fix(webapp): close the queued-reload race and the backslash route escape

Author: kathiekiwi

apps/webapp/app/components/dashboard-agent/DashboardAgentMessages.tsx

@@ -301,7 +301,8 @@ export function DashboardAgentTurns({
   // Must be the exact parts the turns render: the winners map keys by part index.
   const stripped = useMemo(() => messages.map(stripStepParts), [messages]);
 
-  // Must stay the last child of this fragment; see `progress-line.ts`.
+  // Must not go null mid-flight: null unmounts the line and it blinks. The error
+  // callout below legitimately renders after it.
   const progress = liveProgress(stripped, activity);
 
   const investigationWinners = useInvestigationWinners(stripped);

apps/webapp/app/components/dashboard-agent/coalesced-reload.test.ts

@@ -77,6 +77,22 @@ describe("createCoalescedReload", () => {
     expect(started).toBe(2);
   });
 
+  it("joins the queued run when a request lands as the run in front of it settles", async () => {
+    const c = controllable();
+    const reload = createCoalescedReload(c.run);
+
+    const first = reload();
+    // Runs in the window between the first run settling and the queued one starting.
+    void first.then(() => {
+      void reload();
+    });
+    void reload();
+
+    c.finish(0);
+    await settle();
+    expect(c.started).toBe(2);
+  });
+
   it("starts a fresh run once nothing is in flight", async () => {
     const c = controllable();
     const reload = createCoalescedReload(c.run);

apps/webapp/app/components/dashboard-agent/coalesced-reload.ts

@@ -17,8 +17,9 @@ export function createCoalescedReload(run: () => Promise<void>): () => Promise<v
   };
 
   return () => {
-    if (!inFlight) return start();
+    // Queued first: `inFlight` is cleared one microtask before the queued run starts.
     if (queued) return queued;
+    if (!inFlight) return start();
     // Settles either way: a failed run must not strand the queued one.
     const next = inFlight
       .catch(() => {})

apps/webapp/app/components/dashboard-agent/navigate-target.test.ts

@@ -57,6 +57,7 @@ describe("navigateDestination", () => {
 
   it("refuses a protocol-relative path, which would change host", () => {
     expect(navigateDestination({ path: "//evil.example/runs" })).toEqual({ kind: "none" });
+    expect(navigateDestination({ path: "/\\evil.example/runs" })).toEqual({ kind: "none" });
   });
 
   it("resolves to nothing when there is no target", () => {

apps/webapp/app/components/dashboard-agent/navigate-target.ts

@@ -48,7 +48,8 @@ export function navigateDestination(
   const target = resolved?.path;
   if (!target) return { kind: "none" };
 
-  const routable = !resolved?.external && target.startsWith("/") && !target.startsWith("//");
+  // `/\` too: a URL parser maps the backslash to a slash, so it leaves the origin.
+  const routable = !resolved?.external && target.startsWith("/") && !/^\/[/\\]/.test(target);
   if (routable) return { kind: "route", path: appendRunFilters(target, filters) };
 
   // Run filters belong to the runs page, so they are dropped rather than pushed onto a foreign URL.