@thotischner/observability-mcp 1.3.1 → 1.3.2

package/dist/config/loader.d.ts

@@ -2,5 +2,6 @@ import type { Config, GeneralSettings, HealthThresholds } from "../types.js";
 export declare const DEFAULT_SETTINGS: GeneralSettings;
 export declare const DEFAULT_HEALTH_THRESHOLDS: HealthThresholds;
 export declare function substituteEnv(raw: string): string;
+export declare function substituteEnvInTree<T>(node: T): T;
 export declare function loadConfig(): Config;
 export declare function saveConfig(config: Config): void;

package/dist/config/loader.js

@@ -34,10 +34,28 @@ export function substituteEnv(raw) {
         return "";
     });
 }
+// Walk the parsed YAML tree and substitute ${VAR} only inside string values.
+// Comments don't survive yaml.load(), so this side-steps the bug where the
+// regex previously fired on `${...}` written in #-prefixed YAML comments.
+export function substituteEnvInTree(node) {
+    if (typeof node === "string")
+        return substituteEnv(node);
+    if (Array.isArray(node))
+        return node.map((v) => substituteEnvInTree(v));
+    if (node && typeof node === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(node)) {
+            out[k] = substituteEnvInTree(v);
+        }
+        return out;
+    }
+    return node;
+}
 export function loadConfig() {
     try {
         const raw = readFileSync(CONFIG_PATH, "utf-8");
-        const parsed = yaml.load(substituteEnv(raw));
+        const parsedRaw = yaml.load(raw);
+        const parsed = substituteEnvInTree(parsedRaw || {});
         return {
             sources: parsed?.sources || [],
             settings: { ...DEFAULT_SETTINGS, ...parsed?.settings },

package/dist/config/loader.test.js

@@ -167,6 +167,34 @@ sources:
             delete process.env.A;
             delete process.env.B;
         });
+        it("does not substitute or warn for ${VAR} inside YAML comments (#17)", async () => {
+            delete process.env.VAR;
+            const configPath = join(TMP_DIR, "comments.yaml");
+            writeFileSync(configPath, `
+# Note: \${VAR}-style substitution is resolved at runtime from .env.
+# Another mention of \${SHOULD_NOT_WARN} in prose.
+sources:
+  - name: example
+    type: prometheus
+    url: http://localhost:9090
+    enabled: true
+`);
+            process.env.CONFIG_PATH = configPath;
+            const warnings = [];
+            const origWarn = console.warn;
+            console.warn = (msg) => warnings.push(msg);
+            try {
+                const mod = await import("./loader.js?" + Date.now());
+                const config = mod.loadConfig();
+                assert.equal(config.sources.length, 1);
+                assert.equal(config.sources[0].url, "http://localhost:9090");
+                const hits = warnings.filter((w) => w.includes("VAR") || w.includes("SHOULD_NOT_WARN"));
+                assert.equal(hits.length, 0, `expected no warnings for comment placeholders, got: ${hits.join("; ")}`);
+            }
+            finally {
+                console.warn = origWarn;
+            }
+        });
         it("substitutes inside loaded YAML config", async () => {
             process.env.GRAFANA_USER = "12345";
             process.env.GRAFANA_TOKEN = "secret-token";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thotischner/observability-mcp",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "Unified observability gateway for AI agents — one MCP server for Prometheus, Loki, and any backend",
   "type": "module",
   "license": "MIT",