Strip userinfo from git-open remote URLs

[graysurf]

Strip userinfo from git-open remote URLs

Summary

Normalize remotes by stripping userinfo across ssh/http(s) and scp-style URLs and add tests to cover non-git users and credentialed HTTPS remotes.

Problem

• Expected: git-normalize-remote-url should produce browser-safe https URLs without embedded credentials regardless of remote username.
• Actual: non-git scp-style remotes (e.g., alice@github.com:org/repo.git) stay unnormalized and https remotes with userinfo keep credentials in the URL.
• Impact: git-open can emit invalid URLs or leak credentials in terminal output.

Reproduction

1. Set a remote such as git remote set-url origin alice@github.com:org/repo.git.
2. Run git-normalize-remote-url origin.

• Expected result: https://github.com/org/repo
• Actual result: alice@github.com:org/repo

Issues Found

Severity: medium
Confidence: high
Status: open | fixed | deferred | needs-info

ID	Severity	Confidence	Area	Summary	Evidence	Status
PR-60-BUG-001	medium	high	scripts/git/git-open.zsh	Remote normalization leaves userinfo or scp-style usernames in browser URLs	scripts/git/git-open.zsh:53	fixed

Fix Approach

• Strip userinfo from scheme URLs and normalize scp-style remotes for any user.
• Add normalization tests for non-git users and credentialed https remotes.

Testing

• zsh -f tests/git-open-normalize-remote-url.test.zsh (pass)

Risk / Notes

• Userinfo is intentionally stripped from http(s) remotes to avoid credential leakage.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud