fix(projects): prevent invalid script IDs from crashing threads

[saphid]

What Changed

Prevent invalid project script IDs from crashing thread views and project settings. New script IDs are checked against the existing shortcut schema before the server emits an update. Previously saved IDs remain readable, editable, runnable and removable; unsupported shortcut commands return null instead of throwing.

Why

A saved ID such as install-javascript-dependencies passes the project schema but exceeds the shortcut schema's 24-character limit. Rendering the script menu then throws Expected a string matching template literal parts and replaces the entire thread with an error page. Validating only newly introduced IDs avoids locking users out of repairing existing scripts or replaying old events.

Verification

CI passed on 0543a40fe, including all server test shards, release smoke, Rust and the repository check job. Cursor Bugbot and all Macroscope checks passed with no actionable findings; Macroscope submitted an approval. CodeRabbit automatic review is disabled.

• Regression tests failed on the base with the exact crash and accepted invalid updates: 15 failures, 23 passes.
• vp test run apps/web/src/projectScripts.test.ts apps/web/src/lib/projectScriptKeybindings.test.ts apps/web/src/keybindings.test.ts apps/server/src/orchestration/decider.projectScripts.test.ts — 91 passed.
• vp exec tsgo --noEmit -p apps/web/tsconfig.json and -p apps/server/tsconfig.json — passed.
• Targeted formatting and lint on the eight changed files — passed; existing ChatView effect warnings remain.
• Disposable web app: reproduced the base crash, reopened the same thread with the same invalid ID after the fix, saved and ran the legacy action, edited it in project settings, verified persistence, then deleted it and verified the valid action remained. An invalid API update was rejected without changing saved scripts.

The server guard applies to all clients and connection modes; the rendering fix covers shared web/desktop UI. Native mobile and Electron-specific behavior were not exercised. HTTP retains its existing generic 500 response for command-invariant failures; the decider supplies the specific validation message. No wire or persisted-event schema changes.

UI Changes

Same synthetic project, script ID, dark theme and 1280×800 viewport. Before: upstream 363cde411; after: 0543a40fe. The action runs a harmless echo command.

Before: opening the thread crashes while building script shortcuts.

After: the thread opens and the same legacy action runs successfully.

Save and run the legacy action — 10-second web demo. Idle time removed; no playback speed change or timing claim.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for UI changes
• I included a video for the affected interaction

Implemented by Codex (OpenAI) in the T3 Code Codex harness. Independent review command: claude --model claude-opus-5 --effort high --tools '' -p …; it exited 1 because OAuth was expired, so no Claude review occurred.

---

Note

Medium Risk
Touches orchestration invariants and shared script/keybinding UI paths, but behavior is narrowly scoped to script ID validation and graceful null handling rather than auth or data migration.

Overview
Fixes thread crashes when a project has legacy script IDs (e.g. install-javascript-dependencies) that pass project storage but fail the 24-character shortcut command schema.

Server: project.meta.update now rejects newly introduced script IDs that cannot form a valid script.{id}.run keybinding command, while still allowing existing IDs to be edited, removed, or kept alongside valid additions.

Web: commandForProjectScript returns null instead of constructing an invalid command; keybinding helpers and script persistence accept a nullable command so script menus and threads render without throwing, with no shortcut label for unsupported IDs.

^{Reviewed by Cursor Bugbot for commit 0543a40. Bugbot is set up for automated code reviews on this repo. Configure here.}

Current-base verification

Updated to upstream main b2e15185aee22bfdee78806f2734b0a4de9c2c77 at 29e3cf42d2ff5ee18daa6b913d467b67c182c4a5. All 6 applicable focused verification commands passed (38 passing test executions). Earlier runtime observations and media retain their stated revisions and limitations; these fresh runs do not constitute new client recordings. Fresh independent Claude review is unavailable because its OAuth credentials have expired. Refreshed by GPT-6 Astra in the Codex harness.

Note

Reject invalid script IDs in project.meta.update decider and handle null commands in web client

• Adds a script-command schema matcher and max ID-length constant to the orchestration decider. During project.meta.update, only newly introduced script IDs are validated; persisted legacy IDs pass through so they can be edited or removed.
• commandForProjectScript in projectScripts.ts now returns a nullable command. IDs that don't match the script-run format produce no keybinding command, so legacy scripts without shortcuts still work.
• Web keybinding utilities (shortcutLabelForCommand, keybindingValueForCommand, decodeProjectScriptKeybindingRule) and the ChatView persistence callback accept null commands. Null commands yield null shortcuts and cannot be assigned a non-empty keybinding rule.
• Behavioral Change: newly submitted script IDs that fail the format check now raise an OrchestrationCommandInvariantError; existing persisted invalid IDs remain accepted but produce no shortcut command.

^{Macroscope summarized 29e3cf4.}

Latest-main refresh — 7 September 2026

Merged upstream main 08c715ed93f8a6bfd85d42f5a8b7dbe12404554d into the existing branch at 8ce906ce62539a4f0bd7a69d87133a52128aa47a. The contribution remains eight focused paths and is still absent from main.

Fresh verification on that exact head passed: 16 project-script decider tests, 22 web script/keybinding tests, server and web typechecks, scoped lint, scoped formatting, and git diff --check. Scoped lint retains only existing ChatView React effect warnings. Every current commandForProjectScript caller was reviewed for the nullable legacy-ID result; no actionable issue was found.

Earlier real-client evidence and media retain their recorded revisions and limitations; this refresh did not run a client or create new media. No fresh independent Claude review occurred because the known OAuth credential remains expired. Refreshed and self-reviewed by GPT-6 in the Codex harness.

Latest-base follow-up

After upstream advanced, merged pingdotgg/t3code@5b68b2c8e1e971e4ee6956157a1698646ef52a55 and pushed exact head 5b62d5a9d0383e1e16fa05832415a9c30b14400f. The additional upstream commit changes React Native mobile and shared orchestration timing paths, with no overlap in this contribution's eight files. On the final head, the 16 server tests and 22 web tests passed again; server and web package typechecks, scoped lint, formatting, and git diff --check also passed. Existing lint warnings in ChatView.tsx and Effect typecheck suggestions remain outside the contribution.

[macroscopeapp]

Approvability

Verdict: Approved at 0543a40

Macroscope's review found this PR approvable — This is a narrowly scoped fix for legacy project-script IDs, adding server validation and nullable shortcut handling while preserving existing valid and persisted scripts. The affected paths are well covered by targeted regression tests, with no schema, deployment, security, billing, default, or static-analysis changes.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 2da3a1cd-a945-46b5-bfc9-73f76c6748eb

📥 Commits

Reviewing files that changed from the base of the PR and between 08c715e and 8ce906c.

📒 Files selected for processing (8)

• apps/server/src/orchestration/decider.projectScripts.test.ts
• apps/server/src/orchestration/decider.ts
• apps/web/src/components/ChatView.tsx
• apps/web/src/keybindings.ts
• apps/web/src/lib/projectScriptKeybindings.test.ts
• apps/web/src/lib/projectScriptKeybindings.ts
• apps/web/src/projectScripts.test.ts
• apps/web/src/projectScripts.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The server now validates new project script IDs against the supported format while preserving existing legacy scripts. The web application represents unsupported script commands as null and handles them during shortcut labeling, decoding, persistence, and testing.

Changes

Project script compatibility

Layer / File(s)	Summary
Server script ID validation apps/server/src/orchestration/decider.ts, apps/server/src/orchestration/decider.projectScripts.test.ts	Project updates reject invalid new script IDs, accept IDs up to MAX_SCRIPT_ID_LENGTH, and preserve existing legacy scripts for editing and removal.
Nullable project script commands apps/web/src/projectScripts.ts, apps/web/src/projectScripts.test.ts, apps/web/src/components/ChatView.tsx, apps/web/src/keybindings.ts	commandForProjectScript returns null for unsupported IDs. Command persistence and shortcut labels accept nullable commands.
Legacy keybinding handling apps/web/src/lib/projectScriptKeybindings.ts, apps/web/src/lib/projectScriptKeybindings.test.ts	Keybinding lookup returns null for absent commands, while decoding rejects shortcut rules for legacy commands. Tests cover these cases.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 8ce90

Project scripts with unsupported legacy IDs no longer crash thread views or settings, while new invalid IDs are rejected without changing saved scripts. The covered validation and compatibility paths indicate no remaining merge-blocking risk.

Suggested reviewers: juliusmarminge, justsomelegs, t3dotgg

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 8 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing invalid script IDs from crashing thread views.
Description check	✅ Passed	The description covers the required What Changed, Why, UI Changes, and Checklist sections. It explains the validation behavior, legacy-ID handling, verification results, and UI evidence.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}