Skip to content

fix: sanitize streamable HTTP extension names derived from URLs#7740

Merged
codefromthecrypt merged 1 commit intomainfrom
acole/fix-extension-name-sanitize
Mar 9, 2026
Merged

fix: sanitize streamable HTTP extension names derived from URLs#7740
codefromthecrypt merged 1 commit intomainfrom
acole/fix-extension-name-sanitize

Conversation

@codefromthecrypt
Copy link
Copy Markdown
Collaborator

@codefromthecrypt codefromthecrypt commented Mar 9, 2026

Summary

Streamable HTTP extension names derived from URLs (e.g. https://mcp.kiwi.com) contain dots, which silently break ACP agents that validate MCP server names against ^[a-zA-Z0-9_-]+$.

parse_streamable_http_extension was pushing the raw hostname into the name (mcp.kiwi.com), but goose already has name_to_key() which sanitizes names for exactly this purpose. This fix pipes the generated name through name_to_key() so mcp.kiwi.com becomes mcp_kiwi_com.

The constraint is in codex-rs validate_mcp_server_name — names failing this regex cause McpServerConfig { required: false } servers to be silently dropped, so the agent never sees the tools.

Type of Change

  • Bug fix

AI Assistance

  • This PR was created or reviewed with AI assistance

Testing

$ cargo test -p goose-cli test_parse_streamable_http_extension -- --nocapture

running 3 tests
test session::tests::test_parse_streamable_http_extension::port_and_path ... ok
test session::tests::test_parse_streamable_http_extension::name_from_host ... ok
test session::tests::test_parse_streamable_http_extension::different_port_and_path ... ok

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 149 filtered out; finished in 0.00s

@codefromthecrypt codefromthecrypt force-pushed the acole/fix-extension-name-sanitize branch from eaf81c0 to dd3f3a2 Compare March 9, 2026 02:14
@codefromthecrypt codefromthecrypt force-pushed the acole/fix-extension-name-sanitize branch from dd3f3a2 to 2707ed8 Compare March 9, 2026 02:16
@codefromthecrypt codefromthecrypt marked this pull request as ready for review March 9, 2026 02:18
@codefromthecrypt codefromthecrypt added this pull request to the merge queue Mar 9, 2026
Merged via the queue into main with commit 6394165 Mar 9, 2026
17 checks passed
@codefromthecrypt codefromthecrypt deleted the acole/fix-extension-name-sanitize branch March 9, 2026 02:27
jh-block added a commit that referenced this pull request Mar 9, 2026
@jh-block
Merge remote-tracking branch 'origin/main' into jhugo/bump-workspace-…
ff7b8b2 
…deps

* origin/main: (34 commits)
  fix: reduce server log verbosity — skip session in instrument, defaul… (#7729)
  fix: provider test infrastructure (#7738)
  fix: sanitize streamable HTTP extension names derived from URLs (#7740)
  refactor: derive GooseMode string conversions with strum (#7706)
  docs: Add Spraay Batch Payments MCP Extension Tutorial (#7525)
  fix: flake.nix (#7224)
  delete goose web (#7696)
  Add @angiejones as CODEOWNER for documentation (#7711)
  Add MLflow integration guide (#7563)
  docs: LM Studio availability (#7698)
  feat: add Avian as an LLM provider (#7561)
  Adds `linux-mcp-server` to the goose registry (#6979)
  fix: add #[serde(default)] to description field on 4 ExtensionConfig variants (#7708)
  feat: combine TUI UX from alexhancock/tui-goodness with publishing config from jackamadeo/package-tui (#7683)
  chore: cleanup old sandbox (#7700)
  Correct windows artifact (#7699)
  gh fall back (#7695)
  fix: restore smart-approve mode (#7690)
  fix: make TLS configurable in goosed agent via GOOSE_TLS env var (#7686)
  Update to rmcp 1.1.0 (#7619)
  ...

# Conflicts:
#	Cargo.lock
wpfleger96 added a commit that referenced this pull request Mar 9, 2026
@wpfleger96
Merge remote-tracking branch 'origin/main' into wpfleger/socket-support
b5487d8 
* origin/main: (21 commits)
  fix(ui-desktop): unify path resolution around GOOSE_PATH_ROOT (#7335)
  fix: pass OAuth scopes to DCR and extract granted_scopes from token response (#7571)
  fix: write to real file if config.yaml is symlink (#7669)
  fix: preserve pairings when stopping gateway (#7733)
  fix: reduce server log verbosity — skip session in instrument, defaul… (#7729)
  fix: provider test infrastructure (#7738)
  fix: sanitize streamable HTTP extension names derived from URLs (#7740)
  refactor: derive GooseMode string conversions with strum (#7706)
  docs: Add Spraay Batch Payments MCP Extension Tutorial (#7525)
  fix: flake.nix (#7224)
  delete goose web (#7696)
  Add @angiejones as CODEOWNER for documentation (#7711)
  Add MLflow integration guide (#7563)
  docs: LM Studio availability (#7698)
  feat: add Avian as an LLM provider (#7561)
  Adds `linux-mcp-server` to the goose registry (#6979)
  fix: add #[serde(default)] to description field on 4 ExtensionConfig variants (#7708)
  feat: combine TUI UX from alexhancock/tui-goodness with publishing config from jackamadeo/package-tui (#7683)
  chore: cleanup old sandbox (#7700)
  Correct windows artifact (#7699)
  ...
wpfleger96 added a commit that referenced this pull request Mar 9, 2026
@wpfleger96
Merge remote-tracking branch 'origin/main' into wpfleger/summon
baa58a7 
* origin/main: (21 commits)
  fix(ui-desktop): unify path resolution around GOOSE_PATH_ROOT (#7335)
  fix: pass OAuth scopes to DCR and extract granted_scopes from token response (#7571)
  fix: write to real file if config.yaml is symlink (#7669)
  fix: preserve pairings when stopping gateway (#7733)
  fix: reduce server log verbosity — skip session in instrument, defaul… (#7729)
  fix: provider test infrastructure (#7738)
  fix: sanitize streamable HTTP extension names derived from URLs (#7740)
  refactor: derive GooseMode string conversions with strum (#7706)
  docs: Add Spraay Batch Payments MCP Extension Tutorial (#7525)
  fix: flake.nix (#7224)
  delete goose web (#7696)
  Add @angiejones as CODEOWNER for documentation (#7711)
  Add MLflow integration guide (#7563)
  docs: LM Studio availability (#7698)
  feat: add Avian as an LLM provider (#7561)
  Adds `linux-mcp-server` to the goose registry (#6979)
  fix: add #[serde(default)] to description field on 4 ExtensionConfig variants (#7708)
  feat: combine TUI UX from alexhancock/tui-goodness with publishing config from jackamadeo/package-tui (#7683)
  chore: cleanup old sandbox (#7700)
  Correct windows artifact (#7699)
  ...
wpfleger96 added a commit that referenced this pull request Mar 9, 2026
@wpfleger96
Merge remote-tracking branch 'origin/main' into wpfleger/tool-respons…
59d4485 
…e-issue

* origin/main:
  fix(ui-desktop): unify path resolution around GOOSE_PATH_ROOT (#7335)
  fix: pass OAuth scopes to DCR and extract granted_scopes from token response (#7571)
  fix: write to real file if config.yaml is symlink (#7669)
  fix: preserve pairings when stopping gateway (#7733)
  fix: reduce server log verbosity — skip session in instrument, defaul… (#7729)
  fix: provider test infrastructure (#7738)
  fix: sanitize streamable HTTP extension names derived from URLs (#7740)
  refactor: derive GooseMode string conversions with strum (#7706)
  docs: Add Spraay Batch Payments MCP Extension Tutorial (#7525)
  fix: flake.nix (#7224)
  delete goose web (#7696)
  Add @angiejones as CODEOWNER for documentation (#7711)
  Add MLflow integration guide (#7563)
  docs: LM Studio availability (#7698)
  feat: add Avian as an LLM provider (#7561)
  Adds `linux-mcp-server` to the goose registry (#6979)
  fix: add #[serde(default)] to description field on 4 ExtensionConfig variants (#7708)
bioinfornatics pushed a commit to bioinfornatics/goose that referenced this pull request Mar 9, 2026
@codefromthecrypt @bioinfornatics
fix: sanitize streamable HTTP extension names derived from URLs (bloc…
49f7ae8 
…k#7740)

Signed-off-by: Adrian Cole <[email protected]>
Signed-off-by: Jonathan MERCIER <[email protected]>
@github-actions github-actions bot mentioned this pull request Mar 10, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@The-Best-Codes The-Best-Codes The-Best-Codes approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@codefromthecrypt @The-Best-Codes