fix(cli): decode keys before minimatch comparison in --key filtering (#2017)

* fix(cli): decode URL-encoded keys before minimatch comparison in --key filtering

* fix(cli): safely decode keys

Author: AndreyHirsa

.changeset/salty-sails-sell.md

@@ -0,0 +1,5 @@
+---
+"lingo.dev": patch
+---
+
+Fixed --key pattern matching in run and purge commands by decoding URL-encoded keys before minimatch comparison

packages/cli/src/cli/cmd/purge.ts

@@ -6,6 +6,7 @@ import { getBuckets } from "../utils/buckets";
 import { resolveOverriddenLocale } from "@lingo.dev/_spec";
 import createBucketLoader from "../loaders";
 import { minimatch } from "minimatch";
+import { safeDecode } from "../utils/key-matching";
 import { confirm } from "@inquirer/prompts";
 
 interface PurgeOptions {
@@ -123,7 +124,7 @@ export default new Command()
               if (options.key) {
                 // minimatch for key patterns
                 keysToRemove = Object.keys(newData).filter((k) =>
-                  minimatch(k, options.key!),
+                  minimatch(safeDecode(k), safeDecode(options.key!)),
                 );
               } else {
                 // No key specified: remove all keys
@@ -133,7 +134,7 @@ export default new Command()
                 // Show what will be deleted
                 if (options.key) {
                   bucketOra.info(
-                    `About to delete ${keysToRemove.length} key(s) matching '${options.key}' from ${bucketPath.pathPattern} [${targetLocale}]:\n  ${keysToRemove.slice(0, 10).join(", ")}${keysToRemove.length > 10 ? ", ..." : ""}`,
+                    `About to delete ${keysToRemove.length} key(s) matching '${safeDecode(options.key)}' from ${bucketPath.pathPattern} [${targetLocale}]:\n  ${keysToRemove.slice(0, 10).join(", ")}${keysToRemove.length > 10 ? ", ..." : ""}`,
                   );
                 } else {
                   bucketOra.info(
@@ -161,7 +162,7 @@ export default new Command()
                 await bucketLoader.push(targetLocale, newData);
                 if (options.key) {
                   bucketOra.succeed(
-                    `Removed ${keysToRemove.length} key(s) matching '${options.key}' from ${bucketPath.pathPattern} [${targetLocale}]`,
+                    `Removed ${keysToRemove.length} key(s) matching '${safeDecode(options.key)}' from ${bucketPath.pathPattern} [${targetLocale}]`,
                   );
                 } else {
                   bucketOra.succeed(
@@ -170,7 +171,7 @@ export default new Command()
                 }
               } else if (options.key) {
                 bucketOra.info(
-                  `No keys matching '${options.key}' found in ${bucketPath.pathPattern} [${targetLocale}]`,
+                  `No keys matching '${safeDecode(options.key)}' found in ${bucketPath.pathPattern} [${targetLocale}]`,
                 );
               } else {
                 bucketOra.info("No keys to remove.");

packages/cli/src/cli/cmd/run/execute.ts

@@ -4,6 +4,7 @@ import pLimit, { LimitFunction } from "p-limit";
 import _ from "lodash";
 import { minimatch } from "minimatch";
 
+import { safeDecode } from "../../utils/key-matching";
 import { colors } from "../../constants";
 import { CmdRunContext, CmdRunTask, CmdRunTaskResult } from "./_types";
 import { commonTaskRendererOptions } from "./_const";
@@ -231,7 +232,7 @@ function createWorkerTask(args: {
                 ([key]) =>
                   !assignedTask.onlyKeys.length ||
                   assignedTask.onlyKeys?.some((pattern) =>
-                    minimatch(key, pattern),
+                    minimatch(safeDecode(key), safeDecode(pattern)),
                   ),
               )
               .fromPairs()

packages/cli/src/cli/utils/key-matching.ts

@@ -1,9 +1,20 @@
 import { minimatch } from "minimatch";
 
+/**
+ * Safely decodes a URI component, returning the original string if decoding fails.
+ */
+export function safeDecode(value: string): string {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
 /**
  * Checks if a key matches any of the provided patterns using exact, separator-bounded prefix, or glob matching.
  * Separator-bounded means the key must equal the pattern exactly, or continue with a ".", "/", or "-" separator.
- * This prevents "inbox" from matching "inbox_url" while still matching "inbox.title", "inbox/details", or "heading-0".
+ * This prevents "inbox" from matching "inbox_url" while still matching "inbox.title", "inbox/details", or "inbox-0".
  */
 export function matchesKeyPattern(key: string, patterns: string[]): boolean {
   return patterns.some(