mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 09:41:04 +01:00
- Reject ASCII control characters in workspaceFileResourceQuerySchema and
translate that ZodError to the existing 422 + {code: "invalid_path"} shape
in the route layer. The old service-level null-byte check still fires, but
now we reject at the boundary before audit logging tries to write the raw
path into Postgres JSONB (the true source of the 500).
- Parse path:line[:col] in OpenFilePrompt.handleSubmit via parseWorkspaceFileRef,
matching what inline WorkspaceFileLinks and URL deep-links already do, and
widen onSubmit/handlePromptSubmit to carry line/column through to viewer.open.
- Add a regression test for the control-character rejection. Fix a pre-existing
bug in file-resources.test.ts (missing await + wrong field names on the
embedded-postgres helper) so the DB-backed tests actually run instead of
silently skipping.
Co-Authored-By: Paperclip <noreply@paperclip.ing>