@massa-ai/mcp-client 1.18.0 → 1.19.0

package/dist/index.js

@@ -136508,6 +136508,72 @@ var init_attribution_resolver = __esm(() => {
   init_session_pin_store();
 });
 
+// ../../packages/core/dist/kernel/sanitize/credential-scrub.js
+function markerFor(id) {
+  return `[REDACTED:${id}]`;
+}
+function fullMatchRule(id, pattern) {
+  const marker26 = markerFor(id);
+  return {
+    id,
+    replace(text3) {
+      let count = 0;
+      const replaced = text3.replace(pattern, () => {
+        count++;
+        return marker26;
+      });
+      return { text: replaced, count };
+    }
+  };
+}
+function scrubCredentials(payloadJson) {
+  const redactions = {};
+  for (const id of RULE_IDS)
+    redactions[id] = 0;
+  let text3 = payloadJson;
+  for (const rule of RULES) {
+    const { text: next, count } = rule.replace(text3);
+    text3 = next;
+    redactions[rule.id] += count;
+  }
+  const total = Object.values(redactions).reduce((sum, n) => sum + n, 0);
+  return {
+    sanitized: text3,
+    redactions,
+    total
+  };
+}
+var PEM_PATTERN, JWT_PATTERN, AWS_KEY_PATTERN, SK_KEY_PATTERN, GITHUB_TOKEN_PATTERN, SLACK_TOKEN_PATTERN, BEARER_PATTERN, RULES, RULE_IDS;
+var init_credential_scrub = __esm(() => {
+  PEM_PATTERN = /-----BEGIN [A-Z ]{0,32}PRIVATE KEY-----[\s\S]{0,8192}?-----END [A-Z ]{0,32}PRIVATE KEY-----/g;
+  JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+  AWS_KEY_PATTERN = /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g;
+  SK_KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
+  GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g;
+  SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{18,}\b/g;
+  BEARER_PATTERN = /(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})/g;
+  RULES = [
+    fullMatchRule("pem", PEM_PATTERN),
+    fullMatchRule("jwt", JWT_PATTERN),
+    fullMatchRule("aws-key", AWS_KEY_PATTERN),
+    fullMatchRule("sk-key", SK_KEY_PATTERN),
+    fullMatchRule("github-token", GITHUB_TOKEN_PATTERN),
+    fullMatchRule("slack-token", SLACK_TOKEN_PATTERN),
+    {
+      id: "bearer",
+      replace(text3) {
+        let count = 0;
+        const replaced = text3.replace(BEARER_PATTERN, (_m, prefix) => {
+          count++;
+          return `${prefix}${markerFor("bearer")}`;
+        });
+        return { text: replaced, count };
+      }
+    }
+  ];
+  RULE_IDS = RULES.map((r) => r.id);
+});
+
 // ../../packages/core/dist/tools/compact_snapshot.js
 class CompactSnapshotTool {
   name = "compact_snapshot";
@@ -136559,19 +136625,26 @@ class CompactSnapshotTool {
         persistedId = newObservationId();
         try {
           const attribution = await (this.resolverOverride ?? getAttributionResolver()).resolve({ callerProjectId: projectId, sessionId, cwd });
+          const scrub = scrubCredentials(JSON.stringify({
+            snapshot: snapshot.xml,
+            eventCount: snapshot.eventCount,
+            compactCount: snapshot.compactCount,
+            generatedAt: snapshot.generatedAt,
+            sectionCount: snapshot.sections.length
+          }));
+          if (scrub.total > 0) {
+            logger.debug("compact_snapshot payload redacted before persist", {
+              redactions: scrub.redactions,
+              total: scrub.total
+            });
+          }
           store4.insert({
             id: persistedId,
             projectId: attribution.projectId,
             sessionId,
             source: "pre-compact",
             category: "compaction-snapshots",
-            payloadJson: JSON.stringify({
-              snapshot: snapshot.xml,
-              eventCount: snapshot.eventCount,
-              compactCount: snapshot.compactCount,
-              generatedAt: snapshot.generatedAt,
-              sectionCount: snapshot.sections.length
-            }),
+            payloadJson: scrub.sanitized,
             importance: 0.8,
             createdAt: Date.now(),
             attributionSource: attribution.source
@@ -136623,6 +136696,7 @@ var init_compact_snapshot = __esm(() => {
   init_observation_repository();
   init_compaction_snapshot_service();
   init_attribution_resolver();
+  init_credential_scrub();
 });
 
 // ../../packages/core/dist/tools/list_projects.js
@@ -162259,13 +162333,20 @@ class HookService {
     });
     const id = this.idFactory();
     this.queue.enqueue(async () => {
+      const scrub = scrubCredentials(JSON.stringify(ev.payload));
+      if (scrub.total > 0) {
+        logger.debug("hook payload redacted before persist", {
+          redactions: scrub.redactions,
+          total: scrub.total
+        });
+      }
       const obs = {
         id,
         projectId: attribution.projectId,
         sessionId: ev.sessionId,
         source: ev.event,
         category: extractCategory(ev.event, ev.payload),
-        payloadJson: JSON.stringify(ev.payload),
+        payloadJson: scrub.sanitized,
         importance: ev.importance,
         createdAt: ev.ts,
         agentId: ev.agentId,
@@ -162326,6 +162407,7 @@ var init_hook_service = __esm(() => {
   init_observation_extractor();
   init_observation_consolidation_job();
   init_attribution_resolver();
+  init_credential_scrub();
   ValidationError = class ValidationError extends Error {
     code;
     constructor(code, message) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massa-ai/mcp-client",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "massa-ai MCP server - Semantic code search, memory, and context compression via Model Context Protocol",
   "author": "luizgmassa",
   "type": "module",
@@ -20,8 +20,8 @@
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
-    "@massa-ai/core": "^1.18.0",
-    "@massa-ai/shared": "^1.18.0",
+    "@massa-ai/core": "^1.19.0",
+    "@massa-ai/shared": "^1.19.0",
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "devDependencies": {