Cherry-pick: fix(sdk): httpRespond.redirect() takes a path, and an @HttpRoute output that fails its schema answers 500 by frontegg-david · Pull Request #1069 · agentfront/frontmcp

frontegg-david · 2026-11-04T11:15:45Z

Cherry-pick to main

This PR cherry-picks the changes from #1056, which was merged to release/1.11.x.

Original PR

PR: fix(sdk): httpRespond.redirect() takes a path, and an @HttpRoute output that fails its schema answers 500 #1056
Title: fix(sdk): httpRespond.redirect() takes a path, and an @HttpRoute output that fails its schema answers 500
Author: @frontegg-david
Merged to: release/1.11.x
Original commit: 2a43a8b

Why by hand

The cherry-pick workflow commented on #1056 that no cherry-pick was needed, but main doesn't have the change: libs/sdk/src/utils/http-location.utils.ts is missing there.

When the stack merged, fix(sdk): httpRespond.redirect() takes a path, and an @HttpRoute output that fails its schema answers 500 #1056's change landed on release/1.11.x as 2a43a8b66.
The PR's own merge commit, 29920b485, is empty.
The workflow cherry-picked that empty commit onto fix(sdk): createDirect() and create() keep the headers http.forwardHeaders names on in-process calls #1055's cherry-pick branch. That left nothing to commit, which it read as "already applied".

This PR applies 2a43a8b66 itself, which applies to main without conflicts.

Summary by CodeRabbit

New Features
- HTTP routes now support redirects to absolute URLs and request-relative paths, with a default status of 302. Redirect locations safely encode characters that are not valid in a URL.
- The demo web host now redirects /home to /board.
Bug Fixes
- Invalid HTTP response outputs now produce a logged 500 response instead of being returned as ordinary data.
Documentation
- Added guidance on redirect locations, response validation, and potential risks of protocol-relative paths.

…ttpRoute output that fails its schema answers 500 Cherry-picked from #1056 (merged to release/1.11.x) Original commit: 2a43a8b

coderabbitai · 2026-11-04T11:16:03Z

No actionable comments were generated in the recent review.

Walkthrough

The SDK changes HTTP route response validation and redirect handling. It adds errors for invalid response-shaped outputs, accepts relative redirect locations, and normalizes locations before writing response headers. The web-host demo adds a /home redirect to /board.

Changes: HTTP route responses and redirects

Layer / File(s)	Summary
Response validation and error handling `libs/sdk/src/common/schemas/`, `libs/sdk/src/errors/`, `libs/sdk/src/http-route/flows/`, `libs/sdk/src/http-route/__tests__/`, `apps/e2e/demo-e2e-bundle-size/e2e/fixtures/sdk-root-exports.json`, `libs/skills/catalog/frontmcp-development/references/create-http-route.md`	Redirect schema validation accepts absolute and relative locations. Route outputs with a recognized response kind are parsed with schema defaults. Invalid outputs with a `status` fail with a logged `InvalidHttpRouteResponseError`; other objects are returned as JSON. Tests and documentation cover these outcomes.
Redirect location normalization and rendering `libs/sdk/src/utils/http-location.utils.ts`, `libs/sdk/src/utils/__tests__/`, `libs/sdk/src/server/server.validation.ts`, `libs/sdk/src/transport/relay/`, `libs/sdk/src/transport/web-response.renderer.ts`, `libs/skills/catalog/frontmcp-development/references/create-http-route.md`	`toLocationHeader` preserves URL separators and valid percent escapes and encodes unsafe characters. Server, relay, and web response rendering use the helper for redirect locations. Tests cover encoding and invalid character cases.
Web-host redirect example and coverage `apps/e2e/demo-e2e-web-host/src/apps/board/*`, `apps/e2e/demo-e2e-web-host/e2e/web-host.e2e.spec.ts`, `apps/e2e/demo-e2e-bundle-size/e2e/browser-bundle-size.e2e.spec.ts`	The demo registers a public `GET /home` route that redirects to `/board`. An E2E test checks the 302 status and `Location` header. The WebMCP and Vite initial-chunk byte budgets increase.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant RouteHandler
  participant HttpRouteFlow
  participant HttpOutputSchema
  participant FlowControl
  participant HTTPAdapter
  RouteHandler->>HttpRouteFlow: Return response-shaped object
  HttpRouteFlow->>HttpOutputSchema: Parse recognized response kind
  HttpOutputSchema-->>HttpRouteFlow: Parsed response or validation issues
  alt Invalid response with status
    HttpRouteFlow->>FlowControl: Fail flow with route error
  else Valid response
    HttpRouteFlow->>HTTPAdapter: Send parsed response
  end

Possibly related issues

agentfront/frontmcp#1053 — The issue describes path redirects being returned as JSON; this PR updates relative redirect validation and route response handling.

Possibly related PRs

agentfront/frontmcp#1056 — The PR implements the same redirect and invalid route response behavior; this PR applies that change to main as a cherry-pick.
agentfront/frontmcp#1020 — The PR introduced @HttpRoute, HttpOutput, and the route flow that this change updates.

Suggested reviewers: alexmercerpo

Merge Risk: Minimal · up to c58f4

No actionable merge-blocking risk remains after the review.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description explains that this PR cherry-picks `#1056` onto main, names the original PR and commit, and gives the reason the earlier cherry-pick was missed. It does not fill in the template sections…	Add the template sections. Under 'What and why', describe the change itself (redirect accepts paths, and invalid `@HttpRoute` output returns a logged 500) and link the issue if any. Under 'User-facing change', fill in 'What changed', 'Before …

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title names the main change: httpRespond.redirect() now takes a path, and an `@HttpRoute` output that fails its schema returns a 500. The raw summary covers this change (HttpRedirectSchema accepts r…
Docstring Coverage		Docstring coverage is 66.67% which is sufficient. The required threshold is 65.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentati…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: httpRespond.redirect() now takes a path, and an @HttpRoute output that fails its schema returns a 500. The raw summary covers this change (HttpRedirectSchema accepts request-relative paths, toLocationHeader encoding, and InvalidHttpRouteResponseError with a logged 500). The title is long at 118 characters, and the 'Cherry-pick:' prefix describes the PR's origin rather than the code change, but the title is still accurate.

Full details: Docstring Coverage

Explanation

Docstring coverage is 66.67% which is sufficient. The required threshold is 65.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 3 functions across 16 files. (2 skipped: 2 unsupported.)

Full details: Description check

Explanation

The description explains that this PR cherry-picks #1056 onto main, names the original PR and commit, and gives the reason the earlier cherry-pick was missed. It does not fill in the template sections: 'What and why' has no description of the change beyond the cherry-pick reference, the 'User-facing change' section is absent even though the summary shows a public-facing change (redirect path handling and a 500 for invalid route output), and the 'Tests' section is missing. The author should add these sections to match the repository template.

Resolution

Add the template sections. Under 'What and why', describe the change itself (redirect accepts paths, and invalid @HttpRoute output returns a logged 500) and link the issue if any. Under 'User-facing change', fill in 'What changed', 'Before → after', 'frontmcp.dev pages affected', and 'Skills catalog entries updated'. The skills catalog file create-http-route.md is in the diff, so list it there. Under 'Tests', list the spec files added or run, such as http-location.utils.spec.ts, http-output.schema.spec.ts, http-route.flow.spec.ts, relay-http.spec.ts, and the web-host E2E test.

Finishing Touches

Generate docstrings

Commit to this branch
Create a new PR

Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

Source mode: Auto

Repository: agentfront/frontmcp

Branch: main

File: .coderabbit.yaml

Commit: 0eb0543

Layers: Repository YAML

Review profile: CHILL

Plan: Essentials

Run ID: `68247d38-26d6-40b8-b6d6-c9a6abcbf4ca`

Commits

Reviewing files that changed from the base of the PR and between `0eb0543` and `c58f4e1`.

Files selected for processing: 18

`apps/e2e/demo-e2e-bundle-size/e2e/browser-bundle-size.e2e.spec.ts`

`apps/e2e/demo-e2e-bundle-size/e2e/fixtures/sdk-root-exports.json`

`apps/e2e/demo-e2e-web-host/e2e/web-host.e2e.spec.ts`

`apps/e2e/demo-e2e-web-host/src/apps/board/board.routes.ts`

`apps/e2e/demo-e2e-web-host/src/apps/board/index.ts`

`libs/sdk/src/common/schemas/tests/http-output.schema.spec.ts`

`libs/sdk/src/common/schemas/http-output.schema.ts`

`libs/sdk/src/errors/http-route.errors.ts`

`libs/sdk/src/errors/index.ts`

`libs/sdk/src/http-route/tests/http-route.flow.spec.ts`

`libs/sdk/src/http-route/flows/http.route.flow.ts`

`libs/sdk/src/server/server.validation.ts`

`libs/sdk/src/transport/relay/tests/relay-http.spec.ts`

`libs/sdk/src/transport/relay/relay-http.ts`

`libs/sdk/src/transport/web-response.renderer.ts`

`libs/sdk/src/utils/tests/http-location.utils.spec.ts`

`libs/sdk/src/utils/http-location.utils.ts`

`libs/skills/catalog/frontmcp-development/references/create-http-route.md`

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 1 remain after this review.

github-actions · 2026-11-04T11:31:25Z

Performance Test Results

Status: ✅ All tests passed

Summary

Project	Tests	Passed
✅ demo-e2e-agents	4	4
✅ demo-e2e-cache	11	11
✅ demo-e2e-codecall	4	4
✅ demo-e2e-config	4	4
✅ demo-e2e-direct	3	3
✅ demo-e2e-elicitation	1	1
✅ demo-e2e-errors	4	4
✅ demo-e2e-hooks	3	3
✅ demo-e2e-multiapp	4	4
✅ demo-e2e-notifications	3	3
✅ demo-e2e-openapi	2	2
✅ demo-e2e-providers	4	4
✅ demo-e2e-public	4	4
✅ demo-e2e-redis	15	15
✅ demo-e2e-remember	4	4
✅ demo-e2e-remote	5	5
✅ demo-e2e-serverless	2	2
✅ demo-e2e-skills	15	15
✅ demo-e2e-standalone	2	2
✅ demo-e2e-transport-recreation	3	3
✅ demo-e2e-ui	4	4

Total: 101 tests across 21 projects

📊 View full report in workflow run

Generated at: 2026-11-04T11:31:24.305Z
Commit: ef4dbd3f

Cherry-pick: fix(sdk): httpRespond.redirect() takes a path, and an @H…

c58f4e1

…ttpRoute output that fails its schema answers 500 Cherry-picked from #1056 (merged to release/1.11.x) Original commit: 2a43a8b

frontegg-david added the cherry-pick Use cherry-pick for PRs added to version branches to allow merging into main label Nov 4, 2026

frontegg-david mentioned this pull request Nov 4, 2026

1.11.0: httpRespond.redirect() with a path answers 200 with the redirect object as JSON #1053

Closed

frontegg-david mentioned this pull request Nov 4, 2026

ci: cherry-pick a stacked PR's change, not its empty merge commit #1070

Merged

frontegg-david merged commit 59eae6f into main Nov 4, 2026
48 of 49 checks passed

frontegg-david deleted the fix/1053-relative-redirect-cherry-pick-main branch November 4, 2026 12:32

frontegg-david mentioned this pull request Nov 4, 2026

ci: a merged native stack gets one cherry-pick PR to main, not one per PR #1117

Merged

Navigation Menu

Repository navigation

Cherry-pick: fix(sdk): httpRespond.redirect() takes a path, and an @HttpRoute output that fails its schema answers 500 - #1069

Cherry-pick: fix(sdk): httpRespond.redirect() takes a path, and an @HttpRoute output that fails its schema answers 500#1069
frontegg-david merged 1 commit into
mainfrom
fix/1053-relative-redirect-cherry-pick-main

frontegg-david commented Nov 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Nov 4, 2026 •

edited

Loading

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Nov 4, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

frontegg-david commented Nov 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Cherry-pick to main

Original PR

Why by hand

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Nov 4, 2026

Performance Test Results

Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

frontegg-david commented Nov 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Nov 4, 2026 •

edited

Loading