fix: preserve datasource response files - #159
Conversation
🦋 Changeset detectedLatest commit: d1c135d The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
commit: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1b6f2c48c1
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| await mkdir(path.dirname(name), { recursive: true }); | ||
| if (file.encoding === 'base64') { | ||
| await writeFile(name, Buffer.from(String(file.content), 'base64')); | ||
| } else { | ||
| await writeFile(name, String(file.content), 'utf8'); |
There was a problem hiding this comment.
When the datasource API response includes a files entry whose name is an absolute or parent-traversing path, this server now creates parent directories and overwrites that path directly. In the inspected MCP flow, these writes happen inside the plugin process without going through Kimi Code's normal file-write approval, so a compromised/misconfigured datasource endpoint or KIMI_DATASOURCE_API_URL can overwrite arbitrary user files rather than only the requested CSV/output location. Please validate returned paths against the request's expected file_path/safe temp directory before calling writeFile.
Useful? React with 👍 / 👎.
|
Codex Review: Didn't find any major issues. Bravo. ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
1 participant
Related Issue
No linked issue; fixes a datasource plugin bug found from a failing finance/data-source session.
Problem
Datasource gateway responses can include model-facing content in
result.assistantwhileresult.useronly contains a short preview. Some APIs also return full CSV data throughresponse.files. The official JS MCP server only readresult.userand did not writeresponse.files, so models could see{"data_preview": null}for searches and later fail to read CSV paths that should have been created.What changed
Checklist
gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.