fix(mcp): preserve url and redirected when capping a response body

new Response() resets url/redirected; the SDK resolves relative auth-metadata
URLs (resource_metadata) against response.url, so carry the originals over via
defineProperty on the wrapped response.

Author: waleedlatif1

apps/sim/lib/mcp/pinned-fetch.test.ts

@@ -75,6 +75,18 @@ describe('createGuardedMcpFetch', () => {
     const get = await guarded('https://mcp.example/mcp', { method: 'GET' })
     await expect(new Response(get.body).arrayBuffer()).resolves.toBeInstanceOf(ArrayBuffer)
   })
+
+  it('preserves url and redirected on a capped response (SDK auth-metadata resolution)', async () => {
+    const small = new Response('{"ok":true}', { status: 200 })
+    Object.defineProperty(small, 'url', { value: 'https://mcp.example/mcp' })
+    Object.defineProperty(small, 'redirected', { value: true })
+    sentinelFetch.mockImplementation(async () => small)
+    const { fetch: guarded } = createGuardedMcpFetch()
+
+    const res = await guarded('https://mcp.example/mcp', { method: 'POST' })
+    expect(res.url).toBe('https://mcp.example/mcp')
+    expect(res.redirected).toBe(true)
+  })
 })
 
 describe('createSsrfGuardedMcpFetch', () => {

apps/sim/lib/mcp/pinned-fetch.ts

@@ -70,11 +70,16 @@ function capResponseBody(response: Response, maxBytes: number): Response {
       },
     })
   )
-  return new Response(limited, {
+  const wrapped = new Response(limited, {
     status: response.status,
     statusText: response.statusText,
     headers: response.headers,
   })
+  // `new Response()` resets `url`/`redirected` (empty/false); the SDK resolves relative
+  // auth-metadata URLs (e.g. `resource_metadata`) against `response.url`, so carry them over.
+  Object.defineProperty(wrapped, 'url', { value: response.url, configurable: true })
+  Object.defineProperty(wrapped, 'redirected', { value: response.redirected, configurable: true })
+  return wrapped
 }
 
 /**