authorgravatar for julius0216@outlook.comJulius Marminge <julius0216@outlook.com> 2026-02-26 00:42:57-08:00
committergravatar for jmarminge@gmail.comJulius Marminge <jmarminge@gmail.com> 2026-02-26 13:20:36-08:00
logaa5a144d04c5067b9344289c6bc6f28a8acb9765
tree9b9499df10b6fce045c53e56d26bcb4554581fee
parentc6d1f92ba9f2a820cdbee71ff6b9499d1886bba6

small nits

7 files changed, 48 insertions(+), 21 deletions(-)

.plans/16c-pr89-remediation-checklist.md+4-4
......@@ -286,8 +286,8 @@ Counts: active `51` (`valid=33`, `partially-valid=18`), closed-invalid `6`
286286 - Threads: PRRT_kwDORLtfbc5wj4cM
287287 - Audit note: -ilc shell invocation can pollute captured PATH output.
288288
289- [ ] `C029` `parseFileUrlHref` already decodes the path (line 46), but `safeDecode` is called again here, corrupting filenames containing `%` sequences. Consider skipping the decode when `fileUrlTarget` is non-null.
290 - Status: `TODO`
289- [x] `C029` `parseFileUrlHref` already decodes the path (line 46), but `safeDecode` is called again here, corrupting filenames containing `%` sequences. Consider skipping the decode when `fileUrlTarget` is non-null.
290 - Status: `DONE`
291291 - Verdict: `valid`
292292 - Severity: `Medium`
293293 - Area: `Edge-case parsing/platform behavior`
......@@ -295,8 +295,8 @@ Counts: active `51` (`valid=33`, `partially-valid=18`), closed-invalid `6`
295295 - Threads: PRRT_kwDORLtfbc5wnVsU
296296 - Audit note: file URL decoding still double-decodes in one path.
297297
298- [ ] `C030` `EXTERNAL_SCHEME_PATTERN` matches `script.ts:10` as a scheme because `.ts:` looks like `scheme:`. Consider requiring `://` after the colon, or checking that what follows the colon is not just digits. <details> <summary>🚀 Reply "<strong>fix it for me</strong>" or copy this <strong>AI Prompt</strong> for your agent:</summary>
299 - Status: `TODO`
298- [x] `C030` `EXTERNAL_SCHEME_PATTERN` matches `script.ts:10` as a scheme because `.ts:` looks like `scheme:`. Consider requiring `://` after the colon, or checking that what follows the colon is not just digits. <details> <summary>🚀 Reply "<strong>fix it for me</strong>" or copy this <strong>AI Prompt</strong> for your agent:</summary>
299 - Status: `DONE`
300300 - Verdict: `valid`
301301 - Severity: `Medium`
302302 - Area: `Edge-case parsing/platform behavior`
apps/server/src/checkpointing/Layers/CheckpointDiffQuery.test.ts+4-8
......@@ -14,10 +14,6 @@ import { CheckpointDiffQueryLive } from "./CheckpointDiffQuery.ts";
1414import { CheckpointStore, type CheckpointStoreShape } from "../Services/CheckpointStore.ts";
1515import { CheckpointDiffQuery } from "../Services/CheckpointDiffQuery.ts";
1616
17const asProjectId = (value: string): ProjectId => ProjectId.makeUnsafe(value);
18const asTurnId = (value: string): TurnId => TurnId.makeUnsafe(value);
19const asCheckpointRef = (value: string): CheckpointRef => CheckpointRef.makeUnsafe(value);
20
2117function makeSnapshot(input: {
2218 readonly projectId: ProjectId;
2319 readonly threadId: ThreadId;
......@@ -49,7 +45,7 @@ function makeSnapshot(input: {
4945 model: "gpt-5-codex",
5046 branch: null,
5147 worktreePath: input.worktreePath,
52 latestTurnId: asTurnId("turn-1"),
48 latestTurnId: TurnId.makeUnsafe("turn-1"),
5349 createdAt: "2026-01-01T00:00:00.000Z",
5450 updatedAt: "2026-01-01T00:00:00.000Z",
5551 deletedAt: null,
......@@ -57,7 +53,7 @@ function makeSnapshot(input: {
5753 activities: [],
5854 checkpoints: [
5955 {
60 turnId: asTurnId("turn-1"),
56 turnId: TurnId.makeUnsafe("turn-1"),
6157 checkpointTurnCount: input.checkpointTurnCount,
6258 checkpointRef: input.checkpointRef,
6359 status: "ready",
......@@ -74,9 +70,9 @@ function makeSnapshot(input: {
7470
7571describe("CheckpointDiffQueryLive", () => {
7672 it("computes diffs using canonical turn-0 checkpoint refs", async () => {
77 const projectId = asProjectId("project-1");
73 const projectId = ProjectId.makeUnsafe("project-1");
7874 const threadId = ThreadId.makeUnsafe("thread-1");
79 const toCheckpointRef = asCheckpointRef("refs/t3/checkpoints/thread-1/turn/1");
75 const toCheckpointRef = checkpointRefForThreadTurn(threadId, 1);
8076 const hasCheckpointRefCalls: Array<CheckpointRef> = [];
8177 const diffCheckpointsCalls: Array<{
8278 readonly fromCheckpointRef: CheckpointRef;
apps/server/src/codexAppServerManager.ts+1-1
......@@ -986,7 +986,7 @@ function readResumeThreadId(input: ProviderSessionStartInput): ProviderThreadId
986986 typeof input.resumeCursor !== "object" ||
987987 Array.isArray(input.resumeCursor)
988988 ) {
989 return undefined;
989 return input.resumeThreadId;
990990 }
991991 const rawThreadId = (input.resumeCursor as Record<string, unknown>).threadId;
992992 return typeof rawThreadId === "string" ? toProviderThreadId(rawThreadId) : input.resumeThreadId;
apps/server/src/open.ts+11-4
......@@ -85,10 +85,17 @@ export const resolveEditorLaunch = Effect.fnUntraced(function* (
8585
8686export const launchDetached = (launch: EditorLaunch) =>
8787 Effect.callback<void, OpenError>((resume) => {
88 const child = spawn(launch.command, [...launch.args], {
89 detached: true,
90 stdio: "ignore",
91 });
88 let child;
89 try {
90 child = spawn(launch.command, [...launch.args], {
91 detached: true,
92 stdio: "ignore",
93 });
94 } catch (error) {
95 return resume(
96 Effect.fail(new OpenError({ message: "failed to spawn detached process", cause: error })),
97 );
98 }
9299
93100 const handleSpawn = () => {
94101 child.unref();
apps/server/src/terminal/Layers/Manager.ts+4-1
......@@ -1033,7 +1033,10 @@ export const TerminalManagerLive = Layer.effect(
10331033 const logsDir = join(stateDir, "logs", "terminals");
10341034
10351035 const ptyAdapter = yield* PtyAdapter;
1036 const runtime = new TerminalManagerRuntime({ logsDir, ptyAdapter });
1036 const runtime = yield* Effect.acquireRelease(
1037 Effect.sync(() => new TerminalManagerRuntime({ logsDir, ptyAdapter })),
1038 (r) => Effect.sync(() => r.dispose()),
1039 );
10371040
10381041 return {
10391042 open: (input) => Effect.promise(() => runtime.open(input)),
apps/web/src/markdown-links.test.ts+12
......@@ -15,6 +15,12 @@ describe("resolveMarkdownFileLinkTarget", () => {
1515 );
1616 });
1717
18 it("does not treat filename line references as external schemes", () => {
19 expect(resolveMarkdownFileLinkTarget("script.ts:10", "/Users/julius/project")).toBe(
20 "/Users/julius/project/script.ts:10",
21 );
22 });
23
1824 it("resolves bare file names against cwd", () => {
1925 expect(resolveMarkdownFileLinkTarget("AGENTS.md", "/Users/julius/project")).toBe(
2026 "/Users/julius/project/AGENTS.md",
......@@ -31,6 +37,12 @@ describe("resolveMarkdownFileLinkTarget", () => {
3137 expect(resolveMarkdownFileLinkTarget("https://example.com/docs")).toBeNull();
3238 });
3339
40 it("does not double-decode file URLs", () => {
41 expect(resolveMarkdownFileLinkTarget("file:///Users/julius/project/file%2520name.md")).toBe(
42 "/Users/julius/project/file%20name.md",
43 );
44 });
45
3446 it("does not treat app routes as file links", () => {
3547 expect(resolveMarkdownFileLinkTarget("/chat/settings")).toBeNull();
3648 });
apps/web/src/markdown-links.ts+12-3
......@@ -2,11 +2,12 @@ import { resolvePathLinkTarget } from "./terminal-links";
22
33const WINDOWS_DRIVE_PATH_PATTERN = /^[A-Za-z]:[\\/]/;
44const WINDOWS_UNC_PATH_PATTERN = /^\\\\/;
5const EXTERNAL_SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*:/;
5const EXTERNAL_SCHEME_PATTERN = /^([A-Za-z][A-Za-z0-9+.-]*):(.*)$/;
66const RELATIVE_PATH_PREFIX_PATTERN = /^(~\/|\.{1,2}\/)/;
77const RELATIVE_FILE_PATH_PATTERN = /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)+(?::\d+){0,2}$/;
88const RELATIVE_FILE_NAME_PATTERN = /^[A-Za-z0-9._-]+\.[A-Za-z0-9_-]+(?::\d+){0,2}$/;
99const POSITION_SUFFIX_PATTERN = /:\d+(?::\d+)?$/;
10const POSITION_ONLY_PATTERN = /^\d+(?::\d+)?$/;
1011const POSIX_FILE_ROOT_PREFIXES = [
1112 "/Users/",
1213 "/home/",
......@@ -89,6 +90,14 @@ function isRelativePath(path: string): boolean {
8990 );
9091}
9192
93function hasExternalScheme(path: string): boolean {
94 const match = path.match(EXTERNAL_SCHEME_PATTERN);
95 if (!match) return false;
96 const rest = match[2] ?? "";
97 if (rest.startsWith("//")) return true;
98 return !POSITION_ONLY_PATTERN.test(rest);
99}
100
92101export function resolveMarkdownFileLinkTarget(
93102 href: string | undefined,
94103 cwd?: string,
......@@ -101,14 +110,14 @@ export function resolveMarkdownFileLinkTarget(
101110 ? parseFileUrlHref(rawHref)
102111 : null;
103112 const source = fileUrlTarget ?? stripSearchAndHash(rawHref);
104 const decodedPath = safeDecode(source.path.trim());
113 const decodedPath = fileUrlTarget ? source.path.trim() : safeDecode(source.path.trim());
105114 const decodedHash = safeDecode(source.hash.trim());
106115
107116 if (decodedPath.length === 0) return null;
108117 if (
109118 !WINDOWS_DRIVE_PATH_PATTERN.test(decodedPath) &&
110119 !WINDOWS_UNC_PATH_PATTERN.test(decodedPath) &&
111 EXTERNAL_SCHEME_PATTERN.test(decodedPath)
120 hasExternalScheme(decodedPath)
112121 ) {
113122 return null;
114123 }