[juliusmarminge]

Any client with only orchestration:read could call sourceControl.lookupRepository with a selector such as evil.com#.ghe.com/o/n. The host passed the .ghe.com check, the server chose GH_TOKEN/GITHUB_TOKEN, and the request with the bearer token went to https://api.evil.com#.ghe.com, which is api.evil.com. Characters like ?, @ and / worked the same way.

The fix rejects any host that is not a plain hostname (with an optional port):

• parseGitHubRepositorySelector treats a host/owner/name selector with an invalid host as unparseable.
• As a second check, GitHubCredentials.get and environmentToken refuse to hand out a token for such a host (saved, env, or gh), whatever path it arrived by.

Checked and unchanged:

• GH_HOST: comes from the server's own environment, and env-token matching now also requires a valid host.
• parsePullRequestReference and URL selectors take the host from URL.host, which is already safe.
• Remote-derived hosts go through new URL(...).host.
• GitCafe has a fixed host allowlist.
• Forgejo picks a credential only by exact match against stored tea/fj logins.
• Bitbucket has a fixed API base.
• GitLab and Azure DevOps leave host and credential selection to their CLIs.

Tests: new failing-first cases in gitHubRepositoryResolution.test.ts and GitHubCredentials.test.ts.

Claude Opus 5.5 via Claude Code (in T3 Code)

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at 04a7143

Macroscope's review found this PR approvable — Repository selectors and credential lookups now reject malformed host text before retrieving tokens. This is a contained security hardening change that preserves normal GitHub and enterprise-host credential behavior.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.3 KiB	1.3 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.6 KiB	21.6 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.1 KiB	5.0 KiB	−35 B (−0.7%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.3 KiB	1.2 KiB	−35 B (−2.7%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	−41 B (−0.2%)	24.4 KiB	✅
Claude	Live turn messages	2	1	−1 (−50.0%)	8	✅

Baseline: e66ffcc · PR result: 04a7143 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: fix/github-selector-host-validation
• File: .coderabbit.config.ts
• Commit: 04a7143
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: 42f9af1a-b796-4779-bd63-91ed427431eb

Commits

Reviewing files that changed from the base of the PR and between e66ffcc and 04a7143.

Files selected for processing: 4

• packages/source-control-github/src/server/GitHubCredentials.test.ts
• packages/source-control-github/src/server/GitHubCredentials.ts
• packages/source-control-github/src/server/gitHubRepositoryResolution.test.ts
• packages/source-control-github/src/server/gitHubRepositoryResolution.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

Walkthrough

The change adds a shared GitHub host validator and applies it to environment-token lookup, credential lookup, and three-part repository selectors. Tests cover invalid host inputs and a selector with a port.

Changes: GitHub host validation

Layer / File(s)	Summary
Host validation for credentials packages/source-control-github/src/server/GitHubCredentials.ts, packages/source-control-github/src/server/GitHubCredentials.test.ts	A hostname pattern and exported validator are added. Environment-token lookup returns null for invalid hosts, and credential lookup returns GitHubNotSignedInError before checking host settings or credentials. Tests check that invalid inputs do not invoke the process runner.
Repository selector host validation packages/source-control-github/src/server/gitHubRepositoryResolution.ts, packages/source-control-github/src/server/gitHubRepositoryResolution.test.ts	Three-part selectors are accepted only when their lowercased host passes the validator. Tests cover a host with a port and selectors with suspicious characters or a leading hyphen.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• pingdotgg/t3code#23995: Both changes affect GH_REPO parsing and handling of repository selectors with invalid hosts.
• pingdotgg/t3code#21581: Both changes affect repository-specific GitHub credential selection through repository selectors.
• pingdotgg/t3code#21265: The PR adds repository-scoped credentials; this change validates hosts before credential lookup.

Suggested reviewers: maria-rcks, macroscopeapp

Merge Risk: Minimal · up to 04a71

No concrete merge-blocking defect is established; the host-validation change is ready for normal checks.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description explains the vulnerability, the fix, affected credential paths, and added tests. It does not provide the required scope and approval information, and the verification section does not …	Add explicit Problem, Change, Scope and approval, and Verification sections. Provide the triaged issue or maintainer approval, or explain why this focused obvious bug qualifies without one. Report the exact tests run and their observed resu…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary security fix: preventing repository lookups from sending GitHub tokens to arbitrary hosts.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the vulnerability, the fix, affected credential paths, and added tests. It does not provide the required scope and approval information, and the verification section does not report observed test results or unverified checks.

Resolution

Add explicit Problem, Change, Scope and approval, and Verification sections. Provide the triaged issue or maintainer approval, or explain why this focused obvious bug qualifies without one. Report the exact tests run and their observed results, and state what was not checked.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}