fix(security): avoid polynomial-time ReDoS in trimTrailingSlash

[adityathebe]

Summary

Fixes code scanning alert #2 — Polynomial regular expression used on uncontrolled data (js/polynomial-redos, High, CWE‑1333/400/730) at src/index.ts:273.

The trimTrailingSlash helper used the regex /\/+$/:

function trimTrailingSlash(value: string): string {
  return value.trim().replace(/\/+$/, "");
}

Because baseUrl reaches this regex through the SDK's public API (createMissionControlPluginClient({ baseUrl }) → normalizeBaseUrl → trimTrailingSlash, and also via joinURL), the input is uncontrolled. On a string with many / characters that isn't a match — e.g. "/".repeat(n) + "x" — the engine matches \/+ greedily, fails the $ anchor, backtracks one slash, fails again, and so on: O(n²) work, i.e. a denial‑of‑service vector.

Fix

Strip trailing slashes with a linear character scan instead of a backtracking regex:

function trimTrailingSlash(value: string): string {
  const trimmed = value.trim();
  let end = trimmed.length;
  while (end > 0 && trimmed[end - 1] === "/") end--;
  return trimmed.slice(0, end);
}

The leading‑slash strip on the next line (path.replace(/^\/+/, "") in joinURL) is anchored at ^ with nothing following it, so it is linear and was correctly not flagged — left unchanged.

Verification

• Behavior is identical to the old regex on all inputs tested ("", "/", "//", "////", "https://mc.example.com/", "/api/mission-control", " https://x/y// ", "a/b/c").
• Worst‑case "/".repeat(100000) + "x" payload now completes in ~0.07 ms (linear).
• pnpm check (tsc), pnpm build, and pnpm test (9/9) all pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Cz4tJqTqv4TdxxAKdRMdDH

---

Generated by Claude Code