fix(tables): stop URL linkification at delimiters, not whitespace

[Abdulrehman-PIAIC80387]

📝 Summary

Closes #10567

The table-cell URL linkifier matched URLs with https?://\S+, so a URL embedded in JSON text had the trailing "}] delimiters swallowed into the href.

import polars as pl
pl.DataFrame({"attachments": ['[{"name":"inv.pdf","url":"https://example.com/p/AAA"}]']})

The rendered link pointed at https://example.com/p/AAA%22%7D] (the "}] percent-encoded into the href) instead of https://example.com/p/AAA.

🔍 Root cause

frontend/src/utils/url-parser.ts (the table linkifier used by data-table/columns.tsx):

const urlRegex = /(https?:\/\/\S+)/;

\S+ matches any non-whitespace, so with no whitespace before the closing "}] it keeps consuming those delimiters.

🔧 What changed

Match a URL up to the first character that cannot appear unencoded in a URL (RFC 3986 excluded/"unwise" set — whitespace and " ' < > \ { } | \ ^`) instead of any non-whitespace:

-const urlRegex = /(https?:\/\/\S+)/;
+const urlRegex = /(https?:\/\/[^\s"'<>`{}|\\^]+)/;

• Applied to the same greedy regex in json/json-parser.ts (the JSON-viewer link conversion), which had the identical bug.
• Deliberately keeps . , ( ) [ ] etc. valid — real URLs use them (query strings, IPv6 hosts like http://[::1]/, parenthesised paths), so they must not truncate the match.
• Left urls.ts's ^(https?://\S+)$ alone — it's an anchored whole-string isUrl() check where \S+ is correct.

🎥 Demo

clean-link.mp4

Shows the attachments cell: before, "Copy Link Address" yields https://example.com/p/AAA%22%7D]; after, it yields the clean https://example.com/p/AAA.

🧪 Testing

• Added regression tests in url-parser.test.ts for the reporter's JSON case and a trailing-quote case.
• Verified by mutation: reverting the regex to \S+ makes the new tests fail.
• data-table consumer tests (url-detector, columns) — 87 pass, no regressions.
• make fe-check (typecheck + lint) clean.
• Verified manually in make dev (before/after link address as above).

📋 Pre-Review Checklist

• For large changes, or changes that affect the public API: n/a — small, self-contained bug fix.
• Any AI generated code has been reviewed line-by-line by the human PR author, who stands by it.
• Video or media evidence is provided for any visual changes (optional).

✅ Merge Checklist

• I have read the contributor guidelines.
• Documentation has been updated where applicable — n/a.
• Tests have been added for the changes made.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marimo-docs	Ready	Preview	Aug 18, 2026 6:29am

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[mscolnick]

@cubic-dev-ai

[cubic-dev-ai]

@cubic-dev-ai

@mscolnick I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 3 files

Architecture diagram

sequenceDiagram
    participant UI as Data Table / JSON Viewer
    participant LP as Link Parser (url-parser.ts)
    participant JVP as JSON Value Parser (json-parser.ts)
    participant CT as Column Transformer (columns.tsx)

    Note over UI, CT: Runtime flow when rendering table cells or JSON viewer content

    UI->>CT: render cell(value)
    
    alt Cell is a table column
        CT->>LP: parseContent(textContent)
        LP->>LP: Extract URLs with safe delimiter regex<br/>([^\s"'<>`{}|\\^]+)
        LP-->>CT: Parts array (text + url objects)
        CT-->>UI: Rendered cell with links
    else Cell is JSON viewer content
        CT->>JVP: formatValueForMarkdown(jsonValue)
        JVP->>JVP: Convert plain URLs to markdown links<br/>using same safe delimiter regex
        JVP->>JVP: Apply markdown link replacement
        JVP-->>CT: Markdown string with links
        CT-->>UI: Rendered JSON viewer
    end

    Note over LP, JVP: Shared linkification behavior
    Note over LP: Regex stops at delimiters: " ' < > ` { } | \ ^
    Note over JVP: Same regex applied consistently
    Note over LP, JVP: Preserves valid URL chars: . , ( ) [ ] and query strings

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[Light2Dark]

I think would be good to add a benchmark test, regexes like this have a chance to be slow.

[kirangadhave]

Thanks @Abdulrehman-PIAIC80387 for the PR.
I might close this. I have a separate fix for parsing stringified JSON in the cells. That might make this PR moot. I'll verify. If there is still a need after that fix, we can keep this.