This release includes 3 security fixes for security teams reviewing exposed deployments.
Topics
+14 more
Affected surfaces
Summary
AI summarySection Screenshot Fallback Multi‑Tile Capture adds dynamic multi‑tile image generation for oversized sections.
Full changelog
v0.1.7 — God Function Refactor, Security Hardening & Multi-Tile Capture
大規模リファクタリング、セキュリティ強化、および Section Screenshot Fallback Multi-Tile Capture を含むリリース。
A major release including large-scale refactoring, security hardening, and Section Screenshot Fallback Multi-Tile Capture.
Refactored / リファクタリング
- God Function分割:
page-analyze-workerを7フェーズモジュール(phase-0〜phase-5 + common)に分割。analyze.tool→sync-processing抽出、evaluate.tool→evaluate-engine抽出 / God Function splits: page-analyze-worker → 7 phase modules. analyze.tool → sync-processing, evaluate.tool → evaluate-engine - スキーマ分割: motion/schemas → 3ファイル、page/schemas → 3ファイル(re-export hub方式で後方互換性維持) / Schema splits: motion/schemas → 3 files, page/schemas → 3 files (re-export hub for backward compatibility)
- llama-vision.adapter分割: LLMプロンプトと型定義を分離 / llama-vision.adapter split: separated LLM prompts and type definitions
- Dead code 13件削除、narrative-search重複統合、ESLint warning 27件修正 / Removed 13 dead code items, consolidated narrative-search duplicates, fixed 27 ESLint warnings
Security / セキュリティ
- SSRF・XSSサニタイズ・DOMPurifyバイパス修正: 複数のセキュリティ脆弱性を解消 / SSRF, XSS sanitization, and DOMPurify bypass fixes: resolved multiple security vulnerabilities
- isDevelopment()ガード違反25箇所修正: catchブロック内でのエラーサイレント吸収を防止。全環境で
logger.warn/logger.errorを出力するよう統一 / Fixed 25 isDevelopment() guard violations: prevented silent error absorption in catch blocks - 脆弱性解消: undici 7.18.2→7.24.3 (High×6件)、flatted >=3.4.0 (High×1件) / Vulnerability fixes: undici 7.18.2→7.24.3 (6 High), flatted >=3.4.0 (1 High)
Added / 追加
- Section Screenshot Fallback Multi-Tile Capture (v0.1.10): section.height > viewportHeight の場合、セクションを動的に複数タイルに分割してキャプチャし、Sharp composite で垂直結合して完全なセクション画像を生成 / Multi-tile capture: dynamically splits sections exceeding viewport height into tiles, captures each via Playwright, composites with Sharp
- デフォルト上限20タイル(
MAX_TILES_PER_SECTIONで調整可能、絶対上限100) / Default cap 20 tiles (configurable viaMAX_TILES_PER_SECTION, absolute limit 100) - Viewport統一: 1920x1080 / Viewport unification: 1920x1080
- scrollY実測値による clipY計算(sticky header対策) / scrollY measurement for clipY calculation (sticky header compensation)
- 診断ログ: per-section path追跡(in_range/fallback/dynamic/dedup/skipped) / Diagnostic logging: per-section path tracking
- デフォルト上限20タイル(
- Section Merge Post-Processor (v0.1.7-v0.1.8): Phase 1内ポストプロセッサ / Post-processor within Phase 1 (Layout Analysis)
- Rule 1: 同一タイプ3+連続セクションマージ(11 MERGEABLE_TYPES) / Rule 1: merge 3+ consecutive same-type sections
- Rule 2: コンテンツ空unknownセクション吸収 / Rule 2: absorb content-empty unknown sections
- Rule 3: 同名隣接マージ / Rule 3: same-heading adjacent merge
- Section Split Post-Processor Rule 4 (v0.1.9): height > 10,000px の巨大セクション再分割(3戦略: HTML子要素→等分割→分割不可) / Rule 4: oversized section re-splitting (3 strategies)
- Blank Image Detection + Dynamic Fallback (v0.1.9):
isBlankImage()で白画像検出→動的Fallback再取得→DINOv2 visual embedding生成 / Blank image detection with dynamic fallback re-capture - Lazy Loading Scroll (v0.1.9): Phase 0でfullPage screenshot前にページ全体スクロールしLazy Loading発火 / Scrolls entire page before screenshot to trigger lazy loading
- Type-aware dedupヘルパー関数抽出:
shouldSkipDuplicateVision()共通ヘルパー+テスト7件 / ExtractedshouldSkipDuplicateVision()helper with 7 tests
Fixed / 修正
- onnxruntime-node ABIミスマッチ解消: バージョン固定でNode.js ABIクラッシュを修正 / Pin onnxruntime-node to fix ABI mismatch crash
- isBlankImage()ダークテーマ誤検出修正: stddev + mean 2条件判定に変更(ダークテーマの誤検出防止) / Fix dark theme false positive with dual-condition check
- Dynamic Fallbackバグ修正3件: isBlank論理反転、screenshotBuffer解放、Rule 3 excludeIds適用 / 3 Dynamic Fallback fixes
- Phase 2.5 Progress範囲逆行修正: 35-45% → 60-63% に修正 / Phase 2.5 progress range regression fix
- resolveMemoryConfig遅延初期化: 起動時の不要なメモリ設定計算を排除 / Lazy initialization for resolveMemoryConfig
- Pre-Return Pauseレースコンディション解消 / Fix Pre-Return Pause race condition
- Worker path postProcessSections統合: saveSectionPatterns前にRule 1-4実行 / postProcessSections integration in Worker path
Tests / テスト
- デッドテスト11件削除(4,367行削減)、セキュリティテスト3件追加 / Removed 11 dead tests (4,367 lines), added 3 security tests
- テストカバレッジ拡充(Worker系、スコアリング、グラデーション検出) / Test coverage expansion (Worker, scoring, gradient detection)
CI/CD
- E2Eテストジョブ追加: PostgreSQL+pgvector+Playwright+Redis統合テスト環境 / E2E test job with full integrated environment
format:check有効化、.git-blame-ignore-revs作成 / Enabledformat:check, created.git-blame-ignore-revs
Code Style / コードスタイル
- コードベース全体(1,261ファイル)にPrettier整形適用 / Applied Prettier formatting across entire codebase (1,261 files)
Changed / 変更
- エージェント設計をv3.0に刷新(問題領域ベース、15エージェント体制) / Agent architecture redesigned to v3.0 (problem-domain-based, 15 agents)
- Fallback viewport: 1280x800 → 1920x1080 統一 / Viewport unification to 1920x1080
Full Changelog: https://github.com/TKMD/ReftrixMCP/compare/v0.1.6...v0.1.7
Breaking Changes
- page-analyze-worker split into 7 phase modules (phase-0 … phase-5 + common)
- motion/schemas and page/schemas each split into 3 files with re‑export hub for backward compatibility
- llama-vision.adapter split: LLM prompts separated from type definitions
Security Fixes
- Fixed SSRF, XSS sanitization bypasses and DOMPurify issues resolving multiple security vulnerabilities
- Upgraded undici from 7.18.2 to 7.24.3 (6 High severity CVEs fixed)
- Updated flatted to >=3.4.0 (1 High severity CVE fixed)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About TKMD/ReftrixMCP
Web design analysis MCP server with 26 tools for layout extraction, motion detection, quality scoring, and semantic search. Uses Playwright, pgvector HNSW, and Ollama Vision to turn web pages into searchable, structured design knowledge.
Related context
Beta — feedback welcome: [email protected]