sbuilder-mcp 0.82.3 → 0.82.4

package/CHANGELOG.md

@@ -6,6 +6,14 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.82.4] - 2026-10-10
+
+### Fixed
+- `sb_media_upload` with `url` enforces a total time limit on the download, so a server that trickles bytes can no longer hang the call.
+- `sb_media_upload` with `url` rejects a download that switches protocols, closes without answering or returns a status outside 200–599, instead of hanging or crashing the MCP process.
+- `sb_media_upload` with `url` refuses a file larger than the platform's 100 MiB upload cap, early by `content-length` and while the body arrives.
+- `sb_media_upload` with `url` honours the requested IP family and rejects unparseable resolved addresses during the address check.
+
 ## [0.82.3] - 2026-10-10
 
 ### Fixed

package/CHANGELOG.vi.md

@@ -6,6 +6,14 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.82.4] - 2026-10-10
+
+### Fixed
+- `sb_media_upload` với `url` áp dụng hạn chót tổng cho cả lần tải, nên server nhỏ giọt từng byte không còn làm treo lệnh gọi.
+- `sb_media_upload` với `url` từ chối bản tải chuyển giao thức, đóng kết nối mà không trả lời hoặc trả status ngoài 200–599, thay vì treo hay làm sập process MCP.
+- `sb_media_upload` với `url` từ chối file lớn hơn giới hạn upload 100 MiB của platform, ngay từ `content-length` và cả khi nội dung đang về.
+- `sb_media_upload` với `url` tôn trọng họ địa chỉ IP được yêu cầu và từ chối địa chỉ phân giải không hợp lệ trong bước kiểm tra địa chỉ.
+
 ## [0.82.3] - 2026-10-10
 
 ### Fixed

package/dist/transport/media.js

@@ -180,40 +180,120 @@ const isPrivate = (a) => PRIVATE.check(a, isIP(a) === 6 ? 'ipv6' : 'ipv4');
 /** A `lookup` for node:net that refuses to hand a private address to the socket. */
 export function pinnedLookup(resolve = (h) => lookup(h, { all: true })) {
     return (host, opts, cb) => {
-        resolve(host).then((addrs) => {
-            if (!addrs.length || addrs.some((a) => isPrivate(a.address))) {
-                cb(new Error('sbuilder: a media url must be a public http(s) address.'));
+        resolve(host)
+            .then((all) => {
+            // The verdict is worked out INSIDE a try and `cb` is called once: a throw
+            // here would be an unhandled rejection, which ends the MCP process.
+            let err = null;
+            let addrs = all;
+            try {
+                if (!all.length || all.some((a) => isIP(a.address) === 0 || isPrivate(a.address))) {
+                    err = new Error('sbuilder: a media url must be a public http(s) address.');
+                }
+                else if (opts.family === 4 || opts.family === 6) {
+                    addrs = all.filter((a) => a.family === opts.family);
+                    if (!addrs.length)
+                        err = new Error(`sbuilder: ${host} has no IPv${opts.family} address.`);
+                }
+            }
+            catch (e) {
+                err = e;
             }
+            if (err)
+                cb(err);
             else if (opts.all)
                 cb(null, addrs);
             else
                 cb(null, addrs[0].address, addrs[0].family);
-        }, (e) => cb(e));
+        }, (e) => cb(e))
+            .catch(() => { });
     };
 }
 const NULL_BODY = new Set([101, 204, 205, 304]);
-function pinnedFetch(url) {
+/** The platform's own upload cap (`media.MaxUploadBytes`, 100 MiB): nothing larger is worth holding. */
+const MAX_FETCH_BYTES = 100 << 20;
+/**
+ * `lookupFn` is the pin, and `deadlineMs` the whole-request limit; both injectable
+ * only so a test can reach a local server quickly.
+ *
+ * EVERY WAY OUT SETTLES THE PROMISE ONCE, and nothing throws from a socket
+ * callback (an uncaught exception ends the MCP process): a total deadline (an idle
+ * timeout is reset by every trickled byte), a `101`/upgrade or a close with no
+ * answer is a rejection, and the body is refused early by content-length and
+ * capped as it arrives.
+ *
+ * ponytail: the body is held whole (about 3 copies at peak, up to the cap); stream
+ * it into the upload if concurrent large fetches ever matter.
+ */
+export function pinnedFetch(url, lookupFn = pinnedLookup(), deadlineMs = 60_000) {
     const u = new URL(url);
     const send = u.protocol === 'https:' ? httpsRequest : httpRequest;
     return new Promise((resolve, reject) => {
+        let done = false;
+        const deadline = setTimeout(() => req.destroy(new Error('sbuilder: the media url took too long.')), deadlineMs);
+        const ok = (r) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(deadline);
+            resolve(r);
+        };
+        const fail = (e) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(deadline);
+            reject(e);
+        };
         // The headers global fetch sends: many CDNs answer 403 to a request with no agent.
         const headers = { 'user-agent': 'sbuilder-mcp', accept: '*/*' };
-        const req = send(u, { method: 'GET', headers, lookup: pinnedLookup() }, (res) => {
-            const chunks = [];
-            res.on('data', (c) => chunks.push(c));
-            res.on('error', reject);
+        const req = send(u, { method: 'GET', headers, lookup: lookupFn }, (res) => {
+            if (Number(res.headers['content-length'] ?? 0) > MAX_FETCH_BYTES) {
+                req.destroy(new Error('sbuilder: the media url is larger than an upload may be.'));
+                return;
+            }
+            let chunks = [];
+            let size = 0;
+            res.on('data', (c) => {
+                size += c.length;
+                if (size > MAX_FETCH_BYTES)
+                    req.destroy(new Error('sbuilder: the media url is larger than an upload may be.'));
+                else
+                    chunks.push(c);
+            });
+            res.on('error', fail);
             res.on('end', () => {
-                const headers = new Headers();
-                for (const [k, v] of Object.entries(res.headers)) {
-                    if (v !== undefined)
-                        headers.set(k, Array.isArray(v) ? v.join(', ') : v);
+                try {
+                    const h = new Headers();
+                    for (const [k, v] of Object.entries(res.headers)) {
+                        if (v === undefined)
+                            continue;
+                        try {
+                            h.set(k, Array.isArray(v) ? v.join(', ') : v);
+                        }
+                        catch {
+                            // A header value fetch would refuse (non-ByteString) — not one this needs.
+                        }
+                    }
+                    const status = res.statusCode ?? 502;
+                    if (status < 200 || status > 599)
+                        throw new Error(`sbuilder: the media url answered status ${status}.`);
+                    const body = NULL_BODY.has(status) ? null : Buffer.concat(chunks);
+                    chunks = [];
+                    ok(new Response(body, { status, headers: h }));
+                }
+                catch (e) {
+                    fail(e);
                 }
-                const status = res.statusCode ?? 502;
-                resolve(new Response(NULL_BODY.has(status) ? null : Buffer.concat(chunks), { status, headers }));
             });
         });
         req.setTimeout(30_000, () => req.destroy(new Error('sbuilder: the media url timed out.')));
-        req.on('error', reject);
+        req.on('upgrade', (_res, sock) => {
+            sock.destroy();
+            fail(new Error('sbuilder: the media url tried to switch protocols.'));
+        });
+        req.on('error', fail);
+        req.on('close', () => fail(new Error('sbuilder: the media url closed without an answer.')));
         req.end();
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.82.3",
+  "version": "0.82.4",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",