diff --git a/src/github/operations/branch.ts b/src/github/operations/branch.ts index 4de3546..870cd64 100644 --- a/src/github/operations/branch.ts +++ b/src/github/operations/branch.ts @@ -58,14 +58,16 @@ export function validateBranchName(branchName: string): void { ); } - // Strict whitelist pattern: alphanumeric start, then alphanumeric/slash/hyphen/underscore/period/hash. + // Strict whitelist pattern: alphanumeric start, then alphanumeric/slash/hyphen/underscore/period/hash/plus. // # is valid per git-check-ref-format and commonly used in branch names like "fix/#123-description". - // All git calls use execFileSync (not shell interpolation), so # carries no injection risk. - const validPattern = /^[a-zA-Z0-9][a-zA-Z0-9/_.#-]*$/; + // + is valid per git-check-ref-format and generated by Claude Code's EnterWorktree tool when + // converting worktree names containing "/" (e.g. "feat/foo" becomes "worktree-feat+foo"). + // All git calls use execFileSync (not shell interpolation), so neither # nor + carries injection risk. + const validPattern = /^[a-zA-Z0-9][a-zA-Z0-9/_.#+-]*$/; if (!validPattern.test(branchName)) { throw new Error( - `Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, or hashes (#).`, + `Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), or plus signs (+).`, ); } diff --git a/test/validate-branch-name.test.ts b/test/validate-branch-name.test.ts index 7fed15e..9594b48 100644 --- a/test/validate-branch-name.test.ts +++ b/test/validate-branch-name.test.ts @@ -45,6 +45,16 @@ describe("validateBranchName", () => { ).not.toThrow(); expect(() => validateBranchName("fix/issue-#42")).not.toThrow(); }); + + it("should accept branch names containing + (generated by Claude Code EnterWorktree)", () => { + // EnterWorktree converts "/" in worktree names to "+" when generating branch names. + // e.g. EnterWorktree("feat/skill-consolidation") → branch "worktree-feat+skill-consolidation" + expect(() => + validateBranchName("worktree-feat+skill-consolidation"), + ).not.toThrow(); + expect(() => validateBranchName("fix+issue-123")).not.toThrow(); + expect(() => validateBranchName("feature+new-thing")).not.toThrow(); + }); }); describe("command injection attempts", () => {