fix(app): validate comment selection coordinates (#51319)

packages/app/src/utils/comment-note.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from "bun:test"
+import { readCommentMetadata } from "./comment-note"
+
+describe("readCommentMetadata", () => {
+  test("ignores selections with null coordinates", () => {
+    const result = readCommentMetadata({
+      opencodeComment: {
+        path: "src/a.ts",
+        comment: "check this",
+        selection: { startLine: null, startChar: null, endLine: null, endChar: null },
+      },
+    })
+
+    expect(result?.comment).toBe("check this")
+    expect(result?.selection).toBeUndefined()
+  })
+
+  test("retains selections with finite numeric coordinates", () => {
+    const selection = { startLine: 4, startChar: 0, endLine: 6, endChar: 2 }
+    const result = readCommentMetadata({
+      opencodeComment: { path: "src/a.ts", comment: "check this", selection },
+    })
+
+    expect(result?.selection).toEqual(selection)
+  })
+})

packages/app/src/utils/comment-note.ts

@@ -10,11 +10,22 @@ export type PromptComment = {
 
 function selection(selection: unknown) {
   if (!selection || typeof selection !== "object") return undefined
-  const startLine = Number((selection as FileSelection).startLine)
-  const startChar = Number((selection as FileSelection).startChar)
-  const endLine = Number((selection as FileSelection).endLine)
-  const endChar = Number((selection as FileSelection).endChar)
-  if (![startLine, startChar, endLine, endChar].every(Number.isFinite)) return undefined
+  const value = selection as Record<string, unknown>
+  const startLine = value.startLine
+  const startChar = value.startChar
+  const endLine = value.endLine
+  const endChar = value.endChar
+  if (
+    typeof startLine !== "number" ||
+    !Number.isFinite(startLine) ||
+    typeof startChar !== "number" ||
+    !Number.isFinite(startChar) ||
+    typeof endLine !== "number" ||
+    !Number.isFinite(endLine) ||
+    typeof endChar !== "number" ||
+    !Number.isFinite(endChar)
+  )
+    return undefined
   return {
     startLine,
     startChar,