{"id":"permission-delta","title":"Privilege expansion between two manifests: npm, Chrome extension, Android","description":"Compares an old and a new manifest and reports every way the new one gains privilege, for agents reviewing dependency bumps and extension or app updates. npm package.json: new or changed install-time lifecycle scripts, gypfile, bin entries and URL/git/file dependencies (including overrides). Chrome manifest.json: added permissions with Chrome's own warning text, host access not covered by the old host_permissions or content_scripts matches (match-pattern coverage, not string equality), externally_connectable, web_accessible_resources and CSP loosening. AndroidManifest.xml: added uses-permission with dangerous/special tier, newly exported components or lost permission guards, grantUriPermissions and debuggable/cleartext/backup flags. Does not fetch packages, inspect code, resolve manifest merging or judge whether a permission is justified.","roi":"Update reviews miss the one new permission, exported service or postinstall hook hidden in a large diff.","audience":"developer","package":"code-preflight-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/permission-delta","path":"/api/v1/permission-delta","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["kind","before","after"],"properties":{"kind":{"type":"string","enum":["npm","chrome-extension","android"],"description":"Manifest format of both documents."},"before":{"type":"string","maxLength":100000,"description":"Old manifest text (package.json, manifest.json or AndroidManifest.xml)."},"after":{"type":"string","maxLength":100000,"description":"New manifest text."},"threshold":{"type":"string","enum":["any","sensitive"],"description":"any (default): every added permission fails. sensitive: ignore Chrome permissions without a warning and Android normal permissions."}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"kind":{"type":"string"},"expanded":{"type":"boolean"},"added":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string"},"item":{"type":"string"},"risk":{"type":"string"}}}},"removed":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string"},"item":{"type":"string"}}}},"addedDependencies":{"type":"array","items":{"type":"string"},"description":"npm only: dependency names newly declared (informational, not an expansion)."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"kind":{"type":"string"},"expanded":{"type":"boolean"},"added":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string"},"item":{"type":"string"},"risk":{"type":"string"}}}},"removed":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string"},"item":{"type":"string"}}}},"addedDependencies":{"type":"array","items":{"type":"string"},"description":"npm only: dependency names newly declared (informational, not an expansion)."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"kind":"chrome-extension","before":"{\"manifest_version\":3,\"permissions\":[\"storage\"],\"host_permissions\":[\"https://*.example.com/*\"]}","after":"{\"manifest_version\":3,\"permissions\":[\"storage\",\"tabs\"],\"host_permissions\":[\"https://api.example.com/*\",\"<all_urls>\"]}"},"openapiOperation":{"operationId":"permission_delta","summary":"Privilege expansion between two manifests: npm, Chrome extension, Android","description":"Compares an old and a new manifest and reports every way the new one gains privilege, for agents reviewing dependency bumps and extension or app updates. npm package.json: new or changed install-time lifecycle scripts, gypfile, bin entries and URL/git/file dependencies (including overrides). Chrome manifest.json: added permissions with Chrome's own warning text, host access not covered by the old host_permissions or content_scripts matches (match-pattern coverage, not string equality), externally_connectable, web_accessible_resources and CSP loosening. AndroidManifest.xml: added uses-permission with dangerous/special tier, newly exported components or lost permission guards, grantUriPermissions and debuggable/cleartext/backup flags. Does not fetch packages, inspect code, resolve manifest merging or judge whether a permission is justified.\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/permission-delta","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["kind","before","after"],"properties":{"kind":{"type":"string","enum":["npm","chrome-extension","android"],"description":"Manifest format of both documents."},"before":{"type":"string","maxLength":100000,"description":"Old manifest text (package.json, manifest.json or AndroidManifest.xml)."},"after":{"type":"string","maxLength":100000,"description":"New manifest text."},"threshold":{"type":"string","enum":["any","sensitive"],"description":"any (default): every added permission fails. sensitive: ignore Chrome permissions without a warning and Android normal permissions."}}},"example":{"kind":"chrome-extension","before":"{\"manifest_version\":3,\"permissions\":[\"storage\"],\"host_permissions\":[\"https://*.example.com/*\"]}","after":"{\"manifest_version\":3,\"permissions\":[\"storage\",\"tabs\"],\"host_permissions\":[\"https://api.example.com/*\",\"<all_urls>\"]}"}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"kind":{"type":"string"},"expanded":{"type":"boolean"},"added":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string"},"item":{"type":"string"},"risk":{"type":"string"}}}},"removed":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string"},"item":{"type":"string"}}}},"addedDependencies":{"type":"array","items":{"type":"string"},"description":"npm only: dependency names newly declared (informational, not an expansion)."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/permission-delta/","docsJson":"https://agents.writerslogic.com/docs/permission-delta.json","sample":"https://agents.writerslogic.com/api/v1/samples/permission-delta","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}