up

internal/db/db.go

@@ -17,7 +17,11 @@ var migrationsFS embed.FS
 // Open opens (and creates if needed) the SQLite database at the given path,
 // enables performance PRAGMAs, and applies embedded migrations.
 func Open(path string) (*sql.DB, error) {
-	dsn := fmt.Sprintf("file:%s?_pragma=journal_mode(WAL)&_pragma=foreign_keys(on)&_pragma=synchronous(normal)&_pragma=busy_timeout(5000)", path)
+	// Escape only the two characters a path could contain that the DSN would
+	// otherwise read as its query/fragment delimiters. Windows separators
+	// (\\ and the drive ':') are left intact — url.PathEscape would mangle them.
+	safePath := strings.NewReplacer("?", "%3F", "#", "%23").Replace(path)
+	dsn := fmt.Sprintf("file:%s?_pragma=journal_mode(WAL)&_pragma=foreign_keys(on)&_pragma=synchronous(normal)&_pragma=busy_timeout(5000)", safePath)
 	conn, err := sql.Open("sqlite", dsn)
 	if err != nil {
 		return nil, fmt.Errorf("open sqlite: %w", err)