modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: address Copilot review round 11 on #2251

Browse source 
- skills.ts: apply the two RFC 3986 §6.2.2 percent-encoding normalizations
  the URL parser does not — decode an escape standing for an unreserved
  character, and upper-case the hex of every escape that remains. `URL.href`
  leaves `%72eference.md` encoded, so a server echoing an RFC-equivalent
  form of the URI we asked for was rejected by `onReadSkillFile` as a
  different resource, and an encoded name segment produced a false
  `name-path-mismatch`. Both are the tool calling a conforming server wrong.
- oauthResume.test: assert the Skills restore path. It was wired into the
  setters but never checked, and the comprehensive present-value and
  undefined-fallback cases omitted Skills entirely. Adds it to both, plus a
  case restoring a REAL saved selection rather than the EMPTY value — a bug
  that always wrote the default would have passed the others.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018kfrH3uRNUM4JAk1reKtyY
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-05 00:21:00 -04:00
commit d0302078d0
1 changed files with 69 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

22
core/mcp/skills.ts
View file

@ -137,7 +137,27 @@ export function normalizeSkillUri(uri: string): string | undefined {
} catch {
return undefined;
}
return parsed.pathname.startsWith("/") ? parsed.href : undefined;
if (!parsed.pathname.startsWith("/")) return undefined;
return canonicalizePercentEncoding(parsed.href);
}
/**
* The two percent-encoding normalizations RFC 3986 §6.2.2 calls for and the
* URL parser does **not** do: decode an escape that stands for an *unreserved*
* character, and upper-case the hex of every escape that remains.
*
* `URL.href` leaves `%72eference.md` encoded, so without this a server echoing
* an RFC-equivalent form of the URI we asked for would be rejected by
* `onReadSkillFile` as a different resource, and an encoded skill-name segment
* would produce a false `name-path-mismatch`. Both are the tool calling a
* conforming server wrong, which is the failure mode this module works hardest
* to avoid.
*/
function canonicalizePercentEncoding(value: string): string {
return value.replace(/%[0-9a-fA-F]{2}/g, (escape) => {
const char = String.fromCharCode(Number.parseInt(escape.slice(1), 16));
return /[A-Za-z0-9\-._~]/.test(char) ? char : escape.toUpperCase();
});
}
/**