@vibekiln/cutline-mcp-cli 0.3.0 → 0.4.1

package/dist/auth/keychain.js

@@ -10,7 +10,6 @@ export async function deleteRefreshToken() {
     const config = loadConfig();
     if (!config.refreshToken)
         return false;
-    delete config.refreshToken;
-    saveConfig(config);
+    saveConfig({ ...config, refreshToken: undefined });
     return true;
 }

package/dist/servers/cutline-server.js

@@ -4365,6 +4365,39 @@ var UNIVERSAL_CONSTRAINTS = [
     file_patterns: ["**/api/auth/**", "**/api/login*", "**/api/callback*", "**/api/checkout*", "**/middleware/**"],
     framework: "baseline"
   },
+  {
+    id_suffix: "sensitive_tokens_not_in_urls",
+    category: "security",
+    summary: "Auth/session/API tokens MUST NOT be passed in URL query parameters during redirects. Sensitive tokens in URLs leak via logs, browser history, and referrers.",
+    keywords: ["token", "query-param", "callback", "returnUrl", "redirect", "referrer", "url-leakage"],
+    severity: "critical",
+    action: "Use Authorization headers or httpOnly cookies for token transport. Validate callback/return URLs against an allowlist and never append bearer/session tokens to redirected URLs.",
+    checklist_ref: "D11",
+    file_patterns: ["**/auth/**", "**/api/auth/**", "**/api/**/checkout*", "**/mcp-auth*", "**/session/**", "**/middleware/**"],
+    framework: "baseline"
+  },
+  {
+    id_suffix: "no_secrets_in_query_params",
+    category: "security",
+    summary: "Secrets (revalidation secrets, API secrets, webhook secrets) MUST NOT be transported via URL query parameters. Query-string secrets are leaked through logs, referrers, and browser history.",
+    keywords: ["secret", "query-param", "url", "revalidate", "webhook", "referrer", "leakage"],
+    severity: "critical",
+    action: "Accept secrets only via headers or signed request bodies. Reject secret-bearing query params in production endpoints. Rotate any secret previously sent in URLs.",
+    checklist_ref: "D12",
+    file_patterns: ["**/api/**", "**/webhooks/**", "**/revalidate/**", "**/middleware/**"],
+    framework: "baseline"
+  },
+  {
+    id_suffix: "no_state_change_get_cookie_auth",
+    category: "security",
+    summary: "State-changing operations MUST NOT be reachable via GET when cookie authentication is accepted. GET + cookie auth creates CSRF risk.",
+    keywords: ["csrf", "get", "state-change", "cookie-auth", "origin-check", "referer", "method-safety"],
+    severity: "critical",
+    action: "Use POST/PUT/DELETE for side effects. If GET fallback is unavoidable, enforce strict same-origin checks (Origin/Referer/sec-fetch-site) and avoid cookie-based auth fallback where possible.",
+    checklist_ref: "D13",
+    file_patterns: ["**/api/**", "**/auth/**", "**/checkout/**", "**/middleware/**"],
+    framework: "baseline"
+  },
   {
     id_suffix: "ai_cost_caps",
     category: "security",
@@ -5551,6 +5584,9 @@ D7. Do sensitive actions (account deletion, email change, role escalation) requi
 D8. Is payment/billing logic validated server-side? Can prices or quantities be tampered with client-side?
 D9. Are redirect URLs validated against an allowlist? Can open redirects be exploited for phishing?
 D10. Are webhook signatures verified before processing payment or event data?
+D11. Are auth/session/API tokens kept out of URL query params (including callback/returnUrl redirects) and transported via headers or httpOnly cookies instead?
+D12. Are secrets (revalidate/API/webhook/etc.) kept out of URL query params and accepted only via headers or signed bodies?
+D13. Are side-effecting endpoints using non-GET methods, and are cookie-auth GET fallbacks protected with strict same-origin checks?
 
 ### E. Security Rules & Infrastructure
 E1. For Firestore/database rules: do they enforce per-user data isolation?
@@ -5629,7 +5665,7 @@ Return a JSON object with exactly these fields:
 - targetUsers (string): Who uses this product, from a security perspective.
 - referenceClasses (string[]): Security frameworks or standards that apply (e.g., "OWASP Top 10 2021", "SOC 2 Type II").
 - constraints (object?): Resource constraints \u2014 team, budget_usd, deadline_days, must_ship_scope.
-- checklist_summary (object): Keys are checklist IDs (A1-A8, B1-B6, C1-C7, D1-D8, E1-E4, F1-F3, G-*, H1-H3, I1-I8, J1-J6, K1-K8), values are "pass"|"fail"|"warn"|"not_applicable". This forces systematic coverage.
+- checklist_summary (object): Keys are checklist IDs (A1-A8, B1-B6, C1-C8, D1-D13, E1-E7, F1-F4, G-*, H1-H3, I1-I8, J1-J6, K1-K8), values are "pass"|"fail"|"warn"|"not_applicable". This forces systematic coverage.
 - compliance_signals (array of {framework: "pci_dss"|"hipaa"|"fedramp"|"gdpr_ccpa"|"owasp_llm"|"glba"|"ferpa_coppa"|"csa_ccm"|"ios_app_store", signal: string, confidence: number}?): Detected compliance framework signals. Return [] if none.
 
 Be concrete and specific. Reference file paths and line numbers where possible. If a checklist item cannot be assessed from the provided files, mark it "not_applicable" and note why. Cover ALL sections A through K.`;
@@ -5855,6 +5891,11 @@ var SECURITY_PATH_PATTERNS = [
   /\/permissions?/i,
   /\/roles?/i,
   /\/tokens?/i,
+  /\/redirect/i,
+  /\/callback/i,
+  /returnurl/i,
+  /\/mcp-auth/i,
+  /checkout-link/i,
   /\/csrf/i,
   /\/rate-limit/i,
   /\/encrypt/i,
@@ -6538,6 +6579,11 @@ var SECURITY_PATH_PATTERNS2 = [
   /billing/i,
   /stripe/i,
   /webhook/i,
+  /redirect/i,
+  /callback/i,
+  /returnurl/i,
+  /mcp-auth/i,
+  /checkout-link/i,
   // Scalability & reliability patterns
   /\/db\//i,
   /queries?\//i,
@@ -7047,7 +7093,7 @@ function deltaStr(current, previous) {
     return " (no change)";
   return diff > 0 ? ` (**+${diff}** since last scan)` : ` (**${diff}** since last scan)`;
 }
-function formatAuditOutput(result, reportId, publicSiteUrl = "https://thecutline.ai", hiddenAuditDimensions = []) {
+function formatAuditOutput(result, reportId, publicSiteUrl = "https://thecutline.ai", hiddenAuditDimensions = [], fullReport = false) {
   const m = result.metrics;
   const p = result.previousMetrics;
   const isRescan = !!p;
@@ -7135,24 +7181,32 @@ function formatAuditOutput(result, reportId, publicSiteUrl = "https://thecutline
   const totalFindings = visibleFindings.length;
   const criticalCount = visibleFindings.filter((g) => g.severity === "critical" || g.severity === "high").length;
   if (totalFindings > 0) {
-    const topFinding = visibleFindings[0];
-    lines.push(``, `## #1 Finding \u2014 Fix This Now`, ``, `**[${topFinding.severity.toUpperCase()}] ${topFinding.title}**`, `*Category: ${topFinding.category}*`, ``, topFinding.description || "Address this finding to improve your readiness scores.", ``, `> Fix this issue, then re-run \`code_audit\` to see your scores improve.`);
-    const remaining = visibleFindings.slice(1);
-    if (remaining.length > 0) {
-      lines.push(``, `## ${remaining.length} More Finding${remaining.length > 1 ? "s" : ""} Detected`);
-      const teaserLimit = Math.min(remaining.length, 5);
-      for (let i = 0; i < teaserLimit; i++) {
-        lines.push(`- [${remaining[i].severity.toUpperCase()}] ${remaining[i].title}`);
+    if (fullReport) {
+      lines.push(``, `## Findings`, ``);
+      for (const finding of visibleFindings) {
+        lines.push(`**[${finding.severity.toUpperCase()}] ${finding.title}**`, `*Category: ${finding.category}*`, finding.description || "Address this finding to improve your readiness scores.", ``);
       }
-      if (remaining.length > teaserLimit) {
-        lines.push(`- ... and **${remaining.length - teaserLimit} more**`);
+      lines.push(`> Re-run \`code_audit\` after fixes to measure score improvements.`);
+    } else {
+      const topFinding = visibleFindings[0];
+      lines.push(``, `## #1 Finding \u2014 Fix This Now`, ``, `**[${topFinding.severity.toUpperCase()}] ${topFinding.title}**`, `*Category: ${topFinding.category}*`, ``, topFinding.description || "Address this finding to improve your readiness scores.", ``, `> Fix this issue, then re-run \`code_audit\` to see your scores improve.`);
+      const remaining = visibleFindings.slice(1);
+      if (remaining.length > 0) {
+        lines.push(``, `## ${remaining.length} More Finding${remaining.length > 1 ? "s" : ""} Detected`);
+        const teaserLimit = Math.min(remaining.length, 5);
+        for (let i = 0; i < teaserLimit; i++) {
+          lines.push(`- [${remaining[i].severity.toUpperCase()}] ${remaining[i].title}`);
+        }
+        if (remaining.length > teaserLimit) {
+          lines.push(`- ... and **${remaining.length - teaserLimit} more**`);
+        }
       }
     }
   }
   lines.push(``, `---`, ``);
-  if (totalFindings > 1) {
+  if (!fullReport && totalFindings > 1) {
     lines.push(`### Unlock Full Analysis`, ``, `You fixed one \u2014 **${totalFindings - 1} findings** remain (${criticalCount} critical/high).`, `Upgrade to Cutline Pro for:`, `- Full details and remediation for every finding`, `- Prioritized RGR remediation plans your coding agent can execute`, `- Product-specific deep dive with feature-level constraint mapping`, `- Continuous score tracking with this audit as a baseline prior`, ``, `\u2192 Run \`cutline-mcp upgrade\` or visit **https://thecutline.ai/upgrade**`);
-  } else if (totalFindings === 1) {
+  } else if (totalFindings >= 1) {
     lines.push(`### Next Steps`, ``, `Fix the finding above, then re-scan to see your scores improve.`, `When ready, run a **deep dive** for product-specific analysis \u2014`, `these generic scores will serve as a prior for your product graph.`);
   } else {
     lines.push(`### Next Steps`, ``, `No critical findings detected. Run a **deep dive** for product-specific`, `analysis with feature coverage and the generic scores as a prior.`);
@@ -8377,15 +8431,17 @@ Why AI: ${idea.whyAI}`
             return "engineering";
           return "security";
         };
+        let hasPremiumSubscription = false;
         {
           const rateInfo = await getScanRateLimit();
+          hasPremiumSubscription = rateInfo.subscription === "active" || rateInfo.subscription === "trialing";
           const now = /* @__PURE__ */ new Date();
           const resetAt = rateInfo.periodStart ? new Date(rateInfo.periodStart) : /* @__PURE__ */ new Date(0);
           const monthStart = new Date(now.getFullYear(), now.getMonth(), 1);
           if (resetAt < monthStart) {
             await updateScanRateLimit({ free_scan_counter: { count: 1, reset_at: now.toISOString() } });
           } else if (rateInfo.scanCount >= 3) {
-            if (rateInfo.subscription !== "active" && rateInfo.subscription !== "trialing") {
+            if (!hasPremiumSubscription) {
               throw new McpError(ErrorCode.InvalidRequest, "Free scan limit reached (3/month). Run `cutline-mcp upgrade` in your terminal, or visit https://thecutline.ai/upgrade");
             }
           } else {
@@ -8454,7 +8510,7 @@ Why AI: ${idea.whyAI}`
           console.error("[code_audit] Report persistence failed (non-fatal):", e);
         }
         return {
-          content: [{ type: "text", text: formatAuditOutput(result, reportId, reportSiteUrl, hiddenAuditDimensions) }]
+          content: [{ type: "text", text: formatAuditOutput(result, reportId, reportSiteUrl, hiddenAuditDimensions, hasPremiumSubscription) }]
         };
       }
       const authCtx = await resolveAuthContext(args.auth_token);

package/dist/utils/config-store.js

@@ -12,6 +12,13 @@ export function saveConfig(config) {
     ensureConfigDir();
     const current = loadConfig();
     const newConfig = { ...current, ...config };
+    // Treat explicit undefined values as key deletion so callers can clear
+    // persisted fields (for example during logout).
+    for (const [key, value] of Object.entries(config)) {
+        if (value === undefined) {
+            delete newConfig[key];
+        }
+    }
     // Remove legacy fields that are no longer stored (e.g. firebaseApiKey)
     // to prevent stale values from causing cross-project auth mismatches
     delete newConfig.firebaseApiKey;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vibekiln/cutline-mcp-cli",
-    "version": "0.3.0",
+    "version": "0.4.1",
     "description": "CLI and MCP servers for Cutline — authenticate, then run constraint-aware MCP servers in Cursor or any MCP client.",
     "type": "module",
     "main": "dist/index.js",