stellavault 0.4.3 → 0.4.5

package/README.md

@@ -1,27 +1,27 @@
 # Stellavault
 
-> **Self-compiling knowledge MCP server** — ingest anything, auto-organize into Zettelkasten wiki, and let Claude access your entire knowledge base.
+> **Drop anything. It compiles itself into knowledge.** Claude remembers everything you know.
 
-Drop a PDF, paste a YouTube link, type a thought — Stellavault compiles it into structured knowledge, connects the dots, and gives your AI agent full access through 21 MCP tools.
+Self-compiling Zettelkasten MCP server. Ingest PDFs, YouTube, documents — auto-organized into linked wiki. Claude accesses your entire knowledge base. **Your vault files are never modified.**
 
 <p align="center">
-  <img src="images/screenshots/graph-dark-full.png" alt="3D Knowledge Graph" width="800" />
-  <br><em>Your vault as a neural network. Clusters form constellations.</em>
+  <img src="images/screenshots/graph-main-2.png" alt="3D Knowledge Graph" width="800" />
+  <br><em>Your vault as a neural network. Local-first, no cloud required.</em>
 </p>
 
 ## Two Core Ideas
 
-**1. "Drop it and forget it"** (Karpathy's Self-Compiling Knowledge)
+**1. "Drop it and forget it"** (Inspired by Karpathy's Self-Compiling Knowledge)
 ```
 Any input → auto-classify → raw/ → compile → wiki → connected knowledge
 ```
-PDF, DOCX, YouTube, URL, text — everything goes through the same pipeline. You never manually organize.
+PDF, DOCX, PPTX, XLSX, YouTube (with transcript), URL, text — everything goes through the same pipeline. You never manually organize.
 
-**2. "Claude knows what you know"** (MCP Integration)
+**2. "Claude remembers what you know"** (MCP Integration)
 ```bash
 claude mcp add stellavault -- stellavault serve
 ```
-21 MCP tools give Claude direct access to search, ask, draft, and navigate your entire knowledge base.
+Claude searches, asks, drafts from your vault directly. Local-first — no data leaves your machine.
 
 ## 5-Minute Setup
 
@@ -200,19 +200,28 @@ stellavault autopilot                          # Full cycle: inbox → compile
 | **Capture** | ingest (URL/YouTube/PDF/DOCX/PPTX/XLSX/text), fleeting, web drag & drop, mobile PWA |
 | **Organize** | Zettelkasten 3-stage, auto index codes, wikilink auto-connect, configurable folders |
 | **Distill** | compile (raw→wiki), lint (health score), gaps, contradictions, duplicates |
-| **Express** | draft (blog/report/outline), --ai (Claude API), MCP generate-draft (free) |
-| **Memory** | FSRS decay tracking, session-save (daily logs), flush (logs→wiki), compounding loop |
-| **Search** | hybrid (BM25+vector+RRF), multilingual (50+ langs), ask Q&A |
-| **Visualize** | 3D graph, constellation, heatmap, timeline, decay overlay, dark/light |
-| **AI Integration** | 21 MCP tools, Claude Code hooks, Anthropic SDK, generate-draft |
-| **CLI** | 39+ commands, `sv` alias |
+| **Express** | draft (blog/report/outline/instagram/thread/script), blueprint, --ai, MCP generate-draft |
+| **Memory** | FSRS decay, session-save, flush, compounding loop, ADR templates |
+| **Search** | hybrid (BM25+vector+RRF), multilingual 50+, ask Q&A, quotes mode |
+| **Visualize** | 3D graph, heatmap, timeline, right-click context menu, TipTap WYSIWYG editor |
+| **AI Integration** | 21 MCP tools, Claude Code hooks, Anthropic SDK |
+| **Security** | DOMPurify, YAML sanitize, 50MB guard, SSRF protection |
+| **CLI** | 40+ commands, `sv` alias, batch ingest |
+
+## Security
+
+Your vault files are never modified. Stellavault is local-first — no data leaves your machine unless you explicitly use `--ai` (Anthropic API).
+
+See [SECURITY.md](SECURITY.md) for full details.
 
 ## License
 
-MIT
+MIT — full source code available for audit.
 
 ## Links
 
+- [Landing Page](https://evanciel.github.io/stellavault/)
 - [Obsidian Plugin](https://github.com/Evanciel/stellavault-obsidian)
 - [npm](https://www.npmjs.com/package/stellavault)
 - [GitHub Releases](https://github.com/Evanciel/stellavault/releases)
+- [Security Policy](SECURITY.md)

package/SECURITY.md

@@ -0,0 +1,50 @@
+# Security Policy
+
+## Data Access
+
+Stellavault is **local-first**. Your knowledge stays on your machine.
+
+### What Stellavault reads
+- `.md`, `.txt`, `.pdf`, `.docx`, `.pptx`, `.xlsx` files **inside your configured vault path only**
+- Files are read to build a search index (SQLite-vec database stored in `~/.stellavault/`)
+- **Vault original files are never modified by the indexer** — Stellavault creates its own files in `raw/`, `_wiki/`, `_drafts/` folders
+
+### When network requests occur
+- **YouTube ingest**: fetches video metadata + captions from youtube.com (via yt-dlp)
+- **URL ingest**: fetches the target URL to extract text
+- **`stellavault draft --ai`**: sends vault excerpts to Anthropic API (requires explicit `ANTHROPIC_API_KEY` env var — opt-in only)
+- **MCP serve**: local stdio/HTTP only — no external connections
+- **Embedding model**: downloaded once from Hugging Face on first `stellavault index`, then cached locally
+
+### What never leaves your machine
+- Your vault files
+- Your search index database
+- Your session logs and daily logs
+- Your draft outputs
+- All MCP tool responses
+
+## Vault Safety
+
+- **Read-only default**: The search indexer reads files but does not modify them
+- **New files only**: `ingest`, `session-save`, `compile`, `draft` create new `.md` files — they never overwrite existing vault notes
+- **Edit is explicit**: The web UI edit feature and `PUT /api/document` require deliberate user action
+- **Path traversal protection**: All file operations validate paths stay within vault root
+- **Configurable folders**: `raw/`, `_wiki/`, `_literature/` names can be changed in `.stellavault.json`
+
+## Input Sanitization
+
+- **DOMPurify**: All markdown rendered in the web UI is sanitized against XSS
+- **YAML sanitization**: Frontmatter values are escaped to prevent injection
+- **File size limit**: 50MB max for binary file extraction
+- **URL validation**: Image URLs restricted to `https://` scheme
+- **SSRF protection**: Private/local IP addresses blocked for URL ingest
+
+## Reporting Vulnerabilities
+
+Please report security issues to: https://github.com/Evanciel/stellavault/issues (label: security)
+
+Or email: [create a security@stellavault.dev when domain is registered]
+
+## License
+
+MIT — full source code is available for audit at https://github.com/Evanciel/stellavault

package/index.html

@@ -231,7 +231,7 @@ footer{padding:60px 0;text-align:center}
 <section class="hero">
   <div class="graph-visual" id="graphVisual"></div>
   <div class="hero-inner container">
-    <div class="hero-badge">open source <span class="sep">&#9679;</span> local-first <span class="sep">&#9679;</span> MIT license</div>
+    <div class="hero-badge">local-first <span class="sep">&#9679;</span> vault files never modified <span class="sep">&#9679;</span> MIT</div>
     <h1>Drop anything.<br>It <em>compiles itself</em><br>into knowledge.</h1>
     <p class="hero-sub">Self-compiling Zettelkasten MCP server. Ingest PDFs, YouTube, documents&mdash;auto-organized into linked wiki. Claude accesses your entire knowledge base through 21 MCP tools.</p>
     <div class="hero-cta">
@@ -366,8 +366,8 @@ footer{padding:60px 0;text-align:center}
 <section class="s-mcp">
   <div class="container">
     <div class="section-label reveal">Claude Integration</div>
-    <h2 class="section-title reveal">21 MCP tools. Claude knows<br>everything you know.</h2>
-    <p class="section-desc reveal">One command connects your vault to Claude Code. No API key needed.</p>
+    <h2 class="section-title reveal">Claude remembers<br>everything you know.</h2>
+    <p class="section-desc reveal">One command connects your vault. Claude searches, asks, and drafts from your knowledge. Local-first, no data leaves your machine.</p>
     <p class="section-desc reveal">One command connects your vault to Claude Code. No API key needed.</p>
     <div class="mcp-connect reveal"><span class="prompt">$</span> <code>claude mcp add stellavault -- stellavault serve</code></div>
     <div class="mcp-grid reveal">

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "stellavault",
-  "version": "0.4.3",
-  "description": "Self-compiling knowledge MCP server — ingest anything, auto-organize into Zettelkasten wiki, search with AI, and let Claude access your entire knowledge base.",
+  "version": "0.4.5",
+  "description": "Drop anything. It compiles itself into knowledge. Claude remembers everything you know. Local-first MCP server, vault files never modified.",
   "repository": {
     "type": "git",
     "url": "https://github.com/Evanciel/stellavault"

package/packages/cli/dist/commands/adr-cmd.d.ts

@@ -0,0 +1,7 @@
+export declare function adrCommand(title: string, options: {
+    context?: string;
+    options?: string;
+    decision?: string;
+    consequences?: string;
+}): Promise<void>;
+//# sourceMappingURL=adr-cmd.d.ts.map

package/packages/cli/dist/commands/adr-cmd.js

@@ -0,0 +1,45 @@
+// stellavault adr — Architecture Decision Record 구조화 인제스트
+// 의사결정 기록: 제목/맥락/옵션/결정/결과
+import chalk from 'chalk';
+import { loadConfig, ingest } from '@stellavault/core';
+export async function adrCommand(title, options) {
+    if (!title) {
+        console.error(chalk.yellow('Usage: stellavault adr "Decision Title" --context "..." --options "..." --decision "..." --consequences "..."'));
+        process.exit(1);
+    }
+    const config = loadConfig();
+    const now = new Date().toISOString().split('T')[0];
+    const content = [
+        `# ADR: ${title}`,
+        '',
+        `**Date:** ${now}`,
+        `**Status:** Accepted`,
+        '',
+        '## Context',
+        options.context ?? '<!-- Why is this decision needed? -->',
+        '',
+        '## Options Considered',
+        options.options ?? '<!-- What alternatives were evaluated? -->',
+        '',
+        '## Decision',
+        options.decision ?? '<!-- What was decided and why? -->',
+        '',
+        '## Consequences',
+        options.consequences ?? '<!-- What are the implications? -->',
+        '',
+    ].join('\n');
+    const result = ingest(config.vaultPath, {
+        type: 'text',
+        content,
+        tags: ['adr', 'decision'],
+        title: `ADR: ${title}`,
+        stage: 'literature',
+    }, config.folders);
+    console.log(chalk.green(`ADR created: ${title}`));
+    console.log(chalk.dim(`  Saved: ${result.savedTo}`));
+    console.log(chalk.dim(`  Stage: literature`));
+    console.log(chalk.dim(`  Tags: adr, decision`));
+    console.log('');
+    console.log(chalk.dim(`Find later: stellavault ask "why did we choose ${title}?"`));
+}
+//# sourceMappingURL=adr-cmd.js.map

package/packages/cli/dist/commands/ask-cmd.d.ts

@@ -1,4 +1,5 @@
 export declare function askCommand(question: string, options: {
     save?: boolean;
+    quotes?: boolean;
 }): Promise<void>;
 //# sourceMappingURL=ask-cmd.d.ts.map

package/packages/cli/dist/commands/ask-cmd.js

@@ -17,6 +17,7 @@ export async function askCommand(question, options) {
         limit: 10,
         save: options.save ?? false,
         vaultPath: config.vaultPath,
+        mode: options.quotes ? 'quotes' : 'default',
     });
     // 출력
     console.log('');

package/packages/cli/dist/commands/draft-cmd.d.ts

@@ -1,5 +1,6 @@
 export declare function draftCommand(topic: string | undefined, options: {
     format?: string;
     ai?: boolean;
+    blueprint?: string;
 }): Promise<void>;
 //# sourceMappingURL=draft-cmd.d.ts.map

package/packages/cli/dist/commands/draft-cmd.js

@@ -13,7 +13,15 @@ export async function draftCommand(topic, options) {
     const format = (options.format ?? 'blog');
     try {
         // Step 1: rule-based 초안 생성 (스캐폴딩 + 소스 수집)
-        const result = generateDraft(config.vaultPath, { topic, format }, config.folders);
+        // Blueprint 파싱: "Chapter 1:tag1,tag2; Chapter 2:tag3" 형식
+        let blueprint;
+        if (options.blueprint) {
+            blueprint = options.blueprint.split(';').map(s => {
+                const [title, tagsStr] = s.split(':').map(p => p.trim());
+                return { title, tags: tagsStr?.split(',').map(t => t.trim()) };
+            });
+        }
+        const result = generateDraft(config.vaultPath, { topic, format, blueprint }, config.folders);
         if (options.ai) {
             // Step 2: --ai 모드 → Claude API로 실제 글 생성
             console.log(chalk.dim('  AI mode: generating with Claude...'));

package/packages/cli/dist/commands/ingest-cmd.js

@@ -17,21 +17,39 @@ export async function ingestCommand(input, options) {
             console.error(chalk.yellow(`No supported files found in ${input}`));
             process.exit(1);
         }
-        console.log(chalk.dim(`Batch ingest: ${files.length} files from ${input}`));
+        console.log(chalk.dim(`Batch ingest: ${files.length} files from ${input}\n`));
         let success = 0;
-        for (const file of files) {
+        const failed = [];
+        for (let i = 0; i < files.length; i++) {
+            const file = files[i];
+            const name = file.split(/[/\\]/).pop() ?? file;
+            const progress = `[${i + 1}/${files.length}]`;
+            process.stderr.write(`\r${chalk.dim(progress)} ${name}...`);
             try {
-                await ingestCommand(file, { ...options, title: undefined });
+                await ingestSingleFile(file, options);
                 success++;
             }
             catch (err) {
-                console.error(chalk.yellow(`  Failed: ${file} — ${err instanceof Error ? err.message : 'error'}`));
+                failed.push(`${name}: ${err instanceof Error ? err.message : 'error'}`);
             }
         }
-        console.log(chalk.green(`\nBatch complete: ${success}/${files.length} files ingested`));
+        process.stderr.write('\r' + ' '.repeat(80) + '\r');
+        console.log(chalk.green(`Batch complete: ${success}/${files.length} files ingested`));
+        if (failed.length > 0) {
+            console.log(chalk.yellow(`\nFailed (${failed.length}):`));
+            for (const f of failed)
+                console.log(chalk.yellow(`  - ${f}`));
+        }
         return;
     }
-    const config = loadConfig();
+    await ingestSingleFile(input, options);
+}
+/** 캐시된 config (배치 시 반복 로드 방지) */
+let _configCache = null;
+function getConfig() { return _configCache ?? (_configCache = loadConfig()); }
+/** 단일 파일/URL/텍스트 인제스트 (배치에서 재사용) */
+async function ingestSingleFile(input, options) {
+    const config = getConfig();
     const tags = options.tags?.split(',').map(t => t.trim()) ?? [];
     const stage = (options.stage ?? 'fleeting');
     // 입력 타입 감지
@@ -80,8 +98,8 @@ export async function ingestCommand(input, options) {
             // 일반 URL: HTML → 텍스트 변환
             let content = input + '\n';
             try {
-                const resp = await fetch(input);
-                const html = await resp.text();
+                const resp = await fetch(input, { signal: AbortSignal.timeout(15000) });
+                const html = (await resp.text()).slice(0, 500000); // 500KB max
                 const text = html
                     .replace(/<script[\s\S]*?<\/script>/gi, '')
                     .replace(/<style[\s\S]*?<\/style>/gi, '')

package/packages/cli/dist/index.js

@@ -26,6 +26,7 @@ import { compileCommand } from './commands/compile-cmd.js';
 import { draftCommand } from './commands/draft-cmd.js';
 import { sessionSaveCommand } from './commands/session-cmd.js';
 import { flushCommand } from './commands/flush-cmd.js';
+import { adrCommand } from './commands/adr-cmd.js';
 import { lintCommand } from './commands/lint-cmd.js';
 import { fleetingCommand } from './commands/fleeting-cmd.js';
 import { ingestCommand, promoteCommand } from './commands/ingest-cmd.js';
@@ -134,6 +135,7 @@ program
     .command('ask <question>')
     .description('Ask a question about your knowledge base — search, compose answer, optionally save')
     .option('-s, --save', 'Save answer as a new note in your vault')
+    .option('-q, --quotes', 'Show direct quotes from sources (Insight Extraction mode)')
     .action((question, opts) => askCommand(question, opts));
 program
     .command('compile')
@@ -144,9 +146,10 @@ program
     .action((opts) => compileCommand(opts));
 program
     .command('draft [topic]')
-    .description('Express: Generate a blog post, report, or outline draft from your knowledge')
-    .option('--format <type>', 'Output format: blog, report, outline (default: blog)')
+    .description('Express: Generate draft from knowledge (blog/report/outline/instagram/thread/script)')
+    .option('--format <type>', 'Output format: blog, report, outline, instagram, thread, script')
     .option('--ai', 'Use Claude API for AI-enhanced draft (requires ANTHROPIC_API_KEY)')
+    .option('--blueprint <spec>', 'Chapter structure: "Ch1:tag1,tag2; Ch2:tag3"')
     .action((topic, opts) => draftCommand(topic, opts));
 program
     .command('session-save')
@@ -160,6 +163,14 @@ program
     .command('flush')
     .description('Flush daily logs → wiki: extract concepts, rebuild connections (Karpathy compile)')
     .action(() => flushCommand());
+program
+    .command('adr <title>')
+    .description('Create an Architecture Decision Record (structured decision log)')
+    .option('--context <text>', 'Why is this decision needed?')
+    .option('--options <text>', 'What alternatives were considered?')
+    .option('--decision <text>', 'What was decided and why?')
+    .option('--consequences <text>', 'What are the implications?')
+    .action((title, opts) => adrCommand(title, opts));
 program
     .command('lint')
     .description('Knowledge health check — find gaps, duplicates, contradictions, stale notes')

package/packages/core/dist/intelligence/ask-engine.d.ts

@@ -19,5 +19,6 @@ export declare function askVault(searchEngine: SearchEngine, question: string, o
     save?: boolean;
     vaultPath?: string;
     outputDir?: string;
+    mode?: 'default' | 'quotes';
 }): Promise<AskResult>;
 //# sourceMappingURL=ask-engine.d.ts.map

package/packages/core/dist/intelligence/ask-engine.js

@@ -7,7 +7,7 @@ import { join, resolve } from 'node:path';
  * LLM 없이 검색 결과를 구조화하는 버전 (LLM 연동은 MCP ask tool에서 처리).
  */
 export async function askVault(searchEngine, question, options = {}) {
-    const { limit = 10, save = false, vaultPath, outputDir = '_stellavault/answers' } = options;
+    const { limit = 10, save = false, vaultPath, outputDir = '_stellavault/answers', mode = 'default' } = options;
     // 1. 검색
     const results = await searchEngine.search({ query: question, limit });
     // 2. 소스 정리
@@ -18,7 +18,9 @@ export async function askVault(searchEngine, question, options = {}) {
         snippet: r.chunk?.content?.substring(0, 200) ?? '',
     }));
     // 3. 답변 구성 (검색 결과 기반 구조화)
-    const answer = composeAnswer(question, results);
+    const answer = mode === 'quotes'
+        ? composeQuotes(question, results)
+        : composeAnswer(question, results);
     // 4. vault에 저장 (선택)
     let savedTo = null;
     if (save && vaultPath) {
@@ -66,6 +68,38 @@ function composeAnswer(question, results) {
     lines.push(`- Find knowledge gaps: \`stellavault gaps\``);
     return lines.join('\n');
 }
+/**
+ * Quotes 모드: 원문 인용을 카드 형태로 나열.
+ */
+function composeQuotes(question, results) {
+    if (results.length === 0) {
+        return `No quotes found for "${question}".`;
+    }
+    const lines = [];
+    lines.push(`## Quotes: "${question}"\n`);
+    lines.push(`*${results.length} sources found. Each quote is a direct excerpt.*\n`);
+    for (let i = 0; i < Math.min(8, results.length); i++) {
+        const r = results[i];
+        const quote = r.chunk?.content
+            ?.replace(/^---[\s\S]*?---\n?/, '')
+            ?.replace(/^#+\s+.+\n/m, '')
+            ?.trim()
+            ?.substring(0, 300) ?? '';
+        if (!quote)
+            continue;
+        const score = Math.round(r.score * 100);
+        lines.push(`---`);
+        lines.push(`**[${i + 1}] ${r.document.title}** (${score}% match)`);
+        lines.push(`> ${quote.replace(/\n/g, '\n> ')}`);
+        if (r.document.tags.length > 0) {
+            lines.push(`Tags: ${r.document.tags.slice(0, 5).map(t => `#${t}`).join(' ')}`);
+        }
+        lines.push('');
+    }
+    lines.push('---');
+    lines.push(`*Use \`stellavault ask "${question}" --save\` to save these quotes as a note.*`);
+    return lines.join('\n');
+}
 /**
  * 답변을 vault에 .md 파일로 저장.
  * "_stellavault/answers/YYYY-MM-DD-question.md" 형식.

package/packages/core/dist/intelligence/auto-linker.js

@@ -95,10 +95,14 @@ export function insertWikilinks(body, vaultTitles, selfTitle) {
     // 긴 구문부터 매칭 (짧은 구문이 긴 구문의 부분 매칭되는 것 방지)
     const sortedPhrases = [...phraseToTitle.keys()].sort((a, b) => b.length - a.length);
     const linkedPhrases = new Set(); // 이미 링크된 구문 (중복 방지)
+    const contentLower = content.toLowerCase();
     for (const phrase of sortedPhrases) {
         const targetTitle = phraseToTitle.get(phrase);
         if (linkedPhrases.has(targetTitle))
-            continue; // 같은 노트에 여러 구문 매칭 방지
+            continue;
+        // 사전 필터: 본문에 포함되지 않으면 regex 생성 스킵 (성능 최적화)
+        if (!contentLower.includes(phrase.toLowerCase()))
+            continue;
         const escaped = phrase.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         const regex = new RegExp(`(?<!\\[\\[)(?<!#\\s)\\b(${escaped})\\b(?!\\]\\])(?![^\\[]*\\]\\])`, 'gi');
         let replaced = false;

package/packages/core/dist/intelligence/draft-generator.d.ts

@@ -1,8 +1,14 @@
 import { type FolderNames } from '../config.js';
+export interface BlueprintSection {
+    title: string;
+    tags?: string[];
+    description?: string;
+}
 export interface DraftOptions {
     topic?: string;
     format?: 'blog' | 'report' | 'outline' | 'instagram' | 'thread' | 'script';
     maxSections?: number;
+    blueprint?: BlueprintSection[];
 }
 export interface DraftResult {
     title: string;

package/packages/core/dist/intelligence/draft-generator.js

@@ -10,7 +10,7 @@ import { DEFAULT_FOLDERS } from '../config.js';
  * Express 단계: 지식이 vault에서 나가는 출구.
  */
 export function generateDraft(vaultPath, options = {}, folders = DEFAULT_FOLDERS) {
-    const { topic, format = 'blog', maxSections = 8 } = options;
+    const { topic, format = 'blog', maxSections = 8, blueprint } = options;
     // raw + wiki 문서 스캔
     const rawDir = resolve(vaultPath, folders.fleeting);
     const wikiDir = resolve(vaultPath, folders.wiki);
@@ -43,27 +43,54 @@ export function generateDraft(vaultPath, options = {}, folders = DEFAULT_FOLDERS
         ? `Draft: ${topic}`
         : `Knowledge Draft — ${new Date().toISOString().split('T')[0]}`;
     let body;
-    switch (format) {
-        case 'outline':
-            body = generateOutline(draftTitle, topConcepts, filteredDocs);
-            break;
-        case 'report':
-            body = generateReport(draftTitle, topConcepts, filteredDocs);
-            break;
-        case 'instagram':
-            body = generateInstagram(draftTitle, topConcepts, filteredDocs);
-            break;
-        case 'thread':
-            body = generateThread(draftTitle, topConcepts, filteredDocs);
-            break;
-        case 'script':
-            body = generateScript(draftTitle, topConcepts, filteredDocs);
-            break;
-        case 'blog':
-        default:
-            body = generateBlog(draftTitle, topConcepts, filteredDocs);
-            break;
+    // Blueprint 모드: 사용자 정의 챕터 구성
+    if (blueprint && blueprint.length > 0) {
+        const bpLines = [`# ${draftTitle}\n`];
+        bpLines.push(`> Blueprint draft from ${filteredDocs.length} sources\n`);
+        for (const section of blueprint) {
+            bpLines.push(`## ${section.title}\n`);
+            if (section.description)
+                bpLines.push(`*${section.description}*\n`);
+            // 태그 필터로 관련 문서 찾기
+            const sectionDocs = section.tags
+                ? filteredDocs.filter(d => d.tags.some(t => section.tags.includes(t)) || d.title.toLowerCase().includes(section.title.toLowerCase()))
+                : filteredDocs;
+            const usedDocs = sectionDocs.slice(0, 5);
+            for (const doc of usedDocs) {
+                const excerpt = extractExcerpt(doc.content, 200);
+                if (excerpt)
+                    bpLines.push(`> ${excerpt}\n> — *${doc.title}*\n`);
+            }
+            if (usedDocs.length > 0) {
+                bpLines.push(`*Sources: ${usedDocs.map(d => d.title).join(', ')}*\n`);
+            }
+        }
+        bpLines.push(`---\n*Generated by \`stellavault draft --blueprint\` at ${new Date().toISOString()}*`);
+        body = bpLines.join('\n');
     }
+    else {
+        switch (format) {
+            case 'outline':
+                body = generateOutline(draftTitle, topConcepts, filteredDocs);
+                break;
+            case 'report':
+                body = generateReport(draftTitle, topConcepts, filteredDocs);
+                break;
+            case 'instagram':
+                body = generateInstagram(draftTitle, topConcepts, filteredDocs);
+                break;
+            case 'thread':
+                body = generateThread(draftTitle, topConcepts, filteredDocs);
+                break;
+            case 'script':
+                body = generateScript(draftTitle, topConcepts, filteredDocs);
+                break;
+            case 'blog':
+            default:
+                body = generateBlog(draftTitle, topConcepts, filteredDocs);
+                break;
+        }
+    } // end else (non-blueprint)
     const wordCount = body.split(/\s+/).filter(Boolean).length;
     // _drafts/ 폴더에 저장
     const draftsDir = resolve(vaultPath, '_drafts');

package/packages/core/dist/intelligence/file-extractors.d.ts

@@ -9,10 +9,5 @@ export interface ExtractedContent {
     sourceFormat: 'pdf' | 'docx' | 'pptx' | 'xlsx' | 'xls' | 'text';
 }
 export declare function isBinaryFormat(filePath: string): boolean;
-/**
- * 파일 경로에서 텍스트 추출. 확장자 기반 파서 디스패치.
- * 지원: .pdf, .docx, .pptx, .xlsx, .xls
- * 미지원 확장자: utf-8 텍스트로 읽기
- */
 export declare function extractFileContent(filePath: string): Promise<ExtractedContent>;
 //# sourceMappingURL=file-extractors.d.ts.map

package/packages/core/dist/intelligence/file-extractors.js

@@ -1,6 +1,6 @@
 // Design Ref: §file-ingest-v2 — Binary file text extraction dispatchers
 // Plan SC: SC1-SC5 (format-specific extraction + fallback)
-import { readFileSync } from 'node:fs';
+import { readFileSync, statSync } from 'node:fs';
 import { extname, basename } from 'node:path';
 const BINARY_EXTS = new Set(['.pdf', '.docx', '.pptx', '.xlsx', '.xls']);
 export function isBinaryFormat(filePath) {
@@ -11,8 +11,13 @@ export function isBinaryFormat(filePath) {
  * 지원: .pdf, .docx, .pptx, .xlsx, .xls
  * 미지원 확장자: utf-8 텍스트로 읽기
  */
+const MAX_FILE_SIZE = 50 * 1024 * 1024; // 50MB
 export async function extractFileContent(filePath) {
     const ext = extname(filePath).toLowerCase();
+    const { size } = statSync(filePath);
+    if (size > MAX_FILE_SIZE) {
+        throw new Error(`File too large (${Math.round(size / 1024 / 1024)}MB > 50MB limit)`);
+    }
     const buffer = readFileSync(filePath);
     switch (ext) {
         case '.pdf': return extractPdf(buffer, filePath);
@@ -86,12 +91,35 @@ async function extractXlsx(buffer, filePath) {
     try {
         const XLSX = await import('xlsx');
         const workbook = XLSX.read(buffer);
-        const text = workbook.SheetNames
-            .map((name) => {
-            const csv = XLSX.utils.sheet_to_csv(workbook.Sheets[name]);
-            return `## ${name}\n\n${csv}`;
-        })
-            .join('\n\n');
+        const parts = [];
+        for (const name of workbook.SheetNames) {
+            const sheet = workbook.Sheets[name];
+            // 마크다운 테이블 형식 (헤더-값 구조 보존)
+            const rows = XLSX.utils.sheet_to_json(sheet, { header: 1 });
+            if (rows.length === 0)
+                continue;
+            parts.push(`## ${name}\n`);
+            const headers = rows[0].map((h) => String(h ?? ''));
+            parts.push(`| ${headers.join(' | ')} |`);
+            parts.push(`| ${headers.map(() => '---').join(' | ')} |`);
+            for (const row of rows.slice(1)) {
+                const cells = headers.map((_, i) => String(row[i] ?? ''));
+                parts.push(`| ${cells.join(' | ')} |`);
+            }
+            parts.push('');
+            // JSON 구조도 포함 (AI 검색/ask에서 수치 활용 가능)
+            if (rows.length <= 100) {
+                const jsonRows = XLSX.utils.sheet_to_json(sheet);
+                if (jsonRows.length > 0) {
+                    parts.push(`<details><summary>Structured Data (${jsonRows.length} rows)</summary>\n`);
+                    parts.push('```json');
+                    parts.push(JSON.stringify(jsonRows.slice(0, 50), null, 2));
+                    parts.push('```');
+                    parts.push('</details>\n');
+                }
+            }
+        }
+        const text = parts.join('\n');
         return {
             text,
             metadata: {

package/packages/core/dist/intelligence/ingest-pipeline.js

@@ -65,7 +65,9 @@ export function ingest(vaultPath, input, folders = DEFAULT_FOLDERS) {
             }]);
         indexCode = assignments.get(filePath);
     }
-    catch { /* index code is optional */ }
+    catch (err) {
+        console.warn('[ingest] Index code skipped:', err instanceof Error ? err.message : err);
+    }
     // Stellavault 표준 포맷으로 저장
     let md = buildStandardNote({
         title,
@@ -81,7 +83,9 @@ export function ingest(vaultPath, input, folders = DEFAULT_FOLDERS) {
     try {
         md = autoLink(md, vaultPath, title, folders);
     }
-    catch { /* autoLink 실패해도 저장은 진행 */ }
+    catch (err) {
+        console.warn('[ingest] Auto-link skipped:', err instanceof Error ? err.message : err);
+    }
     writeFileSync(fullPath, md, 'utf-8');
     // 자동 compile: fleeting → wiki (rule-based, <100ms)
     try {
@@ -91,7 +95,9 @@ export function ingest(vaultPath, input, folders = DEFAULT_FOLDERS) {
             compileWiki(rawDir, wikiDir);
         }
     }
-    catch { /* compile 실패해도 ingest 성공 */ }
+    catch (err) {
+        console.warn('[ingest] Auto-compile skipped:', err instanceof Error ? err.message : err);
+    }
     return {
         savedTo: filePath,
         stage: autoStage,
@@ -221,10 +227,10 @@ function buildStandardNote(params) {
         '---',
         `title: "${sanitizeYaml(params.title)}"`,
         `type: ${params.stage}`,
-        `source: ${params.source}`,
+        `source: "${sanitizeYaml(params.source)}"`,
         `input_type: ${params.inputType}`,
         params.indexCode ? `zettel_id: "${params.indexCode}"` : null,
-        `tags: [${params.tags.map(t => `"${t}"`).join(', ')}]`,
+        `tags: [${params.tags.map(t => `"${sanitizeYaml(t)}"`).join(', ')}]`,
         `created: ${params.created}`,
         `summary: "${sanitizeYaml(params.body.slice(0, 100))}"`,
         '---',