drupal-mcp-connector 1.8.1 → 2.1.0

package/.claude/commands/drupal-bulk-update.md

@@ -1,12 +1,12 @@
 ---
-description: "Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Returns per-item { index, success, id | error } and a summary { updated, failed }."
+description: "Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision) so bulk edits do not mutate live default revisions. Returns per-item { index, success, id | error } and a summary { updated, failed }."
 argument-hint: "<entityType> <bundle> <items> [site]"
 allowed-tools: mcp__drupal__drupal_bulk_update
 ---
 
 Call the `mcp__drupal__drupal_bulk_update` MCP tool.
 
-Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Returns per-item { index, success, id | error } and a summary { updated, failed }.
+Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision) so bulk edits do not mutate live default revisions. Returns per-item { index, success, id | error } and a summary { updated, failed }.
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 

package/.claude/commands/drupal-create-media.md

@@ -16,7 +16,7 @@ Parse the request in `$ARGUMENTS` into this tool's parameters:
 
 **Optional:**
 - `site` (string): omit for the default site
-- `status` (boolean (true/false))
+- `status` (boolean (true/false)): Published flag. Defaults to false (unpublished). Requires allowPublish when true.
 - `fields` (object (pass as JSON)): Additional field values — include the source field (e.g. field_media_oembed_video: 'https://youtu.be/...')
 
 If a required parameter is missing from `$ARGUMENTS`, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.claude/commands/drupal-drush-sql-query.md

@@ -1,12 +1,12 @@
 ---
-description: "Run a read-only SQL query (SELECT, SHOW, DESCRIBE, EXPLAIN only) via Drush. Write queries are blocked by the security layer."
+description: "Run a single read-only SELECT through mcp_sentinel's governed command (`drush mcp-sentinel:sql-query`). Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection."
 argument-hint: "<query> [site]"
 allowed-tools: mcp__drupal__drupal_drush_sql_query
 ---
 
 Call the `mcp__drupal__drupal_drush_sql_query` MCP tool.
 
-Run a read-only SQL query (SELECT, SHOW, DESCRIBE, EXPLAIN only) via Drush. Write queries are blocked by the security layer.
+Run a single read-only SELECT through mcp_sentinel's governed command (`drush mcp-sentinel:sql-query`). Requires the site to set drushSsh.rawSql="governed" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 

package/.claude/commands/drupal-entity-update.md

@@ -1,12 +1,12 @@
 ---
-description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change."
+description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision)."
 argument-hint: "<entityType> <bundle> <id> [site] [attributes] [relationships] [dryRun] [returning]"
 allowed-tools: mcp__drupal__drupal_entity_update
 ---
 
 Call the `mcp__drupal__drupal_entity_update` MCP tool.
 
-Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change.
+Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision).
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 

package/.claude/commands/drupal-update-node.md

@@ -1,12 +1,12 @@
 ---
-description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. Entity-reference fields go in `relationships`, not `fields`."
+description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`."
 argument-hint: "<type> <id> [site] [title] [body] [summary] [status] [moderationState] [fields] [relationships] [dryRun] [returning]"
 allowed-tools: mcp__drupal__drupal_update_node
 ---
 
 Call the `mcp__drupal__drupal_update_node` MCP tool.
 
-Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. Entity-reference fields go in `relationships`, not `fields`.
+Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`.
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 
@@ -20,7 +20,7 @@ Parse the request in `$ARGUMENTS` into this tool's parameters:
 - `body` (string)
 - `summary` (string)
 - `status` (boolean (true/false)): Published flag for NON-moderated types: true = publish, false = unpublish. Ignored if moderationState is set.
-- `moderationState` (string): Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status.
+- `moderationState` (string): Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status. Required to keep or re-publish a live node — omitting it on a published moderated node defaults the write to 'draft'.
 - `fields` (object (pass as JSON)): Scalar/attribute field values keyed by machine name. Entity-reference fields go in `relationships`, not here.
 - `relationships` (object (pass as JSON)): Entity-reference fields as JSON:API relationships, keyed by field machine name. Single-value uses { data: { type, id } }; multi-value uses { data: [{ type, id }, …] }.
 - `dryRun` (boolean (true/false)): Validate and return a preview of the update without committing.

package/.claude/commands/drupal-upload-file-and-create-media.md

@@ -1,17 +1,17 @@
 ---
-description: "Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow."
+description: "Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow. Media defaults to unpublished."
 argument-hint: "<filePath> <mediaType> <fieldName> [site] [mediaName] [altText] [status]"
 allowed-tools: mcp__drupal__drupal_upload_file_and_create_media
 ---
 
 Call the `mcp__drupal__drupal_upload_file_and_create_media` MCP tool.
 
-Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow.
+Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow. Media defaults to unpublished.
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 
 **Required:**
-- `filePath` (string): Absolute local path to the file
+- `filePath` (string): Local path to the file (must resolve under MCP_UPLOAD_ROOT or the connector working directory)
 - `mediaType` (string): Media type machine name, e.g. 'image'
 - `fieldName` (string): Source field machine name, e.g. 'field_media_image'
 
@@ -19,6 +19,6 @@ Parse the request in `$ARGUMENTS` into this tool's parameters:
 - `site` (string): omit for the default site
 - `mediaName` (string): Name for the media entity (defaults to filename)
 - `altText` (string): Alt text for image media
-- `status` (boolean (true/false))
+- `status` (boolean (true/false)): Published flag. Defaults to false. Requires allowPublish when true.
 
 If a required parameter is missing from `$ARGUMENTS`, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.claude/commands/drupal-upload-file.md

@@ -11,7 +11,7 @@ Upload a local file to Drupal and create a File entity. Returns the file UUID to
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 
 **Required:**
-- `filePath` (string): Absolute local path to the file to upload
+- `filePath` (string): Local path to the file (must resolve under MCP_UPLOAD_ROOT or the connector working directory)
 - `bundle` (string): Bundle machine name, e.g. 'image', 'article'
 - `fieldName` (string): Field machine name, e.g. 'field_media_image', 'field_image'
 

package/CHANGELOG.md

@@ -7,6 +7,100 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.1.0] - 2026-07-31
+
+### Security
+- **Specialized tools honor entity allowlists/denylists (#138).**
+  `drupal_*_node`, media, and taxonomy tools now call the same
+  `assertReadAllowed` / `assertWriteAllowed` / `assertDeleteAllowed` gates as
+  `drupal_entity_*`, so a denied type (e.g. `media`) cannot be reached by
+  switching tool names.
+- **Upload path allowlist and path segment hardening (#137).** File uploads
+  must resolve under `MCP_UPLOAD_ROOT` (or the connector cwd by default);
+  entity/bundle/field path segments are machine-name validated and encoded;
+  Content-Disposition filenames are sanitized. Sensitive paths (`.env*`,
+  `.ssh`, connector `config.json`) are refused even under an allowed root.
+- **Media no longer publishes by default (#139).** `drupal_create_media` and
+  upload-and-create default to `status: false` and honor `assertPublishAllowed`.
+  `moderation_state: published` and `drupal_set_moderation_state` to published
+  are treated as publish-bearing.
+- **HTTPS fails closed without auth when non-loopback (#141).** Binding beyond
+  loopback requires `MCP_AUTH_TOKEN` unless `MCP_ALLOW_UNAUTHENTICATED=1`.
+  Non-loopback HTTPS defaults to 120 req/min rate limiting when
+  `MCP_RATE_LIMIT` is unset.
+- **Link-checker does not follow redirects (#143).** Live checks use
+  `redirect: "manual"` to avoid SSRF via 302 to private/metadata targets.
+- **auditor / production-strict apply SENSITIVE_DENY** (partial #140). Secrets,
+  governance, and account entity types stay denied on those presets. Default
+  when `security` is omitted remains `development` (tracked in #140).
+
+### Fixed
+- **Published moderated updates default to a draft forward revision (#131).**
+  `drupal_update_node`, `drupal_bulk_update`, and `drupal_entity_update` now
+  sniff the target entity: when it is published under content_moderation and
+  the caller omitted `moderation_state` / `moderationState`, the write is sent
+  as `moderation_state: draft` instead of omitting the field. That keeps bulk
+  relationship-wiring and field edits as reviewable forward revisions rather
+  than live default-revision mutations if a server-side publish gate
+  mis-classifies the write. Callers that want a same-state save must pass an
+  explicit moderation state.
+
+### Added
+- **Provider-agnostic agent instructions.** Root `AGENTS.md` is the only
+  committed agent rule file (any coding agent). No vendor-specific
+  `.grok/` / `CLAUDE.md` / parallel rule trees. Generated slash stubs under
+  `.claude/commands/` remain client ergonomics for MCP operators, not project
+  development rules.
+
+### Documentation
+- Security, hardening, deployment, tools-reference, threat-model, and
+  architecture docs updated for the 2.1 controls (fail-closed HTTPS, upload
+  roots, publish/draft defaults, GraphQL policy caveat).
+
+## [2.0.0] - 2026-07-29
+
+### Fixed
+- **Re-pushing a release tag no longer fails the publish job.** The workflow
+  now skips publishing a version already on the registry. Moving or recreating
+  a tag is a normal recovery operation, and npm's E403 "cannot publish over the
+  previously published version" reads as a broken release when the registry is
+  in exactly the state you wanted.
+
+### Changed
+- **BREAKING: `drupal_drush_sql_query` no longer runs ungoverned SQL, and is off
+  by default.** It called `drush sql:query`, which executes below Drupal's
+  entity API — so a site's `mcp_sentinel` policy profile, its denied entity
+  types, its redacted fields and its audit log had no effect on anything this
+  tool read. A statement could return exactly the data the same site refused
+  over JSON:API, and nothing recorded that it had. That is not fixable on the
+  Drupal side: Drush caps `sql:query`'s bootstrap below the level at which
+  module command files are discovered, so no module hook can run on its path.
+  Nor is it fixable here — this process holds the SSH key, so a client-side
+  check is a promise made by the thing being constrained.
+
+  The tool now calls `drush mcp-sentinel:sql-query` (mcp_sentinel ≥ 1.14),
+  where Drupal is fully bootstrapped and the policy profile decides. Two
+  independent opt-ins are required, both off by default: `drushSsh.rawSql:
+  "governed"` on the site here, and `allow_raw_sql` on the policy profile
+  there. There is no ungoverned mode — keeping one behind a flag would have
+  left the bypass a config key away and still invisible when used.
+
+  **To migrate:** set both flags, add `mcp-sentinel:sql-query` to
+  `allowedCommands` if the site pins that list, and expect a narrower tool —
+  the server accepts a single `SELECT` over entity tables only (no `SHOW` /
+  `DESCRIBE` / `EXPLAIN`, no expressions, no `SELECT *` on a table carrying a
+  redacted column). Schema introspection moves to the site-context and
+  entity-schema tools. Sites that do not run mcp_sentinel lose this tool; raw
+  database access belongs to the operator's own shell, not to an agent.
+
+### Fixed
+- **Docs: redirect entities are publishable.** The `redirects.js` header claimed
+  redirect entities have no enabled/disabled flag. That has been stale since the
+  redirect module's dev-1.x made the entity publishable (`enabled` is the published
+  key). Corrected the doc and added a verify-after-create caveat for sites on older
+  `mcp_sentinel` releases (≤ 1.9), where agent-created redirects can arrive silently
+  disabled until the publish gate exempts redirects.
+
 ## [1.8.1] - 2026-07-23
 
 ### Security

package/README.md

@@ -209,6 +209,37 @@ drush mcp-sentinel:setup
 
 Governance keys off the authenticated account's role and OAuth scopes — not request headers. The connector sends an `X-MCP-Client` identity header purely as a log label. See the [MCP Sentinel project page](https://www.drupal.org/project/mcp_sentinel) for the full contract.
 
+### Raw SQL is governed, or it is off
+
+The Drush bridge runs over SSH, which is *below* everything above: a `drush`
+subprocess does not make a request Drupal can govern, and most Drush commands
+never load Drupal's module system at all. `drupal_drush_sql_query` used to
+exploit that without meaning to — it called `drush sql:query`, so no policy
+profile, no denied entity type, no field redaction and no audit entry applied
+to anything it read.
+
+It now calls `drush mcp-sentinel:sql-query` (mcp_sentinel ≥ 1.14), which runs
+with Drupal fully bootstrapped and enforces the same profile that governs
+JSON:API. **Two opt-ins, both off by default**, are required:
+
+```jsonc
+// this connector, per site
+"drushSsh": {
+  "rawSql": "governed",                          // no other value enables it
+  "allowedCommands": ["mcp-sentinel:sql-query"]  // only if you pin this list
+}
+```
+
+…plus `allow_raw_sql` on the policy profile in Drupal. Expect a much narrower
+tool than before: one `SELECT`, entity tables only, no expressions, and no
+`SELECT *` on a table carrying a redacted column. Every attempt — permitted or
+refused — lands in the audit chain with its statement text.
+
+The rest of the bridge (`sql:cli`, `sql:dump`, `php:eval` and anything else you
+reach over SSH) is **outside Drupal governance by construction**. Treat SSH as
+an operator channel: keep the agent's credentials off it, and pin
+`allowedCommands` per site.
+
 ---
 
 ## Documentation

package/config/config.example.json

@@ -70,7 +70,7 @@
       },
       "serverTools": { "url": "/mcp" },
       "drushSsh": {
-        "_comment": "Dev only. DDEV web-container SSH target. Whitelisted to config export/status — every other drupal_drush_* tool is blocked here.",
+        "_comment": "Dev only. DDEV web-container SSH target. Whitelisted to config export/status — every other drupal_drush_* tool is blocked here. rawSql is omitted, so drupal_drush_sql_query is refused: raw SQL reads underneath Drupal's entity API and is only available via mcp_sentinel's governed command. To enable it, set rawSql:\"governed\", add \"mcp-sentinel:sql-query\" to allowedCommands, and set allow_raw_sql on the site's policy profile.",
         "host":            "<ddev-web-container-ssh-host>",
         "user":            "<ddev-ssh-user>",
         "keyPath":         "~/.ssh/id_ed25519",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "1.8.1",
+  "version": "2.1.0",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal — dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",

package/scripts/generate-commands.js

@@ -8,6 +8,10 @@
  * `mcp__drupal__<tool>` and instructs the model to parse `$ARGUMENTS` into the
  * tool's parameters before making a single call.
  *
+ * These files are *client ergonomics* for operators using Claude Code as an MCP
+ * client against this server — not provider-specific project rules. Development
+ * instructions for any agent live only in AGENTS.md.
+ *
  * Driven from the same tool definitions as the server (src/tools/index.js), so the
  * command set never drifts from the tools. Run: `npm run generate:commands`.
  *

package/src/index.js

@@ -384,6 +384,7 @@ if (transport === "stdio") {
 
   const authToken   = process.env.MCP_AUTH_TOKEN || "";
   const checkAuth   = makeBearerCheck(authToken);
+  const allowUnauth = process.env.MCP_ALLOW_UNAUTHENTICATED === "1";
   if (!authToken) {
     console.error(
       "[drupal-mcp-connector] WARNING: the /mcp endpoint is UNAUTHENTICATED. " +
@@ -450,11 +451,33 @@ if (transport === "stdio") {
     return mcpTransport;
   }
 
-  // Optional fixed-window rate limiting on /mcp, keyed by client IP. Off unless
-  // MCP_RATE_LIMIT > 0. Counts are per-process; for multi-replica deployments
-  // prefer rate limiting at the reverse proxy.
-  const rateLimit     = Number(process.env.MCP_RATE_LIMIT || 0);
+  const hasTls   = Boolean(tlsCfg.certPath && tlsCfg.keyPath);
+  // Unauthenticated plain HTTP must never bind beyond loopback. A non-loopback
+  // bind is allowed only alongside TLS, via an explicit MCP_BIND_HOST opt-in.
+  const bindHost = hasTls ? (process.env.MCP_BIND_HOST || "0.0.0.0") : "127.0.0.1";
+  const isLoopbackBind = bindHost === "127.0.0.1" || bindHost === "::1" || bindHost === "localhost";
+
+  // #141: fail closed when HTTPS is network-facing without a bearer token.
+  // Loopback binds and explicit MCP_ALLOW_UNAUTHENTICATED=1 remain for local/proxy setups.
+  if (!authToken && !isLoopbackBind && !allowUnauth) {
+    console.error(
+      "[drupal-mcp-connector] FATAL: MCP_AUTH_TOKEN is required when binding beyond loopback.\n" +
+      "  Set MCP_AUTH_TOKEN, bind to 127.0.0.1 (default without MCP_BIND_HOST), or set\n" +
+      "  MCP_ALLOW_UNAUTHENTICATED=1 only behind a trusted auth boundary."
+    );
+    process.exit(1);
+  }
+
+  // Optional fixed-window rate limiting on /mcp, keyed by client IP.
+  // HTTPS non-loopback defaults to 120 req/min when MCP_RATE_LIMIT is unset (#141).
+  // Set MCP_RATE_LIMIT=0 to disable. Counts are per-process; multi-replica should
+  // also rate-limit at the reverse proxy.
   const rateWindowSec = Number(process.env.MCP_RATE_WINDOW_SEC || 60);
+  const rateLimitEnv  = process.env.MCP_RATE_LIMIT;
+  const rateLimitDefault = (hasTls && !isLoopbackBind) ? 120 : 0;
+  const rateLimit = rateLimitEnv === undefined || rateLimitEnv === ""
+    ? rateLimitDefault
+    : Number(rateLimitEnv);
   const rateLimiter   = rateLimit > 0
     ? createRateLimiter({ limit: rateLimit, windowMs: rateWindowSec * 1000 })
     : null;
@@ -474,11 +497,6 @@ if (transport === "stdio") {
 
   const nodeServer = createNodeServer(requestHandler);
 
-  const hasTls   = Boolean(tlsCfg.certPath && tlsCfg.keyPath);
-  // Unauthenticated plain HTTP must never bind beyond loopback. A non-loopback
-  // bind is allowed only alongside TLS, via an explicit MCP_BIND_HOST opt-in.
-  const bindHost = hasTls ? (process.env.MCP_BIND_HOST || "0.0.0.0") : "127.0.0.1";
-
   nodeServer.listen(port, bindHost, () => {
     const proto = hasTls ? "https" : "http";
     console.error(

package/src/lib/drupal-fetch.js

@@ -7,6 +7,11 @@ import { createReadStream, statSync } from "fs";
 import { basename } from "path";
 import { authHeadersAsync, clientHeaders } from "./config.js";
 import { clearToken } from "./oauth.js";
+import {
+  assertUploadPathAllowed,
+  sanitizeUploadFilename,
+  validateMachineName,
+} from "./validate.js";
 
 const JSON_API_CONTENT_TYPE = "application/vnd.api+json";
 
@@ -115,10 +120,15 @@ export async function drupalGraphqlFetch(site, body) {
  * @throws {Error} on any non-2xx response.
  */
 export async function drupalUploadFile(site, entityType, bundle, fieldName, filePath) {
-  const filename = basename(filePath);
-  // eslint-disable-next-line security/detect-non-literal-fs-filename -- filePath is a caller-supplied local upload path (validated upstream); fs access is the intended behavior
-  const stat = statSync(filePath);
-  const url = `${site.baseUrl}/jsonapi/${entityType}/${bundle}/${fieldName}`;
+  // #137: machine-name segments + path allowlist before any FS or network I/O.
+  validateMachineName(entityType, "entityType");
+  validateMachineName(bundle, "bundle");
+  validateMachineName(fieldName, "fieldName");
+  const safePath = assertUploadPathAllowed(filePath);
+  const filename = sanitizeUploadFilename(basename(safePath));
+  // eslint-disable-next-line security/detect-non-literal-fs-filename -- path allowlisted via assertUploadPathAllowed
+  const stat = statSync(safePath);
+  const url = `${site.baseUrl}/jsonapi/${encodeURIComponent(entityType)}/${encodeURIComponent(bundle)}/${encodeURIComponent(fieldName)}`;
 
   const res = await fetch(url, {
     method: "POST",
@@ -129,8 +139,8 @@ export async function drupalUploadFile(site, entityType, bundle, fieldName, file
       ...clientHeaders(),
       ...(await authHeadersAsync(site)),
     },
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- filePath is a caller-supplied local upload path (validated upstream); fs access is the intended behavior
-    body: createReadStream(filePath),
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- path allowlisted via assertUploadPathAllowed
+    body: createReadStream(safePath),
     // node-fetch requires explicit size for streams to set Content-Length
     size: stat.size,
   });

package/src/lib/link-checker.js

@@ -190,7 +190,9 @@ async function timedFetch(url, method, { timeoutMs, fetchImpl }) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const res = await fetchImpl(url, { method, redirect: "follow", signal: controller.signal });
+    // #143: never auto-follow redirects — a public allowlisted host can 302 to
+    // private/metadata. Report the redirect status; do not chase Location.
+    const res = await fetchImpl(url, { method, redirect: "manual", signal: controller.signal });
     return { status: res.status, error: null };
   } catch (err) {
     const reason = err?.name === "AbortError" ? `timeout after ${timeoutMs}ms` : (err?.message || "request failed");

package/src/lib/moderation-default.js

@@ -0,0 +1,106 @@
+/**
+ * Safe draft default for updates of published, moderated entities (#131).
+ *
+ * When a PATCH targets a *published* entity under content_moderation and the
+ * caller did not pass an explicit `moderation_state`, the write can land on the
+ * live default revision if a server-side publish gate mis-classifies it as "no
+ * transition". Defaulting to `moderation_state: draft` forces a forward
+ * (reviewable) revision instead.
+ *
+ * Callers that genuinely want a same-state save on a published node must opt in
+ * by passing `moderation_state` (or the tool-level `moderationState`) explicitly.
+ *
+ * Detection is best-effort from the existing entity payload: the entity is
+ * treated as moderated when a `moderation_state` field is present on it, and as
+ * published when `status === true`. If the entity cannot be read, attributes
+ * are left unchanged (fail open for non-moderated bundles; server-side gate
+ * remains authoritative).
+ */
+
+/** Default moderation state applied when none was supplied for a published moderated entity. */
+export const SAFE_DRAFT_STATE = "draft";
+
+/**
+ * Whether a canonical entity exposes a content_moderation state field.
+ * @param {?object} entity Canonical entity (or null).
+ * @returns {boolean}
+ */
+export function entityLooksModerated(entity) {
+  if (!entity) return false;
+  if (entity.fields && Object.prototype.hasOwnProperty.call(entity.fields, "moderation_state")) {
+    return true;
+  }
+  // Tolerate a top-level promotion if a backend ever surfaces it that way.
+  return Object.prototype.hasOwnProperty.call(entity, "moderation_state");
+}
+
+/**
+ * Whether a canonical entity is currently published.
+ * @param {?object} entity Canonical entity (or null).
+ * @returns {boolean}
+ */
+export function isPublishedEntity(entity) {
+  return entity?.status === true;
+}
+
+/**
+ * Whether the write attributes already carry an explicit moderation state.
+ * @param {?object} attributes Attribute map about to be sent.
+ * @returns {boolean}
+ */
+export function hasExplicitModerationState(attributes) {
+  return Boolean(attributes && Object.prototype.hasOwnProperty.call(attributes, "moderation_state"));
+}
+
+/**
+ * Decide whether a draft default should be injected for this update.
+ * Pure helper — no I/O.
+ *
+ * @param {{attributes?: object, entity?: ?object}} input
+ * @returns {boolean}
+ */
+export function shouldDefaultPublishedUpdateToDraft({ attributes, entity }) {
+  if (hasExplicitModerationState(attributes)) return false;
+  if (!isPublishedEntity(entity)) return false;
+  if (!entityLooksModerated(entity)) return false;
+  return true;
+}
+
+/**
+ * Apply the safe draft default when updating a published moderated entity.
+ * Returns a new attributes object when a default is applied; otherwise returns
+ * the original attributes reference unchanged.
+ *
+ * @param {object} args
+ * @param {object} args.backend Backend with `getEntity`.
+ * @param {string} args.entityType
+ * @param {string} args.bundle
+ * @param {string} args.id Entity UUID.
+ * @param {object} [args.attributes={}] Attribute map for the write.
+ * @param {?object} [args.existingEntity] Pre-fetched entity; when omitted a get is issued.
+ * @returns {Promise<object>} Attributes to send (possibly with moderation_state: draft).
+ */
+export async function applySafeDraftDefault({
+  backend,
+  entityType,
+  bundle,
+  id,
+  attributes = {},
+  existingEntity,
+}) {
+  if (hasExplicitModerationState(attributes)) return attributes;
+
+  let entity = existingEntity;
+  if (entity === undefined) {
+    try {
+      entity = await backend.getEntity({ entityType, bundle, id });
+    } catch {
+      // Fail open: without a readable target we cannot sniff moderation.
+      return attributes;
+    }
+  }
+  if (!shouldDefaultPublishedUpdateToDraft({ attributes, entity })) {
+    return attributes;
+  }
+  return { ...attributes, moderation_state: SAFE_DRAFT_STATE };
+}

package/src/lib/security.js

@@ -175,7 +175,8 @@ const PRESETS = {
     allowConfigRead: true,            // read-only inspection of config
     allowConfigWrite: false,
     allowedEntityTypes: null,         // read any entity type
-    deniedEntityTypes: [],
+    // Secrets / governance / account entities stay denied even on broad read (#140).
+    deniedEntityTypes: [...SENSITIVE_DENY],
     entityRules: {
       user: {
         allowedOperations: ["read"],
@@ -192,7 +193,7 @@ const PRESETS = {
     allowConfigRead: false,           // nothing implicit; opt in per site
     allowConfigWrite: false,
     allowedEntityTypes: null,         // set an explicit allowlist in your config
-    deniedEntityTypes: ["user"],      // no user data at all
+    deniedEntityTypes: [...SENSITIVE_DENY], // includes user + secrets/governance
     entityRules: {},
     globalRedactedFields: ["pass", "mail", "field_private", "field_api_key", "field_token"],
   },
@@ -379,23 +380,33 @@ export function assertDestructiveAllowed(secConfig, entityType, id) {
 }
 
 /**
- * Whether a set of write attributes carries a publish action. Deliberately
- * limited to the unambiguous, entity-agnostic signal `status === true`; a site's
- * moderation-workflow state names are not knowable from a site-agnostic
- * connector, so publishing via `moderation_state` stays gated server-side.
+ * Whether a set of write attributes carries a publish action.
+ *
+ * Recognized signals:
+ *   - `status === true` (non-moderated publish)
+ *   - `moderation_state` equal to `"published"` (case-insensitive) — the common
+ *     core content_moderation publish state (#139)
+ *
+ * Other workflow state names are site-specific and remain server-gated.
  * @param {object} [attributes] Attribute map for the write.
  * @returns {boolean}
  */
 export function isPublishBearing(attributes = {}) {
-  return attributes?.status === true;
+  if (attributes?.status === true) return true;
+  // Common core content_moderation publish state. Site-specific publish state
+  // names remain server-gated; this closes the obvious connector-layer hole (#139).
+  const mod = attributes?.moderation_state;
+  if (typeof mod === "string" && mod.toLowerCase() === "published") return true;
+  return false;
 }
 
 /**
  * Local, fail-fast publish gate, symmetric with assertDestructiveAllowed. When
  * the connector is not permitted to publish (allowPublish false — the default in
- * every preset except `development`), a write carrying `status: true` is refused
- * before the round-trip, rather than being silently dropped by a moderated-bundle
- * retry or a server-side gate (see #111/#114). Client-side convenience only — the
+ * every preset except `development`), a write that is publish-bearing
+ * (`status: true` or `moderation_state: "published"`) is refused before the
+ * round-trip, rather than being silently dropped by a moderated-bundle retry or
+ * a server-side gate (see #111/#114/#139). Client-side convenience only — the
  * remote Drupal's own permissions remain the real authority.
  * @param {object} secConfig Resolved security config.
  * @param {object} [attributes] Attribute map for the write.
@@ -407,9 +418,8 @@ export function assertPublishAllowed(secConfig, attributes = {}) {
   if (isPublishBearing(attributes)) {
     throw new SecurityError(
       "Publishing is disabled for this connector (allowPublish: false). " +
-      "Blocked: a write carrying status:true. " +
-      "To enable, set security.allowPublish = true in your config; otherwise publish " +
-      "via an operator/server-gated path (e.g. a moderation transition)."
+      "Blocked: a write carrying status:true or moderation_state:published. " +
+      "To enable, set security.allowPublish = true in your config."
     );
   }
 }