@tryarcanist/cli 0.1.304 → 0.1.305

package/dist/index.js

@@ -22995,13 +22995,24 @@ function parseEgressAllowlistSourceFile(content, key = EGRESS_ALLOWLIST_SOURCE_P
 }
 
 // ../../shared/github/repo-url.ts
+var REPO_SEGMENT_PATTERN = /^[A-Za-z0-9_.][A-Za-z0-9_.-]*$/;
+var MAX_REPO_SEGMENT_LENGTH = 100;
+function isValidGithubRepoSegment(value) {
+  if (typeof value !== "string") return false;
+  if (!value || value.length > MAX_REPO_SEGMENT_LENGTH) return false;
+  if (value === "." || value === "..") return false;
+  return REPO_SEGMENT_PATTERN.test(value);
+}
+function parseGithubRepoCoordinate(owner, repo) {
+  return isValidGithubRepoSegment(owner) && isValidGithubRepoSegment(repo) ? { owner, repo } : null;
+}
 function parseGithubRepoFullName(value) {
   const shorthand = value.match(/^([a-zA-Z0-9_.-]+)\/([a-zA-Z0-9_.-]+)$/);
-  if (shorthand) return { owner: shorthand[1], repo: shorthand[2] };
+  if (shorthand) return parseGithubRepoCoordinate(shorthand[1], shorthand[2]);
   const ssh = value.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/);
-  if (ssh) return { owner: ssh[1], repo: ssh[2] };
+  if (ssh) return parseGithubRepoCoordinate(ssh[1], ssh[2]);
   const https = value.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
-  if (https) return { owner: https[1], repo: https[2] };
+  if (https) return parseGithubRepoCoordinate(https[1], https[2]);
   return null;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.304",
+  "version": "0.1.305",
   "description": "CLI for Arcanist - create and manage coding agent sessions",
   "type": "module",
   "bin": {