v1.3.1

Windows login fix

nworks login --user was broken on Windows — the browser only got the first query param of the authorize URL, so login never went through. macOS and Linux were fine, and the MCP nworks_login_user tool was never affected since it just hands back the URL.

The URL is now quoted when it goes to cmd /c start. Unquoted, cmd.exe re-parses the whole command line and reads the & between query params as a command separator, so the browser got everything up to the first & and the rest spilled into the shell as 'scope' is not recognized as an internal or external command.

v1.3.0

Contacts, Shared Drive & Mail Attachments

This release adds contact, shared drive, and mail attachment APIs across CLI and MCP (26 → 36 tools). No breaking changes — but contact tools need nworks login --user again to pick up the new contact scope.

✨ New APIs

• Contacts: nworks contact list/get/create/update/delete/list-tags and nworks_contact_* on MCP
• Shared drive: nworks drive sharedrive-list/sharedrive-files/sharedrive-download and nworks_sharedrive_*
• Mail attachments: nworks mail download-attachment --id --attachment-id, inline responses capped at 5MB (nworks_mail_download_attachment)
• Directory pagination: nworks_directory_members returns nextCursor for large orgs

🔑 OAuth Scopes

• Scope presets: nworks login --user --preset readonly | default | all, shared by CLI and MCP (src/auth/scopes.ts)
• Dependency resolution: write scopes auto-add the reads they require (calendar → calendar.read, task → task.read user.read)
• Contact scope: contact / contact.read added to presets — existing logins return 403 on contact tools until re-authenticated

🐛 Fixes

• Drive download: broken since 1.2.2 for personal and shared alike — the SSRF host whitelist rejected the storage redirect target, and the redirected request dropped its Authorization header
• Subcommand options: --profile and --json are honored again, duplicate root-level options were shadowing them
• MCP server version: reports the installed version instead of a hardcoded 1.0.0 (src/version.ts)

🔒 Security

• Config permissions: config dir enforced at 0700, credential files at 0600
• Atomic writes: credentials written to a temp file and renamed, so an interrupted write cannot truncate them
• Profile name validation: restricted to [\w.-]+, rejecting __proto__, constructor, prototype, ., and ..
• OAuth callback hardening: tightened callback server handling (src/auth/oauth-user.ts)
• Doctor masking: additional fields masked in nworks doctor diagnostics
• Masked secret input: secrets hidden in the interactive nworks login prompt

⚡ Reliability

• Shared User OAuth client: retry with backoff, transparent token refresh, and Retry-After handling (src/api/user-client.ts)
• Rate limiting: per-host semaphore caps concurrency at 5 to stay inside LINE WORKS limits
• Tool annotations: readOnlyHint / destructiveHint on every MCP tool, so clients gate create/update/delete behind approval
• MCP SDK: @modelcontextprotocol/sdk 1.12.1 → 1.29.0

🚀 Distribution

• MCPB bundle: one-click Claude Desktop install, attached to each release (manifest.json)
• MCP registry: published as io.github.yjcho9317/nworks (server.json)
• CI matrix: ubuntu + windows across Node 18/20/22
• Automated release: tag push runs version check, lint, test, build, then npm publish --provenance
• Docs: added ONBOARDING.md and SECURITY.md, documented scope presets in the EN/KO/JA READMEs, unified CLI output to English

📦 Scope

• 58 files changed, 3,706 additions, 3,875 deletions
• 36 MCP tools, up from 26
• All tests pass (54/54), up from 31

v1.2.2

Security Hardening

This release strengthens security across MCP server and auth layers. No breaking changes — all protections work transparently.

🛡️ Input Validation

• Path traversal prevention: API path segments validated and encoded (sanitizePathSegment)
• MCP file traversal protection: Local file upload/download paths validated against directory escape (validateLocalPath)
• Filename sanitization: CRLF injection and path components stripped from filenames (sanitizeFileName)

🔒 Auth Hardening

• OAuth state: Replaced Math.random() with crypto.randomBytes(32) for CSRF protection
• OAuth state verification: Callback server validates state parameter matches
• Private key file permissions: Warning when key file permissions are too open (recommended: 600)
• Token revocation: nworks logout now revokes tokens server-side before clearing local credentials

🔐 SSRF & Info Disclosure

• SSRF protection: Redirect URLs validated against allowed host whitelist (HTTPS only)
• MCP response masking: clientId, serviceAccount, privateKeyPath masked in MCP tool responses (nworks_whoami, nworks_doctor, nworks_setup)
• Error stack hiding: Stack traces no longer exposed in MCP error responses

📦 Scope

• 20 files changed, 437 additions, 90 deletions
• 21 new tests for sanitize utilities
• All existing tests pass (31/31)

v1.2.1

What's Changed

Security: Remove sensitive params from nworks_setup MCP tool

• clientSecret and privateKeyPath are no longer accepted as tool parameters
• These values must be set via MCP config env field or system environment variables
• Prevents sensitive credentials from being exposed in AI conversation logs

Improved AI agent guidance

• Structured step-by-step setup instructions in tool description
• Clear error messages with config examples when env vars are missing
• Better error recovery flow (re-login → re-setup)

Fix: Windows browser not opening on nworks login --user

• Fixed start command treating URL as window title instead of opening browser
• Mac/Linux unaffected

Misc

• Add zod to dependencies for Glama build compatibility
• Version bump to 1.2.1

v1.1.0

MCP tool improvements: scope auto-expand, nworks_doctor, nworks_login_user, Korean error messages, hasMore pagination, 5MB download limit. Added zod dependency for build compatibility.

v1.0.0

First stable release. 26 MCP tools for NAVER WORKS.