fix(mcp): do not split a template value inside a percent escape

A value ran to the first place the next literal appeared, even when that
place was inside a `%XX` escape of the value. With `{a}D{b}`, the URI
`a%2DbDc` split at the `D` of `%2D`, so `a` could not be decoded and a
valid URI matched no template. The search now skips places inside an
escape, so `a` reads `a-b` and `b` reads `c`.

Author: erkamyaman

docs/content/2.adapters/7.mcp.md

@@ -99,7 +99,7 @@ devframeViteBridge(myDevframe, {
 })
 ```
 
-The `uriTemplate` uses RFC 6570 level 1: plain `{name}` expressions. Each one matches a non-empty value without `/`, and `read` gets its value percent-decoded, so a value with a `/` comes in as `%2F`. When one segment has several values, such as `{from}-{to}`, each value runs up to the first place the next text appears. Any other template syntax, or two expressions with nothing between them (`{a}{b}`), throws [DF0084](/errors/DF0084) when the route mounts. `read` returns `text`, or `json` that the server sends as JSON text, and an optional `mimeType` (the default is the `mimeType` of the template, then `application/json`).
+The `uriTemplate` uses RFC 6570 level 1: plain `{name}` expressions. Each one matches a non-empty value without `/`, and `read` gets its value percent-decoded, so a value with a `/` comes in as `%2F`. When one segment has several values, such as `{from}-{to}`, each value runs up to the first place the next text appears outside a `%XX` escape. Any other template syntax, or two expressions with nothing between them (`{a}{b}`), throws [DF0084](/errors/DF0084) when the route mounts. `read` returns `text`, or `json` that the server sends as JSON text, and an optional `mimeType` (the default is the `mimeType` of the template, then `application/json`).
 
 `resources/read` sends a `devframe://resource/<id>` or `devframe://state/<key>` URI to the registered resource or the shared state as before. It tries any other URI against the templates in order, and the first template that matches reads it. A URI that nothing matches gets the usual unknown-resource error, and an error thrown by `read` goes to the MCP client like the error of a registered resource. `resources/list` adds the entries that the `list` of each template returns. With an empty or omitted list, the resources stay as they are and `resources/templates/list` answers method not found. `createMcpServer` and `createMcpFetchHandler` take the same `resourceTemplates` option.
 

packages/agentic/src/mcp/__tests__/mcp-server.test.ts

@@ -770,6 +770,14 @@ describe('mcp adapter (in-memory)', () => {
         expect(range!.match(uri)).toBeUndefined()
     })
 
+    it('does not split a value inside a percent-encoded character', () => {
+      const [pair] = compileResourceTemplates([{ uriTemplate: 'test://pair/{a}D{b}', name: 'pair', read: () => ({}) }])
+      expect(pair!.match('test://pair/a%2DbDc')).toEqual({ a: 'a-b', b: 'c' })
+      expect(pair!.match('test://pair/a%2dbDc')).toEqual({ a: 'a-b', b: 'c' })
+      const [hex] = compileResourceTemplates([{ uriTemplate: 'test://hex/{a}2D{b}', name: 'hex', read: () => ({}) }])
+      expect(hex!.match('test://hex/x%2D2Dy')).toEqual({ a: 'x-', b: 'y' })
+    })
+
     it('keeps a value named __proto__', () => {
       const [proto] = compileResourceTemplates([{ uriTemplate: 'test://proto/{__proto__}', name: 'proto', read: () => ({}) }])
       expect(Object.entries(proto!.match('test://proto/x')!)).toEqual([['__proto__', 'x']])

packages/agentic/src/mcp/build-server.ts

@@ -500,8 +500,9 @@ function compileResourceTemplate(template: McpResourceTemplate): CompiledResourc
 /**
  * Match `uri` in one pass from left to right, with no regular expression, so
  * the time grows with the URI length only and a crafted URI cannot block the
- * process. Each value runs to the first place the next literal appears (the
- * last value runs to the tail). A value must not be empty or contain `/`.
+ * process. Each value runs to the first place the next literal appears
+ * outside a `%XX` escape (the last value runs to the tail). A value must not
+ * be empty or contain `/`.
  * The params object has no prototype, so a variable such as `__proto__`
  * keeps its value.
  */
@@ -518,7 +519,7 @@ function matchTemplate(uri: string, literals: string[], names: string[]): Record
   for (let index = 0; index < names.length; index++) {
     const isLast = index === names.length - 1
     const next = literals[index + 1]!
-    const stop = isLast ? end : uri.indexOf(next, position + 1)
+    const stop = isLast ? end : findLiteral(uri, next, position)
     if (stop <= position || stop > end)
       return undefined
     const raw = uri.slice(position, stop)
@@ -535,6 +536,18 @@ function matchTemplate(uri: string, literals: string[], names: string[]): Record
   return params
 }
 
+/**
+ * The first place `literal` appears after the value that starts at `start`
+ * (which must not be empty), or -1. A place inside a `%XX` escape of the
+ * value is skipped, so `{a}D{b}` reads `a%2DbDc` as `a-b` and `c`.
+ */
+function findLiteral(uri: string, literal: string, start: number): number {
+  let at = uri.indexOf(literal, start + 1)
+  while (at !== -1 && (uri[at - 1] === '%' || (at - 2 >= start && uri[at - 2] === '%')))
+    at = uri.indexOf(literal, at + 1)
+  return at
+}
+
 /**
  * The content blocks a tool result carries through `withMcpContent`, checked
  * and copied field by field, or `undefined` when it carries none. Invalid