fix(http): substitute path parameters only by their whole name

[waleedlatif1]

Summary

• The HTTP request tool substituted each path parameter with a plain string replace of :${key} across the whole URL
• An empty key removed the scheme's colon (https://host → https//host), so the request was refused as not an absolute URL. Models occasionally send an empty path-parameter entry, which made agent API tool calls fail intermittently
• A numeric key rewrote the port into the host (host:8443 → hostx), and :id matched inside :idx
• A key is now substituted only when it starts like a JavaScript identifier, using path-to-regexp's own ID_Start / ID_Continue classes (an empty name is a "Missing parameter name" error there), and a placeholder ends where an identifier ends. Longer keys are substituted first, so :user-id is never consumed by a user key whatever order pathParams lists them in. Keys with ., -, $ or non-ASCII letters keep working, the value is still URL-encoded, and it is inserted literally so $& in a value is not a replacement pattern
• Only behavior change for valid keys: :id no longer substitutes into :id_suffix or :id1, which path-to-regexp reads as different parameter names. pathParams is only ever supplied as a tool argument; no block stores it

Type of Change

• Bug fix

Testing

• Added processUrl tests for an empty key, a numeric key next to a port, a / key, :id vs :idx, a user key next to :user-id and :user.name, Unicode keys, a literal - after a placeholder, hyphenated / dotted / $-prefixed keys, and a value containing $&; the empty-key case fails on the previous implementation with https//www.google.com
• vitest on the HTTP tool, tool execution and agent handler suites (421 passing)
• bun run lint, bun run check:audits, docs-manifest:check, and bun run type-check passing

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 17, 2026 4:21am UTC

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the two previously reported matching defects are fixed and no new actionable issue was identified.

Summary

This PR makes HTTP path-parameter substitution operate on complete parameter names rather than arbitrary colon-prefixed substrings.

• Rejects malformed keys that could alter URL schemes or ports.
• Preserves URL encoding and literal replacement values.
• Uses longest-first matching for overlapping compound keys.
• Supports Unicode identifier names and adds focused regression coverage.

_{Reviews (2) · Last reviewed commit: "fix(http): prefer the longest path param..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}