@everystack/mcp 0.4.5 → 0.4.6

package/dist/index.cjs

@@ -23521,11 +23521,37 @@ var secretInPublicEnv = {
   }
 };
 
+// src/gates/detectors/stage-name-as-trust-boundary.ts
+var STAGE_COMPARISON = /\b(?:ENVIRONMENT|environment|stage)\s*[=!]==\s*['"](?:dev|development|prod|production|staging|local)['"]/;
+var SECURITY_CONTEXT = /\b(?:details|error|stack|message|throw|drop|reset|seed|truncate|delete|secret|token|password|credential|auth|admin|bypass|skip|allow|disable|unsafe|insecure)/i;
+var stageNameAsTrustBoundary = {
+  id: "stage-name-as-trust-boundary",
+  tier: "framework",
+  severity: "deny",
+  guide: "A stage name is not a trust boundary \u2014 ENVIRONMENT comes from $app.stage, so this asks what someone named the stage, not whether the caller is trusted. Gate on an explicit option that defaults to the safe answer, and never return error text to a caller: return the requestId instead.",
+  conform: "an explicit opt-in on the handler/plugin options (see config.allowDevelopment in @everystack/security apple-attest); for error responses, return { error, requestId } and debug with everystack logs:query --traceId <id>",
+  verify: "pnpm --filter @everystack/server test \u2014 __tests__/error-response.test.ts fails on any stage-name gate",
+  async detect(ctx) {
+    if (ctx.tool !== "Write" && ctx.tool !== "Edit") return null;
+    const text = ctx.content;
+    if (!text || !/ENVIRONMENT|environment|stage/.test(text)) return null;
+    const lines = text.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      if (!STAGE_COMPARISON.test(lines[i])) continue;
+      const window = lines.slice(i, i + 3).join(" ");
+      if (!SECURITY_CONTEXT.test(window)) continue;
+      return `line ${i + 1} gates behaviour on the stage name (${lines[i].trim().slice(0, 80)}) \u2014 ENVIRONMENT comes from $app.stage, so this is a deployment label, not a trust decision`;
+    }
+    return null;
+  }
+};
+
 // src/gates/registry.ts
 var FRAMEWORK_GATES = [
   handWrittenMigration,
   embeddedDataBundle,
-  secretInPublicEnv
+  secretInPublicEnv,
+  stageNameAsTrustBoundary
 ];
 function gatesFor(_cwd) {
   return FRAMEWORK_GATES;
@@ -23735,7 +23761,7 @@ async function runGovernanceCli(argv) {
 }
 
 // src/index.ts
-var version2 = (true ? "0.4.5" : null) ?? "0.3.0-dev";
+var version2 = (true ? "0.4.6" : null) ?? "0.3.0-dev";
 var INSTRUCTIONS = [
   "You govern how any agent builds everystack \u2014 a self-hosted application stack for Expo apps on AWS.",
   "Your job is not only to advise but to keep the build on-script: the architecture the maintainer",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/mcp",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Governance layer that governs how any agent builds everystack — grounding, cheat gates, and Model-aware tooling over MCP",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -40,9 +40,9 @@
     "tsx": "4.21.0",
     "typescript": "5.9.3",
     "zod": "3.25.67",
-    "@everystack/cli": "0.4.48",
-    "@everystack/server": "0.4.18",
-    "@everystack/model": "0.4.12"
+    "@everystack/cli": "0.4.49",
+    "@everystack/model": "0.4.13",
+    "@everystack/server": "0.4.19"
   },
   "scripts": {
     "test": "jest",

package/src/gates/detectors/stage-name-as-trust-boundary.ts

@@ -0,0 +1,70 @@
+/**
+ * Cheat: a stage name used as a trust boundary.
+ *
+ * `ENVIRONMENT` is set from `$app.stage` by the SST helper, so `ENVIRONMENT === 'dev'` does not
+ * ask "is this caller trusted" — it asks "what did someone call this stage". The two questions
+ * look identical in a diff and diverge the moment a stage named `dev` is publicly reachable.
+ *
+ * This shipped in the framework and reached two consumers, neither of whom chose anything but a
+ * stage name: a 500 returned raw PostgreSQL text — relation and column names — to unauthenticated
+ * callers. It survived its first fix because the condition had been COPIED into a second file and
+ * only one was found, which is why this is a gate and not a note in a review checklist.
+ *
+ * The correct shape is next door in `@everystack/security`: apple-attest reads the environment
+ * from the attestation CERTIFICATE (a fact about the client, not a deployment label) and still
+ * requires an explicit `config.allowDevelopment` to relax. Derive the fact from something
+ * trustworthy, then require an opt-in that fails closed.
+ */
+
+import type { CheatGate, ToolCallContext } from '../types.js';
+
+/**
+ * A stage/environment label compared against a deployment name. Covers the spellings that have
+ * actually appeared: `process.env.ENVIRONMENT === 'dev'`, `ctx.environment !== 'dev'`, and the
+ * inverted `!== 'production'` form that reads as "anywhere but prod".
+ */
+const STAGE_COMPARISON =
+  /\b(?:ENVIRONMENT|environment|stage)\s*[=!]==\s*['"](?:dev|development|prod|production|staging|local)['"]/;
+
+/**
+ * Security-relevant company on the same line or nearby: what makes a stage comparison a GATE
+ * rather than a label choice. Picking which docs string to print by stage is fine; deciding what
+ * a caller may see, or whether a destructive verb runs, is not.
+ */
+// No trailing \b: these appear camelCased far more often than bare — `skipAuth`, `allowInsecure`,
+// `disableRls`, `adminOnly`. Requiring a word boundary on the right made the detector miss
+// `if (ENVIRONMENT !== 'production') { skipAuth = true }`, which is the exact shape it exists for.
+const SECURITY_CONTEXT =
+  /\b(?:details|error|stack|message|throw|drop|reset|seed|truncate|delete|secret|token|password|credential|auth|admin|bypass|skip|allow|disable|unsafe|insecure)/i;
+
+export const stageNameAsTrustBoundary: CheatGate = {
+  id: 'stage-name-as-trust-boundary',
+  tier: 'framework',
+  severity: 'deny',
+  guide:
+    'A stage name is not a trust boundary — ENVIRONMENT comes from $app.stage, so this asks what someone named the stage, not whether the caller is trusted. Gate on an explicit option that defaults to the safe answer, and never return error text to a caller: return the requestId instead.',
+  conform:
+    'an explicit opt-in on the handler/plugin options (see config.allowDevelopment in @everystack/security apple-attest); for error responses, return { error, requestId } and debug with everystack logs:query --traceId <id>',
+  verify:
+    'pnpm --filter @everystack/server test — __tests__/error-response.test.ts fails on any stage-name gate',
+
+  async detect(ctx: ToolCallContext): Promise<string | null> {
+    if (ctx.tool !== 'Write' && ctx.tool !== 'Edit') return null;
+    const text = ctx.content;
+    // Cheap pre-filter: only content naming a stage label pays for the line scan.
+    if (!text || !/ENVIRONMENT|environment|stage/.test(text)) return null;
+
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (!STAGE_COMPARISON.test(lines[i])) continue;
+
+      // The comparison alone is not the cheat — `channel = ENVIRONMENT` is legitimate. Look at the
+      // line and the two after it, which is where the guarded body sits.
+      const window = lines.slice(i, i + 3).join(' ');
+      if (!SECURITY_CONTEXT.test(window)) continue;
+
+      return `line ${i + 1} gates behaviour on the stage name (${lines[i].trim().slice(0, 80)}) — ENVIRONMENT comes from $app.stage, so this is a deployment label, not a trust decision`;
+    }
+    return null;
+  },
+};

package/src/gates/registry.ts

@@ -11,12 +11,14 @@ import type { CheatGate } from './types.js';
 import { handWrittenMigration } from './detectors/hand-written-migration.js';
 import { embeddedDataBundle } from './detectors/embedded-data-bundle.js';
 import { secretInPublicEnv } from './detectors/secret-in-public-env.js';
+import { stageNameAsTrustBoundary } from './detectors/stage-name-as-trust-boundary.js';
 
 /** Framework-tier gates, on by default. */
 export const FRAMEWORK_GATES: CheatGate[] = [
   handWrittenMigration,
   embeddedDataBundle,
   secretInPublicEnv,
+  stageNameAsTrustBoundary,
 ];
 
 /** The gates that apply to a working directory. Project-tier composition is added later. */