chore: add schema and shell formatting script - #10

Decode encoded URL forms before blocked-scheme checks so obfuscated payloads like `java
script:` and `java%0Ascript:` are stripped during Mermaid SVG sanitization.

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh` • Cost: `$0.01`_

<!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh costs=0.01 -->

## Summary
Fix renderer XSS exposure in diff and markdown diagram paths by removing
unsafe filename HTML rendering in `HunkViewer` and hardening Mermaid SVG
insertion.

## Background
A filename from workspace/repository content was being transformed into
HTML and injected via `dangerouslySetInnerHTML` in `HunkViewer`. Because
filenames are attacker-controlled, this enabled immediate XSS when
viewing a crafted diff. Given renderer-accessible privileged surfaces,
that XSS materially increased impact.

## Implementation
- Replaced filename highlight HTML strings in `HunkViewer` with safe
React element rendering (`<mark>` nodes) so React escaping remains in
effect.
- Removed `dangerouslySetInnerHTML` usage for `hunk.filePath` display.
- Hardened Mermaid rendering:
  - switched Mermaid config from `securityLevel: "loose"` to `"strict"`
- added `sanitizeMermaidSvg()` and route all rendered SVG through it
before `innerHTML` assignment
- removed active containers (`script`, `iframe`, `object`, `embed`) and
stripped inline event handlers / dangerous URL schemes from URL-bearing
attributes
- canonicalized encoded URL values before scheme checks (decodes
entity/percent encodings and strips control/whitespace obfuscation) so
payloads like `java&#10;script:` are blocked
- guarded numeric entity decoding against invalid Unicode code points so
crafted values cannot throw during sanitization
- preserved `<foreignObject>` nodes so Mermaid wrapped labels continue
to render
- Added explicit `SECURITY AUDIT` comments at unavoidable HTML sinks to
document trust boundaries.
- Added `Mermaid.sanitization.test.ts` to verify malformed SVG
rejection, active-content stripping, encoded-scheme blocking,
invalid-entity handling, and label preservation.
- Added a new `Security: Renderer HTML & XSS` section in
`docs/AGENTS.md` to codify safe patterns.

## Validation
- `make static-check` (before initial push)
- `bun test
src/browser/components/Messages/Mermaid.sanitization.test.ts`
- `make static-check` (after foreignObject-label follow-up)
- `bun test
src/browser/components/Messages/Mermaid.sanitization.test.ts`
- `make static-check` (after encoded-scheme canonicalization follow-up)
- `bun test
src/browser/components/Messages/Mermaid.sanitization.test.ts`
- `make static-check` (after invalid-entity guard follow-up)

## Risks
- Mermaid `securityLevel: "strict"` may reduce support for some diagram
features that relied on looser behavior (especially scriptable/unsafe
links), but this is intentional hardening.
- Sanitization is defense-in-depth; if Mermaid output format changes
significantly, sanitizer assumptions should be revisited.

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking:
`xhigh` • Cost: `$0.01`_

<!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh
costs=0.01 -->

…RY, tests

Batch 1 — Compile Errors & Correctness:
- Add TOGGLE_KANBAN to KEYBIND_LABELS and KEYBIND_GROUPS (coder#1)
- Fix Ctrl+K conflict → Ctrl+Shift+K to avoid PREV_WORKSPACE collision (coder#2)
- Add TOGGLE_KANBAN dispatch handler in App.tsx (coder#3)
- Fix dirty-cache in promoteQueuedTask: move flag clearing after moveTask (coder#5)
- Wrap 4 IPC helpers in KanbanBoard with try/catch (coder#4)

Batch 2 — Consistency & DRY:
- Deduplicate KanbanColumnSchema: import from canonical orpc/schemas (coder#6)
- Remove unused KanbanBoardData import from kanbanStorage.test (coder#7)
- Remove dead KANBAN_STORAGE_KEYS constant (coder#8)
- Replace console.warn with log helper in kanbanStorage (coder#9)
- Replace useEffect form reset with key prop in TaskDetailModal (coder#10)
- Remove unsafe {} as KanbanTask cast, use EMPTY_FORM pattern (coder#11)
- Add loading state + error logging to KanbanView (coder#12, coder#13)
- Add KANBAN_STATUS_LABELS helper, use in TaskDetailModal (coder#14)
- Validate column membership in reorderTasks (coder#15)
- Use KanbanTaskPriority type import in TaskCreateModal (coder#16)

Batch 3 — Tests:
- Add 4 tests for updateColumn (coder#17)
- Add 3 tests for promoteQueuedTask (coder#18)
- Rename misleading test 'rejects empty title' → 'accepts empty title' (coder#19)

43 tests pass (was 36). No typecheck or lint regressions.

…r#4017)

## Summary

Splits the 4,131-line `Config` god-class (`src/node/config.ts`, 178
importing files) into five focused stores with narrow contracts under
`src/node/config/`: `Config` (app config.json + workspace metadata
only), `WorkspaceSessionLocator` (path layout + `getSessionDir`),
`ProvidersConfigStore` (providers.jsonc load/save/fingerprint/watcher +
its named file locks), `SecretsStore` (secrets.json + inheritance), and
`FileLeaseManager` (dir locks + Coder OAuth client lease). Services now
inject only the store they use. Strictly behavior-preserving: no on-disk
format or path changes, and existing `~/.xum` data loads with no
migration.

## Background

Refactor coder#10 of 10 from the 2026-08-29 architecture review (evidence at
main @ f04e0f8). Config was a wide, shallow interface: every consumer
imported the whole class, unit tests dragged in watchers and locks, and
single-method consumers (e.g. session-path stores) could not take a
narrow test double.

## Implementation

- `git mv src/node/config.ts src/node/config/index.ts`, then per-cluster
extraction commits so each commit compiles: leases + providers, secrets,
session locator, then a `createConfigStores(rootDir?)` factory wired
through the entry points (desktop main, cli server/run/workflow, bench)
and serviceContainer/coreServices/orpc context.
- No facade: extracted methods were deleted from `Config` in the same
commit that rewired their callers; there are no delegation methods and
no `config.<store>` handles. `Config` keeps its own dependencies
(locator for the legacy `sessions/<id>/metadata.json` fallback;
providers store for `seedRoutePriorityFromProviders`).
- Single-cluster consumers now type against
`Pick<WorkspaceSessionLocator, "sessionsDir">` or the store class
instead of `Config`; the providers/oauth services inject
`ProvidersConfigStore` directly.
- Test landscape reshaped: per-store test files, table-driven
consolidation of near-duplicate corruption/migration/override cases, and
deletion of mock-heavy pass-through harnesses that only re-asserted the
old structure. Review-round commits updated the remaining AgentSession
and ORPC harnesses to supply the narrow locator/store contracts.

## Net LOC (vs main @ f04e0f8)

- Production: **+127** (+1430 / -1303)
- Tests: **-365** (+1951 / -2316)
- Total: **-238** (117 files, +3381 / -3619)

Irreducible production additions, per item:

- Class/module scaffolding for the four extracted stores (imports, class
headers, constructors) that previously shared one file's overhead.
- `createConfigStores` factory plus explicit store wiring in five entry
points and the service containers, replacing implicit "pass the one
Config everywhere" plumbing.
- Constructor seams in services that previously reached through `Config`
(e.g. providers store injection in provider/oauth/workspace services).

## Validation

- `make static-check` green; full `bun test src tests/ipc` sweep on the
final head: 13,711 pass across 807 files, with only failures that also
reproduce on clean main at the merge base (verified against a baseline
worktree at f04e0f8).
- Remote dogfood UAT (2 rounds via Coder Agents) endorsed **PASS** on
this exact head: app settings persistence across restart, provider hot
reload + editor-conflict save round trip, runtime secret-reference
resolution into a live workspace env, lock behavior under concurrent
provider writes (no errors, no leftover lock dirs), legacy metadata.json
fallback, and a before/after `~/.xum` filesystem inventory showing no
new paths.

## Risks

Widest-blast-radius refactor of the fleet (~104 files). Main regression
surfaces: config edit serialization + corrupt-file recovery (queue and
guard logic moved intact within `Config`), providers watcher lifecycle
(now owned by `ProvidersConfigStore`; still a single watcher instance
held by the container), and lock TTL semantics (moved verbatim into
`FileLeaseManager`). All three are covered by the migrated per-store
tests, and UAT exercised the watcher and locks against a real build.

---

_Generated with `xum` • Model: `anthropic:claude-fable-5` • Thinking:
`xhigh` • Cost: `$60.54`_

<!-- mux-attribution: model=anthropic:claude-fable-5 thinking=xhigh
costs=60.54 -->

## Stack

Layer 10/10 of the architecture refactor stack (net -5,101 LOC overall).
This PR's diff is only this layer, against
`mike/arch-store-transport-split`.