@cadraos/sdk 0.3.14-p46.0 → 0.3.14-p46.2

package/dist/kanban/engine/index.cjs

@@ -82,7 +82,12 @@ var HANDOFF_VERDICT_JSON_SCHEMA = {
         required: ["label", "url"],
         properties: {
           label: { type: "string", minLength: 1, maxLength: 120 },
-          url: { type: "string", minLength: 1, maxLength: 2e3 }
+          url: {
+            type: "string",
+            minLength: 1,
+            maxLength: 2e3,
+            description: "An http(s):// URL or a same-origin path starting with '/'. Do not link files you wrote (artifact:<id>) \u2014 they are already attached to the card."
+          }
         }
       }
     }
@@ -90,6 +95,7 @@ var HANDOFF_VERDICT_JSON_SCHEMA = {
   if: { properties: { kind: { const: "DECIDE" } }, required: ["kind"] },
   then: { required: ["decision"] }
 };
+var ARTIFACT_REF_URL_RE = /^artifact:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function isSafeHandoffUrl(url) {
   if (typeof url !== "string" || url.length === 0) return false;
   if (/[\u0000-\u001f\u007f\s]/.test(url)) return false;
@@ -199,13 +205,15 @@ function parseHandoffVerdict(output) {
         };
       }
     }
-    for (const [i, l] of (v.links ?? []).entries()) {
+    const links = v.links?.filter((l) => !ARTIFACT_REF_URL_RE.test(l.url));
+    for (const [i, l] of (links ?? []).entries()) {
       if (!isSafeHandoffUrl(l.url)) {
         return { ok: false, reason: `links[${i}].url must be http(s):// or a same-origin /path` };
       }
     }
     const verdict = {
       ...v,
+      ...links ? { links } : {},
       ...v.state ? {
         state: {
           repos: v.state.repos ?? [],