filePath, userId, folderId, overwrite }) => {
-      try {
-        let result;
-        if (content && fileName) {
-          const buffer = Buffer.from(content, "base64");
-          if (process.env["NWORKS_VERBOSE"] === "1") {
-            console.error(`[nworks] MCP upload: fileName=${fileName}, bufferSize=${buffer.length}`);
-          }
-          result = await uploadBuffer(
-            buffer,
-            fileName,
-            userId ?? "me",
-            folderId,
-            overwrite ?? false
-          );
-        } else if (filePath) {
-          if (process.env["NWORKS_VERBOSE"] === "1") {
-            console.error(`[nworks] MCP upload: filePath=${filePath}`);
-          }
-          result = await uploadFile(
-            filePath,
-            userId ?? "me",
-            folderId,
-            overwrite ?? false
-          );
-        } else {
-          return {
-            content: [{ type: "text", text: JSON.stringify({ error: true, message: "content+fileName \uB610\uB294 filePath \uC911 \uD558\uB098\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4. MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC5D0\uC11C\uB294 \uD30C\uC77C \uB0B4\uC6A9\uC744 base64\uB85C \uC778\uCF54\uB529\uD558\uC5EC content \uD30C\uB77C\uBBF8\uD130\uC5D0 \uC804\uB2EC\uD558\uACE0, fileName\uC5D0 \uD30C\uC77C\uBA85\uC744 \uC9C0\uC815\uD558\uC138\uC694." }) }],
-            isError: true
-          };
-        }
-        return {
-          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
-        };
-      } catch (err) {
-        const error = err;
-        const detail = process.env["NWORKS_VERBOSE"] === "1" ? ` | stack: ${error.stack}` : "";
-        return {
-          content: [{ type: "text", text: `${mcpErrorHint(err, "drive.upload")}${detail}` }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.sharedrive_files") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
-    "nworks_drive_download",
-    "\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
+  defineTool(
+    server,
+    "nworks_sharedrive_download",
+    "\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
     {
-      fileId: z.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_drive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      outputDir: z.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
-      outputName: z.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      sharedriveId: z6.string().describe("\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C ID (nworks_sharedrive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      fileId: z6.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_sharedrive_files\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z6.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z6.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)")
     },
-    async ({ fileId, outputDir, outputName, userId }) => {
+    async ({ sharedriveId, fileId, outputDir, outputName }) => {
       try {
-        const result = await downloadFile(
-          fileId,
-          userId ?? "me"
-        );
+        const result = await downloadSharedDriveFile(sharedriveId, fileId);
         const fileName = outputName ?? result.fileName ?? fileId;
         if (outputDir) {
           const { writeFile: writeFile2 } = await import("fs/promises");
-          const { join: join2 } = await import("path");
-          const outPath = join2(outputDir, fileName);
+          const { join: join3 } = await import("path");
+          const safeDir = validateLocalPath(outputDir);
+          const safeName = sanitizeFileName(fileName);
+          const outPath = join3(safeDir, safeName);
+          validateLocalPath(outPath, safeDir);
           await writeFile2(outPath, result.buffer);
           return {
             content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
@@ -1869,23 +1829,102 @@ OAuth Redirect URI: http://localhost:9876/callback`,
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "drive.download") }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.sharedrive_download") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/mail.ts
+import { z as z7 } from "zod";
+
+// src/api/mail.ts
+var BASE_URL4 = "https://www.worksapis.com/v1.0";
+async function sendMail(opts) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+  }
+  const body = {
+    to: opts.to,
+    subject: opts.subject
+  };
+  if (opts.body !== void 0) body.body = opts.body;
+  if (opts.cc) body.cc = opts.cc;
+  if (opts.bcc) body.bcc = opts.bcc;
+  if (opts.contentType) body.contentType = opts.contentType;
+  const res = await userFetch(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (res.status === 202) return;
+  if (!res.ok) return handleUserApiError(res);
+}
+async function listMails(folderId = 0, userId = "me", count = 30, cursor, isUnread, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  if (isUnread) params.set("isUnread", "true");
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/mailfolders/${sanitizePathSegment(String(folderId))}/children?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return {
+    mails: data.mails ?? [],
+    unreadCount: data.unreadCount,
+    folderName: data.folderName,
+    totalCount: data.totalCount,
+    responseMetaData: data.responseMetaData
+  };
+}
+async function readMail(mailId, userId = "me", profile = "default") {
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/${sanitizePathSegment(String(mailId))}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function downloadAttachment(mailId, attachmentId, userId = "me", profile = "default") {
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/${sanitizePathSegment(
+    String(mailId)
+  )}/attachments/${sanitizePathSegment(String(attachmentId))}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { buffer: Buffer.from(data.data, "base64"), filename: data.filename };
+}
+
+// src/mcp/tools/mail.ts
+function registerMailTools(server) {
+  defineTool(
+    server,
     "nworks_mail_send",
     "NAVER WORKS \uBA54\uC77C\uC744 \uC804\uC1A1\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uBCF4\uB0B4\uC918', '\uC774\uBA54\uC77C \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uBE44\uB3D9\uAE30 \uC804\uC1A1(\uC131\uACF5 \uC2DC 202). User OAuth \uC778\uC99D \uD544\uC694 (mail scope)",
     {
-      to: z.string().describe("\uC218\uC2E0\uC790 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
-      subject: z.string().describe("\uBA54\uC77C \uC81C\uBAA9"),
-      body: z.string().optional().describe("\uBA54\uC77C \uBCF8\uBB38"),
-      cc: z.string().optional().describe("\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
-      bcc: z.string().optional().describe("\uC228\uC740\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
-      contentType: z.enum(["html", "text"]).optional().describe("\uBCF8\uBB38 \uD615\uC2DD (\uAE30\uBCF8: html)"),
-      userId: z.string().optional().describe("\uBC1C\uC2E0\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      to: z7.string().describe("\uC218\uC2E0\uC790 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      subject: z7.string().describe("\uBA54\uC77C \uC81C\uBAA9"),
+      body: z7.string().optional().describe("\uBA54\uC77C \uBCF8\uBB38"),
+      cc: z7.string().optional().describe("\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      bcc: z7.string().optional().describe("\uC228\uC740\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      contentType: z7.enum(["html", "text"]).optional().describe("\uBCF8\uBB38 \uD615\uC2DD (\uAE30\uBCF8: html)"),
+      userId: z7.string().optional().describe("\uBC1C\uC2E0\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ to, subject, body, cc, bcc, contentType, userId }) => {
       try {
@@ -1909,15 +1948,16 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_mail_list",
     "\uBC1B\uC740 \uBA54\uC77C \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uD655\uC778\uD574\uC918', '\uBC1B\uC740\uD3B8\uC9C0\uD568 \uBCF4\uC5EC\uC918', '\uC548 \uC77D\uC740 \uBA54\uC77C \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
     {
-      folderId: z.number().optional().describe("\uBA54\uC77C \uD3F4\uB354 ID (\uAE30\uBCF8: 0 = \uBC1B\uC740\uD3B8\uC9C0\uD568)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 30, \uCD5C\uB300: 200)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
-      isUnread: z.boolean().optional().describe("\uC77D\uC9C0 \uC54A\uC740 \uBA54\uC77C\uB9CC \uC870\uD68C"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      folderId: z7.number().int().min(0).optional().describe("\uBA54\uC77C \uD3F4\uB354 ID (\uAE30\uBCF8: 0 = \uBC1B\uC740\uD3B8\uC9C0\uD568)"),
+      count: z7.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 30, \uCD5C\uB300: 200)"),
+      cursor: z7.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      isUnread: z7.boolean().optional().describe("\uC77D\uC9C0 \uC54A\uC740 \uBA54\uC77C\uB9CC \uC870\uD68C"),
+      userId: z7.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ folderId, count, cursor, isUnread, userId }) => {
       try {
@@ -1947,12 +1987,13 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_mail_read",
     "\uD2B9\uC815 \uBA54\uC77C\uC758 \uC0C1\uC138 \uB0B4\uC6A9(\uBCF8\uBB38, \uCCA8\uBD80\uD30C\uC77C \uB4F1)\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC774 \uBA54\uC77C \uB0B4\uC6A9 \uBCF4\uC5EC\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. mailId\uB294 nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
     {
-      mailId: z.number().describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      mailId: z7.number().int().min(0).describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      userId: z7.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ mailId, userId }) => {
       try {
@@ -1986,15 +2027,207 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
+    "nworks_mail_download_attachment",
+    "\uBA54\uC77C \uCCA8\uBD80\uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. mailId\uC640 attachmentId\uB294 nworks_mail_read\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
+    {
+      mailId: z7.number().int().min(0).describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      attachmentId: z7.number().int().min(0).describe("\uCCA8\uBD80\uD30C\uC77C ID (nworks_mail_read\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z7.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z7.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
+      userId: z7.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ mailId, attachmentId, outputDir, outputName, userId }) => {
+      try {
+        const result = await downloadAttachment(
+          mailId,
+          attachmentId,
+          userId ?? "me"
+        );
+        const fileName = outputName ?? result.filename;
+        if (outputDir) {
+          const { writeFile: writeFile2 } = await import("fs/promises");
+          const { join: join3 } = await import("path");
+          const safeDir = validateLocalPath(outputDir);
+          const safeName = sanitizeFileName(fileName);
+          const outPath = join3(safeDir, safeName);
+          validateLocalPath(outPath, safeDir);
+          await writeFile2(outPath, result.buffer);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
+          };
+        }
+        const MAX_INLINE_SIZE = 5 * 1024 * 1024;
+        if (result.buffer.length > MAX_INLINE_SIZE) {
+          const sizeMB = (result.buffer.length / (1024 * 1024)).toFixed(1);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: true, message: `\uD30C\uC77C\uC774 \uB108\uBB34 \uD07D\uB2C8\uB2E4 (${sizeMB}MB). outputDir\uB97C \uC9C0\uC815\uD574\uC11C \uB85C\uCEEC\uC5D0 \uC800\uC7A5\uD558\uC138\uC694.`, fileName, size: result.buffer.length }) }],
+            isError: true
+          };
+        }
+        const textExtensions = /\.(txt|md|csv|json|xml|html|htm|css|js|ts|jsx|tsx|yaml|yml|toml|ini|cfg|conf|log|sh|bash|zsh|py|rb|java|go|rs|c|cpp|h|hpp|sql|graphql|env|gitignore|dockerignore|editorconfig)$/i;
+        const isText = textExtensions.test(fileName);
+        if (isText) {
+          const text = result.buffer.toString("utf-8");
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "text", content: text }) }]
+          };
+        }
+        const base64 = result.buffer.toString("base64");
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "base64", content: base64 }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "mail.download_attachment") }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/tools/task.ts
+import { z as z8 } from "zod";
+
+// src/api/task.ts
+var BASE_URL5 = "https://www.worksapis.com/v1.0";
+async function resolveUserId(userId, profile) {
+  if (userId !== "me") return userId;
+  const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}`;
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] Resolved "me" \u2192 ${data.userId}`);
+  }
+  return data.userId;
+}
+async function listTasks(categoryId = "default", userId = "me", count = 50, cursor, status = "ALL", profile = "default") {
+  const params = new URLSearchParams();
+  params.set("categoryId", categoryId);
+  params.set("count", String(count));
+  params.set("status", status);
+  if (cursor) params.set("cursor", cursor);
+  const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}/tasks?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { tasks: data.tasks ?? [], responseMetaData: data.responseMetaData };
+}
+async function createTask(opts) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const resolvedUserId = await resolveUserId(userId, profile);
+  const assignorId = opts.assignorId ?? resolvedUserId;
+  const assigneeIds = opts.assigneeIds ?? [resolvedUserId];
+  const body = {
+    assignorId,
+    assignees: assigneeIds.map((id) => ({ assigneeId: id, status: "TODO" })),
+    title: opts.title,
+    content: opts.content ?? "",
+    completionCondition: "ANY_ONE"
+  };
+  if (opts.dueDate) body.dueDate = opts.dueDate;
+  if (opts.categoryId) body.categoryId = opts.categoryId;
+  const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}/tasks`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
+  }
+  const res = await userFetch(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (res.status === 201) {
+    return await res.json();
+  }
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function updateTask(opts) {
+  const profile = opts.profile ?? "default";
+  const body = {};
+  if (opts.title !== void 0) body.title = opts.title;
+  if (opts.content !== void 0) body.content = opts.content;
+  if (opts.dueDate !== void 0) body.dueDate = opts.dueDate;
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(opts.taskId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] PATCH ${url}`);
+  }
+  const res = await userFetch(
+    url,
+    {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function completeTask(taskId, profile = "default") {
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}/complete`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+  }
+  const res = await userFetch(
+    url,
+    { method: "POST" },
+    profile
+  );
+  if (res.status === 204) return;
+  if (!res.ok) return handleUserApiError(res);
+}
+async function incompleteTask(taskId, profile = "default") {
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}/incomplete`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+  }
+  const res = await userFetch(
+    url,
+    { method: "POST" },
+    profile
+  );
+  if (res.status === 204) return;
+  if (!res.ok) return handleUserApiError(res);
+}
+async function deleteTask(taskId, profile = "default") {
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] DELETE ${url}`);
+  }
+  const res = await userFetch(
+    url,
+    { method: "DELETE" },
+    profile
+  );
+  if (res.status === 204) return;
+  if (!res.ok) return handleUserApiError(res);
+}
+
+// src/mcp/tools/task.ts
+function registerTaskTools(server) {
+  defineTool(
+    server,
     "nworks_task_list",
     "\uD560 \uC77C(TODO) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uD560 \uC77C \uD655\uC778\uD574\uC918', 'TODO \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uB0A8\uC740 \uC5C5\uBB34 \uBB50 \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (task.read scope)",
     {
-      categoryId: z.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID (\uAE30\uBCF8: default)"),
-      status: z.enum(["TODO", "ALL"]).optional().describe("\uD544\uD130: TODO \uB610\uB294 ALL (\uAE30\uBCF8: ALL)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 50, \uCD5C\uB300: 100)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      categoryId: z8.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID (\uAE30\uBCF8: default)"),
+      status: z8.enum(["TODO", "ALL"]).optional().describe("\uD544\uD130: TODO \uB610\uB294 ALL (\uAE30\uBCF8: ALL)"),
+      count: z8.number().int().min(1).max(100).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 50, \uCD5C\uB300: 100)"),
+      cursor: z8.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      userId: z8.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ categoryId, status, count, cursor, userId }) => {
       try {
@@ -2024,16 +2257,17 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_task_create",
     "\uD560 \uC77C(TODO)\uC744 \uC0C8\uB85C \uB9CC\uB4ED\uB2C8\uB2E4. '\uD560 \uC77C \uCD94\uAC00\uD574\uC918', 'TODO \uB4F1\uB85D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uAE30\uBCF8\uC801\uC73C\uB85C \uC790\uAE30 \uC790\uC2E0\uC5D0\uAC8C \uD560\uB2F9. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
     {
-      title: z.string().describe("\uD560 \uC77C \uC81C\uBAA9"),
-      content: z.string().optional().describe("\uD560 \uC77C \uB0B4\uC6A9"),
-      dueDate: z.string().optional().describe("\uB9C8\uAC10\uC77C (YYYY-MM-DD)"),
-      categoryId: z.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID"),
-      assigneeIds: z.array(z.string()).optional().describe("\uB2F4\uB2F9\uC790 user ID \uBAA9\uB85D (\uBBF8\uC9C0\uC815 \uC2DC \uC790\uAE30 \uC790\uC2E0)"),
-      userId: z.string().optional().describe("\uC0DD\uC131\uC790 user ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      title: z8.string().describe("\uD560 \uC77C \uC81C\uBAA9"),
+      content: z8.string().optional().describe("\uD560 \uC77C \uB0B4\uC6A9"),
+      dueDate: z8.string().optional().describe("\uB9C8\uAC10\uC77C (YYYY-MM-DD)"),
+      categoryId: z8.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID"),
+      assigneeIds: z8.array(z8.string()).optional().describe("\uB2F4\uB2F9\uC790 user ID \uBAA9\uB85D (\uBBF8\uC9C0\uC815 \uC2DC \uC790\uAE30 \uC790\uC2E0)"),
+      userId: z8.string().optional().describe("\uC0DD\uC131\uC790 user ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ title, content, dueDate, categoryId, assigneeIds, userId }) => {
       try {
@@ -2056,15 +2290,16 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_task_update",
     "\uD560 \uC77C\uC744 \uC218\uC815\uD558\uAC70\uB098 \uC644\uB8CC \uCC98\uB9AC\uD569\uB2C8\uB2E4. '\uD560 \uC77C \uC644\uB8CC \uCC98\uB9AC\uD574\uC918', '\uB9C8\uAC10\uC77C \uBCC0\uACBD\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. taskId\uB294 nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
     {
-      taskId: z.string().describe("\uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      status: z.enum(["done", "todo"]).optional().describe("\uC0C1\uD0DC \uBCC0\uACBD: done(\uC644\uB8CC) \uB610\uB294 todo(\uBBF8\uC644\uB8CC)"),
-      title: z.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
-      content: z.string().optional().describe("\uC0C8 \uB0B4\uC6A9"),
-      dueDate: z.string().optional().describe("\uC0C8 \uB9C8\uAC10\uC77C (YYYY-MM-DD)")
+      taskId: z8.string().describe("\uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      status: z8.enum(["done", "todo"]).optional().describe("\uC0C1\uD0DC \uBCC0\uACBD: done(\uC644\uB8CC) \uB610\uB294 todo(\uBBF8\uC644\uB8CC)"),
+      title: z8.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
+      content: z8.string().optional().describe("\uC0C8 \uB0B4\uC6A9"),
+      dueDate: z8.string().optional().describe("\uC0C8 \uB9C8\uAC10\uC77C (YYYY-MM-DD)")
     },
     async ({ taskId, status, title, content, dueDate }) => {
       try {
@@ -2098,11 +2333,12 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_task_delete",
     "\uD560 \uC77C\uC744 \uC0AD\uC81C\uD569\uB2C8\uB2E4. taskId\uB294 nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
     {
-      taskId: z.string().describe("\uC0AD\uC81C\uD560 \uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
+      taskId: z8.string().describe("\uC0AD\uC81C\uD560 \uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
     },
     async ({ taskId }) => {
       try {
@@ -2118,12 +2354,108 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/board.ts
+import { z as z9 } from "zod";
+
+// src/api/board.ts
+var BASE_URL6 = "https://www.worksapis.com/v1.0";
+function safeParseJson(text) {
+  const safe = text.replace(
+    /"((?:board|post|domain|user)Id)"\s*:\s*(\d{16,})/g,
+    '"$1":"$2"'
+  );
+  return JSON.parse(safe);
+}
+async function listBoards(count = 20, cursor, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${BASE_URL6}/boards?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const text = await res.text();
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
+  }
+  const data = safeParseJson(text);
+  return { boards: data.boards ?? [], responseMetaData: data.responseMetaData };
+}
+async function listPosts(boardId, count = 20, cursor, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${BASE_URL6}/boards/${sanitizePathSegment(boardId)}/posts?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const text = await res.text();
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
+  }
+  const data = safeParseJson(text);
+  return { posts: data.posts ?? [], responseMetaData: data.responseMetaData };
+}
+async function readPost(boardId, postId, profile = "default") {
+  const url = `${BASE_URL6}/boards/${sanitizePathSegment(boardId)}/posts/${sanitizePathSegment(postId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const text = await res.text();
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
+  }
+  return safeParseJson(text);
+}
+async function createPost(opts) {
+  const profile = opts.profile ?? "default";
+  const body = {
+    title: opts.title,
+    body: opts.body ?? ""
+  };
+  if (opts.enableComment !== void 0) body.enableComment = opts.enableComment;
+  if (opts.sendNotifications !== void 0) body.sendNotifications = opts.sendNotifications;
+  const url = `${BASE_URL6}/boards/${sanitizePathSegment(opts.boardId)}/posts`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
+  }
+  const res = await userFetch(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (res.status === 201 || res.ok) {
+    const text = await res.text();
+    if (process.env["NWORKS_VERBOSE"] === "1") {
+      console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
+    }
+    return safeParseJson(text);
+  }
+  return handleUserApiError(res);
+}
+
+// src/mcp/tools/board.ts
+function registerBoardTools(server) {
+  defineTool(
+    server,
     "nworks_board_list",
     "NAVER WORKS \uAC8C\uC2DC\uD310 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310 \uBB50 \uC788\uC5B4?', '\uACF5\uC9C0\uC0AC\uD56D \uAC8C\uC2DC\uD310 \uCC3E\uC544\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
     {
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+      count: z9.number().int().min(1).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20)"),
+      cursor: z9.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
     async ({ count, cursor }) => {
       try {
@@ -2144,13 +2476,14 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_board_posts",
     "\uAC8C\uC2DC\uD310\uC758 \uAE00 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310 \uAE00 \uBCF4\uC5EC\uC918', '\uACF5\uC9C0\uC0AC\uD56D \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. boardId\uB294 nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
     {
-      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 40)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+      boardId: z9.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      count: z9.number().int().min(1).max(40).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 40)"),
+      cursor: z9.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
     async ({ boardId, count, cursor }) => {
       try {
@@ -2164,107 +2497,409 @@ OAuth Redirect URI: http://localhost:9876/callback`,
           createdTime: p.createdTime ?? ""
         }));
         return {
-          content: [{ type: "text", text: JSON.stringify({ posts, count: posts.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+          content: [{ type: "text", text: JSON.stringify({ posts, count: posts.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "board.posts") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_board_read",
+    "\uAC8C\uC2DC\uD310 \uAE00\uC758 \uC0C1\uC138 \uB0B4\uC6A9\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. postId\uB294 nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
+    {
+      boardId: z9.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      postId: z9.string().describe("\uAE00 ID (nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5)")
+    },
+    async ({ boardId, postId }) => {
+      try {
+        const post = await readPost(boardId, postId);
+        return {
+          content: [{ type: "text", text: JSON.stringify({
+            postId: post.postId,
+            boardId: post.boardId,
+            title: post.title,
+            body: post.body ?? "",
+            userName: post.userName ?? "",
+            readCount: post.readCount ?? 0,
+            commentCount: post.commentCount ?? 0,
+            createdTime: post.createdTime ?? "",
+            updatedTime: post.updatedTime ?? ""
+          }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "board.read") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_board_create",
+    "\uAC8C\uC2DC\uD310\uC5D0 \uAE00\uC744 \uC791\uC131\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310\uC5D0 \uAE00 \uC62C\uB824\uC918', '\uACF5\uC9C0 \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. boardId\uB294 nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board scope)",
+    {
+      boardId: z9.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      title: z9.string().describe("\uAE00 \uC81C\uBAA9"),
+      body: z9.string().optional().describe("\uAE00 \uBCF8\uBB38"),
+      enableComment: z9.boolean().optional().describe("\uB313\uAE00 \uD5C8\uC6A9 (\uAE30\uBCF8: true)"),
+      sendNotifications: z9.boolean().optional().describe("\uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)")
+    },
+    async ({ boardId, title, body, enableComment, sendNotifications }) => {
+      try {
+        const post = await createPost({
+          boardId,
+          title,
+          body,
+          enableComment,
+          sendNotifications
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, postId: post.postId, boardId: post.boardId, title: post.title }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "board.create") }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/tools/contact.ts
+import { z as z10 } from "zod";
+
+// src/api/contact.ts
+var BASE_URL7 = "https://www.worksapis.com/v1.0";
+async function listContacts(opts = {}) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const params = new URLSearchParams();
+  params.set("count", String(opts.count ?? 20));
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  if (opts.accessibleRange) params.set("accessibleRange", opts.accessibleRange);
+  if (opts.contactTagId) params.set("contactTagId", opts.contactTagId);
+  if (opts.email) params.set("email", opts.email);
+  if (opts.telephone) params.set("telephone", opts.telephone);
+  if (opts.orderBy) params.set("orderBy", opts.orderBy);
+  if (opts.searchDateType) params.set("searchDateType", opts.searchDateType);
+  if (opts.startDateTime) params.set("startDateTime", opts.startDateTime);
+  if (opts.endDateTime) params.set("endDateTime", opts.endDateTime);
+  const url = `${BASE_URL7}/users/${sanitizePathSegment(userId)}/contacts?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { contacts: data.contacts ?? [], responseMetaData: data.responseMetaData };
+}
+async function getContact(contactId, profile = "default") {
+  const url = `${BASE_URL7}/contacts/${sanitizePathSegment(contactId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function createContact(payload, profile = "default") {
+  const url = `${BASE_URL7}/contacts`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+  }
+  const res = await userFetch(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    },
+    profile
+  );
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function updateContact(contactId, payload, partial = true, profile = "default") {
+  const url = `${BASE_URL7}/contacts/${sanitizePathSegment(contactId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] ${partial ? "PATCH" : "PUT"} ${url}`);
+  }
+  const res = await userFetch(
+    url,
+    {
+      method: partial ? "PATCH" : "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    },
+    profile
+  );
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function deleteContact(contactId, profile = "default") {
+  const url = `${BASE_URL7}/contacts/${sanitizePathSegment(contactId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] DELETE ${url}`);
+  }
+  const res = await userFetch(url, { method: "DELETE" }, profile);
+  if (res.status === 204) return;
+  if (!res.ok) return handleUserApiError(res);
+}
+async function listContactTags(opts = {}) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const params = new URLSearchParams();
+  params.set("count", String(opts.count ?? 20));
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  const url = `${BASE_URL7}/users/${sanitizePathSegment(userId)}/contact-tags?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { contactTags: data.contactTags ?? [], responseMetaData: data.responseMetaData };
+}
+
+// src/mcp/tools/contact.ts
+function registerContactTools(server) {
+  defineTool(
+    server,
+    "nworks_contact_list",
+    "NAVER WORKS \uAC1C\uC778 \uC5F0\uB77D\uCC98 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC5F0\uB77D\uCC98 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uB0B4 \uBA85\uD568\uCCA9 \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (contact.read scope)",
+    {
+      userId: z10.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      count: z10.number().int().min(1).max(500).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 500)"),
+      cursor: z10.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      contactTagId: z10.string().optional().describe("\uC5F0\uB77D\uCC98 \uD0DC\uADF8 ID\uB85C \uD544\uD130\uB9C1 (nworks_contact_list_tags\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      email: z10.string().optional().describe("\uC774\uBA54\uC77C\uB85C \uD544\uD130\uB9C1"),
+      telephone: z10.string().optional().describe("\uC804\uD654\uBC88\uD638\uB85C \uD544\uD130\uB9C1")
+    },
+    async ({ userId, count, cursor, contactTagId, email, telephone }) => {
+      try {
+        const result = await listContacts({
+          userId: userId ?? "me",
+          count: count ?? 20,
+          cursor,
+          contactTagId,
+          email,
+          telephone
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ contacts: result.contacts, count: result.contacts.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_get",
+    "\uD2B9\uC815 \uC5F0\uB77D\uCC98\uC758 \uC0C1\uC138 \uC815\uBCF4\uB97C \uC870\uD68C\uD569\uB2C8\uB2E4. contactId\uB294 nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (contact.read scope)",
+    {
+      contactId: z10.string().describe("\uC5F0\uB77D\uCC98 ID (nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
+    },
+    async ({ contactId }) => {
+      try {
+        const result = await getContact(contactId);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.get") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_create",
+    `\uC0C8 \uC5F0\uB77D\uCC98\uB97C \uB9CC\uB4ED\uB2C8\uB2E4. '\uC5F0\uB77D\uCC98 \uCD94\uAC00\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. payload\uB294 NAVER WORKS \uC5F0\uB77D\uCC98 API \uC2A4\uD399\uC5D0 \uB9DE\uB294 JSON \uAC1D\uCCB4\uB97C \uADF8\uB300\uB85C \uC804\uB2EC\uD569\uB2C8\uB2E4. contactName\uACFC permission\uC740 \uD544\uC218\uC774\uBA70, permission.accessibleMembers\uC5D0\uB294 \uCD5C\uC18C 1\uBA85\uC774 \uC788\uC5B4\uC57C \uD569\uB2C8\uB2E4(\uBCF4\uD1B5 \uBCF8\uC778). \uC608: {"contactName":{"lastName":"\uAE40","firstName":"\uCCA0\uC218"},"emails":[{"email":"a@b.com","primary":true}],"permission":{"accessibleRange":"MEMBER","isCoEditing":false,"accessibleMembers":[{"id":"<userId>","type":"USER"}]}}. User OAuth \uC778\uC99D \uD544\uC694 (contact scope)`,
+    {
+      payload: z10.record(z10.string(), z10.unknown()).describe("\uC5F0\uB77D\uCC98 \uD544\uB4DC. \uD544\uC218: contactName, permission(accessibleRange\xB7isCoEditing\xB7accessibleMembers \uCD5C\uC18C 1\uBA85). \uC120\uD0DD: emails[], telephones[], organizations[], memo")
+    },
+    async ({ payload }) => {
+      try {
+        const result = await createContact(payload);
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.create") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_update",
+    "\uAE30\uC874 \uC5F0\uB77D\uCC98\uB97C \uC218\uC815\uD569\uB2C8\uB2E4. contactId\uB294 nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5. payload\uB294 \uC218\uC815\uD560 \uD544\uB4DC\uB9CC \uB2F4\uC740 JSON \uAC1D\uCCB4\uC785\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (contact scope)",
+    {
+      contactId: z10.string().describe("\uC5F0\uB77D\uCC98 ID (nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      payload: z10.record(z10.string(), z10.unknown()).describe("\uC218\uC815\uD560 \uD544\uB4DC (name, email, tel, company \uB4F1)"),
+      replace: z10.boolean().optional().describe("\uC804\uCCB4 \uAD50\uCCB4(PUT) \uC5EC\uBD80 (\uAE30\uBCF8: false, \uBD80\uBD84 \uC218\uC815 PATCH)")
+    },
+    async ({ contactId, payload, replace }) => {
+      try {
+        const result = await updateContact(contactId, payload, !(replace ?? false));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "board.posts") }],
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.update") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
-    "nworks_board_read",
-    "\uAC8C\uC2DC\uD310 \uAE00\uC758 \uC0C1\uC138 \uB0B4\uC6A9\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. postId\uB294 nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
+  defineTool(
+    server,
+    "nworks_contact_delete",
+    "\uC5F0\uB77D\uCC98\uB97C \uC0AD\uC81C\uD569\uB2C8\uB2E4. contactId\uB294 nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (contact scope)",
     {
-      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      postId: z.string().describe("\uAE00 ID (nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5)")
+      contactId: z10.string().describe("\uC0AD\uC81C\uD560 \uC5F0\uB77D\uCC98 ID (nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
     },
-    async ({ boardId, postId }) => {
+    async ({ contactId }) => {
       try {
-        const post = await readPost(boardId, postId);
+        await deleteContact(contactId);
         return {
-          content: [{ type: "text", text: JSON.stringify({
-            postId: post.postId,
-            boardId: post.boardId,
-            title: post.title,
-            body: post.body ?? "",
-            userName: post.userName ?? "",
-            readCount: post.readCount ?? 0,
-            commentCount: post.commentCount ?? 0,
-            createdTime: post.createdTime ?? "",
-            updatedTime: post.updatedTime ?? ""
-          }) }]
+          content: [{ type: "text", text: JSON.stringify({ success: true, contactId, message: "\uC5F0\uB77D\uCC98\uAC00 \uC0AD\uC81C\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "board.read") }],
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.delete") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
-    "nworks_board_create",
-    "\uAC8C\uC2DC\uD310\uC5D0 \uAE00\uC744 \uC791\uC131\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310\uC5D0 \uAE00 \uC62C\uB824\uC918', '\uACF5\uC9C0 \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. boardId\uB294 nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board scope)",
+  defineTool(
+    server,
+    "nworks_contact_list_tags",
+    "\uC5F0\uB77D\uCC98 \uD0DC\uADF8(\uADF8\uB8F9) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC5F0\uB77D\uCC98 \uD0DC\uADF8 \uBAA9\uB85D \uBCF4\uC5EC\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (contact.read scope)",
     {
-      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      title: z.string().describe("\uAE00 \uC81C\uBAA9"),
-      body: z.string().optional().describe("\uAE00 \uBCF8\uBB38"),
-      enableComment: z.boolean().optional().describe("\uB313\uAE00 \uD5C8\uC6A9 (\uAE30\uBCF8: true)"),
-      sendNotifications: z.boolean().optional().describe("\uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)")
+      userId: z10.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      count: z10.number().int().min(1).max(500).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 500)"),
+      cursor: z10.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
-    async ({ boardId, title, body, enableComment, sendNotifications }) => {
+    async ({ userId, count, cursor }) => {
       try {
-        const post = await createPost({
-          boardId,
-          title,
-          body,
-          enableComment,
-          sendNotifications
-        });
+        const result = await listContactTags({ userId: userId ?? "me", count: count ?? 20, cursor });
         return {
-          content: [{ type: "text", text: JSON.stringify({ success: true, postId: post.postId, boardId: post.boardId, title: post.title }) }]
+          content: [{ type: "text", text: JSON.stringify({ contactTags: result.contactTags, count: result.contactTags.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "board.create") }],
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.list_tags") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/auth.ts
+import { z as z11 } from "zod";
+
+// src/auth/scopes.ts
+var READ_SCOPES = [
+  "calendar.read",
+  "file.read",
+  "mail.read",
+  "task.read",
+  "user.read",
+  "board.read",
+  "contact.read"
+];
+var ALL_SCOPES = [
+  "calendar",
+  "calendar.read",
+  "file",
+  "file.read",
+  "mail",
+  "mail.read",
+  "task",
+  "task.read",
+  "user.read",
+  "board",
+  "board.read",
+  "contact",
+  "contact.read"
+];
+var SCOPE_DEPENDENCIES = {
+  calendar: ["calendar.read"],
+  file: ["file.read"],
+  mail: ["mail.read"],
+  task: ["task.read", "user.read"],
+  "task.read": ["user.read"],
+  board: ["board.read"],
+  contact: ["contact.read"]
+};
+var SCOPE_PRESETS = {
+  readonly: READ_SCOPES,
+  // default를 all로 두는 이유: 현재 제품의 "한 번 로그인으로 전체 기능" 약속을 보존한다.
+  // 읽기 전용을 기본값으로 하면 신규 사용자가 쓰기 기능(일정 생성 등)을 쓸 때 재로그인해야 한다.
+  // 안전을 최우선하려면 readonly로 바꾸면 되지만, 삭제류 도구는 이미 destructiveHint
+  // annotation으로 클라이언트 승인 게이트가 걸린다.
+  default: ALL_SCOPES,
+  all: ALL_SCOPES
+};
+function isPreset(value) {
+  return value === "readonly" || value === "default" || value === "all";
+}
+function expandScopeDependencies(scopes) {
+  const expanded = new Set(scopes);
+  for (const scope of scopes) {
+    const deps = SCOPE_DEPENDENCIES[scope];
+    if (deps) deps.forEach((d) => expanded.add(d));
+  }
+  return [...expanded];
+}
+function resolveScopes(input) {
+  if (!input) return SCOPE_PRESETS.default;
+  if (isPreset(input)) return SCOPE_PRESETS[input];
+  return expandScopeDependencies(input.split(" ").filter(Boolean));
+}
+function mergeScopes(existing, requested) {
+  return [.../* @__PURE__ */ new Set([...existing, ...requested])].join(" ");
+}
+
+// src/mcp/tools/auth.ts
+function registerAuthTools(server) {
+  defineTool(
+    server,
     "nworks_login_user",
-    "User OAuth \uB85C\uADF8\uC778\uC744 \uC2DC\uC791\uD569\uB2C8\uB2E4. \uBC18\uD658\uB41C URL\uC744 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5B4 NAVER WORKS\uC5D0 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uB85C\uADF8\uC778 \uC644\uB8CC \uD6C4 \uC790\uB3D9\uC73C\uB85C \uD1A0\uD070\uC774 \uC800\uC7A5\uB429\uB2C8\uB2E4. \uC911\uC694: scope\uB97C \uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694. \uAE30\uBCF8\uAC12\uC774 \uBAA8\uB4E0 API(\uCE98\uB9B0\uB354, \uBA54\uC77C, \uD560\uC77C, \uB4DC\uB77C\uC774\uBE0C, \uAC8C\uC2DC\uD310)\uB97C \uD3EC\uD568\uD558\uBBC0\uB85C \uD55C \uBC88 \uB85C\uADF8\uC778\uC73C\uB85C \uC804\uCCB4 \uAE30\uB2A5\uC744 \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4. scope\uB97C \uC881\uAC8C \uC9C0\uC815\uD558\uBA74 \uB2E4\uB978 \uAE30\uB2A5 \uC0AC\uC6A9 \uC2DC \uC7AC\uB85C\uADF8\uC778\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.",
+    "User OAuth \uB85C\uADF8\uC778\uC744 \uC2DC\uC791\uD569\uB2C8\uB2E4. \uBC18\uD658\uB41C URL\uC744 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5B4 NAVER WORKS\uC5D0 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uB85C\uADF8\uC778 \uC644\uB8CC \uD6C4 \uC790\uB3D9\uC73C\uB85C \uD1A0\uD070\uC774 \uC800\uC7A5\uB429\uB2C8\uB2E4. \uC911\uC694: preset\uC744 \uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694. \uAE30\uBCF8\uAC12(default=all)\uC774 \uBAA8\uB4E0 API(\uCE98\uB9B0\uB354, \uBA54\uC77C, \uD560\uC77C, \uB4DC\uB77C\uC774\uBE0C, \uAC8C\uC2DC\uD310)\uB97C \uD3EC\uD568\uD558\uBBC0\uB85C \uD55C \uBC88 \uB85C\uADF8\uC778\uC73C\uB85C \uC804\uCCB4 \uAE30\uB2A5\uC744 \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4. \uC77D\uAE30 \uC804\uC6A9\uC73C\uB85C \uC81C\uD55C\uD558\uB824\uBA74 preset='readonly'\uB97C \uC9C0\uC815\uD558\uC138\uC694(\uC774 \uACBD\uC6B0 \uC0DD\uC131/\uC218\uC815/\uC0AD\uC81C \uB3C4\uAD6C\uB294 \uC7AC\uB85C\uADF8\uC778 \uD544\uC694).",
     {
-      scope: z.string().optional().describe("\uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694 (\uAE30\uBCF8\uAC12\uC774 \uC804\uCCB4 scope \uD3EC\uD568). \uD2B9\uC218\uD55C \uACBD\uC6B0\uC5D0\uB9CC \uC0AC\uC6A9")
+      preset: z11.enum(["readonly", "default", "all"]).optional().describe("scope \uD504\uB9AC\uC14B. \uAE30\uBCF8 default(=all, \uC804\uCCB4 \uAE30\uB2A5). readonly\uB294 \uC77D\uAE30 \uC804\uC6A9."),
+      scope: z11.string().optional().describe("\uACE0\uAE09: \uACF5\uBC31 \uAD6C\uBD84 raw scope \uC9C1\uC811 \uC9C0\uC815(preset \uB300\uC2E0). \uD2B9\uC218\uD55C \uACBD\uC6B0\uC5D0\uB9CC \uC0AC\uC6A9")
     },
-    async ({ scope }) => {
-      const DEFAULT_SCOPE = "calendar calendar.read file file.read mail mail.read task task.read user.read board board.read";
+    async ({ preset, scope }) => {
       try {
         const creds = await loadCredentials();
-        const SCOPE_DEPS = {
-          calendar: ["calendar.read"],
-          task: ["user.read"],
-          "task.read": ["user.read"]
-        };
-        const expandScopes = (scopes) => {
-          const expanded = new Set(scopes);
-          for (const s of scopes) {
-            const deps = SCOPE_DEPS[s];
-            if (deps) deps.forEach((d) => expanded.add(d));
-          }
-          return [...expanded];
-        };
         const existingToken = await loadUserToken();
         const existingScopes = existingToken?.scope?.split(" ").filter(Boolean) ?? [];
-        const requestedScopes = expandScopes((scope ?? DEFAULT_SCOPE).split(" ").filter(Boolean));
-        const mergedScopes = [.../* @__PURE__ */ new Set([...existingScopes, ...requestedScopes])].join(" ");
-        const state = Math.random().toString(36).substring(2);
+        const requestedScopes = resolveScopes(preset ?? scope);
+        const mergedScopes = mergeScopes(existingScopes, requestedScopes);
+        const state = generateSecureState();
         const authorizeUrl = buildAuthorizeUrl(creds.clientId, mergedScopes, state);
-        startOAuthCallbackServer(creds.clientId, creds.clientSecret).then(
+        startOAuthCallbackServer(creds.clientId, creds.clientSecret, state).then(
           (token) => saveUserToken({
             accessToken: token.accessToken,
             refreshToken: token.refreshToken,
@@ -2298,7 +2933,8 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_whoami",
     "\uD604\uC7AC \uC778\uC99D\uB41C NAVER WORKS \uACC4\uC815 \uC815\uBCF4\uC640 \uD1A0\uD070 \uC720\uD6A8 \uC0C1\uD0DC\uB97C \uD655\uC778\uD569\uB2C8\uB2E4. \uC778\uC99D \uBB38\uC81C \uC9C4\uB2E8 \uC2DC \uBA3C\uC800 \uD638\uCD9C",
     {},
@@ -2309,9 +2945,10 @@ OAuth Redirect URI: http://localhost:9876/callback`,
         const userToken = await loadUserToken();
         const isValid = token ? token.expiresAt > Date.now() / 1e3 : false;
         const userTokenValid = userToken ? userToken.expiresAt > Date.now() / 1e3 : false;
+        const mask2 = (s) => s.length <= 4 ? "****" : `****${s.slice(-4)}`;
         const info = {
           serviceAccount: creds.serviceAccount ?? null,
-          clientId: creds.clientId,
+          clientId: mask2(creds.clientId),
           botId: creds.botId ?? null,
           tokenValid: isValid,
           userOAuth: userToken ? { valid: userTokenValid, scope: userToken.scope } : null
@@ -2327,12 +2964,25 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_logout",
     "\uC800\uC7A5\uB41C NAVER WORKS \uC778\uC99D \uC815\uBCF4\uC640 \uD1A0\uD070\uC744 \uBAA8\uB450 \uC0AD\uC81C\uD569\uB2C8\uB2E4",
     {},
     async () => {
       try {
+        try {
+          const creds = await loadCredentials();
+          const token = await loadToken();
+          const userToken = await loadUserToken();
+          if (token?.accessToken) {
+            await revokeToken(token.accessToken, creds.clientId, creds.clientSecret);
+          }
+          if (userToken?.refreshToken) {
+            await revokeToken(userToken.refreshToken, creds.clientId, creds.clientSecret);
+          }
+        } catch {
+        }
         await clearCredentials();
         return {
           content: [
@@ -2353,15 +3003,263 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/commands/doctor.ts
+import { Command } from "commander";
+import { existsSync as existsSync2 } from "fs";
+import { readFile as readFile4 } from "fs/promises";
+import { resolve as resolve2, join as join2, sep as sep2 } from "path";
+
+// src/output/format.ts
+function output(data, opts = {}) {
+  const useJson = opts.json || !process.stdout.isTTY;
+  if (useJson) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  if (Array.isArray(data)) {
+    printTable(data);
+  } else if (typeof data === "object" && data !== null) {
+    const record = data;
+    for (const value of Object.values(record)) {
+      if (Array.isArray(value) && value.length > 0) {
+        printTable(value);
+        return;
+      }
+    }
+    for (const [key, value] of Object.entries(record)) {
+      console.log(`  ${key}: ${String(value)}`);
+    }
+  } else {
+    console.log(String(data));
+  }
+}
+function printTable(rows) {
+  if (rows.length === 0) {
+    console.log("  (no data)");
+    return;
+  }
+  const first = rows[0];
+  const keys = Object.keys(first);
+  const widths = {};
+  for (const key of keys) {
+    widths[key] = key.length;
+  }
+  for (const row of rows) {
+    const record = row;
+    for (const key of keys) {
+      const len = String(record[key] ?? "").length;
+      if (len > (widths[key] ?? 0)) {
+        widths[key] = len;
+      }
+    }
+  }
+  const header = keys.map((k) => k.padEnd(widths[k] ?? 0)).join("  ");
+  const separator = keys.map((k) => "\u2500".repeat(widths[k] ?? 0)).join("\u2500\u2500");
+  console.log(`  ${header}`);
+  console.log(`  ${separator}`);
+  for (const row of rows) {
+    const record = row;
+    const line = keys.map((k) => String(record[k] ?? "").padEnd(widths[k] ?? 0)).join("  ");
+    console.log(`  ${line}`);
+  }
+}
+function errorOutput(error, opts = {}) {
+  const payload = {
+    success: false,
+    error: { code: error.code ?? "ERROR", message: error.message, hint: error.hint }
+  };
+  if (opts.json || !process.stderr.isTTY) {
+    console.error(JSON.stringify(payload, null, 2));
+  } else {
+    console.error(`  Error: ${error.message}`);
+    if (error.code) {
+      console.error(`  Code: ${error.code}`);
+    }
+    if (error.hint) {
+      console.error(`  \u2192 ${error.hint}`);
+    }
+  }
+}
+
+// src/output/cli-error.ts
+function cliError(err, opts = {}, area) {
+  const error = err;
+  if (error instanceof ApiError) {
+    errorOutput(
+      {
+        code: error.code,
+        message: error.message,
+        hint: cliErrorHint(err, area).split("\n").slice(1).map((l) => l.replace(/^\s+→\s*/, "")).join(" ")
+      },
+      opts
+    );
+  } else if (error instanceof AuthError) {
+    errorOutput(
+      {
+        code: "AUTH_ERROR",
+        message: error.message,
+        hint: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. `nworks login`\uC73C\uB85C \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694."
+      },
+      opts
+    );
+  } else {
+    errorOutput({ message: error.message }, opts);
+  }
+  process.exitCode = 1;
+}
+
+// src/commands/doctor.ts
+function mask(value) {
+  return value.length <= 4 ? "****" : `****${value.slice(-4)}`;
+}
+async function runChecks(profile) {
+  const results = [];
+  let creds;
+  try {
+    creds = await loadCredentials(profile);
+    results.push({ check: "credentials", status: "OK", detail: `clientId: ${mask(creds.clientId)}` });
+  } catch {
+    results.push({ check: "credentials", status: "FAIL", detail: "No credentials found. CLI: run `nworks login --user`. MCP: use the nworks_setup tool (env NWORKS_CLIENT_SECRET required)." });
+    return results;
+  }
+  if (hasServiceAccountCreds(creds)) {
+    results.push({ check: "serviceAccount", status: "OK", detail: creds.serviceAccount });
+  } else {
+    results.push({ check: "serviceAccount", status: "SKIP", detail: "Not set (required for bot messaging)" });
+  }
+  if (creds.privateKeyPath) {
+    if (existsSync2(creds.privateKeyPath)) {
+      try {
+        await readFile4(creds.privateKeyPath, "utf-8");
+        results.push({ check: "privateKey", status: "OK", detail: creds.privateKeyPath });
+      } catch {
+        results.push({ check: "privateKey", status: "FAIL", detail: `Cannot read: ${creds.privateKeyPath}` });
+      }
+    } else {
+      results.push({ check: "privateKey", status: "FAIL", detail: `File not found: ${creds.privateKeyPath}` });
+    }
+  } else {
+    results.push({ check: "privateKey", status: "SKIP", detail: "Not set" });
+  }
+  if (creds.privateKeyPath && existsSync2(creds.privateKeyPath)) {
+    const resolvedKey = resolve2(creds.privateKeyPath);
+    const cwd = resolve2(process.cwd());
+    const insideCwd = resolvedKey === cwd || resolvedKey.startsWith(cwd + sep2);
+    const looksLikeProject = existsSync2(join2(cwd, ".git")) || existsSync2(join2(cwd, "package.json"));
+    if (insideCwd && looksLikeProject) {
+      results.push({
+        check: "keyLocation",
+        status: "WARN",
+        detail: "Private key is inside a project directory. Risk of exposure via editor plugins, AI tools, or `npm pack` \u2014 move it outside (e.g. your home directory) and update the path."
+      });
+    }
+  }
+  if (creds.botId) {
+    results.push({ check: "botId", status: "OK", detail: creds.botId });
+  } else {
+    results.push({ check: "botId", status: "SKIP", detail: "Not set (required to send messages)" });
+  }
+  const token = await loadToken(profile);
+  if (token) {
+    const valid = token.expiresAt > Date.now() / 1e3;
+    results.push({
+      check: "serviceToken",
+      status: valid ? "OK" : "EXPIRED",
+      detail: valid ? `expires: ${new Date(token.expiresAt * 1e3).toISOString()}` : `expired: ${new Date(token.expiresAt * 1e3).toISOString()}`
+    });
+  } else {
+    results.push({ check: "serviceToken", status: "SKIP", detail: "No token" });
+  }
+  const userToken = await loadUserToken(profile);
+  if (userToken) {
+    const valid = userToken.expiresAt > Date.now() / 1e3;
+    results.push({
+      check: "userOAuth",
+      status: valid ? "OK" : "EXPIRED",
+      detail: valid ? `scope: ${userToken.scope} | expires: ${new Date(userToken.expiresAt * 1e3).toISOString()}` : `expired | scope: ${userToken.scope}`
+    });
+  } else {
+    results.push({ check: "userOAuth", status: "SKIP", detail: "No token. Run `nworks login --user`." });
+  }
+  if (hasServiceAccountCreds(creds) && token && token.expiresAt > Date.now() / 1e3) {
+    try {
+      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
+        headers: { Authorization: `Bearer ${token.accessToken}` }
+      });
+      if (res.ok) {
+        results.push({ check: "apiConnection", status: "OK", detail: "Connected to NAVER WORKS API" });
+      } else {
+        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
+      }
+    } catch (e) {
+      results.push({ check: "apiConnection", status: "FAIL", detail: `Connection failed: ${e.message}` });
+    }
+  } else if (userToken && userToken.expiresAt > Date.now() / 1e3) {
+    try {
+      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
+        headers: { Authorization: `Bearer ${userToken.accessToken}` }
+      });
+      if (res.ok) {
+        results.push({ check: "apiConnection", status: "OK", detail: "Connected to NAVER WORKS API" });
+      } else {
+        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
+      }
+    } catch (e) {
+      results.push({ check: "apiConnection", status: "FAIL", detail: `Connection failed: ${e.message}` });
+    }
+  } else {
+    results.push({ check: "apiConnection", status: "SKIP", detail: "No valid token \u2014 skipping API test" });
+  }
+  return results;
+}
+var doctorCommand = new Command("doctor").description("Check nworks configuration and connectivity").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const results = await runChecks(opts.profile);
+    if (opts.json || !process.stdout.isTTY) {
+      output(results, opts);
+    } else {
+      console.log("\n  nworks doctor\n");
+      for (const r of results) {
+        const icon = r.status === "OK" ? "\u2705" : r.status === "SKIP" ? "\u2796" : r.status === "WARN" ? "\u26A0\uFE0F" : "\u274C";
+        console.log(`  ${icon} ${r.check.padEnd(16)} ${r.detail}`);
+      }
+      console.log();
+    }
+    if (results.some((r) => r.status === "FAIL")) {
+      process.exitCode = 1;
+    }
+  } catch (err) {
+    cliError(err, opts);
+  }
+});
+
+// src/mcp/tools/diagnostics.ts
+function registerDiagnosticsTools(server) {
+  defineTool(
+    server,
     "nworks_doctor",
     "NAVER WORKS \uC5F0\uACB0 \uC0C1\uD0DC\uB97C \uC9C4\uB2E8\uD569\uB2C8\uB2E4. \uC778\uC99D \uC815\uBCF4, \uD1A0\uD070, Private Key, API \uC5F0\uACB0\uC744 \uC810\uAC80\uD569\uB2C8\uB2E4.",
     {},
     async () => {
       try {
         const results = await runChecks("default");
+        const maskedResults = results.map((r) => {
+          if (r.check === "credentials" && r.status === "OK") {
+            return { ...r, detail: r.detail.replace(/clientId: .+/, "clientId: ****") };
+          }
+          if (r.check === "privateKey" && r.status === "OK") {
+            return { ...r, detail: "OK (path hidden)" };
+          }
+          if (r.check === "serviceAccount" && r.status === "OK") {
+            const masked = r.detail.length <= 4 ? "****" : `****${r.detail.slice(-4)}`;
+            return { ...r, detail: masked };
+          }
+          return r;
+        });
         return {
-          content: [{ type: "text", text: JSON.stringify(results) }]
+          content: [{ type: "text", text: JSON.stringify(maskedResults) }]
         };
       } catch (err) {
         return {
@@ -2373,6 +3271,27 @@ OAuth Redirect URI: http://localhost:9876/callback`,
   );
 }
 
+// src/mcp/tools.ts
+function registerTools(server) {
+  registerSetupTools(server);
+  registerMessageTools(server);
+  registerDirectoryTools(server);
+  registerCalendarTools(server);
+  registerDriveTools(server);
+  registerMailTools(server);
+  registerTaskTools(server);
+  registerBoardTools(server);
+  registerContactTools(server);
+  registerAuthTools(server);
+  registerDiagnosticsTools(server);
+}
+
+// src/version.ts
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var VERSION = pkg.version;
+
 // src/mcp/server.ts
 async function startMcpServer() {
   try {
@@ -2393,7 +3312,7 @@ async function startMcpServer() {
   }
   const server = new McpServer({
     name: "nworks",
-    version: "1.0.0"
+    version: VERSION
   });
   registerTools(server);
   const transport = new StdioServerTransport();