From 9f8bc7fa374f882fab493b297785e9701bd131bf Mon Sep 17 00:00:00 2001
From: zhangLei99586 <zhang.lei162@xydigit.com>
Date: Mon, 6 Jul 2026 16:36:44 +0800
Subject: [PATCH] fix(mcp-grant): guard sessionKey.trim() against undefined
 input (#99488)

The mintAttachGrant caller resolves sessionKey via readString() ??
resolveMainSessionKey(). If both return undefined, .trim() throws
TypeError. Use optional chaining + nullish coalescing so the existing
if (!sessionKey) validation guard executes instead of crashing.
---
 src/gateway/mcp-grant-store.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/gateway/mcp-grant-store.ts b/src/gateway/mcp-grant-store.ts
index 536af1a50c80..440c0832a568 100644
--- a/src/gateway/mcp-grant-store.ts
+++ b/src/gateway/mcp-grant-store.ts
@@ -28,7 +28,7 @@ export function mintAttachGrant(params: {
   ttlMs?: number;
   nowMs?: number;
 }): McpAttachGrant {
-  const sessionKey = params.sessionKey.trim();
+  const sessionKey = params.sessionKey?.trim() ?? "";
   if (!sessionKey) {
     throw new Error("mintAttachGrant: sessionKey is required");
   }