fix(connect): keep string contents when stripping trailing commas (#1768)

## Bug

`unmarshalLenientJSON` (the JSONC fallback added for #922) removes
trailing commas with the regex `,\s*([}\]])`. The regex has no notion of
JSON strings, so it also rewrites `, }` and `, ]` inside string values.
The fallback runs whenever strict parsing fails, for example on a
hand-edited `opencode.json` with one trailing comma. Connect,
disconnect, undo and preview then work on the altered document, and
connect writes it back to the client's config file. Another server's
arguments are silently changed on disk.

`stripJSONComments`, the other half of the same fallback, is already
string-aware for exactly this reason.

## Trigger

`~/.config/opencode/opencode.json`:

```json
{
  "mcp": {
    "other": {"type": "local", "command": ["sh", "-c", "echo {a, } [b, ]"]},
  },
}
```

After `mcpproxy connect opencode`, the other server's command on disk is
`["sh", "-c", "echo {a} [b]"]`.

## Fix

Replace the regex with `stripTrailingCommas`, a small scanner that
tracks string and escape state the same way `stripJSONComments` does. It
drops a `,` only when it is outside a string and the next non-whitespace
byte is `}` or `]`. The now-unused `regexp` import is removed.

## Test

`TestConnect_TrailingCommaCleanupPreservesStringContents` runs a real
`Connect("opencode", ...)` on the file above and checks the other
server's command is byte-for-byte unchanged after the write. The
existing trailing-comma and JSONC tests still pass.

## Commands run

- `CGO_ENABLED=0 go vet ./internal/connect`: clean
- `CGO_ENABLED=0 go test -count=1 ./internal/connect`: ok
- With the fix reverted (`git stash` of `connect.go`), the new test
fails with `other server's command rewritten: got ["sh" "-c" "echo {a}
[b]"]`.
- `gofmt -l` on the edited files: no output

Author: rudycelekli

internal/connect/connect.go

@@ -7,7 +7,6 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	"regexp"
 	"sort"
 	"strings"
 	"sync"
@@ -1701,8 +1700,6 @@ func entryPointsToBridge(entry map[string]interface{}, baseURL string) bool {
 	return hasBridgePkg && pointsToUs
 }
 
-var trailingCommaPattern = regexp.MustCompile(`,\s*([}\]])`)
-
 func unmarshalLenientJSON(raw []byte, out interface{}) error {
 	if err := json.Unmarshal(raw, out); err == nil {
 		normalizeNilConfigMap(out)
@@ -1715,7 +1712,7 @@ func unmarshalLenientJSON(raw []byte, out interface{}) error {
 	if cerr != nil {
 		return cerr
 	}
-	cleaned = trailingCommaPattern.ReplaceAll(cleaned, []byte(`$1`))
+	cleaned = stripTrailingCommas(cleaned)
 	if err := json.Unmarshal(cleaned, out); err != nil {
 		return err
 	}
@@ -1791,6 +1788,44 @@ func stripJSONComments(raw []byte) ([]byte, error) {
 	return out, nil
 }
 
+// stripTrailingCommas drops a ',' that is followed (after whitespace) by '}'
+// or ']'. It is string-aware like stripJSONComments: a ", }" inside a JSON
+// string value (a shell snippet in args, say) is content and must survive,
+// because connect writes the parsed document back to the client's file.
+func stripTrailingCommas(raw []byte) []byte {
+	out := make([]byte, 0, len(raw))
+	inString := false
+	escaped := false
+	for i := 0; i < len(raw); i++ {
+		c := raw[i]
+		if inString {
+			switch {
+			case escaped:
+				escaped = false
+			case c == '\\':
+				escaped = true
+			case c == '"':
+				inString = false
+			}
+			out = append(out, c)
+			continue
+		}
+		if c == '"' {
+			inString = true
+		} else if c == ',' {
+			j := i + 1
+			for j < len(raw) && (raw[j] == ' ' || raw[j] == '\t' || raw[j] == '\n' || raw[j] == '\r') {
+				j++
+			}
+			if j < len(raw) && (raw[j] == '}' || raw[j] == ']') {
+				continue
+			}
+		}
+		out = append(out, c)
+	}
+	return out
+}
+
 // jsonHasComments reports whether stripping comments would change the content —
 // i.e. the file actually uses JSONC comments (not just slashes inside strings).
 // An unterminated block comment counts as commented (the write guard refuses).

internal/connect/trailing_comma_strings_test.go

@@ -0,0 +1,48 @@
+package connect
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// The trailing-comma cleanup must not touch ", }" / ", ]" inside string
+// values: connect writes the parsed document back, so a rewritten shell
+// snippet in another server's args would silently change on disk.
+func TestConnect_TrailingCommaCleanupPreservesStringContents(t *testing.T) {
+	const snippet = `echo {a, } [b, ]`
+	svc, home := testService(t)
+	cfgPath := ConfigPath("opencode", home)
+	if err := os.MkdirAll(filepath.Dir(cfgPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(cfgPath, []byte(`{
+	  "mcp": {
+	    "other": {"type": "local", "command": ["sh", "-c", "echo {a, } [b, ]"]},
+	  },
+	}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if res, err := svc.Connect("opencode", "mcpproxy", false); err != nil || !res.Success {
+		t.Fatalf("connect: %+v, %v", res, err)
+	}
+
+	raw, err := os.ReadFile(cfgPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var data struct {
+		MCP map[string]struct {
+			Command []string `json:"command"`
+		} `json:"mcp"`
+	}
+	if err := json.Unmarshal(raw, &data); err != nil {
+		t.Fatal(err)
+	}
+	cmd := data.MCP["other"].Command
+	if len(cmd) != 3 || cmd[2] != snippet {
+		t.Fatalf("other server's command rewritten: got %q, want [sh -c %q]", cmd, snippet)
+	}
+}