fix: apply URL filters to resource loading

[mturac]

Fixes #2218.

McpContext.loadResource() already validated file: resources through workspace roots, but direct http:/https: resource fetches did not apply the configured URL filters. This threads the existing blocked/allowed URL patterns into the context and checks them before fetching remote resources.

Regression coverage uses the local test server to verify blocked URLs are rejected, allowed URLs still load, and an empty allowlist does not accidentally deny all resource loads.

How I tested:

• npm run test tests/McpContext.test.ts
• npm run test tests/network_blocking.test.ts
• npm run check-format

I also tried npm run test; the build completed, but the full suite failed locally in timing-sensitive unrelated tests (telemetry.test.ts waiting for server_start, and shutdown.test.ts stdin-EOF shutdown budget).

[nattallius]

Thanks you for contribution! Looks good for me mostly.

Сan you also add validation of both patterns in src/bin/chrome-devtools-mcp-cli-options.ts

blockedUrlPattern: {
    type: 'array',
    describe:
      'Restricts network access by blocking specified URL patterns (uses https://urlpattern.spec.whatwg.org/). Silently detaches from targets with blocked URLs upon connection, and blocks runtime requests (including navigations and subresources). Accepts an array of patterns.',
    conflicts: ['allowedUrlPattern'],
    coerce: (patterns: unknown[] | undefined) => {
      if (!patterns) {
        return undefined;
      }
      for (const pattern of patterns) {
        new URLPattern(String(pattern));
      }
      return patterns.map(String);
    },
  }

[nattallius]

Now as we pass options into context, we don't need to pass hasNetworkBlockOrAllowlist and we can calculate and assign it in the context constructor ourself. Can you please remove it from McpContextOptions

[nattallius]

Suggested change

	it('http protocol respects the network blocklist', async () => {
	it('should block remote resources matching the blocklist', async () => {

[nattallius]

Suggested change

	it('http protocol respects the network allowlist', async () => {
	it('should only load remote resources matching the allowlist', async () => {

[nattallius]

Suggested change

	it('http protocol ignores an empty network allowlist', async () => {
	it('should allow all remote resources if the allowlist is empty', async () => {

[Lightning00Blade]

Let's extract this is a helper function - verifyUrlPatterns

[Lightning00Blade]

Suggested change

	this.#allowlist =
	options.allowlist && options.allowlist.length > 0
	? options.allowlist.map(pattern => new URLPattern(pattern))
	: undefined;
	this.#allowlist = options.allowlist?.map(pattern => new URLPattern(pattern));

[Lightning00Blade]

We can have the same pattern of

Suggested change

	#blocklist: URLPattern[];
	#blocklist: URLPattern[] | undefined;

And check for existence in #validateNetworkResource

[Lightning00Blade]

Not needed for this variable we can pass the url directly to the pattern.test

[Lightning00Blade]

Let's move this under describe('loadResource', () => {

[Lightning00Blade]

We should not test the function directly but use the parseArguments to validate the parsing. Similar to how it's done for other tests.