Files

T

Adrian PerezandClaude Opus 4.7 6ace4bf7c8 docs(mcp): add Phase 10 pre-push audit reports (5 agents)

Five parallel audit agents reviewed the branch before open-sourcing
the PR to pascalorg/editor:

- a1-secrets.md: SAFE TO PUSH. Scanned 176 files / 40,768 diff lines.
  Zero secrets, tokens, API keys, PEM blocks, JWTs, or cookies.
  Only MEDIUM finding: absolute /Users/adrian paths in test-report
  scripts (cosmetic, not security).

- a2-security.md: FOUND 2 HIGH-severity issues, both FIXED in
  commit 8757de0:
  * PUT /api/scenes/[id] still had the loose graphSchema that POST
    got fixed in Phase 8 P4. Shared schema extracted to
    apps/editor/lib/graph-schema.ts so both routes re-validate.
  * photo_to_scene + analyze_floorplan_image + analyze_room_photo
    all did raw fetch(url) on user-supplied URLs - a textbook SSRF
    to 169.254.169.254 cloud metadata. Added safe-fetch.ts with
    private-IP / link-local / .local-hostname denylists, manual
    redirect revalidation, size cap, timeout, env-allowlist.

- a3-code-quality.md: READY FOR REVIEW. Zero production `any`, all
  tools Zod-validated in+out, uniform error handling,
  conventional-commits. Two non-blocking follow-ups: client editor
  components (SceneLoader, SaveButton) have no tests; document
  check_collisions n^2 scaling.

- a4-performance.md: SHIP WITH NOTES. MCP dist 904 KB, Supabase
  lazy-imported (zero editor bundle impact), v0.1 hot paths
  sub-200ms. Flagged: FilesystemSceneStore.index.json O(n) per
  write (fine <1k scenes), concurrency races (documented in P8),
  client render at 5k nodes unverified.

- a5-pr-description.md: polished final PR description that
  corrected stale test counts (294 not 142), disclosed all 5
  cross-cutting surfaces, named the known failures honestly,
  split the checklist, expanded the scope to the real Phase 7
  deliverables.

Overall verdict: READY TO PUSH after the A2 fixes landed. No
blockers remain.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-19 21:00:02 +02:00

2.9 KiB

Raw Blame History

A1 — Secrets + PII scan

Summary

SAFE TO PUSH. No real secrets, tokens, credentials, JWTs, PEM blocks, or PII leaked. Personal email rexinacho@gmail.com appears only in Co-Authored-By-equivalent git author metadata (a public identity the user already uses for GitHub). Several MEDIUM-severity absolute-path hardcodes (/Users/adrian/...) in test-report scripts do not reveal secrets but do reveal local machine layout.

BLOCKERS

None.

HIGH

None. Author email rexinacho@gmail.com is the committer identity on all 18 commits — treated as acceptable public identity (same address baked into git log of any fork). No other email, no user UUID, no machine hostname, no cookie values leaked.

MEDIUM

/Users/adrian/Desktop/editor/.worktrees/mcp-server/... hardcoded in 7 committed TS scripts and ~10 committed MD reports. Not secrets, but exposes local filesystem layout and worktree name. Files: packages/mcp/test-reports/villa-azul/{v2-geometry,v3-dimensions,v4-openings,v5-http}.ts, packages/mcp/test-reports/casa-sol/build.ts, packages/mcp/test-reports/phase8/p4-url-hardening.ts, packages/mcp/test-reports/t2-http/run.ts, plus md files under test-reports/phase8/ and test-reports/villa-azul/. Redact with sed replacing /Users/adrian/Desktop/editor/.worktrees/mcp-server -> <repo> or move absolute paths behind process.cwd().
Hardcoded dev URLs http://localhost:3917 and http://localhost:3002 appear in test-reports only (never in production source under apps/editor/app/** or packages/mcp/src/** shipped code). Acceptable for test fixtures; flag for follow-up.

LOW

/tmp/pascal-* paths in test scripts — not user-specific (generic tmp); fine to ship.
apps/editor/env.mjs correctly references env-var names (SUPABASE_SERVICE_ROLE_KEY, BETTER_AUTH_SECRET, RESEND_API_KEY, GOOGLE_CLIENT_SECRET) via process.env.* — no values.

Files scanned

diff size: 40768 lines, 176 files
untracked files: none
.env files present in diff: none; .env.example at repo root (placeholder comments only, not in diff)
direct reads: .github/workflows/mcp-ci.yml (clean, no secret values), packages/mcp/sql/migrations/0001_scenes.sql (schema + RLS only), packages/mcp/package.json (no tokens in scripts), apps/editor/public/dev/casa-sol.json (scene geometry only), packages/mcp/test-reports/villa-azul/build-summary.json (synthetic IDs)
git authors: all 18 commits by Adrian Perez <rexinacho@gmail.com> — consistent, no stray identities
no .orig, .swp, .DS_Store, binary blobs staged
regex scans for sk_live_, sk_test_, ghp_, AKIA, AIza, xoxb-, eyJ..., -----BEGIN, JWTs, npm_[A-Za-z0-9]{36}, Authorization: Bearer — all zero matches

Confidence

high

One-line verdict for integrator: SAFE TO PUSH (optional MEDIUM cleanup: redact /Users/adrian/... paths from committed test-reports before publishing a polished PR)

2.9 KiB Raw Blame History