Function assertSafeSegment

tools/mcp-server/src/resolver.ts:15–19

(name: string, label: string)

/** Reject path segments that could escape the project root. */
export function assertSafeSegment(name: string, label: string): void {
  if (!name || name.includes('\0') || name.includes('..') || name.includes('/') || name.includes('\\')) {
    throw new Error(`Invalid ${label}: ${name}`);
  }
}

async function allowedPatternIds(root: string): Promise<Set<string>> {
  const registry = await loadRegistry(root);