chore(sync): merge upstream main (Mastra 1.67, CopilotKit 1.72, MCP ChatGPT app, provider fixes)

[JOY (JOY)]

Summary

90 upstream commits since the last sync:

• Mastra 1.67 + CopilotKit 1.72 upgrade (schema mirror NOT taken — fork architecture keeps Mastra tables outside Prisma; boot-time storage init dropped upstream-side)
• MCP: ChatGPT app on /mcp-oauth-chatgpt, separate no-DCR issuer, upload widget (MCP Apps ui:// resource)
• OAuth hardening: client_secret_basic on token endpoint, email claims for DCR clients on verified domains
• Security: super-admin guard scoped to calling org, debug endpoints restricted to super admins
• Provider fixes: Instagram collaborators, Facebook/Meta graph version + (What do you think about moving to keys into Postiz DB gitroomhq/postiz-app#200) mappings, Reddit/Bluesky/Threads/LinkedIn/Farcaster/TikTok/Pinterest fixes
• Note: the 6 upstream audit-fix branches (refresh-transient-errors, tag-deletion-cleanup, ssrf-literal-ip-bypass, etc.) are STILL not merged upstream — the waiting audit bucket does not move with this sync.

Conflict resolutions

• Kept fork: rebranded .env.example (incl. DOS billing), deleted staging-conflicts workflow (upstream-only), deleted Solana wallet provider (PR fix(deps): remediate 285 audit vulnerabilities — 9 overrides, sharp/vitest bumps, dead-dep removals #34 dead-code removal), no-Mastra-tables schema architecture, DOSClaw MCP tool aliases, branded copilot/agent, bootstrap telemetry scrubbers
• Took upstream: CopilotKit 1.72 request shape + copilotCors, client_secret_basic + revoke endpoint both kept, MantineWrapper/Toaster on auth layout, mcpOnly tool filter, sentry quota sampler (kept our scrubbers), Mastra/CopilotKit dep upgrades
• package.json: semantic 3-way merge (no clashes); lockfile regenerated per upstream precedent

[gemini-code-assist]

Code Review

This pull request introduces a media normalization and processing pipeline using RunPod and Temporal workflows, adds an MCP upload widget, updates the Farcaster signer flow, and implements various bug fixes and optimizations across social providers (Facebook, Instagram, TikTok, Bluesky, Pinterest, and Reddit). The review feedback highlights a critical git merge conflict marker left in the code, potential unhandled exceptions during JSON parsing and handle-stripping, duplicate React key warnings in the customer modal, potential undefined values in CORS origins, and a missing UUID format validation for organization overrides in the authentication middleware.

[gemini-code-assist]

A git merge conflict marker (>>>>>>> upstream/main) was accidentally left in the code. This will cause a syntax/compilation error and must be removed.

Suggested change

	const directTools = (
	>>>>>>> upstream/main
	await Promise.all<{ name: string; tool: any }>(
	const directTools = (
	await Promise.all<{ name: string; tool: any }>(

[gemini-code-assist]

If app.redirectUris contains malformed or invalid JSON, JSON.parse will throw an unhandled exception and crash the request with a 500 error. It is safer to wrap the parsing in a try-catch block to handle this gracefully.

    let uris: string[] = [];
    try {
      uris = JSON.parse(app.redirectUris || '[]') as string[];
    } catch {
      return false;
    }
    const webHosts: string[] = [];
    for (const uri of uris) {

[gemini-code-assist]

If handle is undefined or null, calling handle.replace will throw a TypeError and crash the execution. It is safer to default handle to an empty string or check its type before calling .replace.

Suggested change

	private stripHandle(handle: string) {
	return handle.replace(/^@+/, '');
	}
	private stripHandle(handle?: string) {
	return (handle || '').replace(/^@+/, '');
	}

[gemini-code-assist]

Using name as the React key can lead to duplicate key warnings and rendering issues if multiple customers share the same name. It is safer to map over the original data array and use the customer's unique id (or the array index as a fallback) for the key.

Suggested change

	<datalist id="customer-name-options">
	{(data?.map((p: any) => p.name) || []).map((name: string) => (
	<option key={name} value={name} />
	))}
	</datalist>
	<datalist id="customer-name-options">
	{(data || []).map((p: any, index: number) => (
	<option key={p.id || index} value={p.name} />
	))}
	</datalist>

[gemini-code-assist]

If process.env.FRONTEND_URL is undefined, the origin array will contain undefined, which can cause issues or runtime errors in some CORS libraries. It is safer to filter out any falsy values from the origins array.

Suggested change

	origin: [
	process.env.FRONTEND_URL,
	'http://localhost:6274',
	...(process.env.MAIN_URL ? [process.env.MAIN_URL] : []),
	],
	origin: [
	process.env.FRONTEND_URL,
	'http://localhost:6274',
	process.env.MAIN_URL,
	].filter(Boolean) as string[],

[gemini-code-assist]

If overrideOrgId is not a valid UUID format, passing it to the database query inside getOrgByIdWithSubscription will cause Prisma to throw an inconsistent column data exception, resulting in an unhandled 500 Internal Server Error. It is safer to validate that overrideOrgId is a valid UUID before querying the database.

      if (overrideOrgId) {
        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
        if (!uuidRegex.test(overrideOrgId)) {
          res.status(HttpStatus.BAD_REQUEST).json({ msg: 'Invalid organization ID format' });
          return;
        }

        if (
          isOAuthApp ||
          !(await this._organizationService.canUseSuperAdminApi(org.id))
        ) {
          res.status(HttpStatus.FORBIDDEN).json({ msg: 'Unauthorized' });
          return;
        }

        const overrideOrg =
          await this._organizationService.getOrgByIdWithSubscription(
            overrideOrgId
          );

[JOY (JOY)]

Merge rationale for 2 failing code-scanning checks

CodeQL — 1 critical (SSRF) at media.service.ts:135: false positive at runtime.
The fetch is already wrapped with dispatcher: ssrfSafeDispatcher (our audit S-series guard: DNS resolution pinned + private/literal IP blocking). CodeQL's static model cannot see through the undici dispatcher option, so it flags the user-controlled URL. Follow-up: refactor to a CodeQL-modeled validation step or dismiss with reason.

ESLint — 3 errors in farcaster.provider.tsx: upstream's new Farcaster managed-signers code (exhaustive-deps + <img>). Pre-existing upstream lint debt, carried in by the sync; follow-up quality pass.

Both checks are code-scanning surfaces, not build/test gates — Build, ESLint Analysis (both), Analyze, Branding Guard and CodeQL build steps are green. The build has compiled the entire merged tree.