[P2] reference_doc type validation is bypassed by defaults_file #60

Links

• Epic: Tracking: gaps surfaced by an agent-driven document workflow (from #40) #44
• Introduced alongside: feat: widen reference_doc support to odt and pptx (#52) #59, which added the guard this bypasses
• Code: src/mcp_pandoc/server.py → handle_call_tool, the reference_doc validation block

Problem

#59 added a guard rejecting a reference_doc whose type does not match output_format, because pandoc does not check this and fails silently when it is wrong.

The guard only inspects the reference_doc parameter. Pandoc's --reference-doc can also be set inside a defaults file, via the reference-doc: key, and that path is passed through to pandoc unvalidated.

# my-defaults.yaml
reference-doc: /templates/house.docx

convert-contents(output_format="odt", defaults_file="my-defaults.yaml")
        │
        ▼
  reference_doc parameter is None  ──►  guard never runs  ✅ skipped
        │
        ▼
  extra_args = ["--defaults", "my-defaults.yaml"]
        │
        ▼
  pandoc applies reference-doc from the YAML, exit 0, silent
        │
        ▼
  "Content successfully converted and saved to: out.odt"   ← file is broken

Behaviour being bypassed

Verified on pandoc 3.7.0.2. All combinations exit 0 with nothing on stdout or stderr.

Scope

Pre-existing, not a regression from #59. The parameter path is now guarded; this one is not.

Lower severity than the parameter path: a defaults file is a deliberate artifact a user authors once, rather than something a model fills in per call. But the failure mode is identical, and the tool still reports success.

Acceptance criteria

• reference-doc inside a defaults_file is validated with the same rule as the reference_doc parameter
• Decide precedence when both are supplied, and document it
• Same actionable error message, so a model can self-correct either way
• Test covering the defaults-file path

Out of scope

Whether to validate other pandoc options reachable through defaults_file. Worth a separate look at what else the defaults path can smuggle past validation.