fix(qa): sanitize evidence preview roots

vincentkoc · vincentkoc · commit 3518fa575a2f · 2026-06-20T04:17:12.000+02:00
diff --git a/extensions/qa-lab/src/evidence-gallery.test.ts b/extensions/qa-lab/src/evidence-gallery.test.ts
@@ -181,7 +181,11 @@ describe("evidence gallery", () => {
     const outputDir = path.join(repoRoot, ".artifacts", "qa-e2e", "vitest");
     const artifactPath = path.join(outputDir, "absolute.log");
     await fs.mkdir(outputDir, { recursive: true });
-    await fs.writeFile(artifactPath, "absolute artifact\n", "utf8");
+    await fs.writeFile(
+      artifactPath,
+      `absolute artifact ${repoRoot}\nfile://${repoRoot}/trace.log\n`,
+      "utf8",
+    );
     const evidence: QaEvidenceSummaryJson = vitestArtifactEvidence({
       id: "qa-lab.absolute-artifact-path",
       title: "Absolute artifact path",
@@ -205,7 +209,7 @@ describe("evidence gallery", () => {
     expect(artifact).toMatchObject({
       exists: true,
       path: ".artifacts/qa-e2e/vitest/absolute.log",
-      preview: "absolute artifact\n",
+      preview: "absolute artifact <repo-root>\nfile://<repo-root>/trace.log\n",
     });
     expect(artifact?.href).toContain(
       "artifactPath=%3Crepo-root%3E%2F.artifacts%2Fqa-e2e%2Fvitest%2Fabsolute.log",
diff --git a/extensions/qa-lab/src/evidence-gallery.ts b/extensions/qa-lab/src/evidence-gallery.ts
@@ -104,6 +104,16 @@ function displayGalleryPath(
   return sanitizeGalleryText(value, params);
 }
 
+function sanitizeGalleryPreview(
+  value: string | null,
+  params: {
+    extraRoots?: readonly string[];
+    repoRoot: string;
+  },
+) {
+  return value === null ? null : sanitizeGalleryText(value, params);
+}
+
 async function realpathIfExists(filePath: string): Promise<string | null> {
   return fs.realpath(filePath).catch(() => null);
 }
@@ -356,6 +366,7 @@ function artifactHref(evidencePath: string, artifactPath: string) {
 async function buildProducerContextFile(params: {
   allowedRoots: readonly string[];
   artifactPath: string;
+  extraRoots: readonly string[];
   filePath: string;
   hrefEvidencePath: string;
   previewKind: "json" | "text";
@@ -369,7 +380,14 @@ async function buildProducerContextFile(params: {
   return {
     href: artifactHref(params.hrefEvidencePath, params.artifactPath),
     path: repoPath,
-    preview: await readPreview(realFile, params.previewKind).catch(() => null),
+    preview: await readPreview(realFile, params.previewKind)
+      .then((preview) =>
+        sanitizeGalleryPreview(preview, {
+          extraRoots: params.extraRoots,
+          repoRoot: params.repoRoot,
+        }),
+      )
+      .catch(() => null),
   };
 }
 
@@ -422,9 +440,19 @@ async function buildArtifactView(params: {
     kind: params.artifact.kind,
     mediaKind,
     path: displayPath,
-    preview: await readPreview(realFile, mediaKind).catch(
-      (error: unknown) => `Preview unavailable: ${formatErrorMessage(error)}`,
-    ),
+    preview: await readPreview(realFile, mediaKind)
+      .then((preview) =>
+        sanitizeGalleryPreview(preview, {
+          extraRoots: params.extraRoots,
+          repoRoot: params.repoRoot,
+        }),
+      )
+      .catch((error: unknown) =>
+        sanitizeGalleryText(`Preview unavailable: ${formatErrorMessage(error)}`, {
+          extraRoots: params.extraRoots,
+          repoRoot: params.repoRoot,
+        }),
+      ),
     source: params.artifact.source,
   };
 }
@@ -603,6 +631,7 @@ async function findUxMatrixProducerRoot(params: {
 
 async function buildProducerContext(params: {
   evidencePath: string;
+  extraRoots: readonly string[];
   hrefEvidencePath: string;
   repoRoot: string;
   summaryEntries: readonly QaEvidenceSummaryEntry[];
@@ -632,6 +661,7 @@ async function buildProducerContext(params: {
         await buildProducerContextFile({
           allowedRoots,
           artifactPath: toRepoRelativePath(repoRoot, producerPaths[file.key]),
+          extraRoots: params.extraRoots,
           filePath: producerPaths[file.key],
           hrefEvidencePath: params.hrefEvidencePath,
           previewKind: file.previewKind,
@@ -784,6 +814,7 @@ export async function buildQaEvidenceGalleryModel(params: {
     profile: summary.profile ?? null,
     producerContext: await buildProducerContext({
       evidencePath,
+      extraRoots: [requestedRepoRoot],
       hrefEvidencePath,
       repoRoot,
       summaryEntries: summary.entries,
