refactor: address comments.

Author: knightedcodemonkey

playwright/app.spec.ts

@@ -30,6 +30,8 @@ type PullRequestCreateBody = {
 const waitForAppReady = async (page: Page, path = appEntryPath) => {
   await page.goto(path)
   await expect(page.getByRole('heading', { name: '@knighted/develop' })).toBeVisible()
+  await expect(page.locator('#cdn-loading')).toHaveAttribute('hidden', '')
+  await expect.poll(() => page.locator('#status').textContent()).not.toBe('Idle')
 }
 
 const waitForInitialRender = async (page: Page) => {
@@ -702,6 +704,37 @@ test('Open PR drawer validates unsafe filepaths', async ({ page }) => {
   await expect(page.locator('#clear-confirm-dialog')).not.toHaveAttribute('open', '')
 })
 
+test('Open PR drawer allows dotted file segments that are not traversal', async ({
+  page,
+}) => {
+  await waitForAppReady(page, `${appEntryPath}?feature-ai=true`)
+  await connectByotWithSingleRepo(page)
+  await ensureOpenPrDrawerOpen(page)
+
+  await page.locator('#github-pr-component-path').fill('docs/v1.0..v1.1/App.tsx')
+  await page.locator('#github-pr-styles-path').fill('styles/foo..bar.css')
+  await page.locator('#github-pr-submit').click()
+
+  await expect(page.locator('#clear-confirm-dialog')).toHaveAttribute('open', '')
+  await expect(page.locator('#github-pr-status')).not.toContainText(
+    'File path cannot include parent directory traversal.',
+  )
+})
+
+test('Open PR drawer rejects trailing slash file paths', async ({ page }) => {
+  await waitForAppReady(page, `${appEntryPath}?feature-ai=true`)
+  await connectByotWithSingleRepo(page)
+  await ensureOpenPrDrawerOpen(page)
+
+  await page.locator('#github-pr-component-path').fill('src/components/')
+  await page.locator('#github-pr-submit').click()
+
+  await expect(page.locator('#github-pr-status')).toContainText(
+    'Component path: File path must include a filename (no trailing slash).',
+  )
+  await expect(page.locator('#clear-confirm-dialog')).not.toHaveAttribute('open', '')
+})
+
 test('renders default playground preview', async ({ page }) => {
   await waitForInitialRender(page)
 

src/modules/github-api.js

@@ -545,9 +545,14 @@ const requestGitHubJson = async ({
   signal,
   allowNotFound = false,
 }) => {
+  const headers = {
+    ...buildRequestHeaders(token),
+    ...(body ? { 'Content-Type': 'application/json' } : {}),
+  }
+
   const response = await fetch(url, {
     method,
-    headers: buildRequestHeaders(token),
+    headers,
     body: body ? JSON.stringify(body) : undefined,
     signal,
   })
@@ -636,13 +641,15 @@ export const getRepositoryFileMetadata = async ({
 const toUtf8Base64 = value => {
   const encoder = new TextEncoder()
   const bytes = encoder.encode(value)
-  let binary = ''
+  const chunkSize = 0x8000
+  const chunks = []
 
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte)
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    const chunk = bytes.subarray(offset, offset + chunkSize)
+    chunks.push(String.fromCharCode(...chunk))
   }
 
-  return btoa(binary)
+  return btoa(chunks.join(''))
 }
 
 const isMissingShaForExistingFileError = error => {

src/modules/github-byot-controls.js

@@ -193,6 +193,16 @@ export const createGitHubByotControls = ({
   }
 
   const clearRepoOptions = placeholderLabel => {
+    if (repoSelect instanceof HTMLSelectElement) {
+      repoSelect.replaceChildren(
+        createDefaultRepoOption({
+          label: placeholderLabel,
+          disabled: true,
+        }),
+      )
+      repoSelect.disabled = true
+    }
+
     if (typeof onWritableRepositoriesChange === 'function') {
       onWritableRepositoriesChange({
         repositories: [],

src/modules/github-pr-drawer.js

@@ -71,7 +71,13 @@ const validateFilePath = value => {
     }
   }
 
-  if (path.includes('..')) {
+  if (path.endsWith('/')) {
+    return { ok: false, reason: 'File path must include a filename (no trailing slash).' }
+  }
+
+  const segments = path.split('/').filter(Boolean)
+
+  if (segments.some(segment => segment === '..')) {
     return { ok: false, reason: 'File path cannot include parent directory traversal.' }
   }
 
@@ -83,7 +89,6 @@ const validateFilePath = value => {
     }
   }
 
-  const segments = path.split('/').filter(Boolean)
   if (segments.length === 0 || segments.some(segment => segment === '.' || !segment)) {
     return { ok: false, reason: 'File path is invalid.' }
   }
@@ -99,7 +104,7 @@ const sanitizeBranchPart = value => {
 
   return trimmed
     .replace(/[^a-z0-9._/-]/g, '-')
-    .replace(/\/+/, '/')
+    .replace(/\/+/g, '/')
     .replace(/-{2,}/g, '-')
     .replace(/^[-/.]+|[-/.]+$/g, '')
 }