fix(graph-vfs): decode graph VFS paths safely so a malformed % never throws

[Diwak4r]

Problem

handleGraphVfs (src/daemon/runtime/codebase/query.ts) documents that an unknown/odd path "returns a short usage listing (never throws)", and its VFS caller resolveGraph (src/daemon-client/vfs/read.ts) wraps it in no try/catch — its own docblock repeats "The renderer itself never throws".

But parsePath runs the path remainder through decodeURIComponent, which raises URIError: URI malformed on a lone or short % escape. So a perfectly ordinary caller-supplied VFS path like graph/find/100% (or graph/show/a%zz, graph/neighborhood/src/x%.ts) throws out of handleGraphVfs instead of rendering — breaking the documented contract and propagating out of an un-guarded caller.

> decodeURIComponent('100%')
Uncaught URIError: URI malformed

Fix

Route the remainder through a small safeDecode helper that returns the raw string when decodeURIComponent throws, so an undecodable remainder is passed through verbatim rather than blowing up the whole render. One-line call-site change plus the helper.

How verified

• Added a regression test alongside the existing "never throws" case in tests/daemon/runtime/codebase/query.test.ts covering find/100%, show/a%zz, and neighborhood/src/x%.ts.
• npx vitest run tests/daemon/runtime/codebase/query.test.ts → 26 passed.
• Confirmed no new typecheck/lint issues attributable to this change (the pre-existing useIterableCallbackReturn warning in this file is unrelated and present on main).

Summary by CodeRabbit

• Bug Fixes

  • Prevented graph paths containing malformed percent-encoded sequences from causing errors.
  • Preserved the original path text when decoding is not possible.

• Tests

  • Added coverage for malformed escape sequences to ensure graph path handling completes successfully.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7732d975-c150-4cfd-9e2c-d1c0ff6f60e8

📥 Commits

Reviewing files that changed from the base of the PR and between c1cb6bf and a50dd63.

📒 Files selected for processing (2)

• src/daemon/runtime/codebase/query.ts
• tests/daemon/runtime/codebase/query.test.ts

---

📝 Walkthrough

Walkthrough

parsePath() now safely handles malformed percent-encoded graph paths by returning undecoded input when decoding fails. Tests verify handleGraphVfs() does not throw and returns a string for several malformed inputs.

Changes

Graph path safety

Layer / File(s)	Summary
Safe decoding and malformed-path coverage src/daemon/runtime/codebase/query.ts, tests/daemon/runtime/codebase/query.test.ts	parsePath() catches URI decoding errors and preserves the raw remainder; tests cover malformed percent-escape inputs through handleGraphVfs().

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: copilot

Poem

I’m a rabbit guarding paths tonight,
While crooked percent signs lose their bite.
No throws in the graph, no paths undone,
Raw strings hop safely beneath the sun.
Test carrots confirm the work is right!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: safer graph VFS path decoding to prevent malformed percent escapes from throwing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}