fix(shared): cite assistant messages with IDs over 512 characters#28084

Problem

Citing text from some assistant messages put the raw link [Assistant quote](t3-citation://v1/…) in the composer instead of a quote chip, with no comment field, and it stayed raw text in the sent message. The citation schema capped each ID at 512 characters, but Pi assistant message IDs nest the thread and run IDs and percent-encode them again at every level, so they grow past 512. The link was built without the check, and then failed to parse without any error.

Reproduced on main (a24ec905c8) in a fresh web dev server (T3CODE_DEV_SEED=0). With Pi (Claude Opus 5.5), a reply in a project's default thread:project:<uuid>:<uuid> thread (88-character thread ID) got a 533-character message ID. Selecting its text and clicking Cite inserted the raw link with no chip and no comment field. The control was a Pi reply with a 381-character ID in a thread with a 36-character ID, and it got the chip and comment field.

Change

• AssistantCitation now caps environmentId, threadId and messageId at a shared ASSISTANT_CITATION_MAX_ID_LENGTH of 4,096, up from 512.
• The longest href the parser accepts is now computed from every bounded field: text, comment, three IDs and the two context strings, each at the 9-characters-per-UTF-16-unit worst case for percent-encoding, plus 1,000 for the keys and offsets. The old fixed 16k allowance for selectors is gone. Any citation the schema accepts therefore fits under the link limit, so Cite cannot build a link the parser rejects.
• The link format is unchanged, and existing links parse exactly as before. Raw links saved by earlier builds now render as chips.

Scope and approval

Fixes pingdotgg/t3code#28075

This was triaged through the automated issue flow.

Verification

• Red test first: round-trips citations of provider messages whose IDs nest the thread ID in packages/shared/src/assistantCitations.test.ts. It uses a Pi-style message ID of 631 characters that nests an 88-character thread ID. On main, collectAssistantCitations returns [] for the serialized link:

  1	FAIL packages/shared/src/assistantCitations.test.ts > assistant citation references > round-trips citations of provider messages whose IDs nest the thread ID
  2	AssertionError: expected [] to deeply equal [ { …(4) } ]

  It passes with the fix. The test for the largest possible citation ("accepts complete 8k CJK quotes and comments with maximum-sized source selectors") now uses 4,096-character IDs, so it still covers the real maximum.
• vp test run packages/shared/src/assistantCitations.test.ts: 21/21 pass. vp run check:changed passes (format, lint, knip, typecheck of 35 packages, tests).
• Runtime check in the real app, using the same dev server and data as the reproduction, with the fix loaded:
  • Cite on the 533-character Pi message now shows the quote chip and the "Add an optional comment…" field.
  • The raw link saved as a draft on main now renders as a chip in the composer.
  • I added the comment "Which animal containers are mentioned?" and sent the message. It renders as a chip in the sent message.
• Regex: the CITATION_LINK pattern only had its upper bound raised (about 160k to 256,168 characters). It has no nested quantifiers. Malformed inputs of 3,000 tokens take under 0.5 ms; a single unclosed 300k-character link takes about 8 ms. Time grows linearly with input length.
• Not changed here: what the provider receives. The server sends citation links to providers as they are, whatever the ID length. That is the existing pingdotgg/t3code#16327 and is not fixed by this PR.
• Not checked:
  • Before/after screenshots are not attached.
  • The native mobile quote block was not captured. Mobile uses the same shared parser through renderAssistantCitationsAsText.
  • IDs over 4,096 characters still fall back to the raw link. No such ID has been seen; the longest the reporter saw was 684.

Claude Opus 5.5 (Claude Code in T3 Code), with review by GPT-6.1-Sol (Codex) and Claude Opus 5.5.

Takeover

No code changes; evidence and verification added below. The "Not checked" items above about screenshots and the native mobile quote block are covered by the captures in this section.

Evidence

Before = merge-base 2359643, After = head e3d7260; every Before column is 2359643 and every After column e3d7260. Diff0 marks any nonzero RGB difference (amplified to magenta); DiffT marks channel differences >16/255. Same synthetic seed on both sides (written through the real EventSink), the real dev app from each checkout, T3CODE_DEV_SEED=0. Send uses the bundled Replay (dev) provider, not a live Pi turn.

Environment. Web: Chromium 156/Linux (T3 preview), no device emulation, DPR 2, zoom 1, browser Date constructor frozen at 2026-11-03T01:00:00Z. Native: real Android app on a pooled Pixel 9 (Android 16/API 36), 1080×2424 physical, dark, font scale 0.94, animations off, status bar normalized.

Recording A (1440×900 dark; seconds from driver start): 0 select the 512-char source · 1 Cite · 4 Cancel · 5 select the 631-char source · 6 Cite · 10 type comment · 12 Save · 13 paste the identical serialized commented citation on both sides · 15 Send · 25 open the sent chip · 29 Go to source · hold to 34. A-before.mp4 · A-after.mp4

Recording B (390×844 light, rich text off): 0:00 legacy raw draft saved by main's composer · 0:11 pencil · 0:15 type comment · 0:18 Save · 0:22 reopen · 0:25 clear comment · 0:28 Save · 0:32 reload · 0:51 clear composer · 0:53 select source · 0:55 Cite · 0:59 Cancel new chip · 1:02 restore the no-comment draft · 1:06 Send · 1:18 open sent chip. Main has no pencil/Save/Cancel/popover and keeps the raw link. B-before.mp4 · B-after.mp4

Recording W3b (390×844 light, rich text on): 0:10 pencil · 0:14 type comment · 0:17 Save · 0:21 reopen · 0:24 clear comment · 0:27 Save · 0:31 reload · 1:04 clear composer · 1:06 select source · 1:08 Cite · 1:12 Cancel · 1:15 restore the original draft. After the edit, clear and reload, the draft bytes match the ones main saved. W3b-before.mp4 · W3b-after.mp4

What else changed:

• Raw [Assistant quote](t3-citation://…) text in the composer becomes a compact chip, so the composer shrinks (W1, W3); on 1440 the comment editor opens under the selected source and covers part of the next paragraph (W1).
• Sent links labelled "Assistant quote" become chips labelled with the comment or quote, so their bubbles widen; this also applies to the surrounding seeded citation bubbles in every web row. Their popover covers parts of neighbouring bubbles (W2, W4).
• Native: the generic link becomes a quote block plus a separate Comment: paragraph; bubbles grow and move timestamps and copy controls (M1, M2).
• W3b: nine pixels on the send button's shading differ above 16/255 between the two runs; the citation change does not touch that button.
• No other unrelated visual change was found; this is a reviewed observation, not a zero-pixel claim.

Not captured (supplementary, covered at parser level): maximum-size 4,096-char IDs with 8k quote and comment (H1), queue/stash/title/find previews (A1), source-unavailable navigation (N1), and rejected 4,097-char or malformed links (C1). Their parser and caller coverage is in the fixture matrix and base/head parser diagnostic. Native logical viewport and DPR were not measured. At 390 wide, while the comment editor has focus, the composer collapses to its one-line row, which prints the prompt's raw text including citation markup (W3b 1:08–1:12); that row is unchanged by this PR and the same for short IDs.

Rebuild check: the audit rebuilt W1-after from the uploaded seed and driver: 0 of 1,024,000 pixels differ (rebuild, Diff0).

Scripts and fixtures (synthetic, not committed): fixtures.json · seed.mjs · seed-mobile.mjs · web-driver.js · driver-b-retake.js · native-driver.sh · REPRODUCE (A, C) · REPRODUCE (B) · all scripts A/C · all scripts B · driver-w3b.js · REPRODUCE (W3b) · all scripts W3b