fix(t5): Align Zod and MCP SDK versions (F20, F21) - #6
Merged
Conversation
- F20: Zod range widened ^4.3.6 → ^3.24.0 || ^4.0.0 (npm dedup for Zod 3.x consumers) - F21: MCP SDK pinned ^1.0.0 → ^1.27.1 (ensures required protocol features) - Version bump 0.7.4 → 0.7.5 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThis release bumps the package version from 0.7.5 to 0.7.5 and updates dependency constraints. The MCP SDK minimum is pinned to ^1.27.1, and Zod range is widened to ^3.24.0 || ^4.0.0 for improved npm deduplication. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Comment |
kyalabs
added a commit
that referenced
this pull request
Mar 25, 2026
- Filter case-variant kya-token headers before spreading in webFetch so agents can't override the server-injected Kya-Token (Badge #6) - Update lastEnrolledMerchant on cache hit in getCachedBadgeToken so no-arg getHeaders() returns the correct merchant context (Badge #11) 178/178 tests passing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
kyalabs
added a commit
that referenced
this pull request
Mar 26, 2026
* refactor: extract isPublicOrigin() to shared url-safety module
SSRF protection was defined locally in ucp-manifest.ts. Extract to
src/lib/url-safety.ts so kya_web_fetch and future outbound fetch
tools can reuse it. Zero functional change — import replaces inline.
Adds 16 tests covering RFC1918, localhost, IPv6 private, link-local,
AWS metadata (169.254.x), and malformed URL cases.
Part of: KYA-55
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add kya_getHeaders tool for browser automation identity
Returns { headers: { "Kya-Token": token } } for agents using
Playwright (setExtraHTTPHeaders) or Chrome extensions (document.cookie).
Returns NO_IDENTITY error when no identity established.
Part of: KYA-55 (Path 2/2.5 identity delivery)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add kya_web_fetch tool with auto-declare and SSRF protection
Primary identity delivery path. Wraps fetch with:
- Kya-Token header auto-injection
- Auto-declare (browse_declared event, fire-and-forget)
- SSRF protection via isPublicOrigin()
- HTTPS-only, 5MB body cap, 30s timeout
- Manual redirects (prevents token leak to redirect targets)
- Method allowlist: GET, HEAD, OPTIONS
- Response header filtering (strips set-cookie)
29 tests covering identity, URL validation, SSRF, methods, fetch
behavior, truncation, timeouts, auto-declare, and header override
prevention.
Part of: KYA-55 (Path 1 identity delivery)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: register new tools + deprecate legacy reporting
Register kya_web_fetch and kya_getHeaders in index.ts.
Deprecate kya_reportBadgeOutcome and kya_reportBadgeNotPresented
to no-ops — outcomes tracked server-side via verify endpoint,
not-presented event no longer scored. Both log once-per-session
stderr warning. Remove unused imports.
Update kya_reportBadgePresented description to stop referencing
the now-deprecated kya_reportBadgeOutcome.
Part of: KYA-55
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: bump to v2.5.0 + CHANGELOG for identity delivery
Version 2.4.0 → 2.5.0 (minor: new tools, deprecations, no breaking changes).
CHANGELOG documents kya_web_fetch, kya_getHeaders, deprecations.
.gitignore adds .env patterns.
Part of: KYA-55
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: credential bridge — inject kya_* badge token, not consent key (KYA-98)
The #1 E2E blocker. getHeaders() and webFetch() were injecting the
consent key (pk_* / OAuth token) as Kya-Token header. The verify
endpoint expects kya_* opaque tokens from /api/badge/enroll.
Fix:
- New module badge-token.ts: per-merchant badge token cache + enroll API
- getAgentIdentity: calls enroll after identity established (fire-and-forget)
- webFetch: looks up cached badge token by merchant, enrolls on-the-fly if needed
- getHeaders: reads from badge token cache (last enrolled merchant)
Also updates NEXT_STEP_TEXT to reference 2.0 tools (KYA-105).
178 tests passing (10 new in badge-token.test.ts).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: send consent key as Bearer auth on enroll call (KYA-106 compat)
Enroll endpoint now requires auth. badge-token.ts must send the
consent key as Authorization: Bearer header when calling enroll.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: address CodeRabbit review findings on KYA-55
- Filter case-variant kya-token headers before spreading in webFetch
so agents can't override the server-injected Kya-Token (Badge #6)
- Update lastEnrolledMerchant on cache hit in getCachedBadgeToken
so no-arg getHeaders() returns the correct merchant context (Badge #11)
178/178 tests passing.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(deps): patch picomatch CVEs (GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p)
npm audit fix — upgrades picomatch transitive dep to patched version.
ReDoS via extglob quantifiers + method injection in POSIX character classes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Marty CPO <james@kyalabs.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
^4.3.6to^3.24.0 || ^4.0.0— matches mcp-server, improves npm deduplication for Zod 3.x consumers^1.0.0to^1.27.1— ensures required protocol features are presentTest plan
npm installresolves without errorsnpm ls zod→4.3.6(same as mcp-server)npm ls @modelcontextprotocol/sdk→1.27.1(same as mcp-server)npm run buildpassesnpm testpasses (24/24)Refs
MCPDuro_Mar6 Tier 5
🤖 Generated with Claude Code
Summary by CodeRabbit