sparda-mcp 0.71.0 → 0.71.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/src/ubg/apocalypse.js +13 -0
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "sparda-mcp",
|
|
3
|
-
"version": "0.71.
|
|
3
|
+
"version": "0.71.1",
|
|
4
4
|
"mcpName": "io.github.zyx77550/sparda-mcp",
|
|
5
5
|
"description": "AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant \u2014 no API key, right in the agent edit loop.",
|
|
6
6
|
"type": "module",
|
|
@@ -31,7 +31,7 @@
|
|
|
31
31
|
"mutation": "node tests/mutation/run.mjs",
|
|
32
32
|
"wedge": "node bench/wedge.mjs",
|
|
33
33
|
"release:check": "node scripts/release-gate.mjs",
|
|
34
|
-
"publish:vscode": "cd extensions/vscode && vsce publish"
|
|
34
|
+
"publish:vscode": "cd extensions/vscode && npx --yes @vscode/vsce@3.9.2 publish"
|
|
35
35
|
},
|
|
36
36
|
"files": [
|
|
37
37
|
"src",
|
package/src/ubg/apocalypse.js
CHANGED
|
@@ -290,8 +290,21 @@ export function checkGraph(graph) {
|
|
|
290
290
|
// "confirm intent" — never hidden, never marked safe, never touches PROVEN. The list is the
|
|
291
291
|
// HEAD of the distribution (deliberately precise, not `**/auth/**` blanket: change-password /
|
|
292
292
|
// 2fa / session management are NOT public, and re-labeling those would hide a real hole).
|
|
293
|
+
//
|
|
294
|
+
// The list is precise, but its TOKENS are not: `register` also names authenticated management
|
|
295
|
+
// (`/account/2fa/register`, `/devices/register`), `webhook`/`hook` a subscription CREATE, and
|
|
296
|
+
// any signature can sit under an authenticated namespace (`/account/…`, `/admin/…`). Because
|
|
297
|
+
// this re-label carries NO evidence of a gate, the asymmetric error model forbids it from
|
|
298
|
+
// firing on those: it must ABSTAIN when the path sits in an authenticated area, or it hides
|
|
299
|
+
// the same unguarded mutation it swears off for change-password, one alternative over (the
|
|
300
|
+
// 2FA-register / webhook-management class). Abstaining only ADDS criticals — the safe direction.
|
|
301
|
+
const authenticatedArea =
|
|
302
|
+
/(^|[:/\- ])(account|accounts|settings|admin|me|profile|2fa|mfa|totp|webhooks?|hooks?|devices?|tokens?|api[_-]?keys?|applications?|integrations?)([/:\- ]|$)/i.test(
|
|
303
|
+
ep.label,
|
|
304
|
+
);
|
|
293
305
|
const expectedPublic =
|
|
294
306
|
!credentialGated &&
|
|
307
|
+
!authenticatedArea &&
|
|
295
308
|
(/(^|[:/\- ])(log-?in|sign-?in|sign-?up|register|log-?out|sign-?out|forgot-?password|reset-?password|forgot|verify-?email|email-?verification|confirm-?email|magic-?link|oauth\d?|openid|sso|saml|health(z|check|-?check)?|livez|readyz|metrics|well-known)([/:\- ]|$)/i.test(
|
|
296
309
|
ep.label,
|
|
297
310
|
) ||
|