powerlab-mcp: /version exposes commit hash unauthenticated

[neochaotic]

Status: minor info-disclosure, defer.

What

GET /version is unauthenticated (open from loopback + LAN) and returns:

{"version":"0.7.5","commit":"abc1234","date":"2026-05-28T12:00:00Z"}

Any LAN host (no PowerLab login required) can fingerprint the EXACT commit. That accelerates "which CVEs apply to this box?" research for an attacker who got LAN access through some other means.

Trade-offs

• Keep open / keep commit: simplest; monitoring + ops scripts that probe build identity work without a token. Matches what every other PowerLab service does.
• Keep open / drop commit: return only version on the unauthenticated endpoint; expose commit only behind the JWT gate. Mild hardening.
• Gate it entirely: requires a token for /version. Breaks the "is this thing running v0.7.5?" probe pattern; hurts operator UX more than it helps security.

Recommendation

(2) — drop commit + date from the unauthenticated response, expose the full BuildInfo via an MCP resource (system://build or similar) gated by the same auth layer that gates other resources. Operators still see version on /version; agents see the full identity inside the protocol.

Adversarial battery context

Found while running an adversarial battery against the local binary (2026-05-28) ahead of the MCP MVP cut. Threat model: information disclosure to LAN-resident attackers.