Quote names put into SDK client URL paths; share the helper with MCP

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/tests/sdk/test_client.py

@@ -181,3 +181,23 @@ def test_a_history_is_imported_a_page_at_a_time(monkeypatch):
     assert [one["external_id"] for one in answers] == [
         e["external_id"] for e in entries
     ]
+
+
+def test_a_name_cannot_climb_out_of_its_route(monkeypatch):
+    """httpx resolves ``..``, so ``get_flow("../x")`` was ``GET /api/v1/x``."""
+    seen = []
+
+    def handler(request):
+        seen.append(request.url.raw_path.decode())
+        return httpx.Response(200, json={})
+
+    client = a_client(handler, monkeypatch)
+    client.get_flow("../x")
+    client.put_source("..", "../x", "code")
+    client.run("..")
+
+    assert seen == [
+        "/api/v1/flows/%2E%2E%2Fx",
+        "/api/v1/flows/%2E%2E/nodes/%2E%2E%2Fx/source",
+        "/api/v1/runs/%2E%2E",
+    ]