feat(cli): --repo accepts any git URL, not just GitHub slugs

[AhmedTMM]

Summary

Follow-up to #3360. Lifts the GitHub-only restriction on `--repo`. The flag now takes any git URL.

```
spawn --repo user/repo # GitHub shorthand (still works)
spawn --repo https://gitlab.com/team/repo
spawn --repo git@github.com:user/repo.git
spawn --repo ssh://git@example.com/x/y.git
spawn --repo http://gitea.internal/x/y
```

How it works

New `normalizeRepoUrl()` helper in `shared/orchestrate.ts`:

• GitHub shorthand `user/repo` → `https://github.com/user/repo.git\` (unchanged behavior)
• HTTP(S) / ssh:// / git:// / git+ssh:// URLs → unchanged
• SCP-style `git@host:path` (host must contain a dot) → unchanged
• Anything containing shell metacharacters, whitespace, NUL bytes, or a leading `-` → rejected with a warn (no clone)

The clone URL is also `shellQuote`d at the call site as defense in depth.

Test plan

• `bunx @biomejs/biome check src/` — 0 errors
• `bunx tsc --noEmit -p .` — 0 production errors
• New `repo-url.test.ts` (10 cases): GitHub shorthand expansion, HTTPS / SSH / git:// / SCP pass-through, injection attempts (`;`, backticks, `$()`, `|`, `&&`, quotes), embedded whitespace, NUL bytes, leading `-`, gibberish, oversized inputs, surrounding whitespace trimming.
• Existing `orchestrate.test.ts` still passes.
• End-to-end smoke: `--repo` against a non-GitHub host (GitLab / Gitea)

Bumps CLI to 1.0.23.

🤖 Generated with Claude Code

[la14-1]

Review

Solid follow-up to #3360 — the URL matrix handled here is what users actually want.

Looks good

• normalizeRepoUrl is the right abstraction. Return-null-on-reject + logWarn at the call site gives a clean fail-closed story.
• SCP-style regex requires a dot in the host, which correctly disambiguates from GitHub shorthand. git@github.com:user/repo still flows through; git@localhost:path is rejected (niche, acceptable).
• Leading-- rejection prevents the classic --upload-pack=evil git-option-masquerade attack.
• Length cap at 500 + comprehensive shell-meta rejection + defense-in-depth shellQuote at the call site. Layered right.
• Test coverage is thorough: GitHub shorthand, HTTPS, SSH, git://, SCP-style, meta-chars (;, backticks, $(), |, &&, quotes), whitespace, NUL, leading -, path traversal, oversized input, whitespace trimming.

Minor

• mergeStateStatus: BEHIND — needs a rebase. When you do, the CLI version in package.json will also need to bump: feat(cli): posthog feature flags + fast_provision experiment #3366 / the revert are both ahead of you at 1.0.23/1.0.24, so this PR will need to land at 1.0.25.
• Rejects !, *, ?, # — not strictly dangerous (glob/history, only interactive-shell or git-URL-cosmetic), but harmless to reject. No action needed.
• SCP regex requires a . in the host — intentional per the docstring, but users cloning from a no-dot internal host (git@buildbox:team/repo) will be rejected. If that's a real use case, add an explicit ssh:// form guidance to the warn message.

Nice-to-have (not blocking)

• Consider logging the normalized clone URL alongside the original in the logStep("Cloning template repository...") path when they differ, so debug sessions can tell shorthand expansion from direct URL pass-through.

LGTM after rebase + version bump. No functional changes requested.

Reviewed by SPA

[la14-1]

Rebased onto latest main + bumped to 1.0.25 on Ahmed's behalf (maintainerCanModify was enabled). Full review at the earlier comment. CI green.

[AhmedTMM]

Summary

Follow-up to #3360. Lifts the GitHub-only restriction on `--repo`. The flag now takes any git URL.

```
spawn --repo user/repo # GitHub shorthand (still works)
spawn --repo https://gitlab.com/team/repo
spawn --repo git@github.com:user/repo.git
spawn --repo ssh://git@example.com/x/y.git
spawn --repo http://gitea.internal/x/y
```

How it works

New `normalizeRepoUrl()` helper in `shared/orchestrate.ts`:

• GitHub shorthand `user/repo` → `https://github.com/user/repo.git\` (unchanged behavior)
• HTTP(S) / ssh:// / git:// / git+ssh:// URLs → unchanged
• SCP-style `git@host:path` (host must contain a dot) → unchanged
• Anything containing shell metacharacters, whitespace, NUL bytes, or a leading `-` → rejected with a warn (no clone)

The clone URL is also `shellQuote`d at the call site as defense in depth.

Test plan

• `bunx @biomejs/biome check src/` — 0 errors
• `bunx tsc --noEmit -p .` — 0 production errors
• New `repo-url.test.ts` (10 cases): GitHub shorthand expansion, HTTPS / SSH / git:// / SCP pass-through, injection attempts (`;`, backticks, `$()`, `|`, `&&`, quotes), embedded whitespace, NUL bytes, leading `-`, gibberish, oversized inputs, surrounding whitespace trimming.
• Existing `orchestrate.test.ts` still passes.
• End-to-end smoke: `--repo` against a non-GitHub host (GitLab / Gitea)

Bumps CLI to 1.0.23.

🤖 Generated with Claude Code

[la14-1]

Review

Solid follow-up to #3360 — the URL matrix handled here is what users actually want.

Looks good

• normalizeRepoUrl is the right abstraction. Return-null-on-reject + logWarn at the call site gives a clean fail-closed story.
• SCP-style regex requires a dot in the host, which correctly disambiguates from GitHub shorthand. git@github.com:user/repo still flows through; git@localhost:path is rejected (niche, acceptable).
• Leading-- rejection prevents the classic --upload-pack=evil git-option-masquerade attack.
• Length cap at 500 + comprehensive shell-meta rejection + defense-in-depth shellQuote at the call site. Layered right.
• Test coverage is thorough: GitHub shorthand, HTTPS, SSH, git://, SCP-style, meta-chars (;, backticks, $(), |, &&, quotes), whitespace, NUL, leading -, path traversal, oversized input, whitespace trimming.

Minor

• mergeStateStatus: BEHIND — needs a rebase. When you do, the CLI version in package.json will also need to bump: feat(cli): posthog feature flags + fast_provision experiment #3366 / the revert are both ahead of you at 1.0.23/1.0.24, so this PR will need to land at 1.0.25.
• Rejects !, *, ?, # — not strictly dangerous (glob/history, only interactive-shell or git-URL-cosmetic), but harmless to reject. No action needed.
• SCP regex requires a . in the host — intentional per the docstring, but users cloning from a no-dot internal host (git@buildbox:team/repo) will be rejected. If that's a real use case, add an explicit ssh:// form guidance to the warn message.

Nice-to-have (not blocking)

• Consider logging the normalized clone URL alongside the original in the logStep("Cloning template repository...") path when they differ, so debug sessions can tell shorthand expansion from direct URL pass-through.

LGTM after rebase + version bump. No functional changes requested.

Reviewed by SPA

[la14-1]

Rebased onto latest main + bumped to 1.0.25 on Ahmed's behalf (maintainerCanModify was enabled). Full review at the earlier comment. CI green.

[AhmedTMM]

Summary

Follow-up to #3360. Lifts the GitHub-only restriction on `--repo`. The flag now takes any git URL.

```
spawn --repo user/repo # GitHub shorthand (still works)
spawn --repo https://gitlab.com/team/repo
spawn --repo git@github.com:user/repo.git
spawn --repo ssh://git@example.com/x/y.git
spawn --repo http://gitea.internal/x/y
```

How it works

New `normalizeRepoUrl()` helper in `shared/orchestrate.ts`:

• GitHub shorthand `user/repo` → `https://github.com/user/repo.git\` (unchanged behavior)
• HTTP(S) / ssh:// / git:// / git+ssh:// URLs → unchanged
• SCP-style `git@host:path` (host must contain a dot) → unchanged
• Anything containing shell metacharacters, whitespace, NUL bytes, or a leading `-` → rejected with a warn (no clone)

The clone URL is also `shellQuote`d at the call site as defense in depth.

Test plan

• `bunx @biomejs/biome check src/` — 0 errors
• `bunx tsc --noEmit -p .` — 0 production errors
• New `repo-url.test.ts` (10 cases): GitHub shorthand expansion, HTTPS / SSH / git:// / SCP pass-through, injection attempts (`;`, backticks, `$()`, `|`, `&&`, quotes), embedded whitespace, NUL bytes, leading `-`, gibberish, oversized inputs, surrounding whitespace trimming.
• Existing `orchestrate.test.ts` still passes.
• End-to-end smoke: `--repo` against a non-GitHub host (GitLab / Gitea)

Bumps CLI to 1.0.23.

🤖 Generated with Claude Code

[la14-1]

Review

Solid follow-up to #3360 — the URL matrix handled here is what users actually want.

Looks good

• normalizeRepoUrl is the right abstraction. Return-null-on-reject + logWarn at the call site gives a clean fail-closed story.
• SCP-style regex requires a dot in the host, which correctly disambiguates from GitHub shorthand. git@github.com:user/repo still flows through; git@localhost:path is rejected (niche, acceptable).
• Leading-- rejection prevents the classic --upload-pack=evil git-option-masquerade attack.
• Length cap at 500 + comprehensive shell-meta rejection + defense-in-depth shellQuote at the call site. Layered right.
• Test coverage is thorough: GitHub shorthand, HTTPS, SSH, git://, SCP-style, meta-chars (;, backticks, $(), |, &&, quotes), whitespace, NUL, leading -, path traversal, oversized input, whitespace trimming.

Minor

• mergeStateStatus: BEHIND — needs a rebase. When you do, the CLI version in package.json will also need to bump: feat(cli): posthog feature flags + fast_provision experiment #3366 / the revert are both ahead of you at 1.0.23/1.0.24, so this PR will need to land at 1.0.25.
• Rejects !, *, ?, # — not strictly dangerous (glob/history, only interactive-shell or git-URL-cosmetic), but harmless to reject. No action needed.
• SCP regex requires a . in the host — intentional per the docstring, but users cloning from a no-dot internal host (git@buildbox:team/repo) will be rejected. If that's a real use case, add an explicit ssh:// form guidance to the warn message.

Nice-to-have (not blocking)

• Consider logging the normalized clone URL alongside the original in the logStep("Cloning template repository...") path when they differ, so debug sessions can tell shorthand expansion from direct URL pass-through.

LGTM after rebase + version bump. No functional changes requested.

Reviewed by SPA

[la14-1]

Rebased onto latest main + bumped to 1.0.25 on Ahmed's behalf (maintainerCanModify was enabled). Full review at the earlier comment. CI green.

[AhmedTMM]

Summary

Follow-up to #3360. Lifts the GitHub-only restriction on `--repo`. The flag now takes any git URL.

```
spawn --repo user/repo # GitHub shorthand (still works)
spawn --repo https://gitlab.com/team/repo
spawn --repo git@github.com:user/repo.git
spawn --repo ssh://git@example.com/x/y.git
spawn --repo http://gitea.internal/x/y
```

How it works

New `normalizeRepoUrl()` helper in `shared/orchestrate.ts`:

• GitHub shorthand `user/repo` → `https://github.com/user/repo.git\` (unchanged behavior)
• HTTP(S) / ssh:// / git:// / git+ssh:// URLs → unchanged
• SCP-style `git@host:path` (host must contain a dot) → unchanged
• Anything containing shell metacharacters, whitespace, NUL bytes, or a leading `-` → rejected with a warn (no clone)

The clone URL is also `shellQuote`d at the call site as defense in depth.

Test plan

• `bunx @biomejs/biome check src/` — 0 errors
• `bunx tsc --noEmit -p .` — 0 production errors
• New `repo-url.test.ts` (10 cases): GitHub shorthand expansion, HTTPS / SSH / git:// / SCP pass-through, injection attempts (`;`, backticks, `$()`, `|`, `&&`, quotes), embedded whitespace, NUL bytes, leading `-`, gibberish, oversized inputs, surrounding whitespace trimming.
• Existing `orchestrate.test.ts` still passes.
• End-to-end smoke: `--repo` against a non-GitHub host (GitLab / Gitea)

Bumps CLI to 1.0.23.

🤖 Generated with Claude Code

[la14-1]

Review

Solid follow-up to #3360 — the URL matrix handled here is what users actually want.

Looks good

• normalizeRepoUrl is the right abstraction. Return-null-on-reject + logWarn at the call site gives a clean fail-closed story.
• SCP-style regex requires a dot in the host, which correctly disambiguates from GitHub shorthand. git@github.com:user/repo still flows through; git@localhost:path is rejected (niche, acceptable).
• Leading-- rejection prevents the classic --upload-pack=evil git-option-masquerade attack.
• Length cap at 500 + comprehensive shell-meta rejection + defense-in-depth shellQuote at the call site. Layered right.
• Test coverage is thorough: GitHub shorthand, HTTPS, SSH, git://, SCP-style, meta-chars (;, backticks, $(), |, &&, quotes), whitespace, NUL, leading -, path traversal, oversized input, whitespace trimming.

Minor

• mergeStateStatus: BEHIND — needs a rebase. When you do, the CLI version in package.json will also need to bump: feat(cli): posthog feature flags + fast_provision experiment #3366 / the revert are both ahead of you at 1.0.23/1.0.24, so this PR will need to land at 1.0.25.
• Rejects !, *, ?, # — not strictly dangerous (glob/history, only interactive-shell or git-URL-cosmetic), but harmless to reject. No action needed.
• SCP regex requires a . in the host — intentional per the docstring, but users cloning from a no-dot internal host (git@buildbox:team/repo) will be rejected. If that's a real use case, add an explicit ssh:// form guidance to the warn message.

Nice-to-have (not blocking)

• Consider logging the normalized clone URL alongside the original in the logStep("Cloning template repository...") path when they differ, so debug sessions can tell shorthand expansion from direct URL pass-through.

LGTM after rebase + version bump. No functional changes requested.

Reviewed by SPA

[la14-1]

Rebased onto latest main + bumped to 1.0.25 on Ahmed's behalf (maintainerCanModify was enabled). Full review at the earlier comment. CI green.

[AhmedTMM]

Summary

Follow-up to #3360. Lifts the GitHub-only restriction on `--repo`. The flag now takes any git URL.

```
spawn --repo user/repo # GitHub shorthand (still works)
spawn --repo https://gitlab.com/team/repo
spawn --repo git@github.com:user/repo.git
spawn --repo ssh://git@example.com/x/y.git
spawn --repo http://gitea.internal/x/y
```

How it works

New `normalizeRepoUrl()` helper in `shared/orchestrate.ts`:

• GitHub shorthand `user/repo` → `https://github.com/user/repo.git\` (unchanged behavior)
• HTTP(S) / ssh:// / git:// / git+ssh:// URLs → unchanged
• SCP-style `git@host:path` (host must contain a dot) → unchanged
• Anything containing shell metacharacters, whitespace, NUL bytes, or a leading `-` → rejected with a warn (no clone)

The clone URL is also `shellQuote`d at the call site as defense in depth.

Test plan

• `bunx @biomejs/biome check src/` — 0 errors
• `bunx tsc --noEmit -p .` — 0 production errors
• New `repo-url.test.ts` (10 cases): GitHub shorthand expansion, HTTPS / SSH / git:// / SCP pass-through, injection attempts (`;`, backticks, `$()`, `|`, `&&`, quotes), embedded whitespace, NUL bytes, leading `-`, gibberish, oversized inputs, surrounding whitespace trimming.
• Existing `orchestrate.test.ts` still passes.
• End-to-end smoke: `--repo` against a non-GitHub host (GitLab / Gitea)

Bumps CLI to 1.0.23.

🤖 Generated with Claude Code

[la14-1]

Review

Solid follow-up to #3360 — the URL matrix handled here is what users actually want.

Looks good

• normalizeRepoUrl is the right abstraction. Return-null-on-reject + logWarn at the call site gives a clean fail-closed story.
• SCP-style regex requires a dot in the host, which correctly disambiguates from GitHub shorthand. git@github.com:user/repo still flows through; git@localhost:path is rejected (niche, acceptable).
• Leading-- rejection prevents the classic --upload-pack=evil git-option-masquerade attack.
• Length cap at 500 + comprehensive shell-meta rejection + defense-in-depth shellQuote at the call site. Layered right.
• Test coverage is thorough: GitHub shorthand, HTTPS, SSH, git://, SCP-style, meta-chars (;, backticks, $(), |, &&, quotes), whitespace, NUL, leading -, path traversal, oversized input, whitespace trimming.

Minor

• mergeStateStatus: BEHIND — needs a rebase. When you do, the CLI version in package.json will also need to bump: feat(cli): posthog feature flags + fast_provision experiment #3366 / the revert are both ahead of you at 1.0.23/1.0.24, so this PR will need to land at 1.0.25.
• Rejects !, *, ?, # — not strictly dangerous (glob/history, only interactive-shell or git-URL-cosmetic), but harmless to reject. No action needed.
• SCP regex requires a . in the host — intentional per the docstring, but users cloning from a no-dot internal host (git@buildbox:team/repo) will be rejected. If that's a real use case, add an explicit ssh:// form guidance to the warn message.

Nice-to-have (not blocking)

• Consider logging the normalized clone URL alongside the original in the logStep("Cloning template repository...") path when they differ, so debug sessions can tell shorthand expansion from direct URL pass-through.

LGTM after rebase + version bump. No functional changes requested.

Reviewed by SPA

[la14-1]

Rebased onto latest main + bumped to 1.0.25 on Ahmed's behalf (maintainerCanModify was enabled). Full review at the earlier comment. CI green.

[AhmedTMM]

Summary

Follow-up to #3360. Lifts the GitHub-only restriction on `--repo`. The flag now takes any git URL.

```
spawn --repo user/repo # GitHub shorthand (still works)
spawn --repo https://gitlab.com/team/repo
spawn --repo git@github.com:user/repo.git
spawn --repo ssh://git@example.com/x/y.git
spawn --repo http://gitea.internal/x/y
```

How it works

New `normalizeRepoUrl()` helper in `shared/orchestrate.ts`:

• GitHub shorthand `user/repo` → `https://github.com/user/repo.git\` (unchanged behavior)
• HTTP(S) / ssh:// / git:// / git+ssh:// URLs → unchanged
• SCP-style `git@host:path` (host must contain a dot) → unchanged
• Anything containing shell metacharacters, whitespace, NUL bytes, or a leading `-` → rejected with a warn (no clone)

The clone URL is also `shellQuote`d at the call site as defense in depth.

Test plan

• `bunx @biomejs/biome check src/` — 0 errors
• `bunx tsc --noEmit -p .` — 0 production errors
• New `repo-url.test.ts` (10 cases): GitHub shorthand expansion, HTTPS / SSH / git:// / SCP pass-through, injection attempts (`;`, backticks, `$()`, `|`, `&&`, quotes), embedded whitespace, NUL bytes, leading `-`, gibberish, oversized inputs, surrounding whitespace trimming.
• Existing `orchestrate.test.ts` still passes.
• End-to-end smoke: `--repo` against a non-GitHub host (GitLab / Gitea)

Bumps CLI to 1.0.23.

🤖 Generated with Claude Code

[la14-1]

Review

Solid follow-up to #3360 — the URL matrix handled here is what users actually want.

Looks good

• normalizeRepoUrl is the right abstraction. Return-null-on-reject + logWarn at the call site gives a clean fail-closed story.
• SCP-style regex requires a dot in the host, which correctly disambiguates from GitHub shorthand. git@github.com:user/repo still flows through; git@localhost:path is rejected (niche, acceptable).
• Leading-- rejection prevents the classic --upload-pack=evil git-option-masquerade attack.
• Length cap at 500 + comprehensive shell-meta rejection + defense-in-depth shellQuote at the call site. Layered right.
• Test coverage is thorough: GitHub shorthand, HTTPS, SSH, git://, SCP-style, meta-chars (;, backticks, $(), |, &&, quotes), whitespace, NUL, leading -, path traversal, oversized input, whitespace trimming.

Minor

• mergeStateStatus: BEHIND — needs a rebase. When you do, the CLI version in package.json will also need to bump: feat(cli): posthog feature flags + fast_provision experiment #3366 / the revert are both ahead of you at 1.0.23/1.0.24, so this PR will need to land at 1.0.25.
• Rejects !, *, ?, # — not strictly dangerous (glob/history, only interactive-shell or git-URL-cosmetic), but harmless to reject. No action needed.
• SCP regex requires a . in the host — intentional per the docstring, but users cloning from a no-dot internal host (git@buildbox:team/repo) will be rejected. If that's a real use case, add an explicit ssh:// form guidance to the warn message.

Nice-to-have (not blocking)

• Consider logging the normalized clone URL alongside the original in the logStep("Cloning template repository...") path when they differ, so debug sessions can tell shorthand expansion from direct URL pass-through.

LGTM after rebase + version bump. No functional changes requested.

Reviewed by SPA

[la14-1]

Rebased onto latest main + bumped to 1.0.25 on Ahmed's behalf (maintainerCanModify was enabled). Full review at the earlier comment. CI green.

[AhmedTMM]

Summary

Follow-up to #3360. Lifts the GitHub-only restriction on `--repo`. The flag now takes any git URL.

```
spawn --repo user/repo # GitHub shorthand (still works)
spawn --repo https://gitlab.com/team/repo
spawn --repo git@github.com:user/repo.git
spawn --repo ssh://git@example.com/x/y.git
spawn --repo http://gitea.internal/x/y
```

How it works

New `normalizeRepoUrl()` helper in `shared/orchestrate.ts`:

• GitHub shorthand `user/repo` → `https://github.com/user/repo.git\` (unchanged behavior)
• HTTP(S) / ssh:// / git:// / git+ssh:// URLs → unchanged
• SCP-style `git@host:path` (host must contain a dot) → unchanged
• Anything containing shell metacharacters, whitespace, NUL bytes, or a leading `-` → rejected with a warn (no clone)

The clone URL is also `shellQuote`d at the call site as defense in depth.

Test plan

• `bunx @biomejs/biome check src/` — 0 errors
• `bunx tsc --noEmit -p .` — 0 production errors
• New `repo-url.test.ts` (10 cases): GitHub shorthand expansion, HTTPS / SSH / git:// / SCP pass-through, injection attempts (`;`, backticks, `$()`, `|`, `&&`, quotes), embedded whitespace, NUL bytes, leading `-`, gibberish, oversized inputs, surrounding whitespace trimming.
• Existing `orchestrate.test.ts` still passes.
• End-to-end smoke: `--repo` against a non-GitHub host (GitLab / Gitea)

Bumps CLI to 1.0.23.

🤖 Generated with Claude Code

[la14-1]

Review

Solid follow-up to #3360 — the URL matrix handled here is what users actually want.

Looks good

• normalizeRepoUrl is the right abstraction. Return-null-on-reject + logWarn at the call site gives a clean fail-closed story.
• SCP-style regex requires a dot in the host, which correctly disambiguates from GitHub shorthand. git@github.com:user/repo still flows through; git@localhost:path is rejected (niche, acceptable).
• Leading-- rejection prevents the classic --upload-pack=evil git-option-masquerade attack.
• Length cap at 500 + comprehensive shell-meta rejection + defense-in-depth shellQuote at the call site. Layered right.
• Test coverage is thorough: GitHub shorthand, HTTPS, SSH, git://, SCP-style, meta-chars (;, backticks, $(), |, &&, quotes), whitespace, NUL, leading -, path traversal, oversized input, whitespace trimming.

Minor

• mergeStateStatus: BEHIND — needs a rebase. When you do, the CLI version in package.json will also need to bump: feat(cli): posthog feature flags + fast_provision experiment #3366 / the revert are both ahead of you at 1.0.23/1.0.24, so this PR will need to land at 1.0.25.
• Rejects !, *, ?, # — not strictly dangerous (glob/history, only interactive-shell or git-URL-cosmetic), but harmless to reject. No action needed.
• SCP regex requires a . in the host — intentional per the docstring, but users cloning from a no-dot internal host (git@buildbox:team/repo) will be rejected. If that's a real use case, add an explicit ssh:// form guidance to the warn message.

Nice-to-have (not blocking)

• Consider logging the normalized clone URL alongside the original in the logStep("Cloning template repository...") path when they differ, so debug sessions can tell shorthand expansion from direct URL pass-through.

LGTM after rebase + version bump. No functional changes requested.

Reviewed by SPA

[la14-1]

Rebased onto latest main + bumped to 1.0.25 on Ahmed's behalf (maintainerCanModify was enabled). Full review at the earlier comment. CI green.

[AhmedTMM]

Summary

Follow-up to #3360. Lifts the GitHub-only restriction on `--repo`. The flag now takes any git URL.

```
spawn --repo user/repo # GitHub shorthand (still works)
spawn --repo https://gitlab.com/team/repo
spawn --repo git@github.com:user/repo.git
spawn --repo ssh://git@example.com/x/y.git
spawn --repo http://gitea.internal/x/y
```

How it works

New `normalizeRepoUrl()` helper in `shared/orchestrate.ts`:

• GitHub shorthand `user/repo` → `https://github.com/user/repo.git\` (unchanged behavior)
• HTTP(S) / ssh:// / git:// / git+ssh:// URLs → unchanged
• SCP-style `git@host:path` (host must contain a dot) → unchanged
• Anything containing shell metacharacters, whitespace, NUL bytes, or a leading `-` → rejected with a warn (no clone)

The clone URL is also `shellQuote`d at the call site as defense in depth.

Test plan

• `bunx @biomejs/biome check src/` — 0 errors
• `bunx tsc --noEmit -p .` — 0 production errors
• New `repo-url.test.ts` (10 cases): GitHub shorthand expansion, HTTPS / SSH / git:// / SCP pass-through, injection attempts (`;`, backticks, `$()`, `|`, `&&`, quotes), embedded whitespace, NUL bytes, leading `-`, gibberish, oversized inputs, surrounding whitespace trimming.
• Existing `orchestrate.test.ts` still passes.
• End-to-end smoke: `--repo` against a non-GitHub host (GitLab / Gitea)

Bumps CLI to 1.0.23.

🤖 Generated with Claude Code

[la14-1]

Review

Solid follow-up to #3360 — the URL matrix handled here is what users actually want.

Looks good

• normalizeRepoUrl is the right abstraction. Return-null-on-reject + logWarn at the call site gives a clean fail-closed story.
• SCP-style regex requires a dot in the host, which correctly disambiguates from GitHub shorthand. git@github.com:user/repo still flows through; git@localhost:path is rejected (niche, acceptable).
• Leading-- rejection prevents the classic --upload-pack=evil git-option-masquerade attack.
• Length cap at 500 + comprehensive shell-meta rejection + defense-in-depth shellQuote at the call site. Layered right.
• Test coverage is thorough: GitHub shorthand, HTTPS, SSH, git://, SCP-style, meta-chars (;, backticks, $(), |, &&, quotes), whitespace, NUL, leading -, path traversal, oversized input, whitespace trimming.

Minor

• mergeStateStatus: BEHIND — needs a rebase. When you do, the CLI version in package.json will also need to bump: feat(cli): posthog feature flags + fast_provision experiment #3366 / the revert are both ahead of you at 1.0.23/1.0.24, so this PR will need to land at 1.0.25.
• Rejects !, *, ?, # — not strictly dangerous (glob/history, only interactive-shell or git-URL-cosmetic), but harmless to reject. No action needed.
• SCP regex requires a . in the host — intentional per the docstring, but users cloning from a no-dot internal host (git@buildbox:team/repo) will be rejected. If that's a real use case, add an explicit ssh:// form guidance to the warn message.

Nice-to-have (not blocking)

• Consider logging the normalized clone URL alongside the original in the logStep("Cloning template repository...") path when they differ, so debug sessions can tell shorthand expansion from direct URL pass-through.

LGTM after rebase + version bump. No functional changes requested.

Reviewed by SPA

[la14-1]

Rebased onto latest main + bumped to 1.0.25 on Ahmed's behalf (maintainerCanModify was enabled). Full review at the earlier comment. CI green.