@socialneuron/mcp-server 1.7.4 → 1.7.5

package/dist/index.js

@@ -14,7 +14,7 @@ var MCP_VERSION;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    MCP_VERSION = "1.7.4";
+    MCP_VERSION = "1.7.5";
   }
 });
 
@@ -5747,7 +5747,7 @@ var ERROR_PATTERNS = [
   // Generic sensitive patterns (API keys, URLs with secrets)
   [/[a-z0-9]{32,}.*key|Bearer [a-zA-Z0-9._-]+/i, "An internal error occurred. Please try again."]
 ];
-function sanitizeError2(error) {
+function sanitizeError(error) {
   const msg = error instanceof Error ? error.message : typeof error === "string" ? error : "Unknown error";
   if (process.env.NODE_ENV !== "production") {
     console.error("[Error]", msg);
@@ -5760,6 +5760,171 @@ function sanitizeError2(error) {
   return "An unexpected error occurred. Please try again.";
 }
 
+// src/lib/ssrf.ts
+var BLOCKED_IP_PATTERNS = [
+  // IPv4 localhost/loopback
+  /^127\./,
+  /^0\./,
+  // IPv4 private ranges (RFC 1918)
+  /^10\./,
+  /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
+  /^192\.168\./,
+  // IPv4 link-local
+  /^169\.254\./,
+  // Cloud metadata endpoint (AWS, GCP, Azure)
+  /^169\.254\.169\.254$/,
+  // IPv4 broadcast
+  /^255\./,
+  // Shared address space (RFC 6598)
+  /^100\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\./
+];
+var BLOCKED_IPV6_PATTERNS = [
+  /^::1$/i,
+  // loopback
+  /^::$/i,
+  // unspecified
+  /^fe[89ab][0-9a-f]:/i,
+  // link-local fe80::/10
+  /^fc[0-9a-f]:/i,
+  // unique local fc00::/7
+  /^fd[0-9a-f]:/i,
+  // unique local fc00::/7
+  /^::ffff:127\./i,
+  // IPv4-mapped localhost
+  /^::ffff:(0|10|127|169\.254|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\./i
+  // IPv4-mapped private
+];
+var BLOCKED_HOSTNAMES = [
+  "localhost",
+  "localhost.localdomain",
+  "local",
+  "127.0.0.1",
+  "0.0.0.0",
+  "[::1]",
+  "[::ffff:127.0.0.1]",
+  // Cloud metadata endpoints
+  "metadata.google.internal",
+  "metadata.goog",
+  "instance-data",
+  "instance-data.ec2.internal"
+];
+var ALLOWED_PROTOCOLS = ["http:", "https:"];
+var BLOCKED_PORTS = [22, 23, 25, 110, 143, 445, 3306, 5432, 6379, 27017, 11211];
+function isBlockedIP(ip) {
+  const normalized = ip.replace(/^\[/, "").replace(/\]$/, "");
+  if (normalized.includes(":")) {
+    return BLOCKED_IPV6_PATTERNS.some((pattern) => pattern.test(normalized));
+  }
+  return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+function isBlockedHostname(hostname) {
+  return BLOCKED_HOSTNAMES.includes(hostname.toLowerCase());
+}
+function isIPAddress(hostname) {
+  const ipv4Pattern = /^(\d{1,3}\.){3}\d{1,3}$/;
+  const ipv6Pattern = /^\[?[a-fA-F0-9:]+\]?$/;
+  return ipv4Pattern.test(hostname) || ipv6Pattern.test(hostname);
+}
+async function validateUrlForSSRF(urlString) {
+  try {
+    const url = new URL(urlString);
+    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
+      return {
+        isValid: false,
+        error: `Invalid protocol: ${url.protocol}. Only HTTP and HTTPS are allowed.`
+      };
+    }
+    if (url.username || url.password) {
+      return {
+        isValid: false,
+        error: "URLs with embedded credentials are not allowed."
+      };
+    }
+    const hostname = url.hostname.toLowerCase();
+    if (isBlockedHostname(hostname)) {
+      return {
+        isValid: false,
+        error: "Access to internal/localhost addresses is not allowed."
+      };
+    }
+    if (isIPAddress(hostname) && isBlockedIP(hostname)) {
+      return {
+        isValid: false,
+        error: "Access to private/internal IP addresses is not allowed."
+      };
+    }
+    const port = url.port ? parseInt(url.port, 10) : url.protocol === "https:" ? 443 : 80;
+    if (BLOCKED_PORTS.includes(port)) {
+      return {
+        isValid: false,
+        error: `Access to port ${port} is not allowed.`
+      };
+    }
+    let resolvedIP;
+    if (!isIPAddress(hostname)) {
+      try {
+        const dns = await import("node:dns");
+        const resolver = new dns.promises.Resolver();
+        const resolvedIPs = [];
+        try {
+          const aRecords = await resolver.resolve4(hostname);
+          resolvedIPs.push(...aRecords);
+        } catch {
+        }
+        try {
+          const aaaaRecords = await resolver.resolve6(hostname);
+          resolvedIPs.push(...aaaaRecords);
+        } catch {
+        }
+        if (resolvedIPs.length === 0) {
+          return {
+            isValid: false,
+            error: "DNS resolution failed: hostname did not resolve to any address."
+          };
+        }
+        for (const ip of resolvedIPs) {
+          if (isBlockedIP(ip)) {
+            return {
+              isValid: false,
+              error: "Hostname resolves to a private/internal IP address."
+            };
+          }
+        }
+        resolvedIP = resolvedIPs[0];
+      } catch {
+        return {
+          isValid: false,
+          error: "DNS resolution failed. Cannot verify hostname safety."
+        };
+      }
+    }
+    return { isValid: true, sanitizedUrl: url.toString(), resolvedIP };
+  } catch (error) {
+    return {
+      isValid: false,
+      error: `Invalid URL format: ${error instanceof Error ? error.message : "Unknown error"}`
+    };
+  }
+}
+function quickSSRFCheck(urlString) {
+  try {
+    const url = new URL(urlString);
+    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
+      return { isValid: false, error: `Invalid protocol: ${url.protocol}` };
+    }
+    if (url.username || url.password) {
+      return { isValid: false, error: "URLs with credentials not allowed" };
+    }
+    const hostname = url.hostname.toLowerCase();
+    if (isBlockedHostname(hostname) || isIPAddress(hostname) && isBlockedIP(hostname)) {
+      return { isValid: false, error: "Access to internal addresses not allowed" };
+    }
+    return { isValid: true, sanitizedUrl: url.toString() };
+  } catch {
+    return { isValid: false, error: "Invalid URL format" };
+  }
+}
+
 // src/tools/distribution.ts
 init_supabase();
 init_quality();
@@ -5799,16 +5964,42 @@ function asEnvelope2(data) {
     data
   };
 }
+function isAlreadyR2Signed(url) {
+  try {
+    const u = new URL(url);
+    return u.searchParams.has("X-Amz-Signature");
+  } catch {
+    return false;
+  }
+}
+async function rehostExternalUrl(mediaUrl, projectId) {
+  if (isAlreadyR2Signed(mediaUrl)) {
+    return { signedUrl: mediaUrl, r2Key: "" };
+  }
+  const ssrf = quickSSRFCheck(mediaUrl);
+  if (!ssrf.isValid) {
+    return { error: ssrf.error ?? "URL rejected by SSRF check" };
+  }
+  const { data, error } = await callEdgeFunction(
+    "upload-to-r2",
+    { url: ssrf.sanitizedUrl ?? mediaUrl, projectId },
+    { timeoutMs: 6e4 }
+  );
+  if (error || !data?.key || !data?.url) {
+    return { error: error ?? "upload-to-r2 returned no key" };
+  }
+  return { signedUrl: data.url, r2Key: data.key };
+}
 function registerDistributionTools(server2) {
   server2.tool(
     "schedule_post",
     'Publish or schedule a post to connected social platforms. Check list_connected_accounts first to verify active OAuth for each target platform. For Instagram carousels: use media_type=CAROUSEL_ALBUM with 2-10 media_urls. For YouTube: title is required. schedule_at uses ISO 8601 (e.g. "2026-03-20T14:00:00Z") \u2014 omit to post immediately.',
     {
       media_url: z3.string().optional().describe(
-        "URL of the media file to post. Public URL or R2 signed URL. Not needed if media_urls, r2_key, or job_id is provided."
+        "URL of the media file to post. Any public HTTPS URL works \u2014 including ephemeral generator URLs (Replicate, OpenAI, DALL-E). The server persists non-R2 URLs into R2 before posting so scheduled posts and byte-upload platforms (X, LinkedIn, YouTube, Bluesky) do not 404 when the source URL expires. Set auto_rehost=false to skip. Not needed if media_urls, r2_key, or job_id is provided."
       ),
       media_urls: z3.array(z3.string()).optional().describe(
-        "Array of 2-10 image URLs for carousel posts. Each must be publicly accessible or R2 signed URL. Use with media_type=CAROUSEL_ALBUM."
+        "Array of 2-10 image URLs for carousel posts. Same rehosting rules as media_url \u2014 ephemeral URLs are persisted automatically. Use with media_type=CAROUSEL_ALBUM."
       ),
       r2_key: z3.string().optional().describe(
         "R2 object key from upload_media. Signed on demand at post time \u2014 survives scheduling delays. Alternative to media_url."
@@ -5897,7 +6088,10 @@ function registerDistributionTools(server2) {
       ),
       project_id: z3.string().optional().describe("Social Neuron project ID to associate this post with."),
       response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text."),
-      attribution: z3.boolean().optional().describe('If true, appends "Created with Social Neuron" to the caption. Default: false.')
+      attribution: z3.boolean().optional().describe('If true, appends "Created with Social Neuron" to the caption. Default: false.'),
+      auto_rehost: z3.boolean().optional().describe(
+        "Whether to persist non-R2 media_url/media_urls into R2 before posting. Default: true. Set to false only if you know the source URL will outlive the scheduling window and every target platform supports URL ingest."
+      )
     },
     async ({
       media_url,
@@ -5911,6 +6105,7 @@ function registerDistributionTools(server2) {
       project_id,
       response_format,
       attribution,
+      auto_rehost,
       r2_key,
       r2_keys,
       job_id,
@@ -6022,12 +6217,54 @@ function registerDistributionTools(server2) {
           }
           resolvedMediaUrls = resolved;
         }
+        const shouldRehost = auto_rehost !== false;
+        if (shouldRehost && resolvedMediaUrl && !isAlreadyR2Signed(resolvedMediaUrl)) {
+          const rehost = await rehostExternalUrl(resolvedMediaUrl, project_id);
+          if ("error" in rehost) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Failed to persist media URL into R2: ${rehost.error}. Try upload_media first and pass r2_key instead, or set auto_rehost=false if you're sure the URL is publicly durable and every target platform accepts URL ingest.`
+                }
+              ],
+              isError: true
+            };
+          }
+          resolvedMediaUrl = rehost.signedUrl;
+        }
+        if (shouldRehost && resolvedMediaUrls && resolvedMediaUrls.length > 0) {
+          const needsRehost = resolvedMediaUrls.map((u) => !isAlreadyR2Signed(u));
+          if (needsRehost.some(Boolean)) {
+            const rehosted = await Promise.all(
+              resolvedMediaUrls.map(
+                (u, i) => needsRehost[i] ? rehostExternalUrl(u, project_id) : Promise.resolve({ signedUrl: u, r2Key: "" })
+              )
+            );
+            const failIdx = rehosted.findIndex((r) => "error" in r);
+            if (failIdx !== -1) {
+              const failed = rehosted[failIdx];
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: `Failed to persist media_urls[${failIdx}] into R2: ${failed.error}. Try upload_media first and pass r2_keys instead, or set auto_rehost=false.`
+                  }
+                ],
+                isError: true
+              };
+            }
+            resolvedMediaUrls = rehosted.map(
+              (r) => r.signedUrl
+            );
+          }
+        }
       } catch (resolveErr) {
         return {
           content: [
             {
               type: "text",
-              text: `Failed to resolve media: ${sanitizeError2(resolveErr)}`
+              text: `Failed to resolve media: ${sanitizeError(resolveErr)}`
             }
           ],
           isError: true
@@ -6392,7 +6629,7 @@ Created with Social Neuron`;
         return { content: [{ type: "text", text: lines.join("\n") }], isError: false };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "find_next_slots",
           status: "error",
@@ -6912,7 +7149,7 @@ Created with Social Neuron`;
         };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "schedule_content_plan",
           status: "error",
@@ -6935,6 +7172,19 @@ import { readFile } from "node:fs/promises";
 import { basename, extname } from "node:path";
 init_supabase();
 var MAX_BASE64_SIZE = 10 * 1024 * 1024;
+var ALLOWED_UPLOAD_TYPES = /* @__PURE__ */ new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/svg+xml",
+  "video/mp4",
+  "video/quicktime",
+  "video/x-msvideo",
+  "video/webm"
+]);
+var BASE64_CHARS = /^[A-Za-z0-9+/]+={0,2}$/;
+var DATA_URI_PREFIX = /^data:([^;,]+);base64,/;
 function maskR2Key(key) {
   const segments = key.split("/");
   return segments.length >= 3 ? `\u2026/${segments.slice(-2).join("/")}` : key;
@@ -6955,21 +7205,35 @@ function inferContentType(filePath) {
   };
   return map[ext] || "application/octet-stream";
 }
+function approxBase64Size(raw) {
+  const len = raw.length;
+  if (len === 0) return 0;
+  let padding = 0;
+  if (raw.endsWith("==")) padding = 2;
+  else if (raw.endsWith("=")) padding = 1;
+  return Math.floor(len * 3 / 4) - padding;
+}
 function registerMediaTools(server2) {
   server2.tool(
     "upload_media",
-    "Upload a local file or external URL to persistent R2 storage. Returns a durable r2_key that can be passed to schedule_post. Use for images, videos, or any media that needs to be posted to social platforms. Accepts local file paths (in MCP stdio mode) or public URLs. Max 10MB for base64 upload \u2014 larger files return an error with guidance.",
+    "Upload media to persistent R2 storage. Returns a durable r2_key that can be passed to schedule_post. Three input modes: (1) local file path (stdio mode only), (2) public URL fetched by the server, (3) inline base64 via file_data \u2014 use this from Claude Desktop, Claude Web, or any remote agent that cannot hand the server a filesystem path. Base64 uploads are capped at 10MB decoded; larger files still need stdio + presigned PUT.",
     {
-      source: z4.string().describe(
-        'Local file path (e.g. "/Users/me/image.png") or public URL (e.g. "https://example.com/photo.jpg"). Local files are read and uploaded as base64. URLs are fetched by the server.'
+      source: z4.string().optional().describe(
+        'Local file path (e.g. "/Users/me/image.png") or public URL (e.g. "https://example.com/photo.jpg"). Leave empty when passing file_data instead.'
+      ),
+      file_data: z4.string().optional().describe(
+        'Base64-encoded file bytes, with or without a "data:<mime>;base64," prefix. Use this from remote agents (Claude Web/Desktop) that cannot provide a filesystem path. Max 10MB decoded.'
+      ),
+      file_name: z4.string().optional().describe(
+        'Optional filename for the upload (e.g. "hero.png"). Path components are stripped \u2014 only the basename is used.'
       ),
       content_type: z4.string().optional().describe(
-        'MIME type (e.g. "image/png", "video/mp4"). Auto-detected from file extension if omitted.'
+        'MIME type (e.g. "image/png", "video/mp4"). Auto-detected from file extension for paths/URLs, or from the data: prefix on file_data. Required when passing raw base64 with no prefix.'
       ),
       project_id: z4.string().optional().describe("Project ID for R2 path organization."),
       response_format: z4.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
-    async ({ source, content_type, project_id, response_format }) => {
+    async ({ source, file_data, file_name, content_type, project_id, response_format }) => {
       const format = response_format ?? "text";
       const startedAt = Date.now();
       const userId = await getDefaultUserId();
@@ -6991,46 +7255,187 @@ function registerMediaTools(server2) {
           isError: true
         };
       }
-      const isUrl = source.startsWith("http://") || source.startsWith("https://");
-      const isLocalFile = !isUrl;
+      if (!source && !file_data) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "upload_media requires either `source` (path or URL) or `file_data` (base64)."
+            }
+          ],
+          isError: true
+        };
+      }
+      if (file_data) {
+        let raw = file_data;
+        let detectedType;
+        const prefixMatch = raw.match(DATA_URI_PREFIX);
+        if (prefixMatch) {
+          detectedType = prefixMatch[1].trim().toLowerCase();
+          raw = raw.slice(prefixMatch[0].length);
+        }
+        const ct = (content_type ?? detectedType ?? "").trim().toLowerCase();
+        if (!ct) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "content_type is required when file_data has no data: prefix."
+              }
+            ],
+            isError: true
+          };
+        }
+        if (!ALLOWED_UPLOAD_TYPES.has(ct)) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `content_type "${ct}" is not supported. Allowed: ${[...ALLOWED_UPLOAD_TYPES].sort().join(", ")}.`
+              }
+            ],
+            isError: true
+          };
+        }
+        const stripped = raw.replace(/\s+/g, "");
+        if (!BASE64_CHARS.test(stripped)) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "file_data is not valid base64 \u2014 only A-Z, a-z, 0-9, +, /, = are allowed."
+              }
+            ],
+            isError: true
+          };
+        }
+        const approxSize = approxBase64Size(stripped);
+        if (approxSize > MAX_BASE64_SIZE) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `file_data exceeds the 10MB base64 cap (got ~${(approxSize / 1024 / 1024).toFixed(1)}MB). For larger files, run the stdio MCP server locally and pass a file path so the server can use presigned PUT upload.`
+              }
+            ],
+            isError: true
+          };
+        }
+        const safeName = basename(file_name ?? "upload");
+        const uploadBody2 = {
+          fileData: `data:${ct};base64,${stripped}`,
+          contentType: ct,
+          fileName: safeName,
+          projectId: project_id
+        };
+        const { data: data2, error: error2 } = await callEdgeFunction("upload-to-r2", uploadBody2, { timeoutMs: 6e4 });
+        if (error2) {
+          await logMcpToolInvocation({
+            toolName: "upload_media",
+            status: "error",
+            durationMs: Date.now() - startedAt,
+            details: { error: error2, source: "base64", contentType: ct, size: approxSize }
+          });
+          return {
+            content: [{ type: "text", text: `Upload failed: ${error2}` }],
+            isError: true
+          };
+        }
+        if (!data2?.key) {
+          return {
+            content: [{ type: "text", text: "Upload returned no R2 key." }],
+            isError: true
+          };
+        }
+        await logMcpToolInvocation({
+          toolName: "upload_media",
+          status: "success",
+          durationMs: Date.now() - startedAt,
+          details: {
+            source: "base64",
+            r2Key: data2.key,
+            size: data2.size,
+            contentType: data2.contentType
+          }
+        });
+        if (format === "json") {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(
+                  {
+                    r2_key: data2.key,
+                    signed_url: data2.url,
+                    size: data2.size,
+                    content_type: data2.contentType
+                  },
+                  null,
+                  2
+                )
+              }
+            ],
+            isError: false
+          };
+        }
+        return {
+          content: [
+            {
+              type: "text",
+              text: [
+                "Media uploaded successfully.",
+                `Media key: ${maskR2Key(data2.key)}`,
+                `Signed URL: ${data2.url}`,
+                `Size: ${(data2.size / 1024).toFixed(0)}KB`,
+                `Type: ${data2.contentType}`,
+                "",
+                "Use job_id or response_format=json with schedule_post to post to any platform."
+              ].join("\n")
+            }
+          ],
+          isError: false
+        };
+      }
+      const src = source;
+      const isUrl = src.startsWith("http://") || src.startsWith("https://");
       let uploadBody;
       if (isUrl) {
-        const ct = content_type || inferContentType(source);
+        const ct = content_type || inferContentType(src);
         uploadBody = {
-          url: source,
+          url: src,
           contentType: ct,
-          fileName: basename(new URL(source).pathname) || "upload",
+          fileName: basename(file_name ?? new URL(src).pathname) || "upload",
           projectId: project_id
         };
       } else {
         let fileBuffer;
         try {
-          fileBuffer = await readFile(source);
-        } catch (err) {
+          fileBuffer = await readFile(src);
+        } catch {
           await logMcpToolInvocation({
             toolName: "upload_media",
             status: "error",
             durationMs: Date.now() - startedAt,
-            details: { error: `File not found: ${source}` }
+            details: { error: "File not found", source: "local" }
           });
           return {
             content: [
               {
                 type: "text",
-                text: `File not found or not readable: ${source}`
+                text: `File not found or not readable: ${src}. Remote agents (Claude Web/Desktop) cannot see the MCP server's filesystem \u2014 pass the bytes via the \`file_data\` parameter (base64, up to 10MB) instead.`
               }
             ],
             isError: true
           };
         }
-        const ct = content_type || inferContentType(source);
+        const ct = content_type || inferContentType(src);
         if (fileBuffer.length > MAX_BASE64_SIZE) {
           const { data: putData, error: putError } = await callEdgeFunction(
             "get-signed-url",
             {
               operation: "put",
               contentType: ct,
-              filename: basename(source),
+              filename: basename(file_name ?? src),
               projectId: project_id
             },
             { timeoutMs: 1e4 }
@@ -7132,7 +7537,7 @@ function registerMediaTools(server2) {
         uploadBody = {
           fileData: base64,
           contentType: ct,
-          fileName: basename(source),
+          fileName: basename(file_name ?? src),
           projectId: project_id
         };
       }
@@ -7524,155 +7929,6 @@ function formatAnalytics(summary, days, format) {
 init_edge_function();
 init_supabase();
 import { z as z6 } from "zod";
-
-// src/lib/ssrf.ts
-var BLOCKED_IP_PATTERNS = [
-  // IPv4 localhost/loopback
-  /^127\./,
-  /^0\./,
-  // IPv4 private ranges (RFC 1918)
-  /^10\./,
-  /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
-  /^192\.168\./,
-  // IPv4 link-local
-  /^169\.254\./,
-  // Cloud metadata endpoint (AWS, GCP, Azure)
-  /^169\.254\.169\.254$/,
-  // IPv4 broadcast
-  /^255\./,
-  // Shared address space (RFC 6598)
-  /^100\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\./
-];
-var BLOCKED_IPV6_PATTERNS = [
-  /^::1$/i,
-  // loopback
-  /^::$/i,
-  // unspecified
-  /^fe[89ab][0-9a-f]:/i,
-  // link-local fe80::/10
-  /^fc[0-9a-f]:/i,
-  // unique local fc00::/7
-  /^fd[0-9a-f]:/i,
-  // unique local fc00::/7
-  /^::ffff:127\./i,
-  // IPv4-mapped localhost
-  /^::ffff:(0|10|127|169\.254|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\./i
-  // IPv4-mapped private
-];
-var BLOCKED_HOSTNAMES = [
-  "localhost",
-  "localhost.localdomain",
-  "local",
-  "127.0.0.1",
-  "0.0.0.0",
-  "[::1]",
-  "[::ffff:127.0.0.1]",
-  // Cloud metadata endpoints
-  "metadata.google.internal",
-  "metadata.goog",
-  "instance-data",
-  "instance-data.ec2.internal"
-];
-var ALLOWED_PROTOCOLS = ["http:", "https:"];
-var BLOCKED_PORTS = [22, 23, 25, 110, 143, 445, 3306, 5432, 6379, 27017, 11211];
-function isBlockedIP(ip) {
-  const normalized = ip.replace(/^\[/, "").replace(/\]$/, "");
-  if (normalized.includes(":")) {
-    return BLOCKED_IPV6_PATTERNS.some((pattern) => pattern.test(normalized));
-  }
-  return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized));
-}
-function isBlockedHostname(hostname) {
-  return BLOCKED_HOSTNAMES.includes(hostname.toLowerCase());
-}
-function isIPAddress(hostname) {
-  const ipv4Pattern = /^(\d{1,3}\.){3}\d{1,3}$/;
-  const ipv6Pattern = /^\[?[a-fA-F0-9:]+\]?$/;
-  return ipv4Pattern.test(hostname) || ipv6Pattern.test(hostname);
-}
-async function validateUrlForSSRF(urlString) {
-  try {
-    const url = new URL(urlString);
-    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
-      return {
-        isValid: false,
-        error: `Invalid protocol: ${url.protocol}. Only HTTP and HTTPS are allowed.`
-      };
-    }
-    if (url.username || url.password) {
-      return {
-        isValid: false,
-        error: "URLs with embedded credentials are not allowed."
-      };
-    }
-    const hostname = url.hostname.toLowerCase();
-    if (isBlockedHostname(hostname)) {
-      return {
-        isValid: false,
-        error: "Access to internal/localhost addresses is not allowed."
-      };
-    }
-    if (isIPAddress(hostname) && isBlockedIP(hostname)) {
-      return {
-        isValid: false,
-        error: "Access to private/internal IP addresses is not allowed."
-      };
-    }
-    const port = url.port ? parseInt(url.port, 10) : url.protocol === "https:" ? 443 : 80;
-    if (BLOCKED_PORTS.includes(port)) {
-      return {
-        isValid: false,
-        error: `Access to port ${port} is not allowed.`
-      };
-    }
-    let resolvedIP;
-    if (!isIPAddress(hostname)) {
-      try {
-        const dns = await import("node:dns");
-        const resolver = new dns.promises.Resolver();
-        const resolvedIPs = [];
-        try {
-          const aRecords = await resolver.resolve4(hostname);
-          resolvedIPs.push(...aRecords);
-        } catch {
-        }
-        try {
-          const aaaaRecords = await resolver.resolve6(hostname);
-          resolvedIPs.push(...aaaaRecords);
-        } catch {
-        }
-        if (resolvedIPs.length === 0) {
-          return {
-            isValid: false,
-            error: "DNS resolution failed: hostname did not resolve to any address."
-          };
-        }
-        for (const ip of resolvedIPs) {
-          if (isBlockedIP(ip)) {
-            return {
-              isValid: false,
-              error: "Hostname resolves to a private/internal IP address."
-            };
-          }
-        }
-        resolvedIP = resolvedIPs[0];
-      } catch {
-        return {
-          isValid: false,
-          error: "DNS resolution failed. Cannot verify hostname safety."
-        };
-      }
-    }
-    return { isValid: true, sanitizedUrl: url.toString(), resolvedIP };
-  } catch (error) {
-    return {
-      isValid: false,
-      error: `Invalid URL format: ${error instanceof Error ? error.message : "Unknown error"}`
-    };
-  }
-}
-
-// src/tools/brand.ts
 init_version();
 function asEnvelope4(data) {
   return {
@@ -8196,7 +8452,7 @@ function registerScreenshotTools(server2) {
         };
       } catch (err) {
         await closeBrowser();
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         await logMcpToolInvocation({
           toolName: "capture_app_page",
           status: "error",
@@ -8352,7 +8608,7 @@ function registerScreenshotTools(server2) {
         };
       } catch (err) {
         await closeBrowser();
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         await logMcpToolInvocation({
           toolName: "capture_screenshot",
           status: "error",
@@ -8646,7 +8902,7 @@ function registerRemotionTools(server2) {
           ]
         };
       } catch (err) {
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         await logMcpToolInvocation({
           toolName: "render_demo_video",
           status: "error",
@@ -8774,7 +9030,7 @@ function registerRemotionTools(server2) {
           ]
         };
       } catch (err) {
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         await logMcpToolInvocation({
           toolName: "render_template_video",
           status: "error",
@@ -10711,7 +10967,7 @@ function registerExtractionTools(server2) {
         };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "extract_url_content",
           status: "error",
@@ -11271,7 +11527,7 @@ ${rawText.slice(0, 1e3)}`
             }
           } catch (persistErr) {
             const durationMs2 = Date.now() - startedAt;
-            const message = sanitizeError2(persistErr);
+            const message = sanitizeError(persistErr);
             logMcpToolInvocation({
               toolName: "plan_content_week",
               status: "error",
@@ -11303,7 +11559,7 @@ ${rawText.slice(0, 1e3)}`
         };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "plan_content_week",
           status: "error",
@@ -11395,7 +11651,7 @@ ${rawText.slice(0, 1e3)}`
         };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "save_content_plan",
           status: "error",
@@ -12007,7 +12263,7 @@ function registerPipelineTools(server2) {
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "check_pipeline_readiness",
           status: "error",
@@ -12168,7 +12424,7 @@ function registerPipelineTools(server2) {
           } catch (deductErr) {
             errors.push({
               stage: "planning",
-              message: `Credit deduction failed: ${sanitizeError2(deductErr)}`
+              message: `Credit deduction failed: ${sanitizeError(deductErr)}`
             });
           }
         }
@@ -12339,7 +12595,7 @@ function registerPipelineTools(server2) {
             } catch (schedErr) {
               errors.push({
                 stage: "schedule",
-                message: `Failed to schedule ${post.id}: ${sanitizeError2(schedErr)}`
+                message: `Failed to schedule ${post.id}: ${sanitizeError(schedErr)}`
               });
             }
           }
@@ -12428,7 +12684,7 @@ function registerPipelineTools(server2) {
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "run_content_pipeline",
           status: "error",
@@ -12652,7 +12908,7 @@ function registerPipelineTools(server2) {
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "auto_approve_plan",
           status: "error",
@@ -12832,7 +13088,7 @@ ${i + 1}. ${s.topic}`);
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "suggest_next_content",
           status: "error",
@@ -13173,7 +13429,7 @@ Best: ${best.id.slice(0, 8)}... (${best.platform}) \u2014 ${best.views.toLocaleS
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "generate_performance_digest",
           status: "error",
@@ -13270,7 +13526,7 @@ Best: ${best.id.slice(0, 8)}... (${best.platform}) \u2014 ${best.views.toLocaleS
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "detect_anomalies",
           status: "error",
@@ -14303,7 +14559,7 @@ function registerCarouselTools(server2) {
               slideNumber: slide.slideNumber,
               jobId: null,
               model: image_model,
-              error: sanitizeError2(err)
+              error: sanitizeError(err)
             };
           }
         })