Fix $-pattern corruption of user_config values in replaceVariables

String.prototype.replace treats $ sequences ($&, $$, $`, $', $n) in the
replacement string as special patterns, so any user_config value containing a
$ — e.g. a password with $& in it — was silently corrupted before being
injected into mcp_config. The server then received wrong credentials.

Pass a replacement function so the value is inserted verbatim. Adds a
regression test covering $&, $$ and $n in a substituted value.

Author: alecmcleod-fp

src/shared/config.ts

@@ -34,7 +34,11 @@ export function replaceVariables(
             { key, replacement },
           );
         } else {
-          result = result.replace(pattern, replacement);
+          // Use a replacement function so that `$` sequences in the value
+          // (e.g. `$&`, `$$`, `$1`) are inserted literally rather than being
+          // interpreted as String.prototype.replace special patterns. This
+          // matters for secrets such as passwords that may contain `$`.
+          result = result.replace(pattern, () => replacement);
         }
       }
     }

test/config.test.ts

@@ -29,6 +29,15 @@ describe("replaceVariables", () => {
     consoleWarnSpy.mockRestore();
   });
 
+  it("should insert values containing $ patterns literally", () => {
+    // `$&`, `$$`, `$1` etc. are special in String.prototype.replace's
+    // replacement string — secrets containing them must be inserted verbatim.
+    const result = replaceVariables("${user_config.password}", {
+      "user_config.password": "pa$&ss$$wo$1rd",
+    });
+    expect(result).toBe("pa$&ss$$wo$1rd");
+  });
+
   it("should replace variables in objects", () => {
     const result = replaceVariables(
       { message: "Hello ${name}!" },