fix(shared): do not throw on a malformed URL fragment in the dev browser handshake

[Neekoras]

Description

extractDevBrowserFromURL runs during a development instance's handshake and passed the URL fragment straight to decodeURI. A fragment that is not valid percent-encoding, such as a truncated #%E0%A4%A from a clipped or wrapped link, threw URIError: URI malformed. That stopped initialization before /v1/environment and /v1/client were requested, so the session was never loaded and the app showed the sign-in screen on every route until the fragment was removed.

The fragment is now decoded only when it decodes; otherwise it is used as it is. The legacy __clerk_db_jwt[...] marker is still removed from such a fragment, since its brackets are not percent-encoded in a URL fragment. Valid fragments behave as before.

This is the browser-side counterpart of #9333, which fixed the same class of error for cookies in @clerk/backend.

Fixes #9667

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[changeset-bot]

🦋 Changeset detected

Latest commit: 0f7715b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 23 packages

Name	Type
@clerk/shared	Patch
@clerk/clerk-js	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/mosaic	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/swingset	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@Neekoras is attempting to deploy a commit to the Clerk Production Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5a3490d5-65d7-4e87-8daa-c3e9d4469c21

📥 Commits

Reviewing files that changed from the base of the PR and between 81a6413 and 0f7715b.

📒 Files selected for processing (3)

• .changeset/devbrowser-malformed-url-fragment.md
• packages/shared/src/__tests__/devbrowser.spec.ts
• packages/shared/src/devBrowser.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds decodeURISafely and uses it during legacy dev-browser hash cleanup. Malformed percent-encoded fragments remain unchanged instead of causing URIError. Tests cover malformed hashes, query-token extraction, legacy token removal, and skipped cleanup. A changeset declares patch releases for @clerk/shared and @clerk/clerk-js.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 0f771

Malformed dev-browser fragments no longer abort initialization, while valid legacy markers continue to be cleaned up. The change is ready to merge with minimal current-head risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing errors from malformed URL fragments during the dev browser handshake.
Description check	✅ Passed	The description directly explains the malformed-fragment failure, the code change, expected behavior, tests, and linked issue.
Linked Issues check	✅ Passed	Issue #9667 requires malformed URL fragments to stop aborting initialization and to behave as absent when no dev-browser marker exists. decodeURISafely catches decodeURI failures and returns the o…
Out of Scope Changes check	✅ Passed	The changes are limited to the malformed-fragment handling in packages/shared/src/devBrowser.ts, focused tests, and a patch changeset for the affected packages. These changes directly support issue …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}