Claude finished @Yeraze's task —— View job

PR Review: fix(link-preview): use static api import

Tasks:

• Gather context and read changed files
• Review code quality and best practices
• Check test coverage
• Assess performance and security
• Post final review

Summary

This is a clean, well-targeted fix. The root cause diagnosis is accurate and the solution is correct. Here's my detailed review:

Code Quality ✅

src/utils/linkRenderer.tsx

The change is minimal and correct — replacing await import('../services/api') with a static top-level import eliminates the fragile Vite preload step that was broken under a non-root BASE_URL. The comment in fetchLinkPreview (lines 106–112) clearly explains the historical context and why there's no circular dependency concern, which is valuable for future maintainers.

One minor point: the fetchLinkPreview function has a redundant assignment:

const metadata = await api.fetchLinkPreview(url);
return metadata;

This could be simplified to return await api.fetchLinkPreview(url) (or even return api.fetchLinkPreview(url) since the try/catch would still work), but this is purely cosmetic and doesn't affect correctness.

Test Coverage ✅

src/utils/linkRenderer.test.ts provides good coverage for the two public functions under test:

• fetchLinkPreview: success path and error/null fallback path — exactly what's needed to lock in the "delegate-and-null-on-failure" contract
• extractUrls: https URL with query string, bare www. normalization, and empty case

The mock structure correctly uses vi.mock with a hoisted factory before the import of the module under test, which is the right Vitest pattern for static imports.

One gap: there's no test for renderMessageWithLinks — but that function isn't touched by this PR, so it's acceptable to leave for another time.

Performance ✅

The fix is a strict improvement: eliminating the dynamic import means one fewer lazy chunk, one fewer potential preload race, and slightly faster first-render of any component that calls fetchLinkPreview. The api module is already in the main bundle (statically imported across the app), so this adds no extra weight to the initial bundle.

Security ✅

No security concerns. The URL passed to api.fetchLinkPreview is encoded server-side (visible in api.ts: encodeURIComponent(url)). The rel="noopener noreferrer" attributes on rendered preview links are already present in LinkPreview.tsx. No new attack surface is introduced.

One observation (pre-existing, not introduced by this PR): LinkPreview.tsx:149 renders preview.image as an <img src> from third-party OG metadata without sanitization. This is a common pattern and the risk is bounded by the backend's fetch, but worth noting as a long-term consideration.

Maintainer Note Endorsed

The PR description correctly flags that other lazy chunks (emoji picker, GeoJsonOverlay, embed) loaded via the same dynamic-import mechanism could similarly 404 under a non-root BASE_URL. This fix is surgical and correct for the immediate problem; the broader Vite base/runtime-base handling deserves a follow-up issue.

Verdict

Approve — the fix is correct, minimal, and well-tested. No blocking issues.