Quote names put into SDK client URL paths; share the helper with MCP

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/fluksio/mcp/server.py

@@ -15,12 +15,13 @@ from __future__ import annotations
 import logging
 from contextvars import ContextVar
 from typing import Any
-from urllib.parse import quote
 
 import httpx
 from mcp.server.fastmcp import FastMCP
 from mcp.server.lowlevel.server import request_ctx
 
+from fluksio.sdk.client import seg as _seg
+
 logger = logging.getLogger(__name__)
 
 mcp = FastMCP("fluksio")
@@ -86,17 +87,6 @@ async def forward_caller_auth(request: httpx.Request) -> None:
         request.headers["authorization"] = authorization
 
 
-def _seg(value: str) -> str:
-    """*value* as one path segment, and nothing more.
-
-    httpx resolves ``..`` before sending, so a name put into a path as written
-    could climb out of the route it was meant for: ``save_flow("../ai/config")``
-    was ``PUT /ai/config``. ``quote`` covers the slashes but leaves dots alone,
-    hence encoding those too; the server decodes both.
-    """
-    return quote(value, safe="").replace(".", "%2E")
-
-
 async def _call(method: str, path: str, **kwargs: Any) -> Any:
     """One REST call, with failures handed back as data rather than raised.