fix(mcp): decode Content-Encoding on the undici.request transport (fetch parity)

undici.request returns raw bytes; fetch auto-decompresses. Restore that: pipe a
gzip/deflate/br response body through the matching zlib decoder before the WHATWG
bridge and strip content-encoding/content-length. maxResponseSize still caps the
compressed wire bytes; errors forward into the decoder and the source is torn down
when the decoded stream ends or is cancelled. Adds a gzip decode test.

Author: waleedlatif1

apps/sim/lib/core/security/guarded-request-fetch.server.test.ts

@@ -9,6 +9,7 @@
  * serves buffered reads, and settles the reader when the source is destroyed without an error.
  */
 import { Readable } from 'node:stream'
+import { gzipSync } from 'node:zlib'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockAgent, mockUndiciRequest } = vi.hoisted(() => {
@@ -180,6 +181,27 @@ describe('createSsrfGuardedFetchWithDispatcher (undici.request backed)', () => {
     await reader.read()
   })
 
+  it('decodes a gzip Content-Encoding body and strips the framing headers (fetch parity)', async () => {
+    const gzipped = gzipSync(Buffer.from(JSON.stringify({ ok: true, msg: 'compressed' })))
+    const source = new Readable({ read() {} })
+    source.push(gzipped)
+    source.push(null)
+    mockUndiciRequest.mockResolvedValueOnce(
+      undiciReply(
+        200,
+        { 'content-type': 'application/json', 'content-encoding': 'gzip', 'content-length': '40' },
+        source
+      )
+    )
+    const { fetch } = createSsrfGuardedFetchWithDispatcher()
+
+    const response = await fetch('https://mcp.example.com/data', { method: 'GET' })
+
+    expect(await response.json()).toEqual({ ok: true, msg: 'compressed' })
+    expect(response.headers.get('content-encoding')).toBeNull()
+    expect(response.headers.get('content-length')).toBeNull()
+  })
+
   it('rejects the reader when the source is destroyed without an error (abort/reset)', async () => {
     const source = new Readable({ read() {} }) // stays open, never pushes
     mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, source))

apps/sim/lib/core/security/input-validation.server.ts

@@ -1,4 +1,5 @@
 import { Readable } from 'node:stream'
+import zlib from 'node:zlib'
 import dns from 'dns/promises'
 import http from 'http'
 import https from 'https'
@@ -676,6 +677,28 @@ function toUndiciRequestBody(
   return body as unknown as string | Buffer | Uint8Array | Readable
 }
 
+/**
+ * Decompression transform for a `Content-Encoding`, or `null` to pass the body through.
+ * `undici.fetch` decodes the body automatically; `undici.request` does not, so this restores
+ * fetch parity for gzip/deflate/br responses (common behind CDNs). Unknown/absent encodings
+ * pass through untouched.
+ */
+function contentEncodingDecoder(
+  encoding: string
+): zlib.Gunzip | zlib.Inflate | zlib.BrotliDecompress | null {
+  switch (encoding) {
+    case 'gzip':
+    case 'x-gzip':
+      return zlib.createGunzip()
+    case 'deflate':
+      return zlib.createInflate()
+    case 'br':
+      return zlib.createBrotliDecompress()
+    default:
+      return null
+  }
+}
+
 /**
  * Bridges an undici `request()` Node `Readable` into a WHATWG `ReadableStream` for a
  * `Response` body. Node's built-in `Readable.toWeb` is NOT used: its adapter throws an
@@ -811,8 +834,32 @@ async function undiciRequestAsResponse(
   // 204/205/304 carry no body; `new Response` rejects a non-null body for them. Drain
   // undici's (empty) stream so its socket returns to the Agent pool instead of leaking.
   const isNullBody = statusCode === 204 || statusCode === 205 || statusCode === 304
-  if (isNullBody) body.resume()
-  const response = new Response(isNullBody ? null : nodeReadableToWebStream(body), {
+  if (isNullBody) {
+    body.resume()
+    const response = new Response(null, { status: statusCode, headers: responseHeaders })
+    Object.defineProperty(response, 'url', { value: url, configurable: true })
+    return response
+  }
+
+  // Decode Content-Encoding like `fetch` does (`request()` returns raw bytes). `maxResponseSize`
+  // still caps the compressed wire bytes on `body`; forward its errors into the decoder so the
+  // cap and any socket reset still surface as a stream error, and tear the source down when the
+  // decoded stream ends or is cancelled so the socket can't leak.
+  const contentEncoding = String(headers['content-encoding'] ?? '')
+    .toLowerCase()
+    .trim()
+  const decoder = contentEncodingDecoder(contentEncoding)
+  let bodyStream: Readable = body
+  if (decoder) {
+    body.once('error', (err) => decoder.destroy(err))
+    decoder.once('close', () => body.destroy())
+    bodyStream = body.pipe(decoder)
+    // The bridged body is now decoded; drop framing headers that would misdescribe it.
+    responseHeaders.delete('content-encoding')
+    responseHeaders.delete('content-length')
+  }
+
+  const response = new Response(nodeReadableToWebStream(bodyStream), {
     status: statusCode,
     headers: responseHeaders,
   })