Source attribution links when a URL is verifiably safe (Feature 15) #154

2026-10-09T08:12:48-04:00

2026-10-09 08:12:48 -04:00

Maestro task c1a97243-3e41-42fc-a1a0-1ac684ccb463. The dinner detail API returns source.url only when the stored URL is https with no userinfo, no query and no fragment; the client renders it as a link then, and as plain attribution text otherwise. See the task done-condition and the developer report on the PR.

orchestrator-agent added 1 commit 2026-10-09 08:12:48 -04:00

Return the recipe source url when it is verifiably free of secrets

CI / ci (push) Successful in 5m53s

Details

CI / ci (pull_request) Successful in 5m2s

Details

9a2de85f75

The dinner detail API now sends source.url when the stored recipe link
is https to a host with no userinfo, no query (not even a bare "?") and
no fragment (not even a bare "#"), and a port the client can parse;
otherwise source.url is null. The rule matches sourceUrl() in
web/src/dinners/detail.ts, so the recipe screen links "Recipe from
{site}" in a new tab for a safe link and shows plain text otherwise.
The site-name protection in pageSiteName is unchanged.

Task: c1a97243-3e41-42fc-a1a0-1ac684ccb463

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent requested changes

2026-10-09 08:19:04 -04:00

Dismissed

review_agent left a comment

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

overseer added 1 commit 2026-10-09 08:30:25 -04:00

Withhold recipe source urls whose host the browser cannot parse

CI / ci (pull_request) Failing after 4m13s

Details

CI / ci (push) Failing after 4m11s

Details

0c5772f48e

safeSourceURL accepted hosts that Go's url.Parse takes but the browser's
URL parser refuses, such as "https://[bad]/curry", so the detail API could
send a source.url that sourceUrl() in web/src/dinners/detail.ts rejects,
failing the whole recipe screen. The server now also requires a host the
browser parses as it stands: a bracketed host must be an IPv6 address
without a zone; any other must be ASCII letters, digits and hyphens in
non-empty dot-separated labels, with no punycode label and, when its last
label is a number, a valid dotted quad; and the host must be spelled out,
not percent-encoded. Any other link is withheld as before.

web/src/dinners/testdata/source_url_cases.json pins the source object
the handler sends for each stored link. The Go server test checks the
handler against it, and the recipe screen test renders each source from
it, so the two parsers cannot drift apart on those links.

Task: c1a97243-3e41-42fc-a1a0-1ac684ccb463

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-10-09 08:44:30 -04:00

Dismissed

review_agent left a comment

Independent Codex gpt-6-sol review: APPROVED for this exact commit.

overseer added 1 commit 2026-10-09 10:11:18 -04:00

Merge remote-tracking branch 'origin/feature/293a89c5-bd98-4de4-9afd-5ca371e5e679-recipe-detail-and-kitchen-reading-mode' into task/source-attribution-links_c1a97243-3e41-42fc-a1a0-1ac684ccb463

CI / ci (push) Successful in 5m21s

Details

CI / ci (pull_request) Successful in 5m9s

Details

b472b35aaa

review_agent approved these changes

2026-10-09 10:12:44 -04:00

review_agent left a comment

Independent Codex gpt-6-sol review: APPROVED for this exact commit.

approver_agent merged commit c6d287860b into feature/293a89c5-bd98-4de4-9afd-5ca371e5e679-recipe-detail-and-kitchen-reading-mode

2026-10-09 11:00:16 -04:00

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#154