From 5fc86c48eab46e5c3296bb8cfd500df47dae6192 Mon Sep 17 00:00:00 2001
From: konkonrong-lgtm <konkonrong@gmail.com>
Date: Wed, 12 Aug 2026 12:58:14 +0900
Subject: [PATCH] fix: handle null MCP asset input

---
 src/commands/agent/mcp/asset/replace.ts |  6 +++---
 test/commands/agent/mcp/mcp.test.ts     | 13 +++++++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/commands/agent/mcp/asset/replace.ts b/src/commands/agent/mcp/asset/replace.ts
index 9dc036a0..4393b09f 100644
--- a/src/commands/agent/mcp/asset/replace.ts
+++ b/src/commands/agent/mcp/asset/replace.ts
@@ -73,9 +73,9 @@ export default class ApiCatalogMcpServerAssetReplace extends SfCommand<ApiCatalo
       throw new SfError(messages.getMessage('error.invalidJson'), 'InvalidJson', [], 1);
     }
 
-    const assets = (Array.isArray(parsed) ? parsed : (parsed as { assets?: McpServerAssetReplaceItem[] }).assets) as
-      | McpServerAssetReplaceItem[]
-      | undefined;
+    const assets = (
+      Array.isArray(parsed) ? parsed : (parsed as { assets?: McpServerAssetReplaceItem[] } | null)?.assets
+    ) as McpServerAssetReplaceItem[] | undefined;
     if (!assets || !Array.isArray(assets)) {
       throw new SfError(messages.getMessage('error.invalidShape'), 'InvalidShape', [], 1);
     }
diff --git a/test/commands/agent/mcp/mcp.test.ts b/test/commands/agent/mcp/mcp.test.ts
index 03472a0f..3bc31bab 100644
--- a/test/commands/agent/mcp/mcp.test.ts
+++ b/test/commands/agent/mcp/mcp.test.ts
@@ -360,6 +360,19 @@ describe('agent mcp commands', () => {
     }
   });
 
+  it('asset replace throws InvalidShape for null JSON', async () => {
+    const testOrg = new MockTestOrgData();
+    await $$.stubAuths(testOrg);
+    $$.fakeConnectionRequest = () => Promise.resolve({} as any);
+
+    try {
+      await AgentMcpAssetReplace.run(['--target-org', testOrg.username, '--mcp-server-id', '0XS1', '--assets', 'null']);
+      expect.fail('should have thrown');
+    } catch (err) {
+      expect((err as { name: string }).name).to.equal('InvalidShape');
+    }
+  });
+
   it('get returns the server and strips the secret on read', async () => {
     const testOrg = new MockTestOrgData();
     await $$.stubAuths(testOrg);