From 95fd6a97557b8ac3f57e9f67d5242386c4b4cebe Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 20 Aug 2026 14:41:31 +0000
Subject: [PATCH 1/3] Fix composer crash when a list_item has no list around it
 (MAILSPRING-CLIENT-EV)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Slate throws "Cannot read properties of null (reading 'type')" from
Commands.splitNodeByPath when the composer contains a `list_item` block that is a
direct child of the document — an `<li>` deserialized from email HTML with no
`<ul>`/`<ol>` around it.

slate-edit-list's `getCurrentItem()` answers "is the cursor in a list?" by
returning any parent block whose type is `list_item`, without checking that it is
actually inside a list. So Enter (in an empty item) and Backspace (at its start)
route into `unwrapList()`, which calls `editor.unwrapNodeByKey(item.key)`. The
orphan's path has a single element, so `unwrapNodeByPath` lifts it to the empty
root path; `document.assertNode([])` accepts that (Node#getNode returns the
document itself for an empty path) so nothing asserts, and when the orphan is
neither the first nor the last child of the document the "middle child" branch
calls `splitNodeByPath([], index)`. There `document.getDescendant([])` returns
null by definition, and reading `node.type` throws — matching the reported frames
exactly (slate.js:8142 -> 8022).

Wrap EditListPlugin so key events fall through to the default handling whenever
the current item is not really inside a list.

The document should never hold that shape: slate-edit-list's schema declares a
list parent for `list_item` and normalization rewrites an orphan to a `div`. But
`Editor#withoutNormalizing` sets `tmp.normalize = false`, runs the callback and
restores the flag *without* a try/finally, so any command that throws leaves
normalization disabled for the rest of that editor's life. Exceptions from React
event handlers don't unmount anything, so after the first Slate error the composer
stays open and stops repairing its document — which is what lets the orphan
survive. Patch `withoutNormalizing` to restore the flag on the way out so a single
error can't cascade.

Verified against the pinned slate (cd6f40e8) and @bengotow/slate-edit-list
(b868e108) builds: the unguarded plugin reproduces the exact stack, the guarded
one falls through, and every in-list behaviour (split item, exit list, indent,
backspace-unwrap) is byte-identical before and after.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfnK1t6VeRn37exPfshj7P
---
 .../base-block-plugins-spec.tsx               | 95 +++++++++++++++++++
 .../composer-editor/base-block-plugins.tsx    | 25 ++++-
 .../components/composer-editor/conversion.tsx |  1 +
 .../patch-slate-normalizing.ts                | 28 ++++++
 4 files changed, 148 insertions(+), 1 deletion(-)
 create mode 100644 app/spec/components/composer-editor/base-block-plugins-spec.tsx
 create mode 100644 app/src/components/composer-editor/patch-slate-normalizing.ts

diff --git a/app/spec/components/composer-editor/base-block-plugins-spec.tsx b/app/spec/components/composer-editor/base-block-plugins-spec.tsx
new file mode 100644
index 0000000000..f4614479bd
--- /dev/null
+++ b/app/spec/components/composer-editor/base-block-plugins-spec.tsx
@@ -0,0 +1,95 @@
+import { Editor, Value } from 'slate';
+import { EditListPlugin } from '../../../src/components/composer-editor/base-block-plugins';
+import '../../../src/components/composer-editor/patch-slate-normalizing';
+
+const text = (t: string) => ({ object: 'text', leaves: [{ object: 'leaf', text: t, marks: [] }] });
+const block = (type: string, nodes: any[]) => ({ object: 'block', type, data: {}, nodes });
+const div = (t: string) => block('div', [text(t)]);
+const listItem = (...nodes: any[]) => block('list_item', nodes);
+const list = (...nodes: any[]) => block('ul_list', nodes);
+
+// Built without plugins on purpose: the schema would repair an orphaned `list_item`, and the
+// crash we're guarding against only happens in an editor that is no longer normalizing.
+function editorWith(nodes: any[]) {
+  return new Editor({
+    value: Value.fromJSON({
+      object: 'value',
+      document: { object: 'document', data: {}, nodes },
+    } as any),
+    plugins: [],
+    onChange: () => {},
+  });
+}
+
+function childTypes(editor: Editor) {
+  return (editor.value.document.nodes.toArray() as any[]).map((n) => n.type);
+}
+
+function pressKey(editor: Editor, key: string, textToFocus: string, offset = 0) {
+  const target = editor.value.document.getTexts().find((t) => t.text === textToFocus);
+  editor.moveTo(target.key as any, offset);
+
+  let passedToNext = false;
+  EditListPlugin.onKeyDown(
+    { key, shiftKey: false, preventDefault: () => {} } as any,
+    editor,
+    () => {
+      passedToNext = true;
+    }
+  );
+  return passedToNext;
+}
+
+describe('EditListPlugin', () => {
+  // MAILSPRING-CLIENT-EV: email HTML can contain an <li> with no <ul>/<ol> around it. Slate's
+  // `unwrapNodeByPath` lifts such a node's one-element path to the empty root path, which
+  // `getDescendant` resolves to null, and `splitNodeByPath` then reads `.type` off null.
+  ['Enter', 'Backspace', 'Tab'].forEach((key) => {
+    it(`ignores ${key} inside a list_item that is not in a list`, () => {
+      const editor = editorWith([div('before'), listItem(div('')), div('after')]);
+      let passedToNext = false;
+      expect(() => {
+        passedToNext = pressKey(editor, key, '');
+      }).not.toThrow();
+      expect(passedToNext).toBe(true);
+      expect(childTypes(editor)).toEqual(['div', 'list_item', 'div']);
+    });
+  });
+
+  it('ignores Enter inside an orphaned list_item that is the only node in the document', () => {
+    const editor = editorWith([listItem(div(''))]);
+    expect(() => pressKey(editor, 'Enter', '')).not.toThrow();
+  });
+
+  it('still exits the list when Enter is pressed in an empty item', () => {
+    const editor = editorWith([
+      div('before'),
+      list(listItem(div('x')), listItem(div(''))),
+      div('after'),
+    ]);
+    expect(pressKey(editor, 'Enter', '')).toBe(false);
+    expect(childTypes(editor)).toEqual(['div', 'ul_list', 'div', 'div']);
+  });
+
+  it('still splits the item when Enter is pressed mid-text', () => {
+    const editor = editorWith([div('before'), list(listItem(div('xy'))), div('after')]);
+    expect(pressKey(editor, 'Enter', 'xy', 1)).toBe(false);
+    const items = (editor.value.document.nodes.get(1) as any).nodes.toArray() as any[];
+    expect(items.map((n) => n.text)).toEqual(['x', 'y']);
+  });
+});
+
+describe('Slate withoutNormalizing patch', () => {
+  it('restores normalization when the callback throws', () => {
+    const editor = editorWith([div('hello')]);
+    expect((editor as any).tmp.normalize).toBe(true);
+
+    expect(() =>
+      editor.withoutNormalizing(() => {
+        throw new Error('simulated crash');
+      })
+    ).toThrow();
+
+    expect((editor as any).tmp.normalize).toBe(true);
+  });
+});
diff --git a/app/src/components/composer-editor/base-block-plugins.tsx b/app/src/components/composer-editor/base-block-plugins.tsx
index 0f16d87ebe..cbb5f833f8 100644
--- a/app/src/components/composer-editor/base-block-plugins.tsx
+++ b/app/src/components/composer-editor/base-block-plugins.tsx
@@ -233,12 +233,35 @@ export const BLOCK_CONFIG: {
   },
 };
 
-export const EditListPlugin = new EditList({
+const EditListPluginBase = new EditList({
   types: [BLOCK_CONFIG.ol_list.type, BLOCK_CONFIG.ul_list.type],
   typeItem: BLOCK_CONFIG.list_item.type,
   typeDefault: BLOCK_CONFIG.div.type,
 });
 
+// `slate-edit-list` decides "is the cursor in a list?" with `getCurrentItem`, which returns
+// any parent block of type `list_item` — including one that isn't inside an `ol_list`/`ul_list`.
+// Email HTML regularly contains an `<li>` with no surrounding list, so that shape does reach
+// the composer. Handing Enter/Backspace to the plugin there routes into its `unwrapList`, whose
+// `unwrapNodeByKey` lifts the orphan's one-element path to the empty root path: Slate's
+// `assertNode` accepts that path (it resolves to the document itself) but `getDescendant`
+// returns null for it, so `splitNodeByPath` reads `.type` off null and throws
+// (MAILSPRING-CLIENT-EV). Fall through to the default handling when the item isn't really
+// in a list — the orphan then behaves like any other block.
+export const EditListPlugin = {
+  ...EditListPluginBase,
+  onKeyDown: (event: React.KeyboardEvent, editor: Editor, next: () => void) => {
+    const { utils } = EditListPluginBase;
+    const { value } = editor;
+    // `startBlock` is the precondition `getCurrentItem` itself assumes; it runs on every
+    // keystroke here, not just the keys the plugin handles.
+    if (value.startBlock && utils.getCurrentItem(value) && !utils.getCurrentList(value)) {
+      return next();
+    }
+    return EditListPluginBase.onKeyDown(event, editor, next);
+  },
+};
+
 function renderNode(props, editor: Editor = null, next = () => {}) {
   const config = BLOCK_CONFIG[props.node.type];
   return config ? config.render(props) : next();
diff --git a/app/src/components/composer-editor/conversion.tsx b/app/src/components/composer-editor/conversion.tsx
index 82e9a4136f..14ed090fae 100644
--- a/app/src/components/composer-editor/conversion.tsx
+++ b/app/src/components/composer-editor/conversion.tsx
@@ -25,6 +25,7 @@ import GrammarCheckPlugins from './grammar-check-plugins';
 import { Rule, ComposerEditorPlugin } from './types';
 
 import './patch-chrome-ime';
+import './patch-slate-normalizing';
 import { deepenPlaintextQuote } from './plaintext';
 
 export const schema = {
diff --git a/app/src/components/composer-editor/patch-slate-normalizing.ts b/app/src/components/composer-editor/patch-slate-normalizing.ts
new file mode 100644
index 0000000000..e368cf56ed
--- /dev/null
+++ b/app/src/components/composer-editor/patch-slate-normalizing.ts
@@ -0,0 +1,28 @@
+/*
+Slate's `Editor#withoutNormalizing` clears `editor.tmp.normalize`, runs the callback, and then
+restores the flag — but it does so without a `try/finally`, so a command that throws from inside
+the callback leaves normalization disabled for the rest of that editor's life.
+
+Almost every structural Slate command (delete, insertFragment, splitDescendants, unwrapNode, ...)
+runs inside `withoutNormalizing`, and exceptions thrown from a React event handler don't unmount
+anything — we report them and the composer stays open. So a single Slate error means the document
+is never repaired again for the rest of the session, and structurally invalid nodes that the
+schema would normally fix (eg. a `list_item` with no list around it, deserialized from email HTML)
+survive to crash later commands.
+
+Restore the flag when the callback throws so one error can't cascade.
+*/
+import { Editor } from 'slate';
+
+const prototype = (Editor as any).prototype;
+const withoutNormalizing = prototype.withoutNormalizing;
+
+prototype.withoutNormalizing = function (fn: (editor: Editor) => void) {
+  const previous = this.tmp.normalize;
+  try {
+    return withoutNormalizing.call(this, fn);
+  } catch (err) {
+    this.tmp.normalize = previous;
+    throw err;
+  }
+};

From 5562004de0c18b712559da32cb0667131d71ee1a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 20 Aug 2026 14:51:11 +0000
Subject: [PATCH 2/3] Address review nits: scope patch import, match key gate

- Only import patch-slate-normalizing inside the describe block that needs it,
  instead of at module scope, so it doesn't mutate Editor.prototype for every
  other spec in the run.
- Early-exit EditListPlugin's onKeyDown on the same three keys slate-edit-list
  itself dispatches on (Enter/Tab/Backspace), so the guard's extra tree walks
  don't run on every keystroke.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfnK1t6VeRn37exPfshj7P
---
 .../composer-editor/base-block-plugins-spec.tsx           | 8 +++++++-
 app/src/components/composer-editor/base-block-plugins.tsx | 8 ++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/app/spec/components/composer-editor/base-block-plugins-spec.tsx b/app/spec/components/composer-editor/base-block-plugins-spec.tsx
index f4614479bd..c9ae9c4ffc 100644
--- a/app/spec/components/composer-editor/base-block-plugins-spec.tsx
+++ b/app/spec/components/composer-editor/base-block-plugins-spec.tsx
@@ -1,6 +1,5 @@
 import { Editor, Value } from 'slate';
 import { EditListPlugin } from '../../../src/components/composer-editor/base-block-plugins';
-import '../../../src/components/composer-editor/patch-slate-normalizing';
 
 const text = (t: string) => ({ object: 'text', leaves: [{ object: 'leaf', text: t, marks: [] }] });
 const block = (type: string, nodes: any[]) => ({ object: 'block', type, data: {}, nodes });
@@ -80,6 +79,13 @@ describe('EditListPlugin', () => {
 });
 
 describe('Slate withoutNormalizing patch', () => {
+  // Imported here, not at module scope, since installing it mutates `Editor.prototype` for
+  // every other spec in the run and the `EditListPlugin` specs above don't need it — they
+  // build their editors with `plugins: []` so nothing ever normalizes.
+  beforeAll(() => {
+    require('../../../src/components/composer-editor/patch-slate-normalizing');
+  });
+
   it('restores normalization when the callback throws', () => {
     const editor = editorWith([div('hello')]);
     expect((editor as any).tmp.normalize).toBe(true);
diff --git a/app/src/components/composer-editor/base-block-plugins.tsx b/app/src/components/composer-editor/base-block-plugins.tsx
index cbb5f833f8..1b601c797c 100644
--- a/app/src/components/composer-editor/base-block-plugins.tsx
+++ b/app/src/components/composer-editor/base-block-plugins.tsx
@@ -251,10 +251,14 @@ const EditListPluginBase = new EditList({
 export const EditListPlugin = {
   ...EditListPluginBase,
   onKeyDown: (event: React.KeyboardEvent, editor: Editor, next: () => void) => {
+    // slate-edit-list's own onKeyDown only acts on these three keys; matching its gate here
+    // avoids running the guard below (a couple of tree walks) on every other keystroke.
+    if (event.key !== 'Enter' && event.key !== 'Tab' && event.key !== 'Backspace') {
+      return EditListPluginBase.onKeyDown(event, editor, next);
+    }
     const { utils } = EditListPluginBase;
     const { value } = editor;
-    // `startBlock` is the precondition `getCurrentItem` itself assumes; it runs on every
-    // keystroke here, not just the keys the plugin handles.
+    // `startBlock` is the precondition `getCurrentItem` itself assumes.
     if (value.startBlock && utils.getCurrentItem(value) && !utils.getCurrentList(value)) {
       return next();
     }

From 89df0812f8b17b802555ccd57dee6471077ec94b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 20 Aug 2026 14:54:17 +0000
Subject: [PATCH 3/3] Fix typecheck: use require in describe body, not
 beforeAll

The repo pins @types/jasmine 1.x, which doesn't declare `beforeAll` (a Jasmine 2.0
addition), so tsc failed with TS2304. A `describe` body runs once and synchronously
before its `it`s, so requiring the patch there keeps the same scoping without
needing a setup hook.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfnK1t6VeRn37exPfshj7P
---
 .../composer-editor/base-block-plugins-spec.tsx          | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/app/spec/components/composer-editor/base-block-plugins-spec.tsx b/app/spec/components/composer-editor/base-block-plugins-spec.tsx
index c9ae9c4ffc..cb29a3bcb8 100644
--- a/app/spec/components/composer-editor/base-block-plugins-spec.tsx
+++ b/app/spec/components/composer-editor/base-block-plugins-spec.tsx
@@ -79,12 +79,11 @@ describe('EditListPlugin', () => {
 });
 
 describe('Slate withoutNormalizing patch', () => {
-  // Imported here, not at module scope, since installing it mutates `Editor.prototype` for
+  // Required here, not at module scope, since installing it mutates `Editor.prototype` for
   // every other spec in the run and the `EditListPlugin` specs above don't need it — they
-  // build their editors with `plugins: []` so nothing ever normalizes.
-  beforeAll(() => {
-    require('../../../src/components/composer-editor/patch-slate-normalizing');
-  });
+  // build their editors with `plugins: []` so nothing ever normalizes. A `describe` body runs
+  // once, synchronously, before any of its `it`s, so this installs the patch exactly once.
+  require('../../../src/components/composer-editor/patch-slate-normalizing');
 
   it('restores normalization when the callback throws', () => {
     const editor = editorWith([div('hello')]);