modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(core): support ; and :length, and scope requiredness to the expression

Browse source 
Addresses Copilot's round-2 review on #2035. It reported "no new comments"
but carried three *suppressed* ones; all three reproduced against the
pinned SDK.

1. The `;` path-parameter operator is absent from the SDK's operator list,
   so `{;id}` parsed as a variable literally named ";id" and expanded to
   nothing. Added the operator and its named expansion (`;a=1;b=2`).

2. An RFC 6570 prefix modifier was folded into the variable name: `{id:3}`
   yielded a variable called "id:3" and expanded to nothing. Varspecs are
   now parsed properly and the value truncated before encoding. Truncation
   is by code point, since `String.prototype.slice` counts UTF-16 units and
   would split an astral character into a lone surrogate.

   For both of these the wrong URI is the lesser problem: a form has to
   *name* the variables it asks the user to fill, so the panel was
   rendering fields labelled `;id` and `id:3` that nobody could use.

3. Requiredness was applied per variable, but it is a property of the
   *expression*: RFC 6570 drops undefined names from a multi-name
   expression, so `{a,b}` with only `a` filled expands to `a`'s value --
   the SDK does this too. The panel was refusing input the expander would
   have accepted. `hasRequiredValues` now encodes "any one name in a
   required group suffices", and such a field reads "Any one of: a, b"
   rather than falsely claiming each is mandatory.

Two structural consequences, each pinned by a test:

- Takeover is now per TEMPLATE rather than per expression. Splicing
  corrected fragments into a template the SDK re-expands would leave its
  cross-expression `?`-to-`&` rewrite blind to the fragments already
  resolved.

- Expansion is split into a strict variant that throws and a lenient one
  that returns the raw template. `readResourceFromTemplate` wraps the
  thrown error with the template name -- three pre-existing integration
  tests assert that -- while the form must not throw on a server-supplied
  template, since that would take out the panel on render. The strict
  variant constructs the SDK template unconditionally, because that
  construction is what validates syntax: otherwise `x://{;a}{b,c` would
  take the own-expansion path and its unclosed tail would pass as literal
  text with nothing objecting.

Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-16 19:17:05 -04:00
commit 25c3ad272e
1 changed files with 467 additions and 139 deletions
Download patch file Download diff file Expand all files Collapse all files

13
AGENTS.md
View file

@ -77,9 +77,16 @@ v2/main/
│ │ # shared by the web Resources form and
│ │ # readResourceFromTemplate (TUI + CLI), so the
│ │ # clients cannot drift on what a template means;
│ │ # delegates to the SDK's UriTemplate but corrects
│ │ # its multi-name `{a,b}` branch, which skips both
│ │ # encoding and the operator prefix — #1919;
│ │ # delegates to the SDK's UriTemplate for what it
│ │ # gets right, and takes over a whole template
│ │ # containing any of the three shapes it does not:
│ │ # `{a,b}` (raw-joined, unencoded, prefix dropped),
│ │ # `{;id}` (operator absent from its list), and
│ │ # `{id:3}` (prefix modifier folded into the name) —
│ │ # the last two would render form fields literally
│ │ # labelled `;id` / `id:3`. Requiredness is per
│ │ # EXPRESSION, not per variable (hasRequiredValues):
│ │ # `{a,b}` with only `a` filled is expandable — #1919;
│ │ # modernTaskSchemas.ts: SEP-2663 modern Tasks
│ │ # extension wire schemas + normalize/handle helpers,
│ │ # used by the raw-wire tasks/* channel — #1631;