fix(webapp): pin the AI-help redirect to the dashboard's own origin

new URL(environmentPath, origin) ignores origin when the path is absolute, and
the result goes straight into redirect(). Today's only caller passes a
builder-generated internal path, so this closes the gap rather than a hole.

Author: kathiekiwi

apps/webapp/app/components/dashboard-agent/ask-ai-channels.test.ts

@@ -78,6 +78,42 @@ describe("aiHelpRedirectUrl", () => {
   it("lands on the environment page", () => {
     expect(url.startsWith("https://cloud.trigger.dev/orgs/acme/projects/api/env/dev?")).toBe(true);
   });
+
+  /**
+   * The only caller passes a path its own builder made, so none of these are reachable today.
+   * The guard is here rather than at the `redirect()` because this helper is the one place both
+   * that route and any future caller go through, and it is the only pure one of the two.
+   */
+  it("stays on `origin` whatever shape the path arrives in", () => {
+    const off = (environmentPath: string) =>
+      new URL(
+        aiHelpRedirectUrl({
+          environmentPath,
+          origin: "https://cloud.trigger.dev",
+          query: "why",
+        })
+      );
+
+    expect(off("https://evil.example/steal").origin).toBe("https://cloud.trigger.dev");
+    expect(off("//evil.example/steal").origin).toBe("https://cloud.trigger.dev");
+    expect(off("https://evil.example//steal").origin).toBe("https://cloud.trigger.dev");
+    expect(off("javascript:alert(1)").origin).toBe("https://cloud.trigger.dev");
+  });
+
+  it("keeps the path, search and fragment of a normal internal path", () => {
+    const parsed = new URL(
+      aiHelpRedirectUrl({
+        environmentPath: "/orgs/acme/projects/api/env/dev?tab=runs#top",
+        origin: "https://cloud.trigger.dev",
+        query: "why",
+      })
+    );
+
+    expect(parsed.pathname).toBe("/orgs/acme/projects/api/env/dev");
+    expect(parsed.searchParams.get("tab")).toBe("runs");
+    expect(parsed.searchParams.get("aiHelp")).toBe("why");
+    expect(parsed.hash).toBe("#top");
+  });
 });
 
 /**

apps/webapp/app/components/dashboard-agent/ask-ai-channels.ts

@@ -47,7 +47,11 @@ export function agentDeepLinkParams(availability: AskAiAvailability): readonly D
   return askAiChannelTarget(availability) === "ask-ai" ? NO_PARAMS : ASK_AI_PARAMS;
 }
 
-/** Where `trigger dev`'s "Get a fix for this error using AI" link lands. */
+/**
+ * Where `trigger dev`'s "Get a fix for this error using AI" link lands. Always on `origin`: an
+ * absolute or protocol-relative `environmentPath` would otherwise decide the host itself, and
+ * the caller feeds this straight to `redirect()`.
+ */
 export function aiHelpRedirectUrl({
   environmentPath,
   origin,
@@ -57,7 +61,12 @@ export function aiHelpRedirectUrl({
   origin: string;
   query: string;
 }): string {
-  const url = new URL(environmentPath, origin);
+  const base = new URL(origin);
+  const requested = new URL(environmentPath, base);
+  // Exactly one leading slash: a `javascript:` path has none and would run into the host, and
+  // two would read as the start of another authority.
+  const path = `/${requested.pathname.replace(/^\/+/, "")}`;
+  const url = new URL(base.origin + path + requested.search + requested.hash);
   url.searchParams.set(ASK_AI_DEEP_LINK_PARAM, query);
   return url.toString();
 }