Harden protection with pinned requests and path-param encoding

[pabik]

• What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
  Replace all direct requests.*() calls in agent tools and parsers with pinned_request() from safe_url.py, which resolves DNS once, validates all returned IPs against the SSRF blocklist, and dials the validated IP literal directly.
  Default allow_redirects=False on all outbound requests, preventing redirect-based SSRF bypass (e.g. Location: http://169.254.169.254/...)
  URL-encode path parameter values with quote(value, safe="") before template substitution, preventing path traversal and query injection via LLM-supplied arguments

• Why was this change needed? (You can also link to an open issue here)
  Harden app protection.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nextra-docsgpt	Ready	Preview, Comment	May 23, 2026 1:09am
oss-docsgpt	Ready	Preview, Comment	May 23, 2026 1:09am

[codecov]

Codecov Report

❌ Patch coverage is 97.40260% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.91%. Comparing base (9b8fe2d) to head (46b2ca7).
⚠️ Report is 40 commits behind head on main.

Files with missing lines	Patch %	Lines
application/agents/tools/ntfy.py	60.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2486      +/-   ##
==========================================
- Coverage   91.34%   90.91%   -0.43%     
==========================================
  Files         248      275      +27     
  Lines       20709    24285    +3576     
==========================================
+ Hits        18916    22079    +3163     
- Misses       1793     2206     +413     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.