api/workspaces.py (1)

1031-1066: ⚡ Quick win

Parse messageRequestContext once.

This block runs the same messageRequestContext:% query twice and JSON-decodes each row twice just to populate two maps. Folding both structures into one pass would remove a full-table scan from a hot endpoint with no behavior change.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/workspaces.py` around lines 1031 - 1066, The code currently queries
"cursorDiskKV" for keys like "messageRequestContext:%" twice and JSON-decodes
each row twice; combine these loops by iterating global_db.execute("SELECT key,
value FROM cursorDiskKV WHERE key LIKE 'messageRequestContext:%'") once,
JSON.parse row["value"] a single time, then populate both
message_request_context_map (append the ctx + "contextId") and
project_layouts_map (extract ctx.get("projectLayouts"), JSON-decode each string
layout and append layout["rootPath"] when valid) inside the same try/except
block; keep the existing checks (parts length, isinstance checks) and existing
error handling (except Exception: pass) but remove the duplicated second loop
and its JSON loads.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

api/workspaces.py (1)

480-482: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Escape the remaining read-only SQLite URIs too.

Line 481 and Line 512 still build file: URIs by concatenating raw filesystem paths. That leaves _build_composer_id_to_workspace_id() and _open_global_db() exposed to the same ? / # / space path bug you already fixed at Line 166, so workspaces under such paths can still fail to open.

Suggested fix

 def _build_composer_id_to_workspace_id(workspace_path: str, workspace_entries: list) -> dict:
     """Build mapping: composerId -> workspaceId from per-workspace state.vscdb."""
     mapping = {}
     for entry in workspace_entries:
         db_path = os.path.join(workspace_path, entry["name"], "state.vscdb")
         if not os.path.isfile(db_path):
             continue
         try:
             # closing() guarantees .close() on scope exit (issue `#17`).
-            with closing(sqlite3.connect(f"file:{db_path}?mode=ro", uri=True)) as conn:
+            db_uri = Path(db_path).resolve().as_uri() + "?mode=ro"
+            with closing(sqlite3.connect(db_uri, uri=True)) as conn:
                 row = conn.execute(
                     "SELECT value FROM ItemTable WHERE [key] = 'composer.composerData'"
                 ).fetchone()
@@
     if not os.path.isfile(global_db_path):
         yield None, global_db_path
         return
-    conn = sqlite3.connect(f"file:{global_db_path}?mode=ro", uri=True)
+    global_db_uri = Path(global_db_path).resolve().as_uri() + "?mode=ro"
+    conn = sqlite3.connect(global_db_uri, uri=True)

In Python's sqlite3 module, when uri=True is used, should filesystem paths be converted to proper file: URIs (for example via pathlib.Path(...).resolve().as_uri()) before appending ?mode=ro so reserved characters like ? and # are escaped?

Also applies to: 512-512

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/workspaces.py` around lines 480 - 482, Replace the raw string
concatenation that builds SQLite file: URIs (e.g.,
sqlite3.connect(f"file:{db_path}?mode=ro", uri=True)) with a proper file URI
derived from the filesystem path to escape reserved characters: use
pathlib.Path(db_path).resolve().as_uri() to produce the base file://... URI and
then append the query string (e.g., ?mode=ro) before calling
sqlite3.connect(..., uri=True); apply this change in both
_build_composer_id_to_workspace_id and _open_global_db so paths containing ?, #,
spaces, etc. are correctly escaped.