fix(raycast): reject unsafe base refs

[JSONbored]

Motivation

• Prevent git option injection by validating the inferred or caller-supplied baseRef before it is reused in git invocations so values like --output=/tmp/pwn cannot be parsed as git options.

Description

• Add validateSafeBaseRef(baseRef: string) which rejects empty or dash-prefixed refs and returns the validated ref for downstream use.
• Replace the previous baseRef assignment with a rawBaseRef and validate it via const baseRef = validateSafeBaseRef(rawBaseRef); before any git calls.
• Add regression tests to test/unit/raycast-local-repo-analyzer.test.ts covering both inferred remote HEAD refs and explicit baseRef inputs that start with - to ensure they are rejected early.

Testing

• Ran git diff --check which produced no issues and succeeded.
• Ran npx vitest run test/unit/raycast-local-repo-analyzer.test.ts and all unit tests passed (Test Files 1 passed, Tests 15 passed).
• Ran npm run typecheck (tsc --noEmit) which completed successfully with no type errors.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	8514fdf	Commit Preview URL Branch Preview URL	Jun 10 2026, 07:19 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#502 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.