(CODUX-112) Reject external dashboard-like links in live entity resolution

[numnx]

🧩 Task: Reject external dashboard-like links in live entity resolution

Automated task PR opened by Code UX for T07.

📋 Summary

Sprint: Sprint 178 · Enrich Chat widgets with live data · Task: T07

Enrich existing chat rich widgets so sprint and task references in project-scoped chat and invocation transcripts resolve to real live sprint/task records, show current statuses, and link to the correct dashboard destinations with polished accessible UI.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.5

⏱️ Timing

Started	2026-07-07 13:25:14 UTC
Finished	2026-07-07 13:28:03 UTC
Duration	2m 49s

📊 Token Usage

Metric	Value
Input tokens	34,826
Cached input tokens	412,032
Output tokens	4,629
Total tokens	451,487
Invocations	1
Tool calls	21
Active time	2m 19s

Included usage estimate (subscription/local login): $0.52

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Prevent the live entity resolver from enriching external absolute URLs that happen to use `/sprints` or `/tasks` paths, and add regression coverage.

## Scope
- Edit `dashboard/src/v2/lib/chat-live-entities.ts`.
- Update `tests/dashboard/lib/chat-live-entities.test.ts`.
- Keep the resolver pure, frontend-only, and compatible with existing widget behavior.

## Implementation Requirements
1. Tighten `parseDashboardUrl` so it only accepts relative dashboard links or same-origin dashboard URLs intended for the app, and rejects external-origin absolute URLs even when the pathname is `/sprints` or `/tasks`.
2. Preserve existing resolution behavior for real selected-project sprint/task records, deduplication, and conservative handling of ambiguous task keys.
3. Add a regression test proving an external absolute URL such as `https://example.com/tasks?sprintId=...&taskId=...` does not resolve, while a relative `/tasks?...` link still does.

## Constraints
- Do not change `ChatMessageBubble`, `InvocationMessageBubble`, or `ChatPage`.
- Do not broaden markdown parsing beyond dashboard links.
- Keep the helper side-effect free and data-fetch free.

## Verification
- Run `pnpm exec vitest run tests/dashboard/lib/chat-live-entities.test.ts tests/dashboard/lib/chat-widget-view-models.test.ts`.
- Run `pnpm run typecheck:dashboard`.

🌿 Branch Info

Base: feature/CODUX-178-enrich-chat-widgets-with-live-data
Head: task/feature-codux-178-enrich-chat-widgets-with-live--t07-codex-mraolnoz

---

🤖 Generated by Code UX