Pull Request

Description

Fixes RC4-IMPORT-001, from the codex QA of v0.70.0-rc.4. The bug also exists in rc.2.

A malformed import was accepted and persisted, and then bricked the next startup. The trigger was a URL-only entry imported with a forced claude-desktop format and skip_quarantine=true:

• POST /api/v1/servers/import returned HTTP 200 with imported=1, plus a "missing command" warning;
• it persisted a stdio server with no command;
• the next core start exited with code 4 (command is required for stdio protocol).

Fix

• New config.ValidateServerForLoad(server) runs the boot-path validateDetailedCore on a single server.
• configimport.Import is the single choke point for REST import and CLI import, in daemon and direct-file mode. It now validates each mapped server before offering it for persistence. A server that fails is reported in failed with invalid_server and the reasons, and is never saved. Valid entries in the same payload import as before.
• The REST import applies the caller's rename map after that validation, so renamed servers are re-validated before anything is persisted.
• Side effect, intended: an entry whose working_dir doesn't exist on this machine is now rejected too, because startup would refuse it.

Testing

• I have tested these changes locally

• I have added/updated tests that prove my fix is effective or my feature works

• All existing tests pass

• New tests:

  • configimport: the malformed entry is rejected with its reason, and a valid entry in the same payload still imports;
  • httpapi: TestRunImport_RenameToInvalidNameIsRejected.

• Suites: go test ./internal/configimport/ ./internal/httpapi/ passes.

• Review: zcode found two lows. The rename re-validation is fixed here. The codex-fixture assertion is now environment-tolerant, because its cwd=/home/user entry passes or fails depending on the host.

🤖 Generated with Claude Code