fix(desktop): propagate canonical deep-link length validation to UX - #1983
Merged
integry merged 1 commit intoAug 29, 2026
Merged
Conversation
![propr-dev[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…8dcb68971e6a0e6`. Implemented F1 only on base head `48f85811addf4bccfd390961e8dcb68971e6a0e6`. Changes: - [security.ts](/tmp/git-processor/worktrees/integry/propr/pr-1979-followup-2026-08-29T20-41-29/apps/desktop/src/security.ts) now checks the serialized canonical candidate’s length/controls and requires its dashboard path to equal the validated input path before returning it. - Added desktop and renderer regressions for percent-expansion beyond 2,048 and an exactly 2,048-character valid canonical link. - Existing traversal, encoded-delimiter, auth/pairing, query, and hash tests remain passing. Verification: - Desktop tests: 28 passed. - Focused renderer tests: 5 passed. - Desktop and UI typechecks: passed. - Production package: passed. - `git diff --check`: passed. - Packaged smoke: environment-blocked because no usable Chromium sandbox helper is installed/configured. - Full suite: reached file 155/320 before blocking on unavailable Redis (`127.0.0.1:6379`); neither Redis nor Docker is installed. Only the three scoped files are modified. Per instruction, I did not commit or push; the system must publish the resulting branch head. PR: #1979 Comment by: @integry (ID: 5464771154) Model: gpt-5.6-sol
Checks FailedValidation failed during setup, tests, CLI packaging, linting, or build checks. View Logs |
Owner
Author
|
/review Review exact head d99f006 propagated from the runtime epic into UX epic branch 1951. Verify the three-file delta is exactly the canonical deep-link serialization fix plus focused regressions, preserves the desktop UX architecture and deterministic tests, and introduces no semantic conflict. Reproduce canonical length boundaries and re-audit encoded traversal/auth/reserved/external rejection. No code changes. Report blockers and score only after exact-head checks. |
Contributor
|
✅ AI Code Review Complete requested by @integry Posted 1 review: |
Contributor
🔍 AI Code Review — codex:gpt-5.6-solOverall EvaluationThe three-file delta correctly applies canonical deep-link serialization validation and adds focused, deterministic regressions without changing the desktop delivery architecture. No semantic conflict or PR-introduced blocker is evident. The code itself needs no verified changes, but the PR is not currently merge-ready because the authoritative head status includes a failed Validate Changes check and two pending test suites. ✅ Canonical form is revalidated — ✅ Exact boundary behavior is covered — Both changed test files demonstrate that Unicode expansion beyond 2,048 characters is rejected while an already-canonical link of exactly 2,048 characters is accepted and routed correctly. ✅ Security and architecture remain intact — Re-audit confirms encoded traversal, credentials, reserved parameters, and external-path forms remain rejected; accepted links still travel through the existing main-process, IPC, and renderer navigation path. Merge blockersNo merge blockers. SuggestionsThese are optional follow-ups and are not sent to No suggestions. ScoreThe implementation is correct and well-focused within scope, but the current failed validation check prevents a merge-ready rating until its cause is resolved; the pending suites should also complete successfully. Score: 7/10 🤖 Review Details
🤖 Review by ProPR |
Owner
Author
|
/review Re-review exact unchanged head d99f006 now that all nine exact-head checks, including rerun Validate Changes and Full Test Suite, are green. Confirm prior no-blocker canonical deep-link assessment, exact three-file propagation into UX epic, deterministic UI coverage, 673/674 serialization boundaries, and preserved security/runtime behavior. No code changes. Report final blockers and score from current evidence. |
Contributor
|
✅ AI Code Review Complete requested by @integry Posted 1 review: |
Contributor
🔍 AI Code Review — codex:gpt-5.6-solOverall EvaluationThis exact three-file propagation correctly enforces canonical deep-link serialization without altering the desktop delivery architecture. It is ready to merge. ✅ Canonical boundary enforced — ✅ Route semantics preserved — Open links are accepted only when raw and canonical forms resolve to the identical validated dashboard path, preserving traversal, authentication-route, reserved-parameter, external-route, and control-character protections. ✅ Focused deterministic coverage — Both security and renderer-navigation tests cover expansion rejection and exact-limit acceptance, while all authoritative current-head checks pass. Merge blockersNo merge blockers. SuggestionsThese are optional follow-ups and are not sent to No suggestions. ScoreThe implementation is narrowly scoped, security-preserving, well-covered at serialization boundaries, and fully green on current-head validation. No merge blockers or material verification gaps remain. Score: 10/10 🤖 Review Details
🤖 Review by ProPR |
integry
merged commit Aug 29, 2026
7f9d5e2
into
1951-epic-desktop-experience-uxs
85 of 86 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Propagates the final canonical deep-link serialization invariant into the UX epic after its earlier runtime sync.
This is the exact d99f006 runtime patch: canonical length/control checks, raw/canonical route equivalence, and boundary tests. It targets only the non-main UX epic branch. Related: #1951 #1952 #1979.