feat(protect): hardening — body cap, header screening, multipart, node egress, SQL-error suppression

[patchstackdave]

Five request/response-guard improvements (each with tests). 437 tests pass, typecheck + build clean.

1. Fix — cap the request body on the fetch/route-WAF path

fromFetchRequest read the whole body with no size limit (the node adapter caps at 1 MiB; the fetch path didn't). Now a Content-Length over the cap is skipped before reading, and anything else is discarded past 1 MiB — fail-open, so the request is still evaluated on query/headers/url. Configurable via { maxBodyBytes }.

2. Feature — response-header screening

screenText masked only the body. It now applies the matched secret redactors to header values too, so a response.header.* rule actually strips the header, and a secret that also leaks into a header (Set-Cookie, an echoed X-Api-Key) is masked. Wired through the fetch and node response paths.

3. Feature — multipart/form-data parsing

Only JSON + x-www-form-urlencoded were parsed into post.*. Multipart fields now populate post.<field> (+ raw), and file parts surface via files.<field> (the filename) — so the field-scoped rules we discussed match uploads (e.g. a __proto__ field name).

4. Feature — egress SSRF for node:http/https

The egress guard wrapped only global fetch; it now also patches node:http/https request/get on Node (covers axios/got/raw client), best-effort and restored on uninstall. installEgressGuard is now async; createProtection awaits it.

5. Feature — verbose-error suppression

A new default response rule redacts SQL/ORM error signatures (SQLSTATE[…], SequelizeDatabaseError, ORA-#####, PG::…Error, SQLITE_ERROR, …) beyond the existing stack-trace rule.

Tests (+10)

fetch-body-cap, multipart, response-hardening (header screening + SQL redaction), egress-node-http.

🤖 Generated with Claude Code

[coderbuds]

Robust security enhancements with clear structure and comprehensive tests.

🎯 Quality: 100% Elite · 📦 Size: Large — consider splitting if possible

🛡️ Standards: no pre-flight fit check ran for this change — wire assess-change-fit into your coding agents to catch size before opening.

📈 This month: Your 31st PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review