👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

reviews:
  auto_review:
    drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

@jules Fresh causal security finding on current BiDi hardening lane. I added test-first commit 3cf2442193eb7a31267c1cdace463e244703d81c with BidiIsolationSecurityTest: an attacker-controlled filename containing U+2069 PDI followed by U+202E RLO must not appear as raw directional controls in generated visible/title text, while the href must still address the exact underlying path. Unicode UAX #9 BD9 says the first PDI that decrements the isolate counter to zero is the matching PDI, so the current FSI + raw filename + PDI wrapper can be terminated by a filename-supplied PDI; a following override can then escape the intended text isolation. W3C also recommends markup/isolation for user-generated unknown-direction text rather than relying on embedded controls alone.

Please repair by ordinary descendant, preserving the exact path in URL encoding but neutralizing user-supplied bidirectional formatting controls for display/title contexts before the outer isolation is applied. Cover at least U+061C, U+200E/U+200F, U+202A..U+202E and U+2066..U+2069. Prefer rendering those controls visibly (for example \\u2069) rather than silently changing the filesystem path. Keep ordinary Arabic/Hebrew/CJK/LTR text unchanged. Do not weaken escaping, URL encoding, CSP, symlink checks, or the new regression; remove the generic .jules/sentinel.md doctrine delta rather than treating it as security evidence. GREEN is the focused regression plus existing suite on one exact descendant; browser/a11y evidence is still required before Ready.

@jules Fresh causal security finding on current BiDi hardening lane. I added test-first commit 3cf2442193eb7a31267c1cdace463e244703d81c with BidiIsolationSecurityTest: an attacker-controlled filename containing U+2069 PDI followed by U+202E RLO must not appear as raw directional controls in generated visible/title text, while the href must still address the exact underlying path. Unicode UAX #9 BD9 says the first PDI that decrements the isolate counter to zero is the matching PDI, so the current FSI + raw filename + PDI wrapper can be terminated by a filename-supplied PDI; a following override can then escape the intended text isolation. W3C also recommends markup/isolation for user-generated unknown-direction text rather than relying on embedded controls alone.

Please repair by ordinary descendant, preserving the exact path in URL encoding but neutralizing user-supplied bidirectional formatting controls for display/title contexts before the outer isolation is applied. Cover at least U+061C, U+200E/U+200F, U+202A..U+202E and U+2066..U+2069. Prefer rendering those controls visibly (for example \\u2069) rather than silently changing the filesystem path. Keep ordinary Arabic/Hebrew/CJK/LTR text unchanged. Do not weaken escaping, URL encoding, CSP, symlink checks, or the new regression; remove the generic .jules/sentinel.md doctrine delta rather than treating it as security evidence. GREEN is the focused regression plus existing suite on one exact descendant; browser/a11y evidence is still required before Ready.

Acknowledged. I've updated the escapeHtml function to neutralize user-supplied bidirectional formatting controls (ALM, LRM, RLM, LRE, RLE, PDF, LRO, RLO, LRI, RLI, FSI, PDI) by rendering them visibly as their unicode escape sequence representations (e.g., \u2069). This prevents these raw controls from terminating the intended isolation while maintaining the correct URL encoding for the actual underlying path link. I've successfully verified this fix passes the embeddedBidiControlsCannotTerminateGeneratedIsolation test and the rest of the existing suite.