fix desktop PDF/image export injectTitle replacement-pattern corruption

[buiducnhat]

Fixes #6795

Why

Exporting an artifact to PDF (or the od export PDF/image fallback path) corrupts any title containing JavaScript replacement-pattern sequences ($$, $&, $\``, $'). I reproduced this against the real source functions: injectTitle()passes the user-derived title as the **string** replacement argument ofString.prototype.replace, so ECMA-262 GetSubstitutionexpands those sequences — dropping$characters, splicing the matched<title>` back into the title, and duplicating the document tail into the rendered output. This silently corrupts real user data at export time, and the corruption also lands in the PDF's Title metadata.

What users will see

Exporting a PDF/image whose title contains $ (for example Save $$$ This Quarter or Rock $'n Roll Tour) now renders the title verbatim in the document <title> and PDF metadata — HTML-escaped only, exactly as the surrounding escapeHtmlText() / escapeText() calls intend. No more dropped characters, prematurely-closed titles, or duplicated document content.

Surface area

• None — internal bug fix and regression test only; no new page, CLI flag, endpoint, contract, extension point, i18n key, dependency, or opt-in behavior.

Screenshots

Not applicable — no UI surface changed.

Bug fix verification

• Test path that reproduces the bug: apps/desktop/tests/main/inject-title-replacement-pattern.test.ts
• Did the test go red on main and green on this branch? yes — the test extracts the real injectTitle + escape helper from both pdf-export.ts and artifact-export.ts and fails with 10 assertions on main (all four replacement patterns, both files) before the fix, then passes on this branch.

Validation

• vitest run -c vitest.config.ts tests/main/inject-title-replacement-pattern.test.ts — 10 tests pass.
• The fix is one line in each of apps/desktop/src/main/pdf-export.ts and apps/desktop/src/main/artifact-export.ts, switching the <title> branch to a function replacement (matching the sibling injectBaseHref / injectStyle helpers that already do this).

Adjacent issues

• assembleExample() in apps/daemon/src/routes/static-resource.ts interpolates a skill-derived title through the same string-replacement mechanism. Its trigger surface is much smaller and it sits outside this issue's described boundary, so I left it for a follow-up rather than expanding this PR.

[lefarcen]

Hey @buiducnhat — thanks for the tight regression-focused fix here. I've queued this for review, and because it touches the desktop export path we'll run a manual QA pass before merge.

[lefarcen]

Heads-up: PR #6796 and PR #6891 are also open against the same desktop export bug. All three PRs touch apps/desktop/src/main/pdf-export.ts and apps/desktop/src/main/artifact-export.ts for issue #6795, so it's worth coordinating to avoid parallel fixes landing twice.

[nettee]

@buiducnhat

I reviewed the two desktop export injectTitle changes and the new regression coverage for replacement-pattern titles. The callback replacements preserve literal $ sequences while retaining HTML escaping; the focused regression test (10/10), full desktop Vitest suite (336 passed, 1 skipped), desktop typecheck, repository guard, and workspace typecheck all pass.

Thanks for the focused fix and the clear regression coverage—this closes a subtle user-data corruption path cleanly. Nice work!

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[lefarcen]

Heads-up: PR #6947 is also open against issue #6795. The current head here is now test-only (apps/desktop/tests/main/inject-title-replacement-pattern.test.ts), while #6947 carries the desktop code changes plus the daemon follow-up, so it would be good to coordinate the scopes and avoid landing overlapping fixes twice.

[lefarcen]

Heads-up: PR #6947 has now merged and issue #6795 is closed. The current diff here looks limited to alternative regression coverage in apps/desktop/tests/main/inject-title-replacement-pattern.test.ts, so if you want to keep that extra coverage it may be cleaner to rebase this PR around the shipped fix; otherwise feel free to close it as superseded.

[nettee]

@buiducnhat

The replacement-pattern regression coverage is passing, and I verified the existing real-export regression test, full desktop suite (346 passed, 1 skipped), desktop/workspace typechecks, and repository guard. Thanks for adding focused coverage for this subtle title-corruption path; I left one non-blocking maintainability suggestion inline.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[nettee]

[non-blocking] Keep this regression at the real export seam

apps/desktop/tests/main/export-title-replacement-patterns.test.ts already drives exportPdfFromHtml and exportArtifact with the same replacement-pattern cases. This new Function path reads TypeScript text, strips annotations, and executes a reconstructed helper, so it duplicates coverage while bypassing the actual import/call path; later helper formatting or type-syntax changes can break this test without a product regression. Please move the exact-document assertion and the extra combined HTML/$& case into the existing export integration test, then remove this source-eval harness (or expose a shared pure helper if direct unit coverage is needed).

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[lefarcen]

Hey @buiducnhat — thanks for the quick follow-up here. @nettee's note is non-blocking, but I do think it's the right cleanup direction: if you want to keep this extra regression coverage on top of the shipped fix from #6947, rebasing around the real export-seam test and folding that suggestion in would make this much easier to maintain. Otherwise, closing this one as superseded is also totally reasonable.