✅ Local real-build verification — LGTM

I verified this PR at its head (e551368a8, base 61dcf865de) in an isolated worktree on three layers: a real-source A/B of uploadToCdn (driving the actual api.ts via tsx with a stubbed fetch, observing the exact URL it sends to), a real vitest mutation test, and a host-guard edge-case check. The pre-fix/fixed split is produced by reverting only api.ts to base (tsx transpiles on each run, so the source-revert is the mutation; mutant confirmed by lowerUrlOrParam count 3 → 0 → 3). Environment: macOS, Node v22.22.2.

Verdict: the fix is correct, the new tests genuinely guard it, there is no regression, and it makes the CDN host check apply uniformly to uppercase URLs. Safe to merge.

1. Real-source A/B — what uploadToCdn actually sends to fetch

Stubbed fetch to capture the request URL, then classified it: DIRECT = the CDN URL used as-is; WRAPPED = the input nested inside a new …?encrypted_query_param=<input> URL (the malformed request from #5438); THROWS = rejected before any fetch.

The three controls are identical on both sides → the change is scoped to uppercase/mixed-case schemes only, no regression. Pre-fix, an HTTPS:// CDN URL gets encodeURIComponent-nested into a brand-new encrypted_query_param=HTTPS%3A%2F%2F… URL — exactly the "malformed CDN request" the PR describes — and HTTP:// is silently uploaded instead of rejected.

2. Real vitest mutation test

FIXED   (PR head):   src/api.test.ts → 3 passed (3)   ; full weixin suite → 49 passed (49)
PRE-FIX (api.ts reverted, PR test kept): 3 failed (3)

All 3 new tests fail on pre-fix → they are non-vacuous and guard the fix. Notably the rejects uppercase HTTP test fails by timing out at ~5001ms — pre-fix doesn't reject HTTP://, it enters the real upload + retryWithBackoff path, which matches the WRAPPED routing above.

3. Host guard still enforced for uppercase URLs (no SSRF hole)

The PR claims "the direct URL path still enforces the exact Weixin CDN hostname." Confirmed on the fixed build:

This is actually a small security-positive: pre-fix, HTTPS://evil.com bypassed the host check entirely (it fell to the WRAPPED branch); post-fix it routes through the same new URL(...).hostname !== CDN_HOST gate as lowercase. The fix only lowercases for the scheme comparison — new URL() and the upload still use the original-case string, which is correct (URL/fetch normalize the scheme, and the host compare is case-insensitive via URL).

4. Minor, non-blocking note

The new tests cover HTTPS:// / HtTpS:// / HTTP://, but not an uppercase URL pointing at a wrong host (the host-guard-on-uppercase path). I verified that path works here; a dedicated regression row would be a nice follow-up, not a blocker.

FIXED   （PR head）：  src/api.test.ts → 3 passed (3)   ；weixin 全量 → 49 passed (49)
PRE-FIX （回退 api.ts、保留 PR 测试）： 3 failed (3)

_{Verified locally by a maintainer: real api.ts driven via tsx + real vitest, in an isolated worktree (pre-fix via source revert). Not an automated CI run.}

@qwen-code /triage

Thanks for the PR!

Template looks good ✓ — all required sections present, bilingual body included.

On direction: this is a straightforward correctness fix — URL schemes are case-insensitive per RFC 3986, and the code was doing a case-sensitive startsWith(). Clear bug. Well within scope for a channel integration fix.

On approach: the diff is tight — 2 lines changed in production code, plus regression tests. The approach of lowercasing the entire input for scheme comparison is simple and effective. The else branch (raw param path) correctly continues to use the original urlOrParam, so no case corruption there. The hostname check via new URL() already normalizes the host to lowercase, so that path is also safe.

One minor observation: the tests cover full URL inputs (uppercase HTTPS, mixed-case HTTPS, uppercase HTTP) but don't cover the raw-param path with mixed-case input. Not a blocker since that path is unchanged, but a one-liner test asserting that a raw param like AbCdEf produces the correct constructed URL would guard against future regressions in the lowercasing logic.

Moving on to code review and testing. 🔍

— Qwen Code · qwen3.7-max

Code Review

Independent proposal before reading the diff: lowercase the input for scheme comparison only, keep original for URL construction and param encoding. The PR's approach matches exactly.

The implementation is correct:

• lowerUrlOrParam is used only for the two startsWith() scheme checks — nothing else touches it
• urlOrParam (original) is preserved for url = urlOrParam and encodeURIComponent(urlOrParam) in the else branch
• new URL() normalizes hostname to lowercase, so parsed.hostname !== CDN_HOST is safe regardless of input casing
• No security issues — hostname validation still works correctly for mixed-case URLs

No blockers, no AGENTS.md violations. Clean, minimal change.

Testing

Non-TUI change (internal CDN upload logic), so tmux product testing doesn't apply. Ran the unit tests, build, and lint from the PR diff applied to main:

Unit tests (3/3 pass)

 RUN  v3.2.4

 ✓  @qwen-code/channel-weixin  src/api.test.ts (3 tests) 9ms

 Test Files  1 passed (1)
      Tests  3 passed (3)
   Duration  364ms

Build

> @qwen-code/[email protected] build
> tsc --build

(exit 0)

Lint

npx eslint packages/channels/weixin/src/api.ts packages/channels/weixin/src/api.test.ts
(no output, exit 0)

All checks green. ✅

— Qwen Code · qwen3.7-max

Clean fix, clean diff, clean tests. The change is 2 production lines that solve a real correctness bug (RFC 3986 says schemes are case-insensitive). The implementation matches the simplest possible approach — lowercase for comparison, preserve original everywhere else. Tests cover the regression cases. Build and lint green.

Approving. ✅

— Qwen Code · qwen3.7-max