[TimeToBuildBob]

Summary

Treat caller bucket IDs as literal path segments at all 11 existing bucket-specific URL constructors with quote(bucket_id, safe=""). Fixed route suffixes, query parameters, JSON bodies and in-memory/queued bucket identities stay unchanged. Queued registration reaches encoded create_bucket; queued heartbeats retain the once-encoded endpoint across dispatch and retries.

Closes #155

No slash-ID guarantee, naming-policy change, queue rewrite or JavaScript-client change.

Reproduction / RED

On freshly fetched master c88cf12c6fb122447157c183322eb2b5c12e6266, actual requests transport for get_events("synthetic#fragment") sends /api/0/buckets/synthetic?limit=-1 and raises 404, rather than sending /api/0/buckets/synthetic%23fragment/events?limit=-1.

New repository wire tests before the production edit: 36 failed, 42 passed, 6 optional-server skipped. Failures cover hash, query-like and escape-like percent IDs at all 11 immediate constructors and queued heartbeat dispatch/retry. Ordinary, bare-invalid-percent and Unicode controls pass on the baseline; this does not claim all percent IDs were broken.

Verification on e4f4aac

• make test with repository venv: 206 passed, 6 skipped. The six optional real-server cases skip when aw-server is not installed; all actual HTTP wire tests run without it.
• Isolated supported-server run of tests/test_bucket_paths.py: 90 passed, including six real Flask + MemoryStorage cases. Server source is fetched master 994ea988, core c7821899; only synthetic disposable data is used. Actual SDK requests pass through a loopback HTTP listener into the Flask test client. This is not a production WSGI deployment claim.
• Independent encoded Flask create/list/delete controls establish support for all six tested IDs. Integration checks immediate CRUD/count/export/heartbeat, queued registration/setup and heartbeat dispatch, and unrelated-bucket nonmutation.
• Wire checks assert exact encoded paths, fixed suffixes, bounds/limit, force true/default false, heartbeat pulsetime, unchanged JSON data/import IDs and identical retry endpoints/bodies after 503.
• make typecheck: success, 31 source files.
• Repository Ruff check and format checks on the two changed files: pass.
• Original filing-time transport gate: GREEN against committed repair, exact wire /api/0/buckets/synthetic%23fragment/events?limit=-1.

The optional server suite can be run in an environment with compatible aw-server/aw-core installed using pytest -q tests/test_bucket_paths.py; default client-only CI retains the standalone wire coverage. Source adoption on master, package publication and deployment remain separate boundaries.

CI follow-through (056237f)

Fixed CI Black import spacing and moved mutating test setup/delete operations outside assert expressions (CodeQL finding). Build initially stopped before tests because Python 3.9 is unavailable on the newly moved Ubuntu 26.04 ubuntu-latest; pinned only the Ubuntu test leg to ubuntu-24.04, retaining Python 3.9 and the Windows/macOS matrix. Final local tests, typecheck, Black and Ruff checks pass; supported-server matrix remains 90/90. CI on the new head is still running.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

The PR quotes bucket IDs at all 11 bucket-specific URL constructors while leaving route suffixes, query values, request bodies, and in-memory IDs unchanged.

• Bucket-specific calls keep each bucket ID in one URL path segment.

_{Reviews (1) · Last reviewed commit: "fix(client): encode literal bucket path ..." · Reviewed by Greptile}

[TimeToBuildBob]

The CodeQL thread is already resolved by the follow-up commits. On current head 056237f, five checks have passed; Windows and macOS tests are still running. No further code change or rerun is needed now. Merge remains a maintainer action (Bob has Triage access).

[TimeToBuildBob]

CI-green and mergeable (Greptile 5/5) — waiting only on a maintainer click.

This PR is ready to merge, but the bot has pull-only access to this repo and can't self-merge — surfacing it here so it isn't lost. The monitoring loop will stop re-flagging it now that this note is posted.