observability-toolkit 2.0.0 → 2.1.1

package/dist/lib/errors/error-sanitizer.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Error message sanitization utilities for observability-toolkit MCP server
+ *
+ * Prevents information disclosure by:
+ * - Removing absolute file paths
+ * - Stripping stack traces in production
+ * - Providing generic messages for internal errors
+ *
+ * Security: HIGH severity - prevents leaking internal system details
+ */
+/**
+ * Maximum input length for path sanitization
+ * Prevents ReDoS attacks by limiting string length before regex processing
+ */
+export declare const MAX_SANITIZE_LENGTH = 100000;
+/**
+ * Sanitize an error message for safe user display
+ *
+ * @param error - Error object or string to sanitize
+ * @returns Sanitized error message safe for user display
+ *
+ * @example
+ * // Input with file path
+ * sanitizeErrorMessage(new Error('ENOENT: no such file at /Users/john/.claude/config'))
+ * // Returns: "ENOENT: no such file at [path]"
+ *
+ * @example
+ * // Validation error passes through
+ * sanitizeErrorMessage(new Error('Invalid limit: must be a positive number'))
+ * // Returns: "Invalid limit: must be a positive number"
+ */
+export declare function sanitizeErrorMessage(error: Error | string): string;
+/**
+ * Sanitize an error for MCP tool response
+ *
+ * In production:
+ * - Removes file paths
+ * - Removes stack traces
+ * - Returns only error message
+ *
+ * In development:
+ * - Removes file paths from message
+ * - Optionally includes sanitized stack trace
+ *
+ * @param error - Error object to sanitize
+ * @param includeStack - Whether to include stack in development (default: false)
+ * @returns Sanitized error text for MCP response
+ */
+export declare function sanitizeErrorForResponse(error: Error | unknown, includeStack?: boolean): string;
+/**
+ * Sanitize a path string to remove sensitive information
+ * Used for error messages that include paths (like health check messages)
+ *
+ * @param path - Absolute path to sanitize
+ * @returns Relative or anonymized path
+ *
+ * @example
+ * sanitizePath('/Users/john/.claude/telemetry')
+ * // Returns: "~/.claude/telemetry"
+ */
+export declare function sanitizePath(path: string): string;
+//# sourceMappingURL=error-sanitizer.d.ts.map

package/dist/lib/errors/error-sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-sanitizer.d.ts","sourceRoot":"","sources":["../../../src/lib/errors/error-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAiDH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AA0F1C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CA6BlE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,YAAY,UAAQ,GAAG,MAAM,CAoB7F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqBjD"}

package/dist/lib/errors/error-sanitizer.js

@@ -0,0 +1,235 @@
+/**
+ * Error message sanitization utilities for observability-toolkit MCP server
+ *
+ * Prevents information disclosure by:
+ * - Removing absolute file paths
+ * - Stripping stack traces in production
+ * - Providing generic messages for internal errors
+ *
+ * Security: HIGH severity - prevents leaking internal system details
+ */
+import { createLogger } from '../core/logger.js';
+const securityLog = createLogger('security');
+/**
+ * Check if we're in production mode
+ * Production hides more details for security
+ *
+ * Security: Defaults to production-safe behavior when NODE_ENV is not set.
+ * This prevents stack trace disclosure in environments like Docker or AWS Lambda
+ * where NODE_ENV may not be explicitly configured.
+ */
+/** Cloud environment indicators for detecting misconfigured deployments */
+const CLOUD_ENVIRONMENT_INDICATORS = [
+    'AWS_LAMBDA_FUNCTION_NAME',
+    'GOOGLE_CLOUD_PROJECT',
+    'AZURE_FUNCTIONS_ENVIRONMENT',
+    'KUBERNETES_SERVICE_HOST',
+    'RAILWAY_ENVIRONMENT',
+    'RENDER_SERVICE_ID',
+];
+/** Track if we've already warned about dev mode in cloud (warn once) */
+let hasWarnedAboutDevModeInCloud = false;
+function isProduction() {
+    const nodeEnv = process.env.NODE_ENV;
+    // Warn if development mode detected in a cloud environment (security risk)
+    if (nodeEnv === 'development' && !hasWarnedAboutDevModeInCloud) {
+        const inCloud = CLOUD_ENVIRONMENT_INDICATORS.some(key => process.env[key]);
+        if (inCloud) {
+            hasWarnedAboutDevModeInCloud = true;
+            securityLog.warn('NODE_ENV=development detected in cloud environment. Full stack traces will be exposed. Set NODE_ENV=production for security.');
+        }
+    }
+    // Default to production-safe behavior if NODE_ENV is not set
+    // Only treat as development if explicitly set to 'development' or 'test'
+    if (!nodeEnv) {
+        return true;
+    }
+    return nodeEnv !== 'development' && nodeEnv !== 'test';
+}
+/**
+ * Maximum input length for path sanitization
+ * Prevents ReDoS attacks by limiting string length before regex processing
+ */
+export const MAX_SANITIZE_LENGTH = 100000;
+/**
+ * Combined pattern for all sensitive paths (single O(n) pass)
+ * Matches:
+ * - Unix paths: /Users/..., /home/..., /var/..., /opt/..., /tmp/..., /etc/..., /usr/...
+ * - Windows paths: C:\..., D:\..., etc.
+ * - Home paths: ~/...
+ * - Node internal: node:internal/...:123:45
+ *
+ * Performance: Single regex with alternation replaces 4 separate passes
+ * Security: Input length is limited before regex processing to prevent ReDoS
+ */
+const SENSITIVE_PATH_PATTERN = new RegExp('(' +
+    '\\/(?:Users|home|var|opt|tmp|etc|usr)\\/[^\\s:\'"]+' + // Unix paths
+    '|[A-Za-z]:\\\\[^\\s:\'"]+' + // Windows paths
+    '|~\\/[^\\s:\'"]+' + // Home paths
+    '|node:[^\\s:\'"]+:\\d+:\\d+' + // Node internal
+    ')', 'g' // Case-sensitive for paths (removed 'i' flag for performance)
+);
+/**
+ * Pattern to match stack trace lines
+ * Matches lines like "at Function.something (/path/to/file.js:123:45)"
+ */
+const STACK_TRACE_PATTERN = /^\s*at\s+.+\(.+:\d+:\d+\)$/gm;
+/**
+ * Known safe error patterns that don't need sanitization
+ * These are user-facing validation errors with no sensitive info
+ */
+const SAFE_ERROR_PATTERNS = [
+    /^Invalid .+: must be/i,
+    /^Invalid .+ format/i,
+    /^Validation error/i,
+    /^Rate limit exceeded/i,
+    /^Unknown tool:/i,
+    /^No backend available/i,
+    /^metricName is required/i,
+    /^Circuit breaker open/i,
+    /^SigNoz .+ not configured/i,
+    /^Date range .+ exceeds maximum/i,
+    /^Pattern .+ exceeds maximum/i,
+    /^startDate .+ cannot be after/i,
+];
+/**
+ * Check if an error message is safe (doesn't contain sensitive info)
+ */
+function isSafeErrorMessage(message) {
+    return SAFE_ERROR_PATTERNS.some(pattern => pattern.test(message));
+}
+/**
+ * Remove file paths from a string (single O(n) pass)
+ * Security: Limits input length to prevent ReDoS attacks
+ */
+function removeFilePaths(text) {
+    // Security: Truncate excessively long inputs to prevent ReDoS
+    const wasTruncated = text.length > MAX_SANITIZE_LENGTH;
+    const safeText = wasTruncated
+        ? text.slice(0, MAX_SANITIZE_LENGTH)
+        : text;
+    // Run regex on truncated text
+    const sanitized = safeText.replace(SENSITIVE_PATH_PATTERN, (match) => {
+        // Node internal paths get different placeholder
+        return match.startsWith('node:') ? '[internal]' : '[path]';
+    });
+    // Add truncation marker after regex processing to avoid regex matching it
+    return wasTruncated ? sanitized + '...[truncated]' : sanitized;
+}
+/**
+ * Remove stack traces from error text
+ */
+function removeStackTraces(text) {
+    // Remove "Stack trace:" header and following content
+    const stackIndex = text.indexOf('\n\nStack trace:\n');
+    if (stackIndex !== -1) {
+        return text.substring(0, stackIndex);
+    }
+    // Remove individual stack trace lines
+    return text.replace(STACK_TRACE_PATTERN, '');
+}
+/**
+ * Sanitize an error message for safe user display
+ *
+ * @param error - Error object or string to sanitize
+ * @returns Sanitized error message safe for user display
+ *
+ * @example
+ * // Input with file path
+ * sanitizeErrorMessage(new Error('ENOENT: no such file at /Users/john/.claude/config'))
+ * // Returns: "ENOENT: no such file at [path]"
+ *
+ * @example
+ * // Validation error passes through
+ * sanitizeErrorMessage(new Error('Invalid limit: must be a positive number'))
+ * // Returns: "Invalid limit: must be a positive number"
+ */
+export function sanitizeErrorMessage(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    // Safe errors pass through unchanged
+    if (isSafeErrorMessage(message)) {
+        return message;
+    }
+    // Remove sensitive paths
+    let sanitized = removeFilePaths(message);
+    // In production, be more aggressive with sanitization
+    if (isProduction()) {
+        sanitized = removeStackTraces(sanitized);
+        // If the message still looks suspicious (contains absolute paths we might have missed),
+        // return a generic message. More specific detection to avoid false positives:
+        // - Must start with / followed by a word char (absolute path, not MIME type slashes)
+        // - Excludes URLs (http://, https://) anywhere in the message
+        // - Excludes common safe patterns like application/json, text/plain
+        const hasAbsolutePath = /(?<!\w)\/[a-zA-Z][\w\-./]*/.test(sanitized);
+        const hasUrl = /https?:\/\//.test(sanitized);
+        const hasMimeType = /\b(application|text|image|audio|video|model|font|multipart)\/[\w\-+.]+\b/.test(sanitized);
+        if (hasAbsolutePath && !hasUrl && !hasMimeType) {
+            return 'An internal error occurred. Please try again.';
+        }
+    }
+    return sanitized;
+}
+/**
+ * Sanitize an error for MCP tool response
+ *
+ * In production:
+ * - Removes file paths
+ * - Removes stack traces
+ * - Returns only error message
+ *
+ * In development:
+ * - Removes file paths from message
+ * - Optionally includes sanitized stack trace
+ *
+ * @param error - Error object to sanitize
+ * @param includeStack - Whether to include stack in development (default: false)
+ * @returns Sanitized error text for MCP response
+ */
+export function sanitizeErrorForResponse(error, includeStack = false) {
+    if (!(error instanceof Error)) {
+        return sanitizeErrorMessage(String(error));
+    }
+    const sanitizedMessage = sanitizeErrorMessage(error.message);
+    // In production, never include stack traces
+    if (isProduction()) {
+        return `Error: ${sanitizedMessage}`;
+    }
+    // In development only, optionally include sanitized stack
+    // Security: Force production check to prevent stack disclosure when NODE_ENV is unset
+    if (includeStack && error.stack) {
+        const sanitizedStack = removeFilePaths(error.stack);
+        return `Error: ${sanitizedMessage}\n\nStack trace:\n${sanitizedStack}`;
+    }
+    return `Error: ${sanitizedMessage}`;
+}
+/**
+ * Sanitize a path string to remove sensitive information
+ * Used for error messages that include paths (like health check messages)
+ *
+ * @param path - Absolute path to sanitize
+ * @returns Relative or anonymized path
+ *
+ * @example
+ * sanitizePath('/Users/john/.claude/telemetry')
+ * // Returns: "~/.claude/telemetry"
+ */
+export function sanitizePath(path) {
+    const KEEP_TAIL_PATH_SEGMENTS = 2;
+    // Replace home directory with ~
+    const homeDir = process.env.HOME || process.env.USERPROFILE || '';
+    if (homeDir && path.startsWith(homeDir)) {
+        return '~' + path.slice(homeDir.length);
+    }
+    // If path contains username, anonymize it
+    const match = path.match(/^\/(?:Users|home)\/[^/]+(\/.+)$/);
+    if (match) {
+        return '~' + match[1];
+    }
+    // For other paths, just return the basename and parent
+    const parts = path.split('/').filter(Boolean);
+    if (parts.length > KEEP_TAIL_PATH_SEGMENTS) {
+        return '.../' + parts.slice(-KEEP_TAIL_PATH_SEGMENTS).join('/');
+    }
+    return path;
+}
+//# sourceMappingURL=error-sanitizer.js.map

package/dist/lib/errors/error-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-sanitizer.js","sourceRoot":"","sources":["../../../src/lib/errors/error-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AAE7C;;;;;;;GAOG;AACH,2EAA2E;AAC3E,MAAM,4BAA4B,GAAG;IACnC,0BAA0B;IAC1B,sBAAsB;IACtB,6BAA6B;IAC7B,yBAAyB;IACzB,qBAAqB;IACrB,mBAAmB;CACX,CAAC;AAEX,wEAAwE;AACxE,IAAI,4BAA4B,GAAG,KAAK,CAAC;AAEzC,SAAS,YAAY;IACnB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAErC,2EAA2E;IAC3E,IAAI,OAAO,KAAK,aAAa,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,OAAO,EAAE,CAAC;YACZ,4BAA4B,GAAG,IAAI,CAAC;YACpC,WAAW,CAAC,IAAI,CACd,8HAA8H,CAC/H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,yEAAyE;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,MAAM,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,sBAAsB,GAAG,IAAI,MAAM,CACvC,GAAG;IACD,qDAAqD,GAAG,aAAa;IACrE,2BAA2B,GAA6B,gBAAgB;IACxE,kBAAkB,GAAsC,aAAa;IACrE,6BAA6B,GAA2B,gBAAgB;IAC1E,GAAG,EACH,GAAG,CAAE,8DAA8D;CACpE,CAAC;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAE3D;;;GAGG;AACH,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,iBAAiB;IACjB,wBAAwB;IACxB,0BAA0B;IAC1B,wBAAwB;IACxB,4BAA4B;IAC5B,iCAAiC;IACjC,8BAA8B;IAC9B,gCAAgC;CACjC,CAAC;AAEF;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,8DAA8D;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC;IACvD,MAAM,QAAQ,GAAG,YAAY;QAC3B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC;IAET,8BAA8B;IAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE;QACnE,gDAAgD;QAChD,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,OAAO,YAAY,CAAC,CAAC,CAAC,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,qDAAqD;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtD,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC;IAED,sCAAsC;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAqB;IACxD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvE,qCAAqC;IACrC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,yBAAyB;IACzB,IAAI,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzC,sDAAsD;IACtD,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAEzC,wFAAwF;QACxF,8EAA8E;QAC9E,qFAAqF;QACrF,8DAA8D;QAC9D,oEAAoE;QACpE,MAAM,eAAe,GAAG,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,0EAA0E,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/G,IAAI,eAAe,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,OAAO,+CAA+C,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAsB,EAAE,YAAY,GAAG,KAAK;IACnF,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE7D,4CAA4C;IAC5C,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,UAAU,gBAAgB,EAAE,CAAC;IACtC,CAAC;IAED,0DAA0D;IAC1D,sFAAsF;IACtF,IAAI,YAAY,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,UAAU,gBAAgB,qBAAqB,cAAc,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,UAAU,gBAAgB,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,uBAAuB,GAAG,CAAC,CAAC;IAClC,gCAAgC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IAClE,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,0CAA0C;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC5D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IAED,uDAAuD;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC3C,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/errors/error-sanitizer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-sanitizer.test.d.ts","sourceRoot":"","sources":["../../../src/lib/errors/error-sanitizer.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}