speclock 4.5.6 → 4.5.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +16 -13
  2. package/package.json +2 -2
  3. package/src/cli/index.js +1 -1
  4. package/src/core/compliance.js +1 -1
  5. package/src/core/telemetry.js +1 -1
  6. package/src/dashboard/index.html +2 -2
  7. package/src/mcp/http-server.js +1 -1
  8. package/src/mcp/server.js +1 -1
package/README.md CHANGED
@@ -30,7 +30,7 @@ AI: ⚠️ BLOCKED — violates lock "Never touch the auth system"
30
30
  Should I find another approach?
31
31
  ```
32
32
 
33
- **60 test suites. 100% detection. 0% false positives. Gemini Flash hybrid for universal domain coverage.**
33
+ **557 tests. 98% pass rate. 0 false positives across 5 domains. Gemini Flash hybrid for universal domain coverage.**
34
34
 
35
35
  ---
36
36
 
@@ -109,7 +109,7 @@ Same config — add to `.cursor/mcp.json` or equivalent.
109
109
  |---|:---:|:---:|:---:|:---:|
110
110
  | Remembers context | Yes | Yes | Manual | **Yes** |
111
111
  | **Blocks the AI from breaking things** | No | No | No | **Yes** |
112
- | **Semantic conflict detection** | No | No | No | **100% detection, 0% FP** |
112
+ | **Semantic conflict detection** | No | No | No | **98% detection, 0% FP** |
113
113
  | **Tamper-proof audit trail** | No | No | No | **HMAC-SHA256 chain** |
114
114
  | **Hard enforcement (AI cannot proceed)** | No | No | No | **Yes** |
115
115
  | **SOC 2 / HIPAA compliance exports** | No | No | No | **Yes** |
@@ -134,7 +134,7 @@ Not keyword matching — **real semantic analysis** with Gemini Flash hybrid for
134
134
  <tr><td>Dilution attacks</td><td>100%</td><td>Violation buried in multi-part request</td></tr>
135
135
  <tr><td>Compound sentences</td><td>100%</td><td>"Update UI and also drop users table"</td></tr>
136
136
  <tr><td>Synonym substitution</td><td>100%</td><td>"Sunset the API" = remove the API</td></tr>
137
- <tr><td>Payment brand names</td><td>100%</td><td>"Add Razorpay" vs "Never change payment gateway"</td></tr>
137
+ <tr><td>Payment brand names (11 gateways)</td><td>100%</td><td>"Add Razorpay" / "Implement PayU" vs "Must use Stripe"</td></tr>
138
138
  <tr><td>Salary/payroll cross-vocab</td><td>100%</td><td>"Optimize salary" vs "Payroll records locked"</td></tr>
139
139
  <tr><td>Safety system bypass</td><td>100%</td><td>"Disable safety interlock" = bypass safety</td></tr>
140
140
  <tr><td>Unknown domains (via Gemini)</td><td>100%</td><td>Gaming, biotech, aerospace, music, legal</td></tr>
@@ -386,7 +386,7 @@ The AI opens the file and sees:
386
386
  ┌────────────▼──────────────────▼──────────────────┐
387
387
  │ SpecLock Core Engine │
388
388
  │ │
389
- │ Semantic Engine ─── 55 synonym groups │
389
+ │ Semantic Engine ─── 65+ synonym groups │
390
390
  │ HMAC Audit ──────── SHA-256 hash chain │
391
391
  │ Enforcer ────────── advisory / hard block │
392
392
  │ Auth + RBAC ─────── 4 roles, API keys │
@@ -426,15 +426,18 @@ The AI opens the file and sees:
426
426
 
427
427
  ## Test Results
428
428
 
429
- | Suite | Tests | Pass Rate |
430
- |-------|------:|----------:|
431
- | Direct Mode (heuristic) | 17 | 100% |
432
- | Payment/Salary Domain | 18 | 100% |
433
- | Gemini Hybrid (8 domains) | 16 | 100% |
434
- | Proxy API Endpoint | 9 | 100% |
435
- | **Total** | **60** | **100%** |
429
+ | Suite | Tests | Pass Rate | What it covers |
430
+ |-------|------:|----------:|----------------|
431
+ | Adversarial Conflict | 61 | 100% | Euphemisms, temporal evasion, compound sentences |
432
+ | Phase 4 (Multi-domain) | 91 | 100% | Fintech, e-commerce, IoT, healthcare, SaaS |
433
+ | John (Indie Dev Journey) | 86 | 100% | 8-session Bolt.new build with 5 locks |
434
+ | Sam (Enterprise HIPAA) | 124 | 100% | HIPAA locks, PHI, encryption, RBAC |
435
+ | Real-World Testers | 105 | 95% | 5 developers, 30+ locks, diverse domains |
436
+ | Payment/Salary/PII | 35 | 100% | Cross-vocabulary: payroll, salary, compensation |
437
+ | Claude Tester (G-Suite) | 55 | 95% | Independent AI tester, adversarial probing |
438
+ | **Total** | **557** | **98%** | |
436
439
 
437
- Tested across: fintech, e-commerce, IoT, healthcare, SaaS, gaming, biotech, aerospace, music, legal, payments, payroll. Zero false positives on UI/cosmetic actions.
440
+ Tested across: fintech, e-commerce, IoT, healthcare, SaaS, gaming, biotech, aerospace, payments, payroll. All 11 Indian payment gateways detected (Razorpay, PayU, Cashfree, PhonePe, Paytm, CCAvenue, BillDesk, Instamojo, Juspay, Stripe, PayPal). Zero false positives on UI/cosmetic actions.
438
441
 
439
442
  ---
440
443
 
@@ -472,4 +475,4 @@ Built by **[Sandeep Roy](https://github.com/sgroy10)**
472
475
 
473
476
  ---
474
477
 
475
- <p align="center"><i>v4.5.6 — 600+ tests, 31 MCP tools, 0 false positives, Gemini hybrid. Because remembering isn't enough.</i></p>
478
+ <p align="center"><i>v4.5.7 — 557 tests, 98% pass rate, 31 MCP tools, Gemini hybrid. Because remembering isn't enough.</i></p>
package/package.json CHANGED
@@ -2,9 +2,9 @@
2
2
 
3
3
  "name": "speclock",
4
4
 
5
- "version": "4.5.6",
5
+ "version": "4.5.7",
6
6
 
7
- "description": "AI constraint engine with Gemini LLM universal detection, Policy-as-Code DSL, OAuth/OIDC SSO, admin dashboard, telemetry, API key auth, RBAC, AES-256-GCM encryption, hard enforcement, semantic pre-commit, HMAC audit chain, SOC 2/HIPAA compliance. Cross-platform: MCP + direct API. 31 MCP tools + CLI. Enterprise platform.",
7
+ "description": "AI constraint engine — stops AI from breaking what you locked. Semantic detection, Gemini LLM hybrid, 31 MCP tools, HMAC audit chain, RBAC, encryption, SOC 2/HIPAA compliance. Works with Claude Code, Cursor, Bolt.new, Lovable.",
8
8
 
9
9
  "type": "module",
10
10
 
package/src/cli/index.js CHANGED
@@ -117,7 +117,7 @@ function refreshContext(root) {
117
117
 
118
118
  function printHelp() {
119
119
  console.log(`
120
- SpecLock v4.5.6 — AI Constraint Engine (Gemini LLM + Policy-as-Code + SSO + Dashboard + Telemetry + Auth + RBAC + Encryption)
120
+ SpecLock v4.5.7 — AI Constraint Engine (Gemini LLM + Policy-as-Code + SSO + Dashboard + Telemetry + Auth + RBAC + Encryption)
121
121
  Developed by Sandeep Roy (github.com/sgroy10)
122
122
 
123
123
  Usage: speclock <command> [options]
package/src/core/compliance.js CHANGED
@@ -9,7 +9,7 @@
9
9
  import { readBrain, readEvents } from "./storage.js";
10
10
  import { verifyAuditChain } from "./audit.js";
11
11
 
12
- const VERSION = "4.5.6";
12
+ const VERSION = "4.5.7";
13
13
 
14
14
  // PHI-related keywords for HIPAA filtering
15
15
  const PHI_KEYWORDS = [
package/src/core/telemetry.js CHANGED
@@ -257,7 +257,7 @@ export async function flushToRemote(root) {
257
257
  // Build anonymized payload
258
258
  const payload = {
259
259
  instanceId: summary.instanceId,
260
- version: "4.5.6",
260
+ version: "4.5.7",
261
261
  totalCalls: summary.totalCalls,
262
262
  avgResponseMs: summary.avgResponseMs,
263
263
  conflicts: summary.conflicts,
package/src/dashboard/index.html CHANGED
@@ -89,7 +89,7 @@
89
89
  <div class="header">
90
90
  <div>
91
91
  <h1><span>SpecLock</span> Dashboard</h1>
92
- <div class="meta">v4.5.6 &mdash; AI Constraint Engine</div>
92
+ <div class="meta">v4.5.7 &mdash; AI Constraint Engine</div>
93
93
  </div>
94
94
  <div style="display:flex;align-items:center;gap:12px;">
95
95
  <span id="health-badge" class="status-badge healthy">Loading...</span>
@@ -182,7 +182,7 @@
182
182
  </div>
183
183
 
184
184
  <div style="text-align:center;padding:24px;color:var(--muted);font-size:12px;">
185
- SpecLock v4.5.6 &mdash; Developed by Sandeep Roy &mdash; <a href="https://github.com/sgroy10/speclock" style="color:var(--accent)">GitHub</a>
185
+ SpecLock v4.5.7 &mdash; Developed by Sandeep Roy &mdash; <a href="https://github.com/sgroy10/speclock" style="color:var(--accent)">GitHub</a>
186
186
  </div>
187
187
 
188
188
  <script>
package/src/mcp/http-server.js CHANGED
@@ -91,7 +91,7 @@ import { fileURLToPath } from "url";
91
91
  import _path from "path";
92
92
 
93
93
  const PROJECT_ROOT = process.env.SPECLOCK_PROJECT_ROOT || process.cwd();
94
- const VERSION = "4.5.6";
94
+ const VERSION = "4.5.7";
95
95
  const AUTHOR = "Sandeep Roy";
96
96
  const START_TIME = Date.now();
97
97
 
package/src/mcp/server.js CHANGED
@@ -100,7 +100,7 @@ const PROJECT_ROOT =
100
100
  args.project || process.env.SPECLOCK_PROJECT_ROOT || process.cwd();
101
101
 
102
102
  // --- MCP Server ---
103
- const VERSION = "4.5.6";
103
+ const VERSION = "4.5.7";
104
104
  const AUTHOR = "Sandeep Roy";
105
105
 
106
106
  const server = new McpServer(