fix(native): stop the deep-link mapper from dropping the URL fragment

[innolope-dev]

Summary

mapDeepLink() builds its result from parsed.pathname + parsed.search and never reads parsed.hash, so every deep link loses its fragment on the way into the native app.

That matters for one link type in particular: a claim link's password lives in the fragment (/claim?c=&v=&i=#p=<password>) and is deliberately never sent to the server — peanut-link.utils.ts parses it client-side and claim.ts only ever relays a signature. So today, tapping a claim link on a device with the app installed opens /claim?c=&v=&i= without the password: the page loads, and there is no way to claim from it. sanitizeRedirectURL already preserves .hash, so the loss was entirely in this mapper.

Fix

Re-attach the fragment once in mapDeepLink, around a new mapDeepLinkPath that keeps the existing branch logic untouched:

return `${mapDeepLinkPath(parsed)}${parsed.hash}`

Deliberately not appended inside each branch — there are six return points and a seventh is one route away. Doing it at the boundary is the only shape a future branch can't forget. parsed.hash is '' when absent (and for a bare trailing #), so no stray # is introduced.

Behaviour is otherwise unchanged: off-host links still return null, and malformed percent-escapes still degrade to null via the existing guard rather than throwing during render.

Tests

Added to src/utils/__tests__/native-routes.test.ts (there was no fragment coverage at all):

• claim-link password preserved, full App-Links URL and bare push-payload path
• fragment carried through a dynamic-route rewrite (/send/bob#p=x → /send?recipient=bob#p=x)
• no stray # when the link has no fragment
• off-host link with a fragment still rejected
• web mode preserves the fragment too

Notes for reviewers

• Independent of feat(native): deferred deep linking through the store install (TASK-20772) #2560. Found while reviewing that PR's deferred-deep-linking work, but this is a pre-existing bug on dev and main that breaks warm claim links today, with or without deferred linking. Related to feat(native): deferred deep linking through the store install (TASK-20772) #2560; does not depend on it and is not depended on by it.
• Ships via OTA — no new binary needed.
• Separate finding, not fixed here: iOS AASA is paths: ["*"] for all three appIDs, so peanut.me/invite?code=… routes into the app, but /invite is stripped from the native build (scripts/native-build.js) and absent from the Android intent filter — on iOS that link dead-ends on a route that doesn't exist. Fixing it needs the invite code written to a cookie in the deep-link handler (useNativePlugins), not in this pure path mapper which runs during render, and that file overlaps feat(native): deferred deep linking through the store install (TASK-20772) #2560. Left for a follow-up so this PR stays a one-line behavioural change.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
peanut-wallet	Ready	Preview	Jul 29, 2026 10:49pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bd83a0e5-58d8-4702-abf2-d8f7eadba7a1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code-analysis diff

Painscore total: 6739.08 → 6739.16 (+0.08)
Findings: 0 net (+6 new, -6 resolved)

🆕 New findings (6)

• critical complexity — src/utils/native-routes.ts — CC 67, MI 60.17, SLOC 152
• medium method-complexity — src/utils/native-routes.ts:110 — mapDeepLinkPath CC 19 SLOC 48
• medium method-complexity — src/utils/native-routes.ts:158 — rewriteMethodPath CC 16 SLOC 31
• low high-dlt — src/utils/native-routes.ts:110 — mapDeepLinkPath: DLT 18 (calls 18 distinct functions — high context load)
• low high-mdd — src/utils/native-routes.ts:110 — mapDeepLinkPath: MDD 11.6 (uses across many lines from declarations)
• low high-mdd — src/utils/native-routes.ts:158 — rewriteMethodPath: MDD 11.7 (uses across many lines from declarations)

✅ Resolved (6)

• src/utils/native-routes.ts — CC 66, MI 59.68, SLOC 149
• src/utils/native-routes.ts:97 — mapDeepLink CC 20 SLOC 52
• src/utils/native-routes.ts:150 — rewriteMethodPath CC 16 SLOC 31
• src/utils/native-routes.ts:97 — mapDeepLink: DLT 19 (calls 19 distinct functions — high context load)
• src/utils/native-routes.ts:150 — rewriteMethodPath: MDD 11.7 (uses across many lines from declarations)
• src/utils/native-routes.ts:97 — mapDeepLink: MDD 11.2 (uses across many lines from declarations)

[github-actions]

🧪 UI test report — ✅ all green

Suites

• ✅ unit: 2330 ran, 0 failed, 0 skipped, 42.0s

📊 Coverage (unit)

metric	%
statements	61.0%
branches	44.3%
functions	50.4%
lines	61.5%

⏱ 10 slowest test cases

time	test
4.0s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › never places two stickers in heavy overlap (broad seed sweep)
1.0s	src/utils/__tests__/demo-api.test.ts › isDemoMode() is false when not running under Capacitor
0.5s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › every sticker stays within canvas at any count
0.4s	src/utils/__tests__/sentry.utils.test.ts › defaults to the client budget under a browser global
0.3s	src/app/actions/__tests__/api-headers-extended.test.ts › should not include apiKey in validateInviteCode body
0.3s	src/app/(mobile-ui)/withdraw/__tests__/withdraw-states.test.tsx › Bank withdrawal keeps the $1 minimum for sub-$1 amounts
0.3s	src/app/actions/__tests__/api-headers.test.ts › should include Content-Type in validateInviteCode
0.3s	src/utils/__tests__/sentry.utils.test.ts › still lets a per-call timeoutMs win over the default
0.3s	src/utils/__tests__/auth-token.test.ts › returns the token hydrated from Preferences after authReady
0.2s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › keeps stickers off the username pill (final pass respects the keep-out)

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}