fix: address CodeRabbit MAJOR review comments (round 2, PR #20)

- _server: neutralize CR/LF in request path before logging to prevent
  log forging (CWE-117); ASGI percent-decodes scope["path"]
- schema_cast: infer cast direction from the last non-UUID-tail segment
  so combined anonymous IDs are handled correctly (was reading the
  UUID-tail segment's None minor and returning "unknown"); add regression
  test
- Makefile: add Makefile to $(PY_ENV_STAMP) prerequisites so tool-set
  changes (ruff/mypy) invalidate an existing stamp and get reinstalled

Signed-off-by: Artfizer <artifizer@gmail.com>

Author: Artifizer

Makefile

@@ -38,7 +38,7 @@ help:
 # Create/update the virtual environment and install dev/test dependencies
 py-env: $(PY_ENV_STAMP)
 
-$(PY_ENV_STAMP): gts/pyproject.toml .gts-spec/tests/requirements.txt
+$(PY_ENV_STAMP): gts/pyproject.toml .gts-spec/tests/requirements.txt Makefile
 	@echo "Creating/updating Python virtual environment in $(PY_ENV_DIR)..."
 	$(PYTHON_BOOTSTRAP) -m venv $(PY_ENV_DIR)
 	$(PYTHON) -m pip install --upgrade pip

gts/src/gts/_server.py

@@ -70,10 +70,14 @@ async def receive():
         else:
             status_color = Colors.RED
 
-        # Log response at INFO level (verbose >= 1)
+        # Log response at INFO level (verbose >= 1).
+        # Neutralize CR/LF in the request-derived path to prevent log forging
+        # (CWE-117); ASGI percent-decodes scope["path"], so it may contain
+        # newlines that would otherwise inject forged log records.
+        safe_path = request.url.path.replace("\r", "\\r").replace("\n", "\\n")
         logger.info(
             f"{Colors.CYAN}{request.method}{Colors.RESET} "
-            f"{Colors.BLUE}{request.url.path}{Colors.RESET} -> "
+            f"{Colors.BLUE}{safe_path}{Colors.RESET} -> "
             f"{status_color}{response.status_code}{Colors.RESET} "
             f"in {Colors.MAGENTA}{dur:.1f}ms{Colors.RESET}"
         )

gts/src/gts/schema_cast.py

@@ -183,11 +183,19 @@ def cast(
 
     @staticmethod
     def _infer_direction(from_id: str, to_id: str) -> str:
+        def _last_versioned_segment(gid: GtsID):
+            # Skip the appended UUID-tail segment (ver_minor is None) so
+            # combined anonymous IDs still resolve to their versioned segment.
+            for seg in reversed(gid.gts_id_segments):
+                if not getattr(seg, "_is_uuid_tail", False):
+                    return seg
+            return gid.gts_id_segments[-1]
+
         try:
             gid_from = GtsID(from_id)
             gid_to = GtsID(to_id)
-            from_minor = gid_from.gts_id_segments[-1].ver_minor
-            to_minor = gid_to.gts_id_segments[-1].ver_minor
+            from_minor = _last_versioned_segment(gid_from).ver_minor
+            to_minor = _last_versioned_segment(gid_to).ver_minor
             if from_minor is not None and to_minor is not None:
                 if to_minor > from_minor:
                     return "up"

tests/test_schema_cast.py

@@ -71,6 +71,17 @@ def test_none_direction_same_minor(self):
     def test_unknown_on_invalid_id(self):
         assert GtsEntityCastResult._infer_direction("not-an-id", "also-not") == "unknown"
 
+    def test_combined_anonymous_id_uses_versioned_segment(self):
+        # Regression: the appended UUID-tail segment has ver_minor=None; the
+        # direction must be inferred from the last versioned segment instead.
+        assert (
+            GtsEntityCastResult._infer_direction(
+                "gts.x.test._.foo.v1.0~123e4567-e89b-12d3-a456-426614174000",
+                "gts.x.test._.foo.v1.5~",
+            )
+            == "up"
+        )
+
 
 class TestEffectiveObjectSchema:
     def test_non_dict_returns_empty(self):