[lelia]

Summary

Messages.get_manifest_file_url fell back to substring-matching diff.diff_url for github / gitlab / bitbucket when the config had no scm. That guess never affected a link: CliConfig always sets scm (default api), and without a config there is no repository_url to build a link from. diff_url also points at the Socket dashboard, not the SCM, as the comment just below the branch already says. This PR removes the branch so only config picks the SCM.

This clears CodeQL alert #8 (incomplete URL substring sanitization). There's no behavior change for CLI users.

Other open CodeQL alerts

These are being dismissed in the UI rather than changed in code:

• #3–#6, cache poisoning in pr-preview.yml: the workflow writes no cache (no actions/cache, no setup-python cache). It runs only when a maintainer labels a PR or dispatches the workflow, only for same-repo branches, and with a contents: read token.
• #7, clear-text logging in output.py: the --json output is meant to go to stdout. The report takes only repo, branch, commit_sha and the legal flag from config (FOSSA format: repo and branch), so no secrets reach it.

Testing

• Added a unit test that a GitHub-looking diff_url without an explicit scm falls back to the Socket report link.
• pytest tests/unit: 606 passed.

[cursor]

PR Summary

Low Risk
Small URL-building refactor in manifest linking with a test; no auth or data-path changes, and CLI configs already supply scm.

Overview
Manifest file links no longer infer SCM type from diff.diff_url in Messages.get_manifest_file_url. SCM is taken only from config.scm (default api), matching the fact that diff_url is a Socket dashboard URL, not the host repo.

When SCM is not explicitly GitHub/GitLab/Bitbucket, links fall back to the Socket report ?tab=files&file=… view. A unit test locks in that a GitHub-shaped diff_url without scm does not produce a blob URL.

This removes dead substring-matching logic and addresses a CodeQL incomplete URL substring sanitization finding, with no expected change for CLI flows that always set scm.

^{Reviewed by Cursor Bugbot for commit ca0e80b. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ca0e80b. Configure here.}