diff --git a/‎.changeset/10614-file-name-bare-percent.md‎
Lines changed: 23 additions & 0 deletions b/‎.changeset/10614-file-name-bare-percent.md‎
Lines changed: 23 additions & 0 deletions
diff --git a/‎packages/fields/src/widgets/file-value.bare-percent-10614.test.tsx‎
Lines changed: 73 additions & 0 deletions b/‎packages/fields/src/widgets/file-value.bare-percent-10614.test.tsx‎
Lines changed: 73 additions & 0 deletions
diff --git a/‎packages/fields/src/widgets/file-value.test.ts‎
Lines changed: 35 additions & 0 deletions b/‎packages/fields/src/widgets/file-value.test.ts‎
Lines changed: 35 additions & 0 deletions
diff --git a/‎packages/fields/src/widgets/file-value.ts‎
Lines changed: 17 additions & 1 deletion b/‎packages/fields/src/widgets/file-value.ts‎
Lines changed: 17 additions & 1 deletion
@@ -0,0 +1,23 @@
+---
+'@object-ui/fields': patch
+---
+
+fix(fields): a file URL whose last segment holds a bare `%` renders, named by its raw segment (objectui#10614)
+
+`readFileValue` names a file value that carries no name of its own after the last
+segment of its URL, decoded with `decodeURIComponent`. A segment that is not a
+valid percent-encoding (`https://cdn.example.com/100%.png`, or
+`{ url: 'https://cdn.example.com/a%zz.pdf' }`) made that decode throw
+`URIError: URI malformed`, and the throw left `readFileValue` during render.
+`FileValueSchema.url` is a plain string, so such a value passes the contract.
+
+What a user saw: every face that reads the value (the `file`, `image` and
+`signature` cells, `FileField`, `FileCell`, `ImageField`, and a gallery's cover)
+threw while rendering. Under `SchemaRenderer` the nearest error boundary caught it,
+so one such value replaced a whole grid table, valid rows included, or a whole
+gallery with the "failed to render" panel.
+
+The decode is now guarded once, in the one helper that performs it: on `URIError`
+the name is the raw segment (`100%.png`, `a%zz.pdf`). A valid escape decodes as
+before (`report%20q3.pdf` is named `report q3.pdf`), and a value that carries its
+own `name` or `original_name` is unaffected.
@@ -0,0 +1,73 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * objectui#10614, through a rendered face: a file value whose URL's last
+ * segment is not a valid percent-encoding renders, named by its raw segment.
+ *
+ * `nameFromUrl` (in `file-value.ts`) passed that segment to
+ * `decodeURIComponent` unguarded, so `https://cdn.example.com/100%.png` and
+ * `{ url: 'https://cdn.example.com/a%zz.pdf' }` threw `URIError: URI malformed`
+ * out of `readFileValue`, during render. Measured at the base `eca2760`
+ * before this fix (a historical reading, not re-derived here): every face
+ * that reads such a value threw that error during render, and none of them
+ * contained it. Mounted through `SchemaRenderer`, the nearest error boundary
+ * caught it and replaced the WHOLE view with its "failed to render" panel:
+ * an `object-grid` lost its table (the `data-table` node), valid rows
+ * included, and an `object-gallery` lost every card.
+ *
+ * The helper-level pins, and the control that a valid escape still decodes,
+ * sit in `file-value.test.ts`. This file renders the record-detail face, the
+ * `file` cell renderer, resolved the way production call sites resolve it.
+ */
+import React from 'react';
+import { describe, it, expect, afterEach } from 'vitest';
+import { render, cleanup, within } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import { I18nProvider } from '@object-ui/i18n';
+import type { FileFieldMetadata } from '@object-ui/types';
+
+import { getCellRenderer } from '../index';
+
+const BARE_PERCENT = 'https://cdn.example.com/100%.png';
+const INVALID_ESCAPE = { url: 'https://cdn.example.com/a%zz.pdf' };
+const VALID_ESCAPE = 'https://cdn.example.com/report%20q3.pdf';
+
+const fileField: FileFieldMetadata = { name: 'attachment', label: 'Attachment', type: 'file', multiple: true };
+
+function renderFileCell(value: unknown) {
+  const CellRenderer = getCellRenderer('file');
+  return render(
+    <I18nProvider config={{ defaultLanguage: 'en', detectBrowserLanguage: false }}>
+      <CellRenderer value={value} field={fileField} />
+    </I18nProvider>,
+  );
+}
+
+afterEach(() => {
+  cleanup();
+});
+
+describe('objectui#10614: the file cell renders a URL whose last segment holds a bare `%`', () => {
+  it('both reported values render as links named by their raw last segment', () => {
+    const { container } = renderFileCell([BARE_PERCENT, INVALID_ESCAPE]);
+    expect(within(container).getByRole('link', { name: '100%.png' })).toHaveAttribute('href', BARE_PERCENT);
+    expect(within(container).getByRole('link', { name: 'a%zz.pdf' })).toHaveAttribute('href', INVALID_ESCAPE.url);
+  });
+
+  it('a single (non-array) value with a bare `%` renders too', () => {
+    const { container } = renderFileCell(BARE_PERCENT);
+    expect(within(container).getByRole('link', { name: '100%.png' })).toHaveAttribute('href', BARE_PERCENT);
+  });
+
+  it('THE CONTROL: a valid escape in the same cell still decodes', () => {
+    const { container } = renderFileCell([VALID_ESCAPE, BARE_PERCENT]);
+    expect(within(container).getByRole('link', { name: 'report q3.pdf' })).toHaveAttribute('href', VALID_ESCAPE);
+    expect(within(container).getByRole('link', { name: '100%.png' })).toHaveAttribute('href', BARE_PERCENT);
+  });
+});
@@ -145,6 +145,41 @@ describe('readFileValue', () => {
     });
   });
 
+  /**
+   * objectui#10614: a last segment that is not a valid percent-encoding made
+   * `decodeURIComponent` throw `URIError: URI malformed`, and `readFileValue`
+   * threw with it, during render. `FileValueSchema.url` is a plain string, so
+   * both values below pass the contract. The name is now the raw segment.
+   */
+  describe('a last segment holding a bare `%` names the file by its raw segment (objectui#10614)', () => {
+    it('a URL string whose last segment holds a bare `%` does not throw', () => {
+      const url = 'https://cdn.example.com/100%.png';
+      expect(() => readFileValue(url)).not.toThrow();
+      expect(readFileValue(url)).toEqual({ url, name: '100%.png', raw: url });
+    });
+
+    it('a { url } object whose last segment holds an invalid escape does not throw', () => {
+      const value = { url: 'https://cdn.example.com/a%zz.pdf' };
+      expect(() => readFileValue(value)).not.toThrow();
+      const view = readFileValue(value);
+      expect(view.name).toBe('a%zz.pdf');
+      expect(view.url).toBe(value.url);
+    });
+
+    it('readFileValues reads both values in one field without throwing', () => {
+      expect(
+        readFileValues(['https://cdn.example.com/100%.png', { url: 'https://cdn.example.com/a%zz.pdf' }]).map(
+          (v) => v.name,
+        ),
+      ).toEqual(['100%.png', 'a%zz.pdf']);
+    });
+
+    it('THE CONTROL: a valid escape still decodes', () => {
+      expect(readFileValue('https://cdn.example.com/report%20q3.pdf').name).toBe('report q3.pdf');
+      expect(readFileValue({ url: 'https://cdn.example.com/report%20q3.pdf' }).name).toBe('report q3.pdf');
+    });
+  });
+
   it('resolves a bare reference to the stable download URL', () => {
     const view = readFileValue('file_a', 'File');
 
 
@@ -117,12 +117,28 @@ export function fileUrlFromId(id: string): string {
  * signature is one (objectui#10493). It names nothing, so the caller's
  * fallback applies. The scheme is matched case-insensitively, as URL schemes
  * are.
+ *
+ * A segment that is not a valid percent-encoding (a bare `%`, as in
+ * `100%.png`, or `%zz`) names the file by its raw segment (objectui#10614).
+ * `FileValueSchema.url` is a plain string, so such a value is contract-valid,
+ * and `decodeURIComponent` throws `URIError` on it. Before this guard that
+ * throw escaped `readFileValue` during render, so one such value took down
+ * every face that reads it: the nearest error boundary replaced the whole
+ * table or gallery, valid rows included. The guard lives here, once, because
+ * every caller reaches the decode through this helper; a valid escape
+ * (`report%20q3.pdf`) still decodes as before.
  */
 function nameFromUrl(url: string): string | undefined {
   if (/^data:/i.test(url)) return undefined;
   const path = url.split(/[?#]/)[0] ?? url;
   const seg = path.split('/').filter(Boolean).pop();
-  return seg ? decodeURIComponent(seg) : url;
+  if (!seg) return url;
+  try {
+    return decodeURIComponent(seg);
+  } catch (err) {
+    if (err instanceof URIError) return seg;
+    throw err;
+  }
 }
 
 /**