fix(github): permit a whitespace-only path component

safeUrlPath rejected a path component made only of spaces. That check had no
security value and a real cost: git tracks both a file and a directory whose
entire name is spaces, so a valid GitHub file could not be read, updated, or
deleted.

A whitespace-only segment is not a dot segment, and the parser never removes it:

  new URL('https://x/a/%20%20%20/b').pathname  =>  /a/%20%20%20/b   (kept)
  new URL('https://x/a/../b').pathname         =>  /b              (removed)

Only a truly empty component (a `//`, where the caller wrote no name at all) is
rejected now. Dot-segment and backslash rejection are unchanged.

safeUrlPathSegment still rejects an all-whitespace value. That asymmetry is
correct: it trims opaque ids first, so one made only of spaces has named
nothing.

The TSDoc records why the check is absent, citing the git paths and the parser
behaviour, so it is not restored on aesthetic grounds.

Author: waleedlatif1

apps/sim/tools/github/path_safety.test.ts

@@ -91,14 +91,19 @@ const MULTI_SEGMENT_PARAMS = new Set(['path', 'branch', 'ref', 'base', 'head'])
 
 /**
  * Filenames whose own leading, trailing, or interior spaces are content, not
- * padding. Git tracks all three verbatim, so trimming any of them would make
+ * padding. Git tracks all of these verbatim, so trimming any of them would make
  * `update_file` and `delete_file` act on a different file than the caller named
  * — a silent wrong-target write, which is why `safeUrlPath` does not trim.
+ *
+ * The last entry is a directory whose entire name is spaces. It is a legal git
+ * path and `%20%20%20` is never normalized away, so rejecting it would only
+ * make a real file unreachable.
  */
 const WHITESPACE_PATHS: ReadonlyArray<readonly [string, string]> = [
   ['docs/my file .txt', 'docs/my%20file%20.txt'],
   ['docs/ leading.md', 'docs/%20leading.md'],
   ['docs/trailing.md ', 'docs/trailing.md%20'],
+  ['docs/   /file.txt', 'docs/%20%20%20/file.txt'],
 ]
 
 /**

apps/sim/tools/url-path.test.ts

@@ -377,8 +377,28 @@ describe('whitespace handling differs by purpose', () => {
     expect(decodeURIComponent(url.pathname)).toBe('/repos/o/r/contents/docs/my file .txt')
   })
 
-  it('still rejects a segment that is only whitespace', () => {
-    expect(() => safeUrlPath('docs/   /file.md', 'path')).toThrow(/whitespace-only path segment/)
+  it.each([
+    ['docs/   /file.txt', 'docs/%20%20%20/file.txt'],
+    ['   ', '%20%20%20'],
+    ['e/   /f.txt', 'e/%20%20%20/f.txt'],
+    ['d/   ', 'd/%20%20%20'],
+  ])('permits the whitespace-only component in %j', (value, expected) => {
+    expect(safeUrlPath(value, 'path')).toBe(expected)
+  })
+
+  it('round-trips a whitespace-only component through the URL parser', () => {
+    const url = new URL(`${ORIGIN}/repos/o/r/contents/${safeUrlPath('docs/   /file.txt', 'path')}`)
+
+    expect(url.pathname).toBe('/repos/o/r/contents/docs/%20%20%20/file.txt')
+    expect(decodeURIComponent(url.pathname)).toBe('/repos/o/r/contents/docs/   /file.txt')
+  })
+
+  it('rejects only a truly empty component', () => {
+    expect(() => safeUrlPath('docs//file.txt', 'path')).toThrow(/empty path segment/)
+  })
+
+  it('still rejects an opaque id that is only whitespace, since it trims first', () => {
+    expect(() => safeUrlPathSegment('   ', 'edgeConfigId')).toThrow(/edgeConfigId is required/)
   })
 
   it('still rejects a dot segment inside a path', () => {

apps/sim/tools/url-path.ts

@@ -243,8 +243,33 @@ export function safeUrlPathSegment(value: string | number | bigint, paramName: s
  * 404 for a file that does not exist rather than a quiet success against the
  * wrong one.
  *
- * A segment that is *only* whitespace is still rejected: it names nothing the
- * caller could have meant, and it is indistinguishable from the `//` case above.
+ * A segment that is only whitespace is **permitted**, for the same reason the
+ * rest of the value is not trimmed, and the temptation to reject it on the
+ * grounds that it "names nothing" should be resisted. It names something: git
+ * tracks a file and a directory whose entire name is spaces, exactly as typed.
+ *
+ * ```
+ * $ git ls-files | sed -n 'l'   # `l` makes the line ends visible
+ * d/   $
+ * e/   /f.txt$
+ * ```
+ *
+ * And rejecting it would buy nothing, because a whitespace-only segment is not
+ * a dot segment and the parser never removes it — the encoded form survives
+ * intact, where a dot segment does not:
+ *
+ * ```
+ * new URL('https://x/a/%20%20%20/b').pathname // => '/a/%20%20%20/b'  (kept)
+ * new URL('https://x/a/../b').pathname        // => '/b'              (removed)
+ * ```
+ *
+ * So the check would carry no security value and a real cost: a legitimate file
+ * that could not be read, updated, or deleted. Only a *truly* empty component
+ * — the `//` case above, where the caller wrote no name at all — is rejected.
+ *
+ * {@link safeUrlPathSegment} does still reject an all-whitespace value, and
+ * that asymmetry is correct rather than an oversight: it trims first, so an
+ * opaque id of only spaces really has named nothing.
  *
  * Not trimming also does not weaken the dot-segment check, which compares the
  * raw segment. A space-wrapped dot segment needs no rejection because encoding
@@ -271,7 +296,7 @@ export function safeUrlPathSegment(value: string | number | bigint, paramName: s
  * @returns The trimmed path with every segment percent-encoded and the `/`
  *   separators preserved, safe to interpolate.
  * @throws If the value is not a string or a usable number, is empty, contains
- *   an empty or whitespace-only segment, contains a dot segment, contains a
+ *   a truly empty segment (a `//`), contains a dot segment, contains a
  *   backslash, or cannot be encoded.
  */
 export function safeUrlPath(value: string | number | bigint, paramName: string): string {
@@ -288,8 +313,8 @@ export function safeUrlPath(value: string | number | bigint, paramName: string):
   return path
     .split('/')
     .map((segment) => {
-      if (!segment.trim()) {
-        throw new Error(`${paramName} cannot contain an empty or whitespace-only path segment`)
+      if (!segment) {
+        throw new Error(`${paramName} cannot contain an empty path segment`)
       }
 
       if (segment === '.' || segment === '..') {