fix: harden URL encoding and input validation for AI/LLM callers#21

Merged

jpoehnelt merged 13 commits intomainfrom

fix/encoding-url

Mar 4, 2026

Commits on Mar 4, 2026

refactor: replace manual urlencoded() with reqwest .query() builder

jpoehnelt-bot
authored and
jpoehnelt
committed
fix: percent-encode path parameters to prevent path traversal

jpoehnelt-bot
authored and
jpoehnelt
committed
fix: add shared URL safety helpers for path params

jpoehnelt-bot
authored and
jpoehnelt
committed
test: add AI edge case tests for URL safety helpers

jpoehnelt-bot
authored and
jpoehnelt
committed
fix: warn on stderr when API calls fail silently

jpoehnelt-bot
authored and
jpoehnelt
committed
fix: harden input validation for AI/LLM callers

jpoehnelt-bot
authored and
jpoehnelt
committed
chore: add changesets for PR #21 commits

jpoehnelt-bot
authored and
jpoehnelt
committed
test: add comprehensive test coverage for input validation handlers

jpoehnelt-bot
authored and
jpoehnelt
committed
docs: document input validation and URL safety patterns in AGENTS.md and CONTRIBUTING.md

jpoehnelt-bot
authored and
jpoehnelt
committed
fix: address PR review comments — reject ?/# in resource names, validate subscription arg, remove redundant validate_msg_format

jpoehnelt-bot
authored and
jpoehnelt
committed
fix: store validated PathBuf, remove dead code, delete duplicate SubscribeConfig

jpoehnelt-bot
authored and
jpoehnelt
committed
fix: per-segment traversal check in validate_resource_name, fix docs

jpoehnelt-bot
authored and
jpoehnelt
committed
fix: harden security validation and deduplicate logic
jpoehnelt
committed