feat: nightly hardening - remote content-type validation

[mouse-value-add]

Problem

accepted any successful HTTPS response body type. That allowed non-markdown content types (for example or other binary/media responses) to flow into parsing, which wastes parse budget and weakens input hygiene for remote profile loading.

Approach

• Added an allowlist check for remote in .
• Normalize header values (strip parameters and lowercase) before validation.

• Allow only markdown/text profile media types:
• Return a with a clear message when content type is unsupported.
• Added parser tests to verify rejection happens before body reads and that allowed types with charset parameters still pass.

Verification

you-md@0.2.0 test
vitest run --run test/parser/loadFromUrl.test.ts

RUN v2.1.9 /Users/mouse/.openclaw/workspace/repos/you.md

✓ test/parser/loadFromUrl.test.ts (5 tests) 9ms

Test Files 1 passed (1)
Tests 5 passed (5)
Start at 15:08:55
Duration 240ms (transform 34ms, setup 0ms, collect 38ms, tests 9ms, environment 0ms, prepare 26ms)

you-md@0.2.0 test
vitest run --run test/parser

RUN v2.1.9 /Users/mouse/.openclaw/workspace/repos/you.md

✓ test/parser/frontmatter.test.ts (7 tests) 1ms
✓ test/parser/markdown.test.ts (11 tests) 3ms
✓ test/parser/yaml.test.ts (12 tests) 3ms
✓ test/parser/timeout.test.ts (3 tests) 2ms
✓ test/parser/loadFromUrl.test.ts (5 tests) 10ms

Test Files 5 passed (5)
Tests 38 passed (38)
Start at 15:08:55
Duration 264ms (transform 95ms, setup 0ms, collect 179ms, tests 19ms, environment 0ms, prepare 166ms)

• Result: all parser tests passing (38/38), including new content-type hardening coverage.

Risks

• Some servers may publish valid markdown with uncommon MIME types and now be rejected until added to the allowlist.

Rollback Plan

• Revert this commit to restore previous behavior:
  • [chore/nightly-hardening-20260417-content-type-guard c67819b] Revert "feat: harden remote profile loading by validating content-type"
    Date: Fri Apr 17 15:08:56 2026 -0700
    2 files changed, 78 deletions(-)
• If needed, hotfix by expanding the allowlist for trusted additional MIME types.