fix(web): open Windows absolute file paths in session viewer - #1113
Conversation
|
Adjacent (not overlapping): #1120 covers relative chat autolink footguns — explicit markdown links, backtick-wrapped paths, and missing allowlist entries such as |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Findings
- None.
Summary
- Review mode: initial
- No issues found with the Windows absolute path matching/rewrite changes in
web/src/lib/remark-file-path-links.ts. - Residual risk: I could not run the web test/typecheck commands because
bunis not installed in this runner.
Testing
- Not run (automation):
bununavailable in this environment.
HAPI Bot
* fix(web): autolink markdown links, inline code, and .mmd file paths in chat Chat autolinking previously only worked for bare file paths in plain text. Fancier markdown forms silently produced dead links: - COMMON_FILE_EXTENSIONS omitted common agent-cited types (mmd, puml, rst, csv, ini, etc.), so bare diagram.mmd never linked. - inlineCode nodes were never processed, so `path/to/file.md` never linked. - explicit [label](relative/file.md) links kept a raw relative URL that the SPA router treated as a dead route under /sessions/. Changes: - Expand COMMON_FILE_EXTENSIONS with justified doc/diagram/config/lang exts; deliberately exclude TLD-lookalikes (org/com/io) to avoid domain false positives. - Autolink inlineCode nodes whose ENTIRE value is a single path pattern match (whitespace-free, allowlisted ext), wrapping an inlineCode child to keep monospace. Real code snippets are left untouched. - Rewrite explicit markdown links whose target is a repo-relative allowlisted file path into hapi-file: hrefs (aligns with tiann#1113). Preserves label. Security invariants preserved: shouldLinkPath still rejects abs / ~/ / ../ / Windows-drive / scheme:// paths; scheme-bearing link urls are left for the deny-scheme layer; deny-scheme handling untouched. Refs tiann#1120 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): don't rewrite explicit links in standalone markdown preview Codex review (tiann#1142): rewriteFileLinkNode ran on the standalone file-preview surface too, but that surface has no HappyChatContext so the shared `A` anchor collapses hapi-file: links to plain text (returns props.children when !chat). That turned an explicit [label](file.md) link in a README preview from an anchor into plain text. Gate explicit-link rewriting behind a rewriteExplicitLinks option (default on for chat) and disable it for the standalone renderer via new MARKDOWN_PLUGINS_STANDALONE(_WITH_BREAKS) arrays. Bare-path and inlineCode autolinks are kept — they were already inert on the standalone surface, so no behavior change there. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Debian <heavygee@oos-linux.in.lockhouse> Co-authored-by: Cursor <cursoragent@cursor.com>
fc29ae2 to
117cfd2
Compare
|
Rebased onto current main after #1142 and resolved the shared file-path plugin conflicts. Windows absolute paths now use the same bare-text, inline-code, and explicit-link flows while preserving the relative-path exclusions added there; workspace containment remains enforced by the CLI file RPC. Updated coverage passes locally (37 targeted tests, 165 Web test files / 1394 tests, and root typecheck). |
There was a problem hiding this comment.
Findings
- None.
Summary
- Review mode: follow-up after new commits
- No issues found in the latest
web/src/lib/remark-file-path-links.tsandweb/src/lib/remark-file-path-links.test.tschanges. - Prior HAPI Bot review at
fc29ae202a3fd372bf815ff7629e914921055b90also had no findings; this pass reviewed the full latest PR diff, not only the incremental context. - Residual risk: Windows path handling depends on the existing CLI file RPC path validation on the session host.
Testing
- Not run (automation):
bununavailable in this environment.
HAPI Bot
|
Hi @heavygee, a quick follow-up now that #1142 has landed: I’ve rebased this PR onto the latest main and aligned the Windows absolute-path handling with the new bare-text, inline-code, and explicit-link flows. The PR is conflict-free and all checks are green. When you have a chance, could you please review it for merging? I’m happy to address any remaining concerns. Thanks! |
fix(web): open Windows absolute file paths in session viewer
fix(web): open Windows absolute file paths in session viewer
There was a problem hiding this comment.
LGTM - thumbs up.
Reviewed the post-#1142 rebase of the Windows absolute-path handling in remark-file-path-links:
- Drive-letter recognition (
C:\.../C:/...) is correctly gated on the existing extension allowlist. - Explicit-link rewrite correctly special-cases Windows drive letters so the residual-colon deny still catches
mailto:,foo:bar.md, etc. - Bare-text / inlineCode / explicit-link coverage matches the #1142 shape; POSIX abs /
~//../exclusions stay intact. - Containment still bottoms out in CLI
validatePath()on the session host (the right place for this); web only rewrites tohapi-file:and routes through the session file viewer.
CI is green (test, pr-review).
Currently by convention, only @tiann merges - please wait for them to land this. Happy to re-check if anything else comes up.
heavygee
added
low-impact
2 participants
Summary
Problem
Windows absolute paths such as
C:\Users\dev\project\handoff.mdcould be rendered as customc:URI links. Clicking them opened the custom URI confirmation dialog and then did nothing, especially when the HAPI web client was running on a different device from the session host.HAPI already has a session-aware file viewer backed by the CLI
ReadFileRPC. Relative file paths use that route, but Windows drive-letter paths were explicitly excluded from the Markdown file-path transform.Implementation
C:\...andC:/...formshapi-file:representation:line/:line:columnsuffixes from the read targetThe web client does not read local files directly. Clicking the link still navigates to
/sessions/:sessionId/file, and the CLI's existingvalidatePath()check rejects targets outside the session working directory.Test plan
bun run --cwd web test src/lib/remark-file-path-links.test.tsbun run --cwd web typecheckbun run --cwd web test— 165 files / 1394 tests passedbun typecheckc:custom URI dialogAI disclosure
Implementation and tests were prepared with OpenAI Codex assistance and manually reviewed.