fix(server): require hierarchical elicitation UI URIs

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: krubenok

src/server/index.test.ts

@@ -414,14 +414,11 @@ describe("elicitation UI metadata", () => {
     },
   };
 
-  it("attaches and reads an absolute ui:// resource URI", () => {
-    const enhanced = withElicitationUi(
-      params,
-      "ui://example/choose-option.html",
-    );
+  it("attaches and reads an absolute hierarchical ui:// resource URI", () => {
+    const enhanced = withElicitationUi(params, "ui://weather/view.html");
     expect(enhanced.requestedSchema).toEqual(params.requestedSchema);
     expect(getElicitationUiResourceUri(enhanced)).toBe(
-      "ui://example/choose-option.html",
+      "ui://weather/view.html",
     );
   });
 
@@ -441,4 +438,29 @@ describe("elicitation UI metadata", () => {
       "absolute ui://",
     );
   });
+
+  it.each([
+    "ui:example/view.html",
+    "ui:///view.html",
+    "ui://",
+    "ui://[invalid",
+  ])("rejects invalid resource URI in the setter: %s", (resourceUri) => {
+    expect(() => withElicitationUi(params, resourceUri)).toThrow(
+      "absolute ui://",
+    );
+  });
+
+  it.each([
+    "ui:example/view.html",
+    "ui:///view.html",
+    "ui://",
+    "ui://[invalid",
+  ])("rejects invalid resource URI in the getter: %s", (resourceUri) => {
+    expect(() =>
+      getElicitationUiResourceUri({
+        ...params,
+        _meta: { ui: { resourceUri } },
+      }),
+    ).toThrow("absolute ui://");
+  });
 });

src/server/index.ts

@@ -522,6 +522,26 @@ export function supportsAppElicitation(
   );
 }
 
+const ELICITATION_UI_URI_ERROR =
+  "Elicitation UI resourceUri must be an absolute ui:// URI";
+
+function validateElicitationUiResourceUri(resourceUri: string): void {
+  let parsed: URL;
+  try {
+    parsed = new URL(resourceUri);
+  } catch {
+    throw new Error(ELICITATION_UI_URI_ERROR);
+  }
+
+  if (
+    parsed.protocol !== "ui:" ||
+    !/^ui:\/\//i.test(resourceUri) ||
+    parsed.host.length === 0
+  ) {
+    throw new Error(ELICITATION_UI_URI_ERROR);
+  }
+}
+
 /**
  * Attach an MCP App resource to a standard form-mode elicitation request.
  */
@@ -535,15 +555,7 @@ export function withElicitationUi(
     throw new Error("MCP Apps only support form-mode elicitations");
   }
 
-  let parsed: URL;
-  try {
-    parsed = new URL(resourceUri);
-  } catch {
-    throw new Error("Elicitation UI resourceUri must be an absolute ui:// URI");
-  }
-  if (parsed.protocol !== "ui:") {
-    throw new Error("Elicitation UI resourceUri must be an absolute ui:// URI");
-  }
+  validateElicitationUiResourceUri(resourceUri);
 
   const meta = params._meta ?? {};
   const ui =
@@ -578,14 +590,6 @@ export function getElicitationUiResourceUri(
     throw new Error("Elicitation UI resourceUri must be a string");
   }
 
-  let parsed: URL;
-  try {
-    parsed = new URL(resourceUri);
-  } catch {
-    throw new Error("Elicitation UI resourceUri must be an absolute ui:// URI");
-  }
-  if (parsed.protocol !== "ui:") {
-    throw new Error("Elicitation UI resourceUri must be an absolute ui:// URI");
-  }
+  validateElicitationUiResourceUri(resourceUri);
   return resourceUri;
 }