fix(mcp): BugBash 2026-05-20 Wave 2 — pin mock to openapi.json + 5 client fixes

[mastermanas805]

Resolves the six T17 findings (2 P0s, 4 P1s) flagged in
BUGHUNT-2026-05-20-T17.md. Every fix carries a CI-run regression test under
BugBash 2026-05-20 T17 ... in test/integration.test.ts so a future revert
fails the gate immediately. Branched off origin/master.

Findings fixed

ID	Theme	Fix	Regression test
T17 P0-1	redeploy crashes on real API (expects {ok,item}, API returns bare 202)	client.redeploy() returns {ok, id} and tolerates the empty 2xx body; index.ts redeploy handler no longer dereferences result.item.app_id; mock now emits a bare 202 with no body	redeploy resolves successfully when the api returns 202 with no body (no TypeError on result.item.app_id)
T17 P0-2	get_api_token 403s because PATs can't mint PATs (the typical INSTANODE_TOKEN is a PAT)	formatError maps pat_cannot_mint_pat to a clear "use a session JWT — sign in at https://instanode.dev/dashboard" headline; tool description rewritten to state the constraint plainly; mock models the 403 against a new PAT_TOKEN fixture	get_api_token with a PAT bearer surfaces the 'use a session JWT' message (not a generic 403) + get_api_token tool description mentions the session-vs-PAT requirement
T17 P1-1	Name schema regex — min(1).max(64) doesn't mirror the api's ^[A-Za-z0-9][A-Za-z0-9 _-]*$	Added the regex (as a named constant API_NAME_PATTERN) to the shared nameArg AND create_deploy.name; mock now enforces the same pattern with invalid_name	13 tests: 6 rejected names + 5 accepted names on create_postgres, 1 case on create_deploy, plus a registry-iterating coverage test that fails if any future create_* ships without the pattern
T17 P1-3	4 npm audit vulns (1 high fast-uri, 3 moderate)	npm audit fix → 0 vulnerabilities	CI gate output (npm audit runs in npm install step)
T17 P1-6	User-Agent hardcodes instanode-mcp/0.11.0 in two places	Sourced from package.json at module load (PKG_VERSION + USER_AGENT constants); both headers() and authHeaders() read the same const	client UA string equals 'instanode-mcp/<package.json version>' (no hardcoded 0.11.0 literal)
T17 P0/P1-5	The integration mock is not faithful to live openapi.json — masks the bugs above	Fetched the live spec from https://api.instanode.dev/openapi.json and aligned mock-api.ts shapes: /deploy/{id}/redeploy bare 202; /api/v1/auth/api-keys 403 for PATs / 400 missing name / 400 invalid scope; /claim 200 ClaimResponse {ok, team_id, user_id, session_token, message} (not the legacy 201 direct-claim); provisioning routes enforce the live name regex	6 contract-pinning tests under mock-api contract pinning

Gate output

$ npm install && npm run build && npm test

# install
> found 0 vulnerabilities

# build
> instanode-mcp@0.11.1 build
> tsc
# (tsc clean, 0 errors)

# test
✔ instanode-mcp integration suite (15.3 s)
﹣ live smoke (provision-then-teardown) (0.75 ms) # SKIP
ℹ tests 62
ℹ suites 16
ℹ pass 62
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0

Previously 39 pass / 0 fail — the 23 new tests all map to BugBash findings
(redeploy bare-202, get_api_token PAT, name regex × 13, registry coverage,
UA from package.json, plus 6 mock contract-pin tests).

Versioning

Bumped 0.11.0 → 0.11.1 in package.json + server.json. The User-Agent
test reads the resolved version dynamically so it stays green across future
bumps.

Not in scope

• T17 P1-2 (delete_resource description wording) — informational, no
  behavior change needed.
• T17 P1-4 (claim_token chain documented as walking through
  get_api_token) — needs a product call on whether to remove the chain
  advice or wire a session-issuing flow; left for follow-up.
• T17 P2/P3 items.

🤖 Generated with Claude Code

[mastermanas805]

Closing as superseded. This PR's fixes (T17 P0-1 redeploy crash, P0-2 PAT clarity, P1 name regex, P1 npm audit, P1 User-Agent) were re-landed on master directly via PR #12 (merged 2026-05-21) since this PR had been sitting open unmerged. The wave3 P2 fixes (tarball cap, allowed_ips invariant) from PR #11 are also on master. Nothing here is missing from master.