fix: resolve ../ and strip titles in rewriteRelativeImagePaths

[hivecommons-hive]

Two bugs in rewriteRelativeImagePaths:

• ../ was forwarded verbatim, so the docs-image route rejected the URL (403). The src is now resolved against baseDir with inline posix-style normalisation; refs that escape docs/content are left unchanged.
• An optional CommonMark title was captured as part of the path (404). The title is now split off, only the destination is rewritten, and the title is re-emitted unchanged.

Absolute, /-rooted, data: and plain references behave as before. Tests and a changelog fragment added.

Closes #362

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for hivecommons-docs ready!

Name	Link
🔨 Latest commit	af2dc47
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6ad45178837e36348fc4ef80
😎 Deploy Preview	https://deploy-preview-363--hivecommons-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Logic looks correct to me; the only thing holding this back is the red TypeScript & ESLint check, which is a Prettier formatting failure, not a type/lint error.

What I verified (at 6f86f21):

• src/app/api/docs-image/[...path]/route.ts:33 rejects any path containing .. with 403, so the premise (forwarding ../ verbatim → 403) is real, and resolving against baseDir before emitting is the right fix.
• src/lib/rewriteImagePaths.ts:37-48: baseDir="hive/guides" + ../images/logo.png → [hive, images, logo.png]; a .. with an empty stack returns match unchanged, so refs that would escape docs/content are left alone rather than emitted as a 403 URL.
• Idempotence is preserved: the rewritten /docs-images/... output hits the startsWith("/") early return on a second pass (rewriteImagePaths.ts:29).
• Title split at rewriteImagePaths.ts:25 only matches \S+ followed by a quoted title, so destinations without a title (including ones containing spaces) fall through to the old behaviour.
• Caller src/app/docs/[...slug]/page.tsx:231-234 already passes a posix dirname ('' for root), matching the new baseDir.split("/") handling.
• npx vitest run src/__tests__/rewriteImagePaths.test.ts → 16/16 pass.

Blocker (CI): npm run format:check fails on both touched files. The only diff Prettier wants in src/lib/rewriteImagePaths.ts is wrapping the const parts = [...] line at :38 onto multiple lines (it exceeds the print width); the test file has similar wrapping. npx prettier --write src/lib/rewriteImagePaths.ts src/__tests__/rewriteImagePaths.test.ts and push would turn the check green. I can't push to the scanner/ branch from this lane.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: pushed prettier formatting fix for the TypeScript & ESLint check; CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: af2dc47

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the tree, not just the diff. This looks correct to me.

• The 403 mechanism is real: src/app/api/docs-image/[...path]/route.ts:33 rejects any path containing .., so the previous verbatim forwarding of ../images/x.png could never succeed. The new segment walk in src/lib/rewriteImagePaths.ts resolves against baseDir first and bails out (return match) only when .. would pop past the docs/content root — so ../x.png from hive/guides becomes /docs-images/hive/x.png, while ../x.png from "" is left alone, matching the tests.
• The only caller (src/app/docs/[...slug]/page.tsx:231-234) passes path.posix.dirname(fullRelPath) (or "" at root), so the split("/") normalisation gets posix input on every platform.
• Idempotence is preserved: the rewritten /docs-images/... destination begins with / and is skipped on a second pass, and the title suffix is re-emitted outside the destination so it does not get double-rewritten.

No findings from the correctness, security, intent, style or docs angles; the changelog fragment matches the behaviour change. Approval itself is a maintainer's call.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed (style) — approve; one advisory note.

• src/lib/rewriteImagePaths.ts:36 justifies the hand-rolled segment loop with "this module may run in the browser", but the only caller is the server component src/app/docs/[...slug]/page.tsx (imports fs/path, line 12-13, calls at line 234), and the repo already uses path.posix for this kind of normalisation (page.tsx, scripts/link-rewrite.ts, scripts/sync-sibling-docs.ts), which is also what #362 suggested. The implementation is fine either way; just reword the comment so a future maintainer isn't told a constraint that doesn't exist (or drop it). While there, the header doc at lines 2-8 still only describes images/ and ./images/ and could mention ../ resolution and title preservation.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#363af2dc47` sha256:5c8e5a81106ffa7fe06380df537c9b6dca1ab78eb31c4058b7988a9a70f9d651 — download from the dashboard or `hivectl review evidence #363`.