karst 0.2.0 → 0.4.0

data/lib/rails/commands/karst/verify/verify_command.rb

@@ -12,17 +12,29 @@ module Rails
         include Karst::Boot
 
         class_option :json, type: :boolean, default: false, desc: "Emit stable JSON evidence"
+        class_option :anonymous, type: :boolean, default: false,
+                                 desc: "Probe with no principal established, and verify the " \
+                                       "application observed none"
+        class_option :as, type: :string,
+                          desc: "Run as one specific existing principal instead of sampling one, " \
+                                "e.g. --as User:72. Resolved only through Karst's own configured " \
+                                "principal source(s); cannot be combined with --anonymous"
 
         desc "Verify bounded GET access to a local application path"
+        # rubocop:disable Metrics/AbcSize
         def perform(*arguments)
           method, path = parse(arguments)
           boot_karst_application!
-          exit(::Karst::CLI::Verification.new(path: path, http_method: method, json: options[:json]).call)
+          exit(::Karst::CLI::Verification.new(path: path, http_method: method, json: options[:json],
+                                              identity: (:anonymous if options[:anonymous]),
+                                              as: options[:as]).call)
         rescue ArgumentError => e
-          document = { schema_version: 1, error: { type: "input_error", message: e.message } }
+          document = { schema_version: ::Karst::CLI::Verification::SCHEMA_VERSION,
+                       error: { type: "input_error", message: e.message } }
           puts(options[:json] ? JSON.generate(document) : "Karst cannot verify this route:\n#{e.message}")
           exit(2)
         end
+        # rubocop:enable Metrics/AbcSize
 
         private
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: karst
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Karst contributors
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-13 00:00:00.000000000 Z
+date: 2026-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -34,16 +34,22 @@ dependencies:
   name: mcp
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 0.9.0
+        version: '1.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 0.9.0
+        version: '1.7'
 description: Karst tests Rails routes as a bounded set of existing users and reports
   runtime access evidence.
 email: 
@@ -60,6 +66,7 @@ files:
 - SECURITY.md
 - docs/advanced-configuration.md
 - docs/rails8-authentication.md
+- docs/request-reproduction.md
 - lib/generators/karst/install/install_generator.rb
 - lib/generators/karst/install/templates/karst_identity_controller.rb
 - lib/generators/karst/install/templates/karst_initializer.rb
@@ -67,6 +74,11 @@ files:
 - lib/karst/access/approved_populations.rb
 - lib/karst/access/candidate_population.rb
 - lib/karst/access/database_isolation.rb
+- lib/karst/access/errors.rb
+- lib/karst/access/identity_probe.rb
+- lib/karst/access/local_path.rb
+- lib/karst/access/observed_endpoint.rb
+- lib/karst/access/outcome_groups.rb
 - lib/karst/access/population_approval.rb
 - lib/karst/access/population_approvals.rb
 - lib/karst/access/population_discovery.rb
@@ -75,20 +87,34 @@ files:
 - lib/karst/access/principal_selection.rb
 - lib/karst/access/principal_source.rb
 - lib/karst/access/principal_source_selection.rb
+- lib/karst/access/probe.rb
 - lib/karst/access/probe_application.rb
 - lib/karst/access/search.rb
 - lib/karst/access/selected_principal_sources.rb
 - lib/karst/access/sensitive_attribute_names.rb
 - lib/karst/access/sweep.rb
+- lib/karst/cli/identity_serialization.rb
+- lib/karst/cli/outcome_summary.rb
+- lib/karst/cli/principal_reference.rb
+- lib/karst/cli/reproduction.rb
 - lib/karst/cli/verification.rb
 - lib/karst/configuration.rb
 - lib/karst/execution_context.rb
 - lib/karst/identity.rb
 - lib/karst/identity/devise_support.rb
+- lib/karst/identity/evidence.rb
+- lib/karst/identity/observation.rb
 - lib/karst/identity/warden_adapter.rb
+- lib/karst/mcp/compatibility.rb
+- lib/karst/mcp/reproduce_request_tool.rb
+- lib/karst/mcp/reproduction.rb
 - lib/karst/mcp/server.rb
 - lib/karst/mcp/verify_access_tool.rb
 - lib/karst/railtie.rb
+- lib/karst/reproduction/curl.rb
+- lib/karst/reproduction/exercise.rb
+- lib/karst/reproduction/observation.rb
+- lib/karst/reproduction/sanitizer.rb
 - lib/karst/value.rb
 - lib/karst/version.rb
 - lib/karst/web/badge.rb
@@ -101,6 +127,7 @@ files:
 - lib/karst/web/route_lookup.rb
 - lib/rails/commands/karst/boot.rb
 - lib/rails/commands/karst/mcp/mcp_command.rb
+- lib/rails/commands/karst/reproduce/reproduce_command.rb
 - lib/rails/commands/karst/verify/verify_command.rb
 homepage: https://github.com/SilenceDogood1984/karst
 licenses: