From 4a008684f688947aaa0d17b7e1f0e3fbb7763e49 Mon Sep 17 00:00:00 2001
From: naps62-yolo <yolo-git-naps-pt@naps62.com>
Date: Mon, 1 Jun 2026 01:27:31 +0000
Subject: [PATCH] refactor(maestro): dedup CLI JWT percent-encoder onto
 urlencoding crate (NAP-273 part A)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`maestro-cli` carried a hand-rolled `urlencoding()` for the attach-token query
param while `maestro-daemon` already used the `urlencoding` crate for the same
wire field. Two encoders for one field is exactly the drift that only surfaces
in production — collapse to the crate (`urlencoding = "2"`), deleting the local
copy. The unreserved set is identical, so the encoded output is unchanged
(existing `attach_url` tests pass).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Cargo.lock                       |  1 +
 crates/maestro-cli/Cargo.toml    |  1 +
 crates/maestro-cli/src/attach.rs | 20 +-------------------
 3 files changed, 3 insertions(+), 19 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 17e9488..6376c0d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1144,6 +1144,7 @@ dependencies = [
  "toml",
  "tracing",
  "tracing-subscriber",
+ "urlencoding",
  "uuid",
 ]
 
diff --git a/crates/maestro-cli/Cargo.toml b/crates/maestro-cli/Cargo.toml
index 54a6a7a..ae360a4 100644
--- a/crates/maestro-cli/Cargo.toml
+++ b/crates/maestro-cli/Cargo.toml
@@ -28,6 +28,7 @@ tokio-tungstenite = { workspace = true, features = ["rustls-tls-webpki-roots"] }
 toml.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
+urlencoding = "2"
 uuid.workspace = true
 
 [dev-dependencies]
diff --git a/crates/maestro-cli/src/attach.rs b/crates/maestro-cli/src/attach.rs
index 4fd922c..64052e6 100644
--- a/crates/maestro-cli/src/attach.rs
+++ b/crates/maestro-cli/src/attach.rs
@@ -75,7 +75,7 @@ pub fn attach_url(info: &ConnectInfo, session_id: Uuid) -> Result<String, Attach
     }
     Ok(format!(
         "{base}/sessions/{session_id}/stream?token={token}",
-        token = urlencoding(&info.jwt)
+        token = urlencoding::encode(&info.jwt)
     ))
 }
 
@@ -106,24 +106,6 @@ pub fn broker_attach_url(
     Ok(format!("{ws_base}/api/attach/{session_id}"))
 }
 
-/// Minimal percent-encoder for the token in a query string. JWTs only contain
-/// `A-Z a-z 0-9 - _ .` (URL-safe base64 + dots) so this is paranoia, not need.
-fn urlencoding(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => {
-                out.push('%');
-                out.push_str(&format!("{b:02X}"));
-            }
-        }
-    }
-    out
-}
-
 /// RAII guard that puts the terminal into raw mode and restores on drop.
 #[derive(Debug)]
 struct RawTty {