fix: address code scanning alerts (#240)

src/commands/install-github-app/repoSlug.test.ts

@@ -0,0 +1,36 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { extractGitHubRepoSlug } from './repoSlug.ts'
+
+test('keeps owner/repo input as-is', () => {
+  assert.equal(extractGitHubRepoSlug('Gitlawb/openclaude'), 'Gitlawb/openclaude')
+})
+
+test('extracts slug from https GitHub URLs', () => {
+  assert.equal(
+    extractGitHubRepoSlug('https://github.com/Gitlawb/openclaude'),
+    'Gitlawb/openclaude',
+  )
+  assert.equal(
+    extractGitHubRepoSlug('https://www.github.com/Gitlawb/openclaude.git'),
+    'Gitlawb/openclaude',
+  )
+})
+
+test('extracts slug from ssh GitHub URLs', () => {
+  assert.equal(
+    extractGitHubRepoSlug('git@github.com:Gitlawb/openclaude.git'),
+    'Gitlawb/openclaude',
+  )
+  assert.equal(
+    extractGitHubRepoSlug('ssh://git@github.com/Gitlawb/openclaude'),
+    'Gitlawb/openclaude',
+  )
+})
+
+test('rejects malformed or non-GitHub URLs', () => {
+  assert.equal(extractGitHubRepoSlug('https://gitlab.com/Gitlawb/openclaude'), null)
+  assert.equal(extractGitHubRepoSlug('https://github.com/Gitlawb'), null)
+  assert.equal(extractGitHubRepoSlug('not actually github.com/Gitlawb/openclaude'), null)
+})

src/commands/install-github-app/repoSlug.ts

@@ -0,0 +1,38 @@
+export function extractGitHubRepoSlug(value: string): string | null {
+  const trimmed = value.trim()
+
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) && !trimmed.includes('github.com')) {
+    return null
+  }
+
+  if (!trimmed.includes('github.com')) {
+    return trimmed
+  }
+
+  const sshMatch = trimmed.match(
+    /^(?:git@|ssh:\/\/git@)(?:www\.)?github\.com[:/](?<owner>[^/:\s]+)\/(?<repo>[^/\s]+?)(?:\.git)?\/?$/i,
+  )
+  if (sshMatch?.groups?.owner && sshMatch.groups.repo) {
+    return `${sshMatch.groups.owner}/${sshMatch.groups.repo}`
+  }
+
+  try {
+    const parsed = new URL(trimmed)
+    const hostname = parsed.hostname.toLowerCase()
+    if (hostname !== 'github.com' && hostname !== 'www.github.com') {
+      return null
+    }
+
+    const segments = parsed.pathname
+      .replace(/^\/+|\/+$/g, '')
+      .split('/')
+      .filter(Boolean)
+    if (segments.length < 2) {
+      return null
+    }
+
+    return `${segments[0]}/${segments[1]}`.replace(/\.git$/i, '')
+  } catch {
+    return null
+  }
+}