fix(mcp): carry redirect mode from a Request input in liftFetchArgs

liftFetchArgs copied method/headers/body/signal from a Request but omitted
redirect, so a Request({ redirect: 'manual' }) on the pinned path defaulted to
'follow' and was transparently followed. Copy input.redirect (explicit init still
wins). Adds a Request-input redirect-mode test.

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.server.ts

@@ -909,6 +909,9 @@ async function liftFetchArgs(
         headers: input.headers,
         body: bodyAllowed ? await input.clone().arrayBuffer() : undefined,
         signal: input.signal,
+        // Carry the Request's redirect mode so the pinned fetch honors `manual`/`error`
+        // instead of defaulting a `Request({ redirect: 'manual' })` to `follow`.
+        redirect: input.redirect,
         ...init,
       },
     }

apps/sim/lib/core/security/pinned-fetch.server.test.ts

@@ -124,6 +124,18 @@ describe('createPinnedFetch', () => {
     expect(response.headers.get('location')).toBe('https://login.example.com/')
   })
 
+  it('honors redirect mode carried on a Request input (not just init)', async () => {
+    mockUndiciRequest.mockResolvedValueOnce(
+      undiciReply(302, { location: 'https://login.example.com/' }, byteStream(''))
+    )
+    const pinned = createPinnedFetch('203.0.113.10')
+
+    const response = await pinned(new Request('https://mcp.example.com/', { redirect: 'manual' }))
+
+    expect(mockUndiciRequest).toHaveBeenCalledTimes(1)
+    expect(response.status).toBe(302)
+  })
+
   it('follows redirects by default and DROPS headers on a cross-origin hop (no api-key leak)', async () => {
     mockUndiciRequest
       .mockResolvedValueOnce(