fix(coding-agent): bind status-line PR URLs

[sj0618]

What

• Require the status-line PR number to be a positive safe integer.
• Bind the terminal hyperlink to an exact canonical /<owner>/<repo>/pull/<number> HTTP(S) URL.
• Reject control characters, userinfo, query/fragment ambiguity, number mismatches, non-PR paths, and extra path prefixes while preserving GitHub Enterprise hosts.

Why

The status line labels this target as a trusted PR number and emits it through an OSC 8 terminal hyperlink. Closed PR #3562 only checked for an absolute HTTP(S) URL, so an arbitrary or contradictory target could still appear behind that label. This current-dev successor implements the exact owner-requested identity binding and closes the extra-prefix bypass found during independent review.

Testing

• bun test packages/coding-agent/test/status-line-gh.test.ts — 7 passed, 87 assertions
• bun --cwd=packages/coding-agent run check
• git diff --check

GJC verdict

gajae.pr-review-verdict.v1 merge-approved sha256:b593c5038b6f97d1a30f21acb8192e5a418b1368 reviewer:critic evidence:local-exact-head-review

---

• Target branch is dev
• bun check passes
• Tested locally
• CHANGELOG updated (if user-facing)
• Verdict above matches the exact PR head, not an earlier commit

[Yeachan-Heo]

Exact-head red-team review for b593c50.

No implementation defect found in the status-line URL binding patch after reviewing canonical URL parsing and adversarial cases, and running:

• bun test packages/coding-agent/test/status-line-gh.test.ts (7 pass, 87 assertions)
• bun --cwd=packages/coding-agent run check (Biome and TypeScript passed)

REQUEST CHANGES: GitHub reports this exact head as CONFLICTING/DIRTY against dev. The PR base is b40bc27, while current dev is be3940a. Rebase or otherwise update the PR onto current dev, rerun CI, and request review again. This is a mergeability blocker, not a code finding.

Review receipt: gajae.pr-review-verdict.v1 needs-changes sha256:b593c5038b6f97d1a30f21acb8192e5a418b1368 reviewer:Yeachan-Heo evidence:terminal-exact-head-red-team

[Yeachan-Heo]

Exact-head red-team review for b593c5038b6f97d1a30f21acb8192e5a418b1368 (single commit on merge base b40bc2715; current dev tip is 54b14cb6e).

Verdict: REQUEST_CHANGES (mergeability only — no code defect)

No implementation defect found

The canonicalPrUrl() binding is sound:

• Control-character rejection: C0_C1_CONTROL_CHARACTERS regex tested before new URL() parsing, preventing OSC 8 escape injection at the consumption site (segments.ts:275: \x1b]8;;${pr.url}\x07). Verified with the full C0 (U+0000–U+001F) and C1 (U+007F–U+009F) range — all rejected.
• Protocol restriction: only http:/https: accepted; ftp: rejected.
• Userinfo/query/hash rejection: url.username, url.password, url.search, url.hash all checked and rejected. Prevents https://github.com@attacker.example/... and redirect/fragment ambiguity.
• PR-number binding: pathname must end with /pull/${number} where number is the validated positive safe integer from the JSON. A URL pointing to PR 9999 when the response says 3354 is rejected.
• Repository path validation: exactly 2 non-empty components (owner/repo), rejecting /pull/3354 (no repo), /extra/pull/3354 (3 components), and /security/advisories (wrong path shape).
• Canonical normalization: returns url.href, so HTTPS://GHE.INTERNAL.EXAMPLE.COM:443/... normalizes to https://ghe.internal.example.com/.... GitHub Enterprise hosts over HTTP(S) are preserved.
• Number validation: Number.isSafeInteger(pr.number) && pr.number > 0 rejects 0, -1, 1.5, MAX_SAFE_INTEGER + 1, and string "3354".

The downstream OSC 8 hyperlink at segments.ts:275 now only receives a validated canonical URL, and the visible label (#${pr.number}) is a validated positive integer. The injection surface is closed.

Mergeability — stale base (blocking)

GitHub reports CONFLICTING/DIRTY. I confirmed via git merge --no-commit origin/dev pr-3702-head that the textual content auto-merges cleanly (zero conflict markers; only CHANGELOG.md additive context shifts). The DIRTY status is a stale PR metadata base reference (b40bc2715), not a textual conflict. Rebase or update the PR branch to refresh the merge base, then rerun CI.

Verification run

• bun test packages/coding-agent/test/status-line-gh.test.ts — 7 pass, 87 assertions (PR head)
• bun --cwd=packages/coding-agent run lint (Biome) — clean, 2496 files
• tsc --noEmit — no errors in status-line/gh.ts
• git merge --no-commit origin/dev pr-3702-head — clean auto-merge, zero conflict markers

I did not merge or mutate the PR.

Review receipt: gajae.pr-review-verdict.v1 needs-changes sha256:b593c5038b6f97d1a30f21acb8192e5a418b1368 reviewer:Yeachan-Heo evidence:terminal-exact-head-red-team

[Yeachan-Heo]

Exact-head mergeability re-verification for b593c50 against current dev 57577ac.

Implementation is unchanged since my prior CHANGES_REQUESTED reviews (code clean, no defect). The CHANGES_REQUESTED was solely for the stale base (CONFLICTING/DIRTY). I confirmed via git merge-tree that the PR auto-merges cleanly against current dev — zero conflict markers. The DIRTY status is a stale PR metadata base reference (b40bc27 vs current dev 57577ac), not a textual conflict.

Next step for merge: rebase or update the PR branch to refresh the merge base and rerun CI.

Review receipt: gajae.pr-review-verdict.v1 pending-rebase sha256:b593c5038b6f97d1a30f21acb8192e5a418b1368 reviewer:Yeachan-Heo evidence:terminal-exact-head-red-team