@everystack/mcp 0.4.4 → 0.4.6

package/dist/index.cjs

@@ -21685,7 +21685,7 @@ var RESOURCES = [
   {
     uri: "everystack://logging",
     name: "Logging & Analytics",
-    description: "Structured logging: log levels, crash reports, analytics events, S3 log storage, CloudWatch ingestion trigger, client SDK, admin dashboard integration.",
+    description: "Structured logging: log levels, crash reports, analytics events, S3 log storage, CloudWatch ingestion trigger, client SDK, admin dashboard integration. Includes how to debug a 500 from its requestId, since error responses never carry the error text.",
     filename: "logging.md"
   },
   {
@@ -23521,11 +23521,37 @@ var secretInPublicEnv = {
   }
 };
 
+// src/gates/detectors/stage-name-as-trust-boundary.ts
+var STAGE_COMPARISON = /\b(?:ENVIRONMENT|environment|stage)\s*[=!]==\s*['"](?:dev|development|prod|production|staging|local)['"]/;
+var SECURITY_CONTEXT = /\b(?:details|error|stack|message|throw|drop|reset|seed|truncate|delete|secret|token|password|credential|auth|admin|bypass|skip|allow|disable|unsafe|insecure)/i;
+var stageNameAsTrustBoundary = {
+  id: "stage-name-as-trust-boundary",
+  tier: "framework",
+  severity: "deny",
+  guide: "A stage name is not a trust boundary \u2014 ENVIRONMENT comes from $app.stage, so this asks what someone named the stage, not whether the caller is trusted. Gate on an explicit option that defaults to the safe answer, and never return error text to a caller: return the requestId instead.",
+  conform: "an explicit opt-in on the handler/plugin options (see config.allowDevelopment in @everystack/security apple-attest); for error responses, return { error, requestId } and debug with everystack logs:query --traceId <id>",
+  verify: "pnpm --filter @everystack/server test \u2014 __tests__/error-response.test.ts fails on any stage-name gate",
+  async detect(ctx) {
+    if (ctx.tool !== "Write" && ctx.tool !== "Edit") return null;
+    const text = ctx.content;
+    if (!text || !/ENVIRONMENT|environment|stage/.test(text)) return null;
+    const lines = text.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      if (!STAGE_COMPARISON.test(lines[i])) continue;
+      const window = lines.slice(i, i + 3).join(" ");
+      if (!SECURITY_CONTEXT.test(window)) continue;
+      return `line ${i + 1} gates behaviour on the stage name (${lines[i].trim().slice(0, 80)}) \u2014 ENVIRONMENT comes from $app.stage, so this is a deployment label, not a trust decision`;
+    }
+    return null;
+  }
+};
+
 // src/gates/registry.ts
 var FRAMEWORK_GATES = [
   handWrittenMigration,
   embeddedDataBundle,
-  secretInPublicEnv
+  secretInPublicEnv,
+  stageNameAsTrustBoundary
 ];
 function gatesFor(_cwd) {
   return FRAMEWORK_GATES;
@@ -23735,7 +23761,7 @@ async function runGovernanceCli(argv) {
 }
 
 // src/index.ts
-var version2 = (true ? "0.4.4" : null) ?? "0.3.0-dev";
+var version2 = (true ? "0.4.6" : null) ?? "0.3.0-dev";
 var INSTRUCTIONS = [
   "You govern how any agent builds everystack \u2014 a self-hosted application stack for Expo apps on AWS.",
   "Your job is not only to advise but to keep the build on-script: the architecture the maintainer",

package/dist/logging.md

@@ -76,6 +76,30 @@ everystack logs:query --stage dev --level error --source api
 everystack logs:tail --stage dev            # Raw CloudWatch output
 ```
 
+## Debugging a 500
+
+An error response carries the id that finds the error, never the error itself:
+
+```json
+{ "error": "Internal Server Error", "requestId": "kBQF3n8s…" }
+```
+
+Same id as the `x-request-id` header, and the handler logs the full error against it before
+responding. Resolve it with:
+
+```bash
+everystack logs:query --stage production --traceId kBQF3n8s…
+```
+
+It is the CloudFront edge request id, so it also joins to the CDN access logs
+(`x-edge-request-id`). Locally the same log line goes to stdout — no lookup needed.
+
+**Never add error text to a response to make debugging easier.** Relation and column names handed
+to an unauthenticated caller are schema disclosure. In particular do not gate it on
+`ENVIRONMENT === 'dev'`: `ENVIRONMENT` is set from `$app.stage`, so that gate asks what someone
+named their stage, not whether the caller is trusted. A test in `@everystack/server` fails the
+build if such a gate is reintroduced. The request id is the debugging path.
+
 ## Plugin
 
 ```typescript

package/dist/security.md

@@ -212,6 +212,20 @@ Effect: PATCH and DELETE auto-append `WHERE authorId = user.sub`. Returns 404 if
 
 Use both. rowOwnership catches IDOR at HTTP level with clear 404. RLS catches it at SQL level as a safety net.
 
+## Error responses never carry internals
+
+A `500` returns `{ "error": "Internal Server Error", "requestId": "…" }` and nothing else. A
+database error stringifies to `relation "games" does not exist` — schema disclosure to whoever
+made the request.
+
+**Never gate disclosure on the stage name.** `ENVIRONMENT` comes from `$app.stage`, so
+`ENVIRONMENT === 'dev'` asks what someone named their stage, not whether the caller is trusted.
+A publicly reachable stage named `dev` is a public stage. A test in `@everystack/server` fails the
+build if such a gate appears in `src/`.
+
+Debug from the id instead: `everystack logs:query --traceId <requestId>`. The full error is
+already logged against it.
+
 ## Testing Checklist
 
 Before deploying RLS:
@@ -247,6 +261,7 @@ RESET ROLE;
 - [ ] Write RLS policies per table x role
 - [ ] Connect as `authenticator` (never use RDS master/superuser in production)
 - [ ] Test: SET ROLE authenticated; SELECT returns only expected rows
+- [ ] Test: a 500 returns only `error` and `requestId` — no relation or column names
 
 ### Handler
 - [ ] `exposedTables` whitelist (404 for unlisted tables)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/mcp",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Governance layer that governs how any agent builds everystack — grounding, cheat gates, and Model-aware tooling over MCP",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -40,9 +40,9 @@
     "tsx": "4.21.0",
     "typescript": "5.9.3",
     "zod": "3.25.67",
-    "@everystack/model": "0.4.8",
-    "@everystack/cli": "0.4.43",
-    "@everystack/server": "0.4.15"
+    "@everystack/cli": "0.4.49",
+    "@everystack/model": "0.4.13",
+    "@everystack/server": "0.4.19"
   },
   "scripts": {
     "test": "jest",

package/src/gates/detectors/stage-name-as-trust-boundary.ts

@@ -0,0 +1,70 @@
+/**
+ * Cheat: a stage name used as a trust boundary.
+ *
+ * `ENVIRONMENT` is set from `$app.stage` by the SST helper, so `ENVIRONMENT === 'dev'` does not
+ * ask "is this caller trusted" — it asks "what did someone call this stage". The two questions
+ * look identical in a diff and diverge the moment a stage named `dev` is publicly reachable.
+ *
+ * This shipped in the framework and reached two consumers, neither of whom chose anything but a
+ * stage name: a 500 returned raw PostgreSQL text — relation and column names — to unauthenticated
+ * callers. It survived its first fix because the condition had been COPIED into a second file and
+ * only one was found, which is why this is a gate and not a note in a review checklist.
+ *
+ * The correct shape is next door in `@everystack/security`: apple-attest reads the environment
+ * from the attestation CERTIFICATE (a fact about the client, not a deployment label) and still
+ * requires an explicit `config.allowDevelopment` to relax. Derive the fact from something
+ * trustworthy, then require an opt-in that fails closed.
+ */
+
+import type { CheatGate, ToolCallContext } from '../types.js';
+
+/**
+ * A stage/environment label compared against a deployment name. Covers the spellings that have
+ * actually appeared: `process.env.ENVIRONMENT === 'dev'`, `ctx.environment !== 'dev'`, and the
+ * inverted `!== 'production'` form that reads as "anywhere but prod".
+ */
+const STAGE_COMPARISON =
+  /\b(?:ENVIRONMENT|environment|stage)\s*[=!]==\s*['"](?:dev|development|prod|production|staging|local)['"]/;
+
+/**
+ * Security-relevant company on the same line or nearby: what makes a stage comparison a GATE
+ * rather than a label choice. Picking which docs string to print by stage is fine; deciding what
+ * a caller may see, or whether a destructive verb runs, is not.
+ */
+// No trailing \b: these appear camelCased far more often than bare — `skipAuth`, `allowInsecure`,
+// `disableRls`, `adminOnly`. Requiring a word boundary on the right made the detector miss
+// `if (ENVIRONMENT !== 'production') { skipAuth = true }`, which is the exact shape it exists for.
+const SECURITY_CONTEXT =
+  /\b(?:details|error|stack|message|throw|drop|reset|seed|truncate|delete|secret|token|password|credential|auth|admin|bypass|skip|allow|disable|unsafe|insecure)/i;
+
+export const stageNameAsTrustBoundary: CheatGate = {
+  id: 'stage-name-as-trust-boundary',
+  tier: 'framework',
+  severity: 'deny',
+  guide:
+    'A stage name is not a trust boundary — ENVIRONMENT comes from $app.stage, so this asks what someone named the stage, not whether the caller is trusted. Gate on an explicit option that defaults to the safe answer, and never return error text to a caller: return the requestId instead.',
+  conform:
+    'an explicit opt-in on the handler/plugin options (see config.allowDevelopment in @everystack/security apple-attest); for error responses, return { error, requestId } and debug with everystack logs:query --traceId <id>',
+  verify:
+    'pnpm --filter @everystack/server test — __tests__/error-response.test.ts fails on any stage-name gate',
+
+  async detect(ctx: ToolCallContext): Promise<string | null> {
+    if (ctx.tool !== 'Write' && ctx.tool !== 'Edit') return null;
+    const text = ctx.content;
+    // Cheap pre-filter: only content naming a stage label pays for the line scan.
+    if (!text || !/ENVIRONMENT|environment|stage/.test(text)) return null;
+
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (!STAGE_COMPARISON.test(lines[i])) continue;
+
+      // The comparison alone is not the cheat — `channel = ENVIRONMENT` is legitimate. Look at the
+      // line and the two after it, which is where the guarded body sits.
+      const window = lines.slice(i, i + 3).join(' ');
+      if (!SECURITY_CONTEXT.test(window)) continue;
+
+      return `line ${i + 1} gates behaviour on the stage name (${lines[i].trim().slice(0, 80)}) — ENVIRONMENT comes from $app.stage, so this is a deployment label, not a trust decision`;
+    }
+    return null;
+  },
+};

package/src/gates/registry.ts

@@ -11,12 +11,14 @@ import type { CheatGate } from './types.js';
 import { handWrittenMigration } from './detectors/hand-written-migration.js';
 import { embeddedDataBundle } from './detectors/embedded-data-bundle.js';
 import { secretInPublicEnv } from './detectors/secret-in-public-env.js';
+import { stageNameAsTrustBoundary } from './detectors/stage-name-as-trust-boundary.js';
 
 /** Framework-tier gates, on by default. */
 export const FRAMEWORK_GATES: CheatGate[] = [
   handWrittenMigration,
   embeddedDataBundle,
   secretInPublicEnv,
+  stageNameAsTrustBoundary,
 ];
 
 /** The gates that apply to a working directory. Project-tier composition is added later. */

package/src/resources/index.ts

@@ -179,7 +179,7 @@ const RESOURCES: ResourceDef[] = [
     uri: 'everystack://logging',
     name: 'Logging & Analytics',
     description:
-      'Structured logging: log levels, crash reports, analytics events, S3 log storage, CloudWatch ingestion trigger, client SDK, admin dashboard integration.',
+      'Structured logging: log levels, crash reports, analytics events, S3 log storage, CloudWatch ingestion trigger, client SDK, admin dashboard integration. Includes how to debug a 500 from its requestId, since error responses never carry the error text.',
     filename: 'logging.md',
   },
   {

package/src/resources/logging.md

@@ -76,6 +76,30 @@ everystack logs:query --stage dev --level error --source api
 everystack logs:tail --stage dev            # Raw CloudWatch output
 ```
 
+## Debugging a 500
+
+An error response carries the id that finds the error, never the error itself:
+
+```json
+{ "error": "Internal Server Error", "requestId": "kBQF3n8s…" }
+```
+
+Same id as the `x-request-id` header, and the handler logs the full error against it before
+responding. Resolve it with:
+
+```bash
+everystack logs:query --stage production --traceId kBQF3n8s…
+```
+
+It is the CloudFront edge request id, so it also joins to the CDN access logs
+(`x-edge-request-id`). Locally the same log line goes to stdout — no lookup needed.
+
+**Never add error text to a response to make debugging easier.** Relation and column names handed
+to an unauthenticated caller are schema disclosure. In particular do not gate it on
+`ENVIRONMENT === 'dev'`: `ENVIRONMENT` is set from `$app.stage`, so that gate asks what someone
+named their stage, not whether the caller is trusted. A test in `@everystack/server` fails the
+build if such a gate is reintroduced. The request id is the debugging path.
+
 ## Plugin
 
 ```typescript

package/src/resources/security.md

@@ -212,6 +212,20 @@ Effect: PATCH and DELETE auto-append `WHERE authorId = user.sub`. Returns 404 if
 
 Use both. rowOwnership catches IDOR at HTTP level with clear 404. RLS catches it at SQL level as a safety net.
 
+## Error responses never carry internals
+
+A `500` returns `{ "error": "Internal Server Error", "requestId": "…" }` and nothing else. A
+database error stringifies to `relation "games" does not exist` — schema disclosure to whoever
+made the request.
+
+**Never gate disclosure on the stage name.** `ENVIRONMENT` comes from `$app.stage`, so
+`ENVIRONMENT === 'dev'` asks what someone named their stage, not whether the caller is trusted.
+A publicly reachable stage named `dev` is a public stage. A test in `@everystack/server` fails the
+build if such a gate appears in `src/`.
+
+Debug from the id instead: `everystack logs:query --traceId <requestId>`. The full error is
+already logged against it.
+
 ## Testing Checklist
 
 Before deploying RLS:
@@ -247,6 +261,7 @@ RESET ROLE;
 - [ ] Write RLS policies per table x role
 - [ ] Connect as `authenticator` (never use RDS master/superuser in production)
 - [ ] Test: SET ROLE authenticated; SELECT returns only expected rows
+- [ ] Test: a 500 returns only `error` and `requestId` — no relation or column names
 
 ### Handler
 - [ ] `exposedTables` whitelist (404 for unlisted tables)