fix(flaunch): fail closed on unsafe token image URLs and paths

[SashaMIT]

Summary

Flaunch token creation takes an agent-controlled image string and either fetches it or fs.readFiles it before uploading bytes to IPFS. There was no host allowlist, redirect policy, or cwd confinement, so a tool call could hit loopback/metadata (SSRF) or read arbitrary local files.

This PR:

• requires https:// with a non-blocked host (loopback / RFC1918 / link-local / CGNAT / .localhost)
• uses fetch(..., { redirect: "error" }) so redirects cannot bypass the host check
• confines local paths to process.cwd() via realpath

Distinct from open #1421 / #1423 (quote fail-closed).

Test plan

• npx jest --testPathPattern=metadata_utils (5 passed)
• Manual: https public image still flaunchs; http://127.0.0.1/... and /etc/passwd fail closed

Made with Cursor

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[SashaMIT]

Consolidating our open queue to reduce triage load. Closing this for now; the core set we are keeping open is #1392, #1404, #1405, #1409, #1421, #1423. Happy to reopen or refile this specific fix if a maintainer wants it.