[franksong2702]

Scope

Backport upstream #1413, merge 991a7c3e0943131bac993c290de5d136205bb6d4, to the maintained integration branch at 3ca34f673f6e169c376c7e279eabd62a597ba666. The original five-file patch applies unchanged, preserving fork diagnostics and Session recovery fixes. Reuses the existing cross-platform path validator, preserves the 4096-byte limit, and rejects NUL early. Authentication, same-origin, Runner ownership, native path and allowed-roots enforcement are unchanged.

Validation

• Linux fail-first control: 2 expected assertion failures for Windows absolute path rejection and NUL admission.
• Final admin tests: 41 passed; core path validator: 1 passed.
• Formatting, Markdown links, diff checks, 22-package workspace policy and 20 checker self-tests passed.
• Independent final review found no blocker and checked test logs.
• API commit tree cbeeb57cdcc04aaab19830378d241e6b34825d09 exactly matches local validated/reviewed commit 48eb40fbe207aa4216739d8fbda81d635530f057.

Validation report.

Exact-head fork CI passed in run 42743280877 and again after ready-for-review in run 42744578875, completed 2026-11-10 02:50:41 UTC. Each had 11 successful jobs and 7 native/Docker policy skips; required test and test-native aggregates passed. Skipped platform jobs are not native execution acceptance. Merged into the maintained integration branch as 8340dd0fc9192c2a0cc594e0d754ead83578a607; merge tree remains cbeeb57cdcc04aaab19830378d241e6b34825d09, identical to the tested/reviewed candidate. Upstream CI is separate evidence. No full local Server/workspace, native Windows/macOS/ARM64, real Host/MCP or deployed Server/Runner acceptance is claimed. Valid HTTP paths only reach empty Runner lookup, not filesystem acceptance. No deployment, release, restart, upstream PR or force-push.