fix(mcp): wave 3 — BugHunt 2026-05-20 T17 P2 fixes

[mastermanas805]

Summary

Wave 3 of the BugHunt 2026-05-20 sweep — three T17 P2 findings on the MCP
surface. All fixes are local-only (no API contract changes), guarded by
4 new regression tests, build + test green.

Fixes

T17 P2 — client-side 50 MiB tarball cap in createDeploy

Pre-fix, an oversized base64 payload was decoded, uploaded in full via
multipart, and rejected server-side — wasting bandwidth and (depending
on the host) logging multi-MB strings. The cap now fails fast with a
clear error and a "shrink with .dockerignore" hint, before any
network I/O. Constant MAX_TARBALL_BYTES exported from client.ts as
a named source of truth.

T17 P2 — allowed_ips ↔ private invariant enforced client-side

The api only consults allowed_ips when private===true; passing
allowed_ips without private silently leaves the deploy publicly
reachable — an agent believes it restricted access but did not. The
MCP now rejects both shapes locally with explicit errors:

• allowed_ips without private:true → "set private:true to use the
  allowlist OR remove allowed_ips for a public deploy"
• private:true with empty allowed_ips → "pass at least one IP or
  CIDR, e.g. allowed_ips: ['203.0.113.42/32']"

The create_deploy tool description now documents the coupling.

T17 P2 — anonymous-tier teardown contract documented

Per CLAUDE.md the free surface is throwaway-by-construction: anonymous
resources auto-expire after 24h, on-demand delete is paid-tier only
by design. This isn't a missing feature — it's the platform
contract. Updated:

• delete_resource description: explicit "paid tier only", the
  contract reason ("the free surface is throwaway-by-construction"),
  and what an agent should do for cleanup (do nothing — the worker
  reaper handles it at 24h)
• Every create_* tool description (postgres, cache, nosql, queue,
  storage, webhook): a Cleanup: line pointing callers at auto-expire
  (anonymous) or delete_resource (paid)

Tests (4 new regression tests in test.sh)

PASS: create_deploy rejects >50 MiB tarball client-side (T17 P2)
PASS: create_deploy rejects allowed_ips without private:true (T17 P2)
PASS: create_deploy rejects private:true with empty allowed_ips (T17 P2)
PASS: delete_resource description documents anonymous auto-expire (T17 P2)

Gate output

$ npm install && npm run build && npm test
> instanode-mcp@0.11.0 build
> tsc                                   # clean, 0 errors

> instanode-mcp@0.11.0 test
> bash test.sh                          # 16 PASS, 0 FAIL

Files changed

• src/client.ts — MAX_TARBALL_BYTES constant, client-side tarball
  cap + allowed_ips/private invariant in createDeploy().
• src/index.ts — Tool descriptions updated (6 × create_*,
  delete_resource, create_deploy).
• test.sh — 4 new T17 P2 regression tests.

NOT merged

Branch lives on fix/bugbash-2026-05-20-wave3 per the task brief —
review-only, no auto-merge.

🤖 Generated with Claude Code