fix(desktop): propagate canonical deep-link length validation

[integry]

Propagates the final canonical deep-link serialization invariant from the runtime epic into the top desktop epic.

• reject canonical hrefs that expand beyond 2,048 characters
• revalidate the exact serialized value delivered to renderer
• require raw/canonical dashboard path equivalence
• add desktop and renderer boundary regressions

This PR targets the non-main desktop epic branch. It must be reviewed and merged only into that branch. Related: #1950 #1952 #1979.

[integry]

/review

Review exact head d99f006 propagated from the runtime epic into top epic branch 1950. Verify the three-file delta is exactly the canonical deep-link serialization fix plus focused regressions, preserves every top-epic runtime/UX change, and introduces no semantic conflict. Reproduce canonical length boundaries and re-audit encoded traversal/auth/reserved/external rejection. No code changes. Report blockers and score only after exact-head checks.

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

At exact head d99f006211026dac64d355ceb9d5c31d2683b22b, the three-file delta is narrowly limited to canonical deep-link serialization validation and focused regressions. The 2,048-character boundary is correctly enforced on the serialized value, raw/canonical dashboard routes must agree, and traversal, credential/auth, reserved-parameter, and external-route rejection remain intact. No semantic conflict with the surrounding runtime or UX behavior is evident.

The code itself has no verified merge blocker, but the PR needs minor follow-up before merge because the authoritative current status includes a failed Validate Changes check and two pending full-suite runs.

✅ Canonical value is revalidated — apps/desktop/src/security.ts checks the exact url.href length and control characters, reparses it, and requires its normalized dashboard path to equal the raw input’s normalized path.

✅ Length boundaries are correctly covered — Both desktop and renderer regressions demonstrate rejection when serialization expands beyond 2,048 characters and acceptance at exactly 2,048.

✅ Security invariants remain preserved — The changed path continues through the existing credential, encoded traversal, reserved route/parameter, and absolute/external destination checks.

Merge blockers

No merge blockers.

Suggestions

These are optional follow-ups and are not sent to /fix.

No suggestions.

Score

The scoped implementation appears correct and well tested, but the current failed validation check prevents declaring the exact head merge-ready until its cause is resolved; the pending full-suite checks should also complete.

Score: 7/10

---

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 1m 7s
• Tokens: 25,671 (23,275 in / 2,396 out)
• Cost: $0.13

View Task

---

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}

[integry]

/review

Re-review exact unchanged head d99f006 now that all nine exact-head checks, including rerun Validate Changes and Full Test Suite, are green. Confirm prior no-blocker canonical deep-link assessment, exact three-file propagation into top epic, 673/674 serialization boundaries, and preserved security/runtime behavior. No code changes. Report final blockers and score from current evidence.

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

This exact three-file delta is focused, correct, and ready to merge into the intended non-main desktop epic branch.

✅ Canonical serialization enforced — normalizeDeepLink validates the serialized url.href, rejects values exceeding 2,048 characters, and revalidates open-link path equivalence.

✅ Boundary behavior is correct — The 2,048-character case is accepted while the next expansion beyond the limit is rejected, covering the intended 673/674 serialization transition.

✅ Security behavior preserved — Existing traversal, authentication, reserved-parameter, malformed, and external-path rejection remains intact; production renderer behavior is unchanged. Current-head status reports 0 failed, 0 pending, and 27 passed checks.

Merge blockers

No merge blockers.

Suggestions

These are optional follow-ups and are not sent to /fix.

No suggestions.

Score

The implementation fully satisfies the scoped objective, adds focused desktop and renderer regressions, and has no identified behavioral or security regressions at a fully green current head.

Score: 10/10

---

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 56s
• Tokens: 25,344 (23,058 in / 2,286 out)
• Cost: $0.14

View Task

---

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}