odysseus/static
Amir Fathi 9d5c031914
Some checks failed
CI / Focused test guidance (report-only) (push) Has been cancelled
CI / Python syntax (compileall) (push) Has been cancelled
CI / JS syntax (node --check) (push) Has been cancelled
CI / Python tests (pytest) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript-typescript) (push) Has been cancelled
CodeQL / Analyze (python) (push) Has been cancelled
ci / docker publish / build (amd64) (push) Has been cancelled
ci / docker publish / build (arm64) (push) Has been cancelled
ci / docker publish / merge manifest + tag (push) Has been cancelled
fix(mcp): reject malformed Args on Add MCP Server instead of silently defaulting to [] (#6215)
* fix(mcp): reject malformed Args on Add MCP Server instead of silently defaulting to []

* test(mcp): pass every Form param add_server reads past args validation

CI's pytest run showed test_add_server_still_accepts_valid_json_args and
test_add_server_still_defaults_empty_args_to_empty_list failing with
TypeError: the JSON object must be str, bytes or bytearray, not Form.

Calling the endpoint function directly bypasses FastAPI's dependency
resolution, so an unpassed Form(...) parameter (url, oauth_file,
oauth_config) arrives as the Form marker object itself rather than its
declared default, and add_server's later `if oauth_file:` check reads
that marker as truthy. The malformed-args test never hit this because it
raises before reaching that code. Not a production bug: a real HTTP
request resolves these through FastAPI before add_server ever runs.

* fix(mcp): reject non-list args and surface the new 400 in the Admin panel

o3LL's review on #6215 found two gaps in the args validation this PR adds:
the Admin panel posts to the same /api/mcp/servers endpoint but never
validates Args client-side, so the new 400 falls into the generic failure
branch and shows "Added but connection failed: unknown". Mirror the same
JSON.parse guard settings.js already has.

Also add an isinstance(list) check next to the existing JSON parse, since
valid-but-wrong-shaped JSON (args=5) reaches StdioServerParameters(args=5)
and 500s in the error formatter. Pre-existing on dev, same validation site
this PR already touches.

* fix(admin): surface the server's 400 detail instead of a generic connection-failed message

The Admin add-server handler read needs_oauth/connected/error but never
res.ok, so a request rejected by the isinstance(list) check added for
#6211 (args=5, a valid-JSON-but-non-list value the client-side JSON.parse
guard cannot catch) fell into the same-shape else branch as a successful
add whose connection attempt failed, and the form fields were cleared as
if the server had accepted it.
2026-09-11 15:36:41 +02:00
..
fonts feat(a11y): add a Text size control and an OpenDyslexic font option (#4210) 2026-06-22 13:53:46 +02:00
icons Cookbook model workflow fixes 2026-06-21 11:02:35 +00:00
js fix(mcp): reject malformed Args on Add MCP Server instead of silently defaulting to [] (#6215) 2026-09-11 15:36:41 +02:00
lib perf(static): vendor KaTeX and Mermaid, and load them on first use (#5994) 2026-08-16 22:43:12 +01:00
app.js fix(agent): allow remaining actions for an approved task (#6113) 2026-08-19 08:01:34 -06:00
icon.ico feat(launcher): add portable windows launcher (#976) 2026-06-16 04:58:16 +01:00
index.html fix(agent): allow remaining actions for an approved task (#6113) 2026-08-19 08:01:34 -06:00
login.html fix(auth): normalize mounted request paths (#5807) 2026-08-15 18:55:15 +01:00
manifest.json pwa missing icons added (#428) 2026-06-15 16:00:13 +09:00
modal-control-variants.html Merge verified Odysseus fixes 2026-07-23 14:49:02 +00:00
style.css refactor(settings): add registry-backed navigation and finder (#6040) 2026-08-16 02:48:19 +01:00
sw.js perf(static): vendor KaTeX and Mermaid, and load them on first use (#5994) 2026-08-16 22:43:12 +01:00
wave-variants.html Merge verified Odysseus fixes 2026-07-23 14:49:02 +00:00
whirlpool-variants.html Merge verified Odysseus fixes 2026-07-23 14:49:02 +00:00