fix(gallery): link PR comment thumbnails by the name pr-media.py stores

[teamleaderleo]

Summary

The gallery PR comment's inline thumbnails 404 on every PR (seen on #18152 and #18224). The comment links <prefix><key>, for example agent-pane.docked-chat--working--en--Apple_System_Colors--w400-webkit.png. The publisher uploads that file through scripts/pr-media.py, whose sanitize() collapses each run of dashes, so pr-media holds agent-pane.docked-chat-working-en-Apple_System_Colors-w400-webkit.png.

The poster side changed. sanitize() has collapsed dashes since pr-media.py was added (#15295). The gallery diff (#18205) introduced entry--variant keys and linked them as given.

The fix is in report.ts: thumbUrl names the stored file by collapsing dash runs in the key, as sanitize() does. SAFE_KEY now also requires the key to start with a letter or digit, so prefix plus key can't form a new dash run. The uploader and the workflow are unchanged. The publish job runs the base branch's scripts, so comments are fixed from the first PR run after this lands.

Verification

The new test, thumbnail links name the file pr-media.py stores, calls the real pr-media.py sanitize() and checks both the comment link and the feed thumbnail against it. This ties the link to the uploader instead of to a copy of its rule.

• Red on f4cd85f (the test commit alone): hosted gallery-pr / render "Test the diff" (bun test in scripts/gallery-matrix) reported 16 pass, 1 fail. The failure was the new test, whose link still had the double dash. https://github.com/manaflow-ai/cmux/actions/runs/37588366412
• Green: the same step on the fix commit (pending).
• Web tests were not run locally.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes gallery PR comment thumbnails 404ing because comment links used keys with dash runs (for example agent-pane.docked-chat--working--en-...) while scripts/pr-media.py stores files under its sanitize() name with those runs collapsed, so every inline thumbnail broke (#18152, #18224).

Bug Fixes

• Adds a test that runs the real pr-media.py sanitize() and asserts both the comment link and the feed thumbnail name the file the uploader actually stores.
• Uploader and workflow are unchanged, so comments are fixed from the first PR run after this lands.

^{Written for commit 1ca6605. Summary will update on new commits.}

---

Note

Low Risk
Scoped to gallery report URL generation and tests; uploader/workflow unchanged and no auth or data-path changes.

Overview
Fixes gallery PR comment thumbnail 404s by building raw URLs from the filename scripts/pr-media.py actually stores, not the raw outcome key.

thumbUrl in report.ts now applies a storedName step that collapses runs of dashes (matching sanitize() on upload), so keys like entry--variant no longer produce links with -- while pr-media holds a single-dash name. SAFE_KEY also requires keys to start with a letter or digit so thumbBase + key cannot introduce an extra dash run.

Tests update expected URLs and add thumbnail links name the file pr-media.py stores, which runs the real Python sanitize() and asserts both the comment <img> and feed thumbnail URLs match.

^{Reviewed by Cursor Bugbot for commit 1ca6605. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 667f8c0d-d343-412d-aee8-55c56500e72b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/37597620459 at e39f213 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at 1aa7972. This pull request is one of 3 merged since: #18311, #18301, #18317.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.