sparda-mcp 0.66.1 → 0.66.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sparda-mcp",
-  "version": "0.66.1",
+  "version": "0.66.2",
   "mcpName": "io.github.zyx77550/sparda-mcp",
   "description": "AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.",
   "type": "module",
@@ -61,19 +61,19 @@
   "author": "Residual Labs (residual-labs.fr)",
   "license": "BUSL-1.1",
   "dependencies": {
-    "@babel/parser": "7.26.5",
-    "@babel/traverse": "7.26.5",
-    "@clack/prompts": "0.9.1",
     "@modelcontextprotocol/sdk": "1.29.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.4",
-    "@vitest/coverage-v8": "^3.2.6",
-    "eslint": "^9.39.4",
-    "eslint-config-prettier": "^9.1.2",
-    "express": "^4.21.0",
-    "globals": "^15.15.0",
+    "@babel/parser": "^8.0.4",
+    "@babel/traverse": "^8.0.4",
+    "@clack/prompts": "^1.7.0",
+    "@eslint/js": "^10.0.1",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^10.7.0",
+    "eslint-config-prettier": "^10.1.8",
+    "express": "^5.2.1",
+    "globals": "^17.7.0",
     "prettier": "^3.8.4",
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.10"
   }
 }

package/src/commands/evolve.js

@@ -82,7 +82,7 @@ export async function runEvolve(opts) {
       },
     );
   }
-  let exemplars = {};
+  let exemplars;
   try {
     exemplars = JSON.parse(fs.readFileSync(twinPath, 'utf8')).exemplars ?? {};
   } catch {

package/src/commands/heal.js

@@ -100,7 +100,7 @@ async function gate(opts, id, flight, healDir) {
   // 3. apocalypse: no new critical/high, nothing protected got removed
   const fixedGraph = canonicalizeGraph(compileUBG(opts.cwd, { write: false }).graph);
   const staticFindings = checkGraph(fixedGraph).findings;
-  let regressions = [];
+  let regressions;
   const baselinePath = path.join(healDir, 'baseline.json');
   if (fs.existsSync(baselinePath)) {
     const baseline = JSON.parse(fs.readFileSync(baselinePath, 'utf8'));

package/src/commands/seed.js

@@ -277,7 +277,7 @@ export async function runSeed(opts, args) {
     if (opts.germinate) {
       const { buildGrammar } = await import('./grammar.js');
       const { twinFilePath } = await import('./twin.js');
-      let exemplars = null;
+      let exemplars;
       try {
         exemplars =
           JSON.parse(fs.readFileSync(twinFilePath(opts.cwd), 'utf8')).exemplars ?? null;

package/src/flight/heal.js

@@ -27,7 +27,7 @@ export function evaluateHealing(flight, replay, expectation = null) {
     reasons.push('response is byte-identical to the recorded bug — nothing changed');
   }
 
-  let expectationMet = null;
+  let expectationMet;
   if (expectation) {
     expectationMet = true;
     if (expectation.status !== undefined && replay.actual.status !== expectation.status) {

package/src/generator/express.js

@@ -80,7 +80,7 @@ export function generateExpress({ cwd, entryFile, moduleType, port, routes }) {
   const isESM = moduleType === 'esm';
   const isTS = ext === '.ts';
 
-  let importLine = '';
+  let importLine;
   let reqType = '';
   let resType = '';
   let nextType = '';

package/src/generator/manifest.js

@@ -42,7 +42,7 @@ export function ensureSpardaKey(cwd, prevManifest = null) {
 // state (opt-in flags + observed circuits), and the `sparding` security
 // memory survive as long as the tool's method+path are unchanged.
 export function carryOverManifest(cwd, tools) {
-  let prev = null;
+  let prev;
   try {
     prev = JSON.parse(fs.readFileSync(path.join(cwd, 'sparda.json'), 'utf8'));
   } catch {

package/src/parser/fastapi.js

@@ -30,6 +30,7 @@ export function parseFastAPIProject(cwd, entryFile, pythonCmd = 'python') {
   } catch (err) {
     throw new Error(
       `Failed to parse Python extractor output: ${err.message}. Raw output: ${res.stdout}`,
+      { cause: err },
     );
   }
 }

package/src/ubg/fastapi.js

@@ -38,6 +38,7 @@ export function extractFastAPI(cwd, entryFile, pythonCmd = 'python') {
   } catch (err) {
     throw new Error(
       `FastAPI UBG extractor returned invalid JSON: ${err.message}. Raw: ${res.stdout.slice(0, 200)}`,
+      { cause: err },
     );
   }
   if (payload.error) throw new Error(payload.error);

package/src/ubg/genome.js

@@ -134,7 +134,7 @@ export function verifyAntibody(ab) {
   const id = `${ANTIBODY_VERSION}_${sha256(body).slice(0, 32)}`;
   if (id !== ab.id) return { ok: false, reason: 'content-address' };
   // signature: Ed25519 over the same claim bytes the id commits to.
-  let sigOk = false;
+  let sigOk;
   try {
     sigOk = crypto.verify(
       null,