Guard comment activity IDs in task detail

[cursor]

Changes

• Added getCommentActivityId / isPendingCommentId helpers for safe comment activity ID handling.
• Updated task detail comment reply, expanded-reply, delete, and stable-id flows to avoid calling .includes or Zod string parsing on missing activity details.id values.
• Preserved optimistic temp-comment handling while skipping malformed IDs instead of crashing the UI.

Testing Criteria

• yarn test src/utils/commentActivity.test.ts --runInBand passes and covers missing/non-string IDs plus pending temp IDs.
• yarn lint:check passes with existing warnings only.
• yarn tsc --noEmit passes.
• yarn test --runInBand was also attempted: 17 suites / 143 tests passed, but the full suite failed in src/app/api/tests/utils/authenticate.test.ts because Jest could not transform the ESM p-retry dependency (SyntaxError: Cannot use import statement outside a module). This failure is unrelated to the touched task-detail/comment files.
• Local browser smoke was attempted at /detail/00000000-0000-0000-0000-000000000000/iu?token=fake-token; the app correctly blocked on Failed to authenticate token, so the task detail activity/comment UI could not be manually exercised without a real Copilot launch token.

Notes

• Linear and Sentry MCP access were unavailable during triage: Linear read/comment calls returned 401 and Sentry MCP required authentication, so the root cause was inferred from the webhook title plus repository search for unsafe .includes receivers.

Impact & Surface Area of Change

• Task detail activity/comment UI: comment reply queueing, expanded replies, comment deletion, optimistic temp-comment resolution, and comment stable IDs.
• No database/API contract changes.

  

[linear-code]

POR-21030

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tasks-app	Ready	Preview, Comment	Jul 8, 2026 6:07pm