[xubenqiang]

memorySkillFiles.list() and read() looked up the path they were given without normalising it the way the record index normalises its keys, so list('sub/') and read('./SKILL.md') threw "no such directory"/"no such file". In read() the raw Object.hasOwn(files, path) check also ran before any validation, so a .. segment could reach the record when the raw string happened to be a key.

What changed

• list() normalises through splitRelativePath(dir, 'directory') (with '' still meaning the record root), and read() normalises through splitRelativePath(path, 'file path') before the hasOwn fast path or index lookup. A .. segment is now rejected first.
• packages/server/test/ext/skills/files.test.ts covers trailing-slash and dot-segment directories, non-canonical reads, a record whose own key is ./SKILL.md, .. rejection for both calls, and the unchanged missing-path errors.
• A changeset (patch for @modelcontextprotocol/server).

Verification

Run in packages/server:

vitest run test/ext/skills        # 92 passed, 3 skipped (6 files)
eslint src/ext/skills/files.ts    # clean
prettier --check <files>          # clean
tsgo -p tsconfig.json --noEmit    # exit 0

Red check with files.ts reverted: the new file reports 3 of 6 tests failing (trailing-slash listing, non-canonical read, .. rejection), which is the behaviour in the issue.

Fixes #3102

[changeset-bot]

🦋 Changeset detected

Latest commit: bb19e69

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3104

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3104

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3104

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3104

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3104

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3104

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3104

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3104

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3104

commit: bb19e69