@codyswann/lisa 4.26.2 → 4.26.3

package/plugins/lisa-cursor/skills/lisa-jira-journey/scripts/parse-plan.py

@@ -25,6 +25,7 @@ Output (JSON):
     }
 """
 
+import ipaddress
 import json
 import os
 import re
@@ -41,6 +42,24 @@ from urllib.parse import urlsplit
 # a capture obligation.
 LOCAL_EVIDENCE_PATTERN = re.compile(r'\[(SCREENSHOT|EVIDENCE):\s*([^\]]+)\]')
 
+# One ASCII DNS name: dot-separated labels of letters, digits and inner hyphens.
+# IPv4 literals are a subset of this form. Anything else -- percent-encoding, a
+# trailing dot, an empty label, a leading or trailing hyphen -- is refused,
+# because a hostname this pattern cannot describe is one whose meaning depends
+# on who resolves it.
+DNS_NAME_PATTERN = re.compile(
+    r'^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$'
+)
+
+# The only two path spellings that mean "no path".
+ROOT_PATHS = ("", "/")
+
+DEFAULT_HTTPS_PORT = 443
+
+
+class JiraConfigError(Exception):
+    """A configured Jira server could not be established as trusted."""
+
 
 def jira_config_candidates():
     """Return project-first jira-cli config candidates without duplicates."""
@@ -80,63 +99,158 @@ def read_jira_config(config_path):
     return server, login
 
 
+def canonical_authority(netloc, hostname):
+    """Return the canonical authority for one host, or "" when it is not one."""
+    if netloc.startswith("["):
+        try:
+            return f"[{ipaddress.IPv6Address(hostname).compressed}]"
+        except ValueError:
+            return ""
+    return hostname if DNS_NAME_PATTERN.match(hostname) else ""
+
+
+def is_bare_origin(server, parsed):
+    """Report whether the raw value names an origin and nothing besides.
+
+    The query and fragment are checked against the raw string rather than the
+    parse, because ``https://host?`` and ``https://host`` parse to the same
+    empty query. A delimiter carrying nothing is still a component the operator
+    wrote and the trust key would discard.
+    """
+    if "?" in server or "#" in server:
+        return False
+    if parsed.scheme != "https" or "@" in parsed.netloc:
+        return False
+    return parsed.path in ROOT_PATHS
+
+
 def server_origin(server):
-    """Return the normalized HTTPS origin used as the credential trust key."""
+    """Return the canonical HTTPS origin, or "" when the value is not one.
+
+    This value is both the credential trust key and the base every request is
+    built from, so the two have to be the same string. A normalizer that reduced
+    an arbitrary URL to its origin would approve one value and send another:
+    userinfo, a query, a fragment, or a path would ride along into the request
+    while the trust check saw only the host, which is how an API token reaches a
+    URL that validation never approved. So the accepted grammar is a bare
+    origin -- ``https://host`` or ``https://host/`` with an optional non-default
+    port -- and every richer form is refused rather than trimmed down to fit.
+
+    Self-hosted context paths and internationalized hostnames are deliberately
+    out of scope: either needs its own base-path contract, and inventing one
+    here would re-open the gap between what is checked and what is sent.
+    """
+    if not server or any(char <= " " or char >= "\x7f" for char in server):
+        return ""
     try:
         parsed = urlsplit(server)
         port = parsed.port
     except ValueError:
         return ""
-    if parsed.scheme.lower() != "https" or not parsed.hostname:
+    if not parsed.hostname or port == 0:
+        return ""
+    if not is_bare_origin(server, parsed):
         return ""
-    if port == 0:
+    authority = canonical_authority(parsed.netloc, parsed.hostname)
+    if not authority:
         return ""
-    hostname = parsed.hostname.lower()
-    authority = f"[{hostname}]" if ":" in hostname else hostname
-    if port is not None and port != 443:
+    if port is not None and port != DEFAULT_HTTPS_PORT:
         authority = f"{authority}:{port}"
     return f"https://{authority}"
 
 
-def resolve_jira_config_path():
-    """Resolve a project config only when its host matches a user trust root."""
+def resolve_trusted_origin():
+    """Return the operator-owned origin a checkout config must match, or "".
+
+    An explicit JIRA_SERVER wins over the home config. A JIRA_SERVER that is not
+    a canonical origin raises rather than resolving to "": degrading a malformed
+    trust root into "no trust root" would silently widen what a checkout config
+    is allowed to claim, which is the opposite of what setting it asked for.
+    """
+    configured = os.environ.get("JIRA_SERVER", "")
+    if configured.strip():
+        origin = server_origin(configured)
+        if not origin:
+            raise JiraConfigError(
+                "JIRA_SERVER must be a valid HTTPS URL naming one origin, with "
+                "no userinfo, path, query or fragment"
+            )
+        return origin
+
+    home_config = (Path.home() / ".config" / ".jira" / ".config.yml").resolve()
+    if not home_config.exists():
+        return ""
+    return server_origin(read_jira_config(home_config)[0])
+
+
+def resolve_jira_config_path(trusted_origin=None):
+    """Select the jira-cli config that governs this checkout.
+
+    The nearest checkout-owned config is decisive. When one exists it must match
+    the operator's trust root, and a mismatch fails naming that file. Falling
+    through to the home config instead would report a missing or unusable home
+    config for a project config that was found and refused -- an error about the
+    wrong file, pointing whoever has to fix it away from the one that is wrong.
+
+    Args:
+        trusted_origin: The operator's trust root, resolved when not supplied.
+    """
     candidates = jira_config_candidates()
     home_config = candidates[-1]
-    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
-    if not trusted_server and home_config.exists():
-        trusted_server, _ = read_jira_config(home_config)
-    trusted_origin = server_origin(trusted_server)
+    if trusted_origin is None:
+        trusted_origin = resolve_trusted_origin()
 
     for candidate in candidates[:-1]:
         if not candidate.exists():
             continue
-        candidate_server, _ = read_jira_config(candidate)
-        if trusted_origin and server_origin(candidate_server) == trusted_origin:
-            return candidate
+        if not trusted_origin:
+            raise JiraConfigError(
+                f"jira-cli config {candidate} cannot be trusted: neither "
+                "JIRA_SERVER nor a home config establishes a trust root"
+            )
+        if server_origin(read_jira_config(candidate)[0]) != trusted_origin:
+            raise JiraConfigError(
+                f"jira-cli config {candidate} server does not match the "
+                "trusted JIRA server origin"
+            )
+        return candidate
     return home_config
 
 
 def get_jira_config():
-    """Read JIRA server and login from the project-first jira-cli config."""
-    config_path = resolve_jira_config_path()
+    """Read JIRA server and login from the project-first jira-cli config.
+
+    Every exit below happens before the token is read, so a configured URL that
+    fails validation cannot reach a request. The returned server is the
+    canonical origin, never the configured string, which is what keeps the value
+    that was checked and the value that is sent identical.
+    """
+    try:
+        trusted_origin = resolve_trusted_origin()
+        config_path = resolve_jira_config_path(trusted_origin)
+    except JiraConfigError as error:
+        print(f"ERROR: {error}", file=sys.stderr)
+        sys.exit(1)
+
     if not config_path.exists():
         print(f"ERROR: jira-cli config not found at {config_path}", file=sys.stderr)
         sys.exit(1)
 
     server, login = read_jira_config(config_path)
-
-    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
-    trusted_origin = server_origin(trusted_server)
-    if trusted_server and not trusted_origin:
-        print("ERROR: JIRA_SERVER must be a valid HTTPS URL", file=sys.stderr)
+    origin = server_origin(server)
+    if not origin:
+        print(
+            f"ERROR: JIRA server in {config_path} must be an HTTPS URL naming "
+            "one origin, with no userinfo, path, query or fragment",
+            file=sys.stderr,
+        )
         sys.exit(1)
-    if trusted_origin:
-        if server_origin(server) != trusted_origin:
-            print("ERROR: jira-cli config server does not match trusted JIRA_SERVER", file=sys.stderr)
-            sys.exit(1)
-        server = trusted_server.rstrip("/")
-    if not server_origin(server):
-        print("ERROR: JIRA server must be an HTTPS URL from a trusted config", file=sys.stderr)
+    if trusted_origin and origin != trusted_origin:
+        print(
+            f"ERROR: jira-cli config {config_path} server does not match the "
+            "trusted JIRA server origin",
+            file=sys.stderr,
+        )
         sys.exit(1)
 
     token = os.environ.get("JIRA_API_TOKEN", "")
@@ -144,7 +258,7 @@ def get_jira_config():
         print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)
         sys.exit(1)
 
-    return server, login, token
+    return origin, login, token
 
 
 def fetch_ticket(server, login, token, ticket_id):

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.26.2",
+  "version": "4.26.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-jira-journey/SKILL.md

@@ -37,8 +37,30 @@ python3 .claude/skills/jira-journey/scripts/parse-plan.py <TICKET_ID>
 
 The parser resolves Jira configuration from the checkout first: it searches
 `$CLAUDE_PROJECT_DIR/.lisa/jira-cli/.config.yml`, then the current directory and
-its parents, and only then falls back to `~/.config/.jira/.config.yml`. Do not
-copy project settings into the home-level file just to make this step work.
+its parents, and uses `~/.config/.jira/.config.yml` when no checkout config
+exists. Do not copy project settings into the home-level file just to make this
+step work.
+
+A checkout config is not automatically trusted. The first checkout candidate
+that exists is decisive — that is `$CLAUDE_PROJECT_DIR` when it is set, which
+outranks a config nearer the current directory, and only otherwise the nearest
+one walking up from the current directory. Its server must match the operator's
+trust root — `JIRA_SERVER` when set, otherwise the home config — and a mismatch
+fails naming that file rather than quietly using the home config instead, so the
+error points at the file that is actually wrong.
+
+`server` must be a bare HTTPS origin: `https://host`, optionally with a port and
+a single trailing slash. An explicit `:443` is accepted and canonicalized away,
+so `https://host:443` and `https://host` are the same origin and either may be
+configured. Userinfo (`https://user:token@…`), a query, a fragment, and any
+other path are refused rather than trimmed away. So are a hostname this parser
+cannot describe unambiguously — surrounding whitespace, control characters,
+percent-encoded or non-ASCII hostnames, a trailing dot, and port 0.
+The reason is that this value is both the trust key and the base every request
+is built from; normalizing a richer URL down to its origin would approve one
+value and then send the API token to a different one. Self-hosted context paths
+and internationalized hostnames are out of scope and would need their own
+base-path contract.
 
 The script outputs JSON with: `ticket`, `prerequisites`, `steps`, `viewports`, `assertions`.