fix(tools): reject dot path segments in tool request URLs

[waleedlatif1]

Summary

• Reject tool request URLs whose path contains a . or .. segment (incl. %2e spellings) before dispatch, so an id param interpolated into a URL template can't traverse to another endpoint
• Central check in the shared request transport, so it covers every URL-builder tool
• A hand-written HTTP Request URL containing a literal .. segment is now rejected too

Type of Change

• Bug fix

Testing

• tools/request-transport.test.ts: new traversal cases fail without the guard; registry probe now requires benign URLs to pass and injected .. ids to be rejected
• tools/ + executor/handlers suites, lint, type-check, check:audits, docs-manifest:check, root bun run test (2 unrelated timing flakes, pass on rerun)

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 3, 2026 7:34pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds path traversal validation to tool request URLs.

The PR appears safe to merge; no outstanding blocking finding was established.

Summary

The PR adds a shared pre-dispatch check for dot path segments in external tool request URLs and tests both rejected traversal paths and allowed non-segment dots.

• The latest revision tightens the registry probe’s assertions and aligns boundary-whitespace handling with URL parsing.

_{Reviews (2) · Last reviewed commit: "fix(tools): match URL parser boundary st..."}

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}