fix(mcp): match resource templates in one pass and keep a __proto__ value

A template with several values in one segment, such as `{a}-{b}-{c}`,
compiled to a regular expression with overlapping `([^/]+)` groups, so a
crafted URI could backtrack long enough to block the process. Templates
now match in one pass from left to right with no regular expression: each
value runs to the first place the next text appears. Two expressions
with nothing between them (`{a}{b}`) throw DF0084, since a URI cannot
show where one value ends.

The params object has no prototype, so a variable named `__proto__`
keeps its value.

Author: erkamyaman

docs/content/2.adapters/7.mcp.md

@@ -99,7 +99,7 @@ devframeViteBridge(myDevframe, {
 })
 ```
 
-The `uriTemplate` uses RFC 6570 level 1: plain `{name}` expressions. Each one matches one non-empty URI segment, without `/`, and `read` gets its value percent-decoded, so a value with a `/` comes in as `%2F`. Any other template syntax throws [DF0084](/errors/DF0084) when the route mounts. `read` returns `text`, or `json` that the server sends as JSON text, and an optional `mimeType` (the default is the `mimeType` of the template, then `application/json`).
+The `uriTemplate` uses RFC 6570 level 1: plain `{name}` expressions. Each one matches a non-empty value without `/`, and `read` gets its value percent-decoded, so a value with a `/` comes in as `%2F`. When one segment has several values, such as `{from}-{to}`, each value runs up to the first place the next text appears. Any other template syntax, or two expressions with nothing between them (`{a}{b}`), throws [DF0084](/errors/DF0084) when the route mounts. `read` returns `text`, or `json` that the server sends as JSON text, and an optional `mimeType` (the default is the `mimeType` of the template, then `application/json`).
 
 `resources/read` sends a `devframe://resource/<id>` or `devframe://state/<key>` URI to the registered resource or the shared state as before. It tries any other URI against the templates in order, and the first template that matches reads it. A URI that nothing matches gets the usual unknown-resource error, and an error thrown by `read` goes to the MCP client like the error of a registered resource. `resources/list` adds the entries that the `list` of each template returns. With an empty or omitted list, the resources stay as they are and `resources/templates/list` answers method not found. `createMcpServer` and `createMcpFetchHandler` take the same `resourceTemplates` option.
 

docs/content/6.errors/DF0084.md

@@ -9,7 +9,7 @@ description: 'MCP resource template "{name}" has an invalid `uriTemplate` "{uriT
 
 ## Cause
 
-An entry in the `resourceTemplates` list of the MCP route options (or of `createMcpServer` / `createMcpFetchHandler`) has a `uriTemplate` that goes beyond RFC 6570 level 1. The MCP server supports plain `{name}` expressions only. A name is made of letters, digits, `_` and `.`, and each name appears once. An operator (`{+path}`, `{?q}`, `{/id}`), a modifier (`{path*}`, `{id:3}`), a list of names (`{a,b}`), an empty expression (`{}`), or a `{` or `}` outside an expression throws this. The check runs once, when the MCP route mounts or `createMcpServer` starts, so no request is served with a broken template.
+An entry in the `resourceTemplates` list of the MCP route options (or of `createMcpServer` / `createMcpFetchHandler`) has a `uriTemplate` that goes beyond RFC 6570 level 1. The MCP server supports plain `{name}` expressions only. A name is made of letters, digits, `_` and `.`, and each name appears once. An operator (`{+path}`, `{?q}`, `{/id}`), a modifier (`{path*}`, `{id:3}`), a list of names (`{a,b}`), an empty expression (`{}`), two expressions with nothing between them (`{a}{b}`, where a URI cannot show where one value ends), or a `{` or `}` outside an expression throws this. The check runs once, when the MCP route mounts or `createMcpServer` starts, so no request is served with a broken template.
 
 ## Example
 

packages/agentic/src/mcp/__tests__/mcp-server.test.ts

@@ -756,11 +756,33 @@ describe('mcp adapter (in-memory)', () => {
     })
 
     it('throws DF0084 for a template beyond RFC 6570 level 1', () => {
-      for (const uriTemplate of ['test://file/{+path}', 'test://search{?q}', 'test://pair/{a,b}', 'test://file/{path*}', 'test://file/{path', 'test://file/path}', 'test://pair/{a}/{a}', 'test://file/{}']) {
+      for (const uriTemplate of ['test://file/{+path}', 'test://search{?q}', 'test://pair/{a,b}', 'test://file/{path*}', 'test://file/{path', 'test://file/path}', 'test://pair/{a}/{a}', 'test://file/{}', 'test://pair/{a}{b}']) {
         expect(() => compileResourceTemplates([{ uriTemplate, name: 'bad', read: () => ({}) }])).toThrow(expect.objectContaining({ code: 'DF0084' }))
       }
       expect(compileResourceTemplates([{ uriTemplate: 'test://fixed', name: 'fixed', read: () => ({}) }])[0]!.match('test://fixed')).toEqual({})
     })
+
+    it('matches several values in one segment, each up to the next literal', () => {
+      const [range] = compileResourceTemplates([{ uriTemplate: 'test://range/{from}-{to}.json', name: 'range', read: () => ({}) }])
+      expect(range!.match('test://range/1-2.json')).toEqual({ from: '1', to: '2' })
+      expect(range!.match('test://range/1-2-3.json')).toEqual({ from: '1', to: '2-3' })
+      for (const uri of ['test://range/-2.json', 'test://range/1-.json', 'test://range/1.json', 'test://range/1-2.txt', 'test://range/1-2/3.json'])
+        expect(range!.match(uri)).toBeUndefined()
+    })
+
+    it('keeps a value named __proto__', () => {
+      const [proto] = compileResourceTemplates([{ uriTemplate: 'test://proto/{__proto__}', name: 'proto', read: () => ({}) }])
+      expect(Object.entries(proto!.match('test://proto/x')!)).toEqual([['__proto__', 'x']])
+    })
+
+    it('rejects a long URI that matches no template without backtracking', () => {
+      const [many] = compileResourceTemplates([{ uriTemplate: 'test://many/{a}-{b}-{c}-{d}.json', name: 'many', read: () => ({}) }])
+      // Ends like a match, but the `/` near the end fails it only after every value is read.
+      const uri = `test://many/${'x-'.repeat(25_000)}/.json`
+      const start = performance.now()
+      expect(many!.match(uri)).toBeUndefined()
+      expect(performance.now() - start).toBeLessThan(500)
+    })
   })
 
   describe('onResourcesChanged', () => {

packages/agentic/src/mcp/build-server.ts

@@ -450,17 +450,13 @@ const TEMPLATE_EXPRESSION_RE = /\{([^{}]*)\}/g
 /** RFC 6570 `varname`: letters, digits and `_`, with single dots between them. */
 const TEMPLATE_VARNAME_RE = /^\w+(?:\.\w+)*$/
 
-function escapeRegExp(text: string): string {
-  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-}
-
 /**
  * Compile resource templates to URI matchers, once per endpoint. Only RFC
  * 6570 level 1 is supported: plain `{name}` expressions. Each expression
- * matches one non-empty URI segment (no `/`), and its value is
- * percent-decoded, so an encoded `%2F` reads back as `/`. A URI with
- * malformed percent-encoding matches no template. Any other template syntax
- * throws `DF0084`.
+ * matches a non-empty value with no `/`, and its value is percent-decoded,
+ * so an encoded `%2F` reads back as `/`. A URI with malformed
+ * percent-encoding matches no template. Any other template syntax, and two
+ * expressions with nothing between them, throw `DF0084`.
  *
  * @internal
  */
@@ -472,7 +468,8 @@ function compileResourceTemplate(template: McpResourceTemplate): CompiledResourc
   const { name, uriTemplate } = template
   const invalid = (reason: string) => diagnostics.DF0084({ name, uriTemplate, reason })
   const names: string[] = []
-  let source = '^'
+  // The text around the expressions: one more than `names`.
+  const literals: string[] = []
   let last = 0
   for (const expression of uriTemplate.matchAll(TEMPLATE_EXPRESSION_RE)) {
     const literal = uriTemplate.slice(last, expression.index)
@@ -483,33 +480,59 @@ function compileResourceTemplate(template: McpResourceTemplate): CompiledResourc
       throw invalid(`the expression "{${varname}}" is not a plain \`{name}\`.`)
     if (names.includes(varname))
       throw invalid(`the name "${varname}" is used more than once.`)
+    if (names.length > 0 && literal === '')
+      throw invalid(`"{${names.at(-1)}}" and "{${varname}}" have nothing between them, so a URI cannot show where one ends.`)
+    literals.push(literal)
     names.push(varname)
-    source += `${escapeRegExp(literal)}([^/]+)`
     last = expression.index + expression[0].length
   }
   const tail = uriTemplate.slice(last)
   if (/[{}]/.test(tail))
     throw invalid('a `{` or `}` is outside an expression.')
-  const pattern = new RegExp(`${source}${escapeRegExp(tail)}$`)
+  literals.push(tail)
 
   return {
     template,
-    match(uri) {
-      const found = pattern.exec(uri)
-      if (!found)
-        return undefined
-      const params: Record<string, string> = {}
-      try {
-        names.forEach((varname, index) => {
-          params[varname] = decodeURIComponent(found[index + 1]!)
-        })
-      }
-      catch {
-        return undefined
-      }
-      return params
-    },
+    match: uri => matchTemplate(uri, literals, names),
+  }
+}
+
+/**
+ * Match `uri` in one pass from left to right, with no regular expression, so
+ * the time grows with the URI length only and a crafted URI cannot block the
+ * process. Each value runs to the first place the next literal appears (the
+ * last value runs to the tail). A value must not be empty or contain `/`.
+ * The params object has no prototype, so a variable such as `__proto__`
+ * keeps its value.
+ */
+function matchTemplate(uri: string, literals: string[], names: string[]): Record<string, string> | undefined {
+  const head = literals[0]!
+  const tail = literals.at(-1)!
+  const params: Record<string, string> = Object.create(null)
+  if (names.length === 0)
+    return uri === head ? params : undefined
+  if (!uri.startsWith(head) || !uri.endsWith(tail))
+    return undefined
+  const end = uri.length - tail.length
+  let position = head.length
+  for (let index = 0; index < names.length; index++) {
+    const isLast = index === names.length - 1
+    const next = literals[index + 1]!
+    const stop = isLast ? end : uri.indexOf(next, position + 1)
+    if (stop <= position || stop > end)
+      return undefined
+    const raw = uri.slice(position, stop)
+    if (raw.includes('/'))
+      return undefined
+    try {
+      params[names[index]!] = decodeURIComponent(raw)
+    }
+    catch {
+      return undefined
+    }
+    position = stop + (isLast ? 0 : next.length)
   }
+  return params
 }
 
 /**

packages/devframe/src/types/mcp.ts

@@ -148,8 +148,9 @@ export interface McpResourceTemplateContent {
 /**
  * A resource template the MCP server lists in `resources/templates/list` and
  * reads in `resources/read`. The `uriTemplate` uses RFC 6570 level 1 only:
- * plain `{name}` expressions. Each expression matches one non-empty URI
- * segment (no `/`), and its value is percent-decoded.
+ * plain `{name}` expressions, with text between any two of them. Each
+ * expression matches a non-empty value with no `/`, and its value is
+ * percent-decoded.
  *
  * `list` and `read` get the node context of the devframe (or of the hub), so
  * they can read live state such as `ctx.rpc.sharedState` or `ctx.agent`. The