Guard every URL decode behind decodedOrNull

Routes every URL-reachable decodeURIComponent call in apps/web and
packages/ through one shared, guarded helper instead of leaving each
call site to throw on a malformed percent-escape:

- New leaf package @corbits/url-path (no deps, safe in the browser
  bundle and hub code alike) holding decodedOrNull —
  packages/artifact-ui, packages/chat, and apps/hub can't depend on
  apps/web, so the helper can't stay local to path-ids.ts.
- apps/web/src/path-ids.ts imports it instead of keeping its own copy.
- apps/web/src/workbench-path.ts: workbenchIdFromPath,
  workbenchSettingsSectionFromPath (now also validated against
  WorkbenchSettingsSectionId via the new isWorkbenchSettingsSectionId,
  replacing the unchecked `as` cast — packages/chat-ui exports both
  the guard and its backing WORKBENCH_SETTINGS_SECTION_IDS list),
  workbenchSettingsEntityIdFromPath.
- apps/web/src/insights-path.ts (moved out of the 1700-line
  insights-page.tsx, which now just imports it): parseInsightsPath's
  workbenchId/runId. A malformed escape now falls all the way back to
  {mode: "landing"} — returning {mode: "workbench", workbenchId:
  null} would render a bench-scoped dashboard mislabeled "All
  workbenches" with permanently-empty panels instead of the plain
  landing view every other unresolvable path already gets.
- packages/artifact-ui/src/kind-filter.ts: libraryArtifactIdFromPath.
- packages/chat/src/routes.ts: DELETE .../participants/:address now
  400s on a malformed address instead of throwing mid-request.
- apps/hub/src/index.ts's createStaticHandler (exported for the new
  test): the SPA static-file fallback ahead of every non-/api route,
  reachable unauthenticated — GET /%zz threw a 500 before this;
  now falls through to the platform's own 404 like any other
  unresolvable path.

packages/connections/src/oauth-routes.ts's decode was already
try/caught and is left as-is. Not in scope: apps/hub's
dbConfigFromUrl decodes a database URL's own user/password at boot —
operator-supplied config, never a client-reachable URL, so it's
noted here rather than guarded (its shape is mirrored by six test
doubles across apps/hub, packages/insights, packages/inbox, and
packages/approvals, none of them production code either).

Claude-Session: https://claude.ai/code/session_01Shhie5zM8L54bLHq5gFQti

Author: TheGreatAxios

apps/hub/package.json

@@ -44,6 +44,7 @@
     "@corbits/tasks": "workspace:*",
     "@corbits/tool-registry-publish": "workspace:*",
     "@corbits/turn-artifacts": "workspace:*",
+    "@corbits/url-path": "workspace:*",
     "@corbits/webhook-triggers": "workspace:*",
     "@corbits/workflow-catalog": "workspace:*",
     "@corbits/workflow-source": "workspace:*",

apps/hub/src/index.ts

@@ -95,6 +95,7 @@ import {
 } from "@corbits/chat";
 import type { RelaunchNoticePort } from "@corbits/chat";
 import type { FinalizedTurnToolCall } from "@corbits/turn-artifacts";
+import { decodedOrNull } from "@corbits/url-path";
 import {
   createCryptoProviderCache,
   createTopLevelRunRoutes,
@@ -413,12 +414,12 @@ function dbConfigFromUrl(databaseUrl: string) {
 // Serves the single-page application from the hub origin: a real file
 // when one exists, index.html otherwise so client-side routes deep-link,
 // and never anything under /api, which stays with the platform routes.
-function createStaticHandler(staticDir: string) {
+export function createStaticHandler(staticDir: string) {
   return async (c: Context<AppEnv>, next: Next) => {
     if (c.req.path === "/api" || c.req.path.startsWith("/api/")) return next();
-    const rel = path
-      .normalize(decodeURIComponent(c.req.path))
-      .replace(/^[/\\]+/, "");
+    const decodedPath = decodedOrNull(c.req.path);
+    if (decodedPath === null) return next();
+    const rel = path.normalize(decodedPath).replace(/^[/\\]+/, "");
     if (rel === ".." || rel.startsWith(`..${path.sep}`)) return next();
     const asset = Bun.file(path.join(staticDir, rel));
     if (await asset.exists()) return new Response(asset);

apps/web/package.json

@@ -37,6 +37,7 @@
     "@corbits/shell-layout": "workspace:*",
     "@corbits/slug": "workspace:*",
     "@corbits/tasks-ui": "workspace:*",
+    "@corbits/url-path": "workspace:*",
     "@corbits/workflow-catalog": "workspace:*",
     "@corbits/icons": "workspace:*",
     "@intx/types": "0.3.0",

apps/web/src/bench-context.tsx

@@ -45,7 +45,10 @@ export type BenchState = {
   readonly onBenchCreated: (tenantId: string) => void;
 };
 
-const BenchContext = createContext<BenchState | null>(null);
+/** Exported only so a render test can inject a fixed `BenchState` without
+ * standing up `BenchProvider`'s own `/api/me/principals` fetch — every
+ * real caller still goes through `useBench`/`BenchProvider`. */
+export const BenchContext = createContext<BenchState | null>(null);
 
 /** The membership this context currently treats as selected: the stored
  * choice if it still names a bench the account belongs to *and* still

apps/web/src/insights-path.ts

@@ -0,0 +1,51 @@
+// Insights' own route parser — its own module (not inlined in
+// insights-page.tsx) so it can be exercised directly without dragging in
+// that page's bench/query-client wiring.
+
+import { decodedOrNull } from "@corbits/url-path";
+
+import { INSIGHTS_PATH_PREFIX, INSIGHTS_RUNS_PATH } from "./path-ids";
+
+/**
+ * `/insights/workbench/:workbenchId` (CL-5879) is its own dedicated route — a
+ * conversation's own scoped view, resolved by `InsightsWorkbenchPage`, never
+ * a sub-mode of the landing. Every other path stays the cross-workbench
+ * default landing: no per-mode branch needed there, since scoping happens
+ * in InsightsRoute (which tenantId every query below targets), not here.
+ * A stale `/insights/workbench/:tenantId` link (that route is retired,
+ * hard cut) falls through to the plain landing default below rather than
+ * matching anything.
+ *
+ * A malformed percent-escape in the id segment reads as the plain landing
+ * default too, never as a detail mode with no entity to show — `mode:
+ * "workbench"` (or `"run"`) with a `null` id would otherwise render that
+ * mode's own scoped, permanently-empty dashboard instead of falling back
+ * to the landing view any other unresolvable path already gets.
+ */
+export function parseInsightsPath(path: string): {
+  mode: "landing" | "runs" | "run" | "workbench";
+  runId: string | null;
+  workbenchId: string | null;
+} {
+  const workbenchMatch = /^\/insights\/workbench\/([^/]+)\/?$/.exec(path);
+  if (workbenchMatch !== null && workbenchMatch[1] !== undefined) {
+    const workbenchId = decodedOrNull(workbenchMatch[1]);
+    if (workbenchId !== null) {
+      return { mode: "workbench", runId: null, workbenchId };
+    }
+  }
+  if (path === INSIGHTS_PATH_PREFIX || path === `${INSIGHTS_PATH_PREFIX}/`) {
+    return { mode: "landing", runId: null, workbenchId: null };
+  }
+  if (path === INSIGHTS_RUNS_PATH || path === `${INSIGHTS_RUNS_PATH}/`) {
+    return { mode: "runs", runId: null, workbenchId: null };
+  }
+  const match = /^\/insights\/runs\/([^/]+)\/?$/.exec(path);
+  if (match !== null && match[1] !== undefined) {
+    const runId = decodedOrNull(match[1]);
+    if (runId !== null) {
+      return { mode: "run", runId, workbenchId: null };
+    }
+  }
+  return { mode: "landing", runId: null, workbenchId: null };
+}

apps/web/src/pages/insights-page.tsx

@@ -61,6 +61,7 @@ import {
   type WorkbenchInsightsResolution,
 } from "../insights-workbench-scope";
 import { workbenchInsightsPath } from "../insights-deeplinks";
+import { parseInsightsPath } from "../insights-path";
 import {
   ActivityResponseSchema,
   InsightsScopeSchema,
@@ -1077,46 +1078,6 @@ export function InsightsRunDetail({
   );
 }
 
-/**
- * `/insights/workbench/:workbenchId` (CL-5879) is its own dedicated route — a
- * conversation's own scoped view, resolved by `InsightsWorkbenchPage`, never
- * a sub-mode of the landing. Every other path stays the cross-workbench
- * default landing: no per-mode branch needed there, since scoping happens
- * in InsightsRoute (which tenantId every query below targets), not here.
- * A stale `/insights/workbench/:tenantId` link (that route is retired,
- * hard cut) falls through to the plain landing default below rather than
- * matching anything.
- */
-function parseInsightsPath(path: string): {
-  mode: "landing" | "runs" | "run" | "workbench";
-  runId: string | null;
-  workbenchId: string | null;
-} {
-  const workbenchMatch = /^\/insights\/workbench\/([^/]+)\/?$/.exec(path);
-  if (workbenchMatch !== null && workbenchMatch[1] !== undefined) {
-    return {
-      mode: "workbench",
-      runId: null,
-      workbenchId: decodeURIComponent(workbenchMatch[1]),
-    };
-  }
-  if (path === INSIGHTS_PATH_PREFIX || path === `${INSIGHTS_PATH_PREFIX}/`) {
-    return { mode: "landing", runId: null, workbenchId: null };
-  }
-  if (path === INSIGHTS_RUNS_PATH || path === `${INSIGHTS_RUNS_PATH}/`) {
-    return { mode: "runs", runId: null, workbenchId: null };
-  }
-  const match = /^\/insights\/runs\/([^/]+)\/?$/.exec(path);
-  if (match !== null && match[1] !== undefined) {
-    return {
-      mode: "run",
-      runId: decodeURIComponent(match[1]),
-      workbenchId: null,
-    };
-  }
-  return { mode: "landing", runId: null, workbenchId: null };
-}
-
 /**
  * The landing view's default scope, and every non-landing mode's scope,
  * as one pure decision so it can be unit-tested without mounting the

apps/web/src/path-ids.ts

@@ -8,6 +8,7 @@
 // below.
 
 import { isValidSlug, type Slug } from "@corbits/slug";
+import { decodedOrNull } from "@corbits/url-path";
 
 export const SETTINGS_PATH_PREFIX = "/settings";
 export const AGENTS_PATH_PREFIX = "/agents";
@@ -43,19 +44,6 @@ function rawSegmentFromTopLevelPath(
   return rest === "" ? null : rest;
 }
 
-/** A URL segment carries percent-escapes an id needs decoded, and a
- * hand-typed or truncated URL can carry a malformed one — which
- * `decodeURIComponent` answers with a throw. A path that cannot be decoded
- * names no entity, so it reads as no selection at all rather than taking
- * the render down with it. */
-function decodedOrNull(segment: string): string | null {
-  try {
-    return decodeURIComponent(segment);
-  } catch {
-    return null;
-  }
-}
-
 /** Extract a sub-selection from a flat top-level route (`/agents/:id`,
  * `/skills/:id`) — `null` for the bare prefix or a path outside it. */
 function entityIdFromTopLevelPath(path: string, prefix: string): string | null {

apps/web/src/workbench-path.ts

@@ -8,7 +8,11 @@
 // `/settings/:section` and `settingsEntityIdFromPath` for the app-level
 // Settings page.
 
-import type { WorkbenchSettingsSectionId } from "@corbits/chat-ui";
+import {
+  isWorkbenchSettingsSectionId,
+  type WorkbenchSettingsSectionId,
+} from "@corbits/chat-ui";
+import { decodedOrNull } from "@corbits/url-path";
 
 export const WORKBENCH_PATH_PREFIX = "/w";
 const LEGACY_CHAT_PATH_PREFIX = "/chat";
@@ -33,7 +37,7 @@ export function workbenchIdFromPath(path: string): string | null {
     if (!base.startsWith(`${prefix}/`)) continue;
     const rest = base.slice(prefix.length + 1);
     if (rest === "") return null;
-    return decodeURIComponent(rest);
+    return decodedOrNull(rest);
   }
   return null;
 }
@@ -83,12 +87,13 @@ export function workbenchSettingsPath(
 
 /** Extract the section id from `/w/:id/settings/:section` (or
  * `/settings/:section/:entityId`, or its legacy `/chat` equivalent) —
- * `undefined` for bare `/settings` or a non-settings path. Only the first
- * segment after `/settings/` is the section, so a trailing entity id does
- * not change the section. Not validated against the known section ids: the
- * settings surface already falls back to its first section for an id it
- * doesn't recognize, the same contract `settingsSectionIdFromPath` in
- * `path-ids.ts` relies on its caller for. */
+ * `undefined` for bare `/settings`, a non-settings path, a malformed
+ * escape, or a segment that isn't one of `WorkbenchSettingsSectionId`'s own
+ * values. Only the first segment after `/settings/` is the section, so a
+ * trailing entity id does not change the section. An unrecognized id reads
+ * the same as no section at all: the settings surface already falls back
+ * to its first section then, the same contract `settingsSectionIdFromPath`
+ * in `path-ids.ts` relies on its caller for. */
 export function workbenchSettingsSectionFromPath(
   path: string,
 ): WorkbenchSettingsSectionId | undefined {
@@ -99,7 +104,11 @@ export function workbenchSettingsSectionFromPath(
   if (rest === "") return undefined;
   const section = rest.split("/")[0];
   if (section === undefined || section === "") return undefined;
-  return decodeURIComponent(section) as WorkbenchSettingsSectionId;
+  const decoded = decodedOrNull(section);
+  if (decoded === null || !isWorkbenchSettingsSectionId(decoded)) {
+    return undefined;
+  }
+  return decoded;
 }
 
 /** Extract a section's own sub-selection from
@@ -116,5 +125,5 @@ export function workbenchSettingsEntityIdFromPath(
   const index = path.indexOf(sectionPrefix);
   if (index === -1) return null;
   const rest = path.slice(index + sectionPrefix.length);
-  return rest === "" ? null : decodeURIComponent(rest);
+  return rest === "" ? null : decodedOrNull(rest);
 }