v0.7.0: request-body check (BODY)

Added

• BODY check for POST/PUT/PATCH calls with an inline JSON map: fails when the app sends a key the backend's request model does not declare (Pydantic drops it silently) or omits a field the model requires. Request models resolve across files with inheritance, Optional[X], Field(alias=...); Depends/Query/Path/... params are not bodies; list bodies are not judged. OpenAPI requestBody supported. --no-body switch.
• Findings are per call site: one path used with several verbs keeps each verb's model and body; a METHOD finding no longer hides other sites' FIELD/BODY.

Fixed (found auditing real apps)

• Ternary values ('platform': isIOS ? 'ios' : ...) were read as body keys.
• if (x) 'k': v entries lost their if.
• Bodies in the endpoints file were never parsed.

Verified

Mutation-tested on copies of real apps: renamed body key, path typo, verb change and renamed model key are each reported at the exact call site; unmutated apps stay at 0 findings. 50+ tests.

Limits

Only inline maps are seen (not data: payload.toJson()); nested fields are not flattened; Optional[X] without a default counts as not required.

Update

claude plugin marketplace update neo-plugins && claude plugin update fullstack-sync@neo-plugins, then restart Claude Code.

v0.6.0: per-endpoint field check, fewer false positives

Added

• Per-endpoint FIELD check: links each HTTP call to the Model.fromJson that parses it and to the backend response model for that endpoint. Fails only for a non-null cast (j['id'] as String) the backend does not declare; anything the scan cannot prove required is a FIELD? review item. Dict-returning endpoints are skipped, never guessed.
• Dart constants resolved ('$v4/x'), trailing $path-style dynamic segments checked as a prefix (DYNAMIC).
• FastAPI extractor: response models across files, inheritance, List/Optional/X | None, return annotations, Field(alias=...); static include_router prefixes; backend.prefix_rule for directory-derived mounting.
• Loose FIELD? = the backend never mentions the name anywhere (fields, attributes, kwargs, dict keys, strings).
• Stop hook also lists FIELD findings; --no-endpoint-fields switch.

Limits

Nested response fields are not flattened; request bodies are not compared per endpoint; no multi-level router chains; whether the app tolerates a missing key is only judged by a non-null cast.

Update

claude plugin marketplace update neo-plugins && claude plugin update fullstack-sync@neo-plugins, then restart Claude Code.

v0.5.0: methods and field names in the drift check

Added

• drift_check.py checks HTTP methods (METHOD) as well as paths (PATH), both fail the run.
• --fields: FIELD? review list of JSON keys the app reads in fromJson / writes in toJson that no backend model declares (snake_case-normalised). --strict-fields makes it fail. A coverage guard skips the list when the extractor cannot see the backend's models.
• The Stop hook runs the check and prints concrete PATH/METHOD lines in its nudge.
• OpenAPI source (--openapi) now supplies methods and schema fields.
• Opt-outs: // fss-ignore and drift_ignore in the config.

Fixed

• A verb from an earlier statement leaked into a later wrapper call (false METHOD).
• An unserved-prefix rule hid real endpoints that were also a prefix of another path.

Limits

Per-endpoint field checking (a field on the wrong model) stays with the model-driven api-contract-sync skill. Dynamic paths are not seen.

Update

claude plugin marketplace update neo-plugins && claude plugin update fullstack-sync@neo-plugins, then restart Claude Code.

v0.4.0: CI drift gate (no Claude needed)

Added

• scripts/drift_check.py: fails a PR when the app calls a path the backend does not serve. Backend from the FastAPI extractor or an OpenAPI file (--openapi). Exit 0 in sync, 1 drift, 2 bad input; --json, --warn.
• Example GitHub Actions workflow: docs/examples/drift-gate.yml.
• Tests for path normalisation, prefix tolerance, call-context filtering, base-constant skipping and CLI exit codes.

Limits

Paths only (no methods or fields). Dynamically built paths are not seen. Prefixes present on one side only are tolerated, so it can miss a drift but should not invent one.

Update

claude plugin marketplace update neo-plugins && claude plugin update fullstack-sync@neo-plugins, then restart Claude Code.

v0.3.1: fast drift-check hook

Fixed

• The drift-check Stop hook no longer walks .venv, .git, node_modules, caches or worktrees. On real FastAPI backends it took 8 to 14 s and often hit the hook timeout; it now takes about 0.1 to 1 s with identical output.
• Files that fail to parse are skipped instead of failing the run.
• Project paths containing quotes no longer break hook state handling.

Changed

• Extractor takes --max-seconds (hook uses 6 s, then falls back to a coarse nudge).
• Stop hook timeout 15 s to 10 s.
• Added MIT license, changelog, README badges.

Update

claude plugin marketplace update neo-plugins && claude plugin update fullstack-sync@neo-plugins, then restart Claude Code.

Full list: CHANGELOG.md