v0.7.0: request-body check (BODY)

Added

• BODY check for POST/PUT/PATCH calls with an inline JSON map: fails when the app sends a key the backend's request model does not declare (Pydantic drops it silently) or omits a field the model requires. Request models resolve across files with inheritance, Optional[X], Field(alias=...); Depends/Query/Path/... params are not bodies; list bodies are not judged. OpenAPI requestBody supported. --no-body switch.
• Findings are per call site: one path used with several verbs keeps each verb's model and body; a METHOD finding no longer hides other sites' FIELD/BODY.

Fixed (found auditing real apps)

• Ternary values ('platform': isIOS ? 'ios' : ...) were read as body keys.
• if (x) 'k': v entries lost their if.
• Bodies in the endpoints file were never parsed.

Verified

Mutation-tested on copies of real apps: renamed body key, path typo, verb change and renamed model key are each reported at the exact call site; unmutated apps stay at 0 findings. 50+ tests.

Limits

Only inline maps are seen (not data: payload.toJson()); nested fields are not flattened; Optional[X] without a default counts as not required.

Update

claude plugin marketplace update neo-plugins && claude plugin update fullstack-sync@neo-plugins, then restart Claude Code.