From 8b34a428f41b0263e14a0009912c3990a3b2e16e Mon Sep 17 00:00:00 2001
From: agent_coder <agent_coder@vvzvlad.xyz>
Date: Sun, 12 Jul 2026 05:58:04 +0300
Subject: [PATCH] fix(mcp): unconditional final ERROR_MESSAGE_CAP backstop in
 formatSpaceNotAccessible (#536 review)

The list-only cap assumed a well-formed prefix; a pathologically long
agent-supplied spaceId (unvalidated for length) lives in the prefix and bypassed
the cap. Add the same unconditional final slice formatDocmostAxiosError uses, so
the WHOLE message is bounded regardless of spaceId length. No-op for normal
inputs (36-char UUID) where the list cap already keeps it <= 300.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 packages/mcp/src/client/errors.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/mcp/src/client/errors.ts b/packages/mcp/src/client/errors.ts
index 787c6b88..07b4aa08 100644
--- a/packages/mcp/src/client/errors.ts
+++ b/packages/mcp/src/client/errors.ts
@@ -90,7 +90,14 @@ export function formatSpaceNotAccessible(
   if (listed.length > budget) {
     listed = listed.slice(0, Math.max(0, budget - 1)) + "…";
   }
-  return `${prefix}${listed}${suffix}`;
+  const message = `${prefix}${listed}${suffix}`;
+  // Unconditional final backstop (mirrors formatDocmostAxiosError): the list
+  // cap above assumes a well-formed prefix, but a pathologically long
+  // agent-supplied spaceId lives in the prefix and would otherwise blow past the
+  // budget. Cap the WHOLE message so nothing bloats the model context.
+  return message.length > ERROR_MESSAGE_CAP
+    ? message.slice(0, ERROR_MESSAGE_CAP - 1) + "…"
+    : message;
 }
 
 // Keep ONLY the pathname of a request (no host, no query string, no fragment)