fix(local-lambda): allow '/' in durable execution and callback URI labels

After aws-durable-execution-sdk-python-testing#216, DurableExecutionArn
values are minted as <uuid>/<invocation-id> and boto percent-encodes
the '/' as %2F in the URI label. Werkzeug decodes %2F back to '/'
during routing, so the path no longer matches a single <string>
segment and every Get/History/Stop request 404'd before reaching the
handler with PathNotFoundLocally. The same shape applies to
base64-encoded CallbackId values which contain '/'.

Switch the six ARN/CallbackId URI labels from the default <string>
converter to <path:...>. Werkzeug picks the right rule via
trailing-literal specificity (.../<path:arn>/history beats
.../<path:arn>). The existing unquote() calls in handlers stay --
idempotent on already-decoded values. Backwards-compatible with
old UUID-only ARNs.

Adds TestDurableRoutingPercentEncodedSlash regression tests that
drive the real Flask app via test_client with %2F-encoded paths
across all six routes plus a UUID-only legacy form, asserting
routing reaches the correct handler with the decoded value.

Verified locally:
  - make pr (init, schema, black-check, lint, test-all): green
    (9248 unit tests pass, 25 skipped, 28 subtests pass, coverage
    94.17%)
  - tests/integration/local/start_lambda/test_start_lambda_durable.py
    all 18 tests pass (was 17 failures pre-fix), exercising the new
    ARN format end-to-end through real Docker emulator

Fixes #9039

Author: yaythomas

samcli/local/lambda_service/local_lambda_http_service.py

@@ -96,43 +96,43 @@ def create(self):
 
         # Durable functions endpoints
         self._app.add_url_rule(
-            "/2025-12-01/durable-executions/<durable_execution_arn>",
+            "/2025-12-01/durable-executions/<path:durable_execution_arn>",
             endpoint="get_durable_execution",
             view_func=self._get_durable_execution_handler,
             methods=["GET"],
         )
 
         self._app.add_url_rule(
-            "/2025-12-01/durable-executions/<durable_execution_arn>/history",
+            "/2025-12-01/durable-executions/<path:durable_execution_arn>/history",
             endpoint="get_durable_execution_history",
             view_func=self._get_durable_execution_history_handler,
             methods=["GET"],
         )
 
         self._app.add_url_rule(
-            "/2025-12-01/durable-executions/<durable_execution_arn>/stop",
+            "/2025-12-01/durable-executions/<path:durable_execution_arn>/stop",
             endpoint="stop_durable_execution",
             view_func=self._stop_durable_execution_handler,
             methods=["POST"],
         )
 
         # Callback endpoints
         self._app.add_url_rule(
-            "/2025-12-01/durable-execution-callbacks/<callback_id>/succeed",
+            "/2025-12-01/durable-execution-callbacks/<path:callback_id>/succeed",
             endpoint="send_callback_success",
             view_func=self._send_callback_success_handler,
             methods=["POST"],
         )
 
         self._app.add_url_rule(
-            "/2025-12-01/durable-execution-callbacks/<callback_id>/fail",
+            "/2025-12-01/durable-execution-callbacks/<path:callback_id>/fail",
             endpoint="send_callback_failure",
             view_func=self._send_callback_failure_handler,
             methods=["POST"],
         )
 
         self._app.add_url_rule(
-            "/2025-12-01/durable-execution-callbacks/<callback_id>/heartbeat",
+            "/2025-12-01/durable-execution-callbacks/<path:callback_id>/heartbeat",
             endpoint="send_callback_heartbeat",
             view_func=self._send_callback_heartbeat_handler,
             methods=["POST"],

tests/unit/local/lambda_service/test_local_lambda_http_service.py

@@ -64,42 +64,42 @@ def test_create_service_endpoints(self, flask_mock, error_handling_mock):
 
         # Verify durable functions endpoints were added
         app_mock.add_url_rule.assert_any_call(
-            "/2025-12-01/durable-executions/<durable_execution_arn>",
+            "/2025-12-01/durable-executions/<path:durable_execution_arn>",
             endpoint="get_durable_execution",
             view_func=service._get_durable_execution_handler,
             methods=["GET"],
         )
 
         app_mock.add_url_rule.assert_any_call(
-            "/2025-12-01/durable-executions/<durable_execution_arn>/history",
+            "/2025-12-01/durable-executions/<path:durable_execution_arn>/history",
             endpoint="get_durable_execution_history",
             view_func=service._get_durable_execution_history_handler,
             methods=["GET"],
         )
 
         app_mock.add_url_rule.assert_any_call(
-            "/2025-12-01/durable-executions/<durable_execution_arn>/stop",
+            "/2025-12-01/durable-executions/<path:durable_execution_arn>/stop",
             endpoint="stop_durable_execution",
             view_func=service._stop_durable_execution_handler,
             methods=["POST"],
         )
 
         app_mock.add_url_rule.assert_any_call(
-            "/2025-12-01/durable-execution-callbacks/<callback_id>/succeed",
+            "/2025-12-01/durable-execution-callbacks/<path:callback_id>/succeed",
             endpoint="send_callback_success",
             view_func=service._send_callback_success_handler,
             methods=["POST"],
         )
 
         app_mock.add_url_rule.assert_any_call(
-            "/2025-12-01/durable-execution-callbacks/<callback_id>/fail",
+            "/2025-12-01/durable-execution-callbacks/<path:callback_id>/fail",
             endpoint="send_callback_failure",
             view_func=service._send_callback_failure_handler,
             methods=["POST"],
         )
 
         app_mock.add_url_rule.assert_any_call(
-            "/2025-12-01/durable-execution-callbacks/<callback_id>/heartbeat",
+            "/2025-12-01/durable-execution-callbacks/<path:callback_id>/heartbeat",
             endpoint="send_callback_heartbeat",
             view_func=service._send_callback_heartbeat_handler,
             methods=["POST"],
@@ -1313,3 +1313,96 @@ def test_invoke_request_handler_combines_headers_with_durable_execution_arn(
             ),
         }
         service_response_mock.assert_called_once_with("hello world", expected_headers, 200)
+
+
+class TestDurableRoutingPercentEncodedSlash(TestCase):
+    """
+    Regression tests for #9039: Werkzeug's default ``<string>`` URL converter
+    rejects path segments containing ``/`` (decoded from ``%2F``), so a
+    ``DurableExecutionArn`` of the form ``<uuid>/<invocation-id>`` 404'd before
+    reaching the handler. The fix is the ``<path:...>`` converter.
+
+    These tests drive the real Flask app via its test client to assert that
+    boto-encoded ARNs (``%2F`` for ``/``) reach the correct handler with the
+    decoded value, and that the more-specific trailing-literal rule (``/history``
+    or ``/stop``) wins over the bare ``<path:arn>`` rule.
+    """
+
+    SLASH_ARN = "9a1bc86c-40b9-4688-86b4-d7ecaca41579/2a8bc667-bc0b-4b5e-8c78-26db9c5b4e33"
+    ENCODED_SLASH_ARN = "9a1bc86c-40b9-4688-86b4-d7ecaca41579%2F2a8bc667-bc0b-4b5e-8c78-26db9c5b4e33"
+
+    @patch("samcli.local.lambda_service.local_lambda_http_service.LocalLambdaHttpService._construct_error_handling")
+    def _build_service(self, error_handling_mock):
+        lambda_runner_mock = Mock()
+        service = LocalLambdaHttpService(lambda_runner=lambda_runner_mock, port=3000, host="127.0.0.1")
+        service.create()
+        return service
+
+    @patch.object(LocalLambdaHttpService, "_get_durable_execution_handler")
+    def test_get_durable_execution_routes_arn_with_slash(self, handler_mock):
+        handler_mock.return_value = ("ok", 200)
+        service = self._build_service()
+        client = service._app.test_client()
+
+        response = client.get(f"/2025-12-01/durable-executions/{self.ENCODED_SLASH_ARN}")
+
+        # Pre-fix: 404 PathNotFoundLocally because <string> won't match a segment with "/"
+        self.assertEqual(response.status_code, 200)
+        handler_mock.assert_called_once_with(durable_execution_arn=self.SLASH_ARN)
+
+    @patch.object(LocalLambdaHttpService, "_get_durable_execution_history_handler")
+    def test_get_durable_execution_history_routes_arn_with_slash(self, handler_mock):
+        handler_mock.return_value = ("ok", 200)
+        service = self._build_service()
+        client = service._app.test_client()
+
+        response = client.get(f"/2025-12-01/durable-executions/{self.ENCODED_SLASH_ARN}/history")
+
+        self.assertEqual(response.status_code, 200)
+        # Trailing literal /history must win over the bare <path:arn> rule.
+        handler_mock.assert_called_once_with(durable_execution_arn=self.SLASH_ARN)
+
+    @patch.object(LocalLambdaHttpService, "_stop_durable_execution_handler")
+    def test_stop_durable_execution_routes_arn_with_slash(self, handler_mock):
+        handler_mock.return_value = ("ok", 200)
+        service = self._build_service()
+        client = service._app.test_client()
+
+        response = client.post(f"/2025-12-01/durable-executions/{self.ENCODED_SLASH_ARN}/stop")
+
+        self.assertEqual(response.status_code, 200)
+        handler_mock.assert_called_once_with(durable_execution_arn=self.SLASH_ARN)
+
+    @parameterized.expand(
+        [
+            ("succeed", "_send_callback_success_handler"),
+            ("fail", "_send_callback_failure_handler"),
+            ("heartbeat", "_send_callback_heartbeat_handler"),
+        ]
+    )
+    def test_callback_routes_id_with_slash(self, action, handler_attr):
+        # Base64 callback IDs contain '/' which boto percent-encodes the same way.
+        decoded_id = "abc/def=="
+        encoded_id = "abc%2Fdef=="
+        with patch.object(LocalLambdaHttpService, handler_attr) as handler_mock:
+            handler_mock.return_value = ("ok", 200)
+            service = self._build_service()
+            client = service._app.test_client()
+
+            response = client.post(f"/2025-12-01/durable-execution-callbacks/{encoded_id}/{action}")
+
+            self.assertEqual(response.status_code, 200)
+            handler_mock.assert_called_once_with(callback_id=decoded_id)
+
+    @patch.object(LocalLambdaHttpService, "_get_durable_execution_handler")
+    def test_get_durable_execution_still_matches_uuid_only_arn(self, handler_mock):
+        # Backwards-compatibility: the old single-UUID form must still route.
+        handler_mock.return_value = ("ok", 200)
+        service = self._build_service()
+        client = service._app.test_client()
+
+        legacy_arn = "9a1bc86c-40b9-4688-86b4-d7ecaca41579"
+        response = client.get(f"/2025-12-01/durable-executions/{legacy_arn}")
+
+        self.assertEqual(response.status_code, 200)
+        handler_mock.assert_called_once_with(durable_execution_arn=legacy_arn)