[andyhorn]

Follows up #1, which introduced source links.

Every file:line link on a generated page now uses the full commit sha and a clean https://github.com/<owner>/<repo> base.

Changes

• validate-output.sh requires full-sha links. The old check was a substring match on the short sha, so /blob/abc1234/ passed. SKILL.md already says an abbreviated sha 404s once a squash merge takes the commit off every branch (fastapi PR 16102). A link now fails unless its sha is 40 hex characters starting with the short commit. A malformed sha argument exits 2.
• The remote-to-base sed in SKILL.md strips credentials and enforces github.com. The old one-liner only rewrote git@host:. An origin such as https://x-access-token:<token>@github.com/o/r.git, common in CI clones, copied the token into every link. ssh://git@github.com/o/r.git produced broken ssh:// links. The new snippet strips the scheme, any user:token@, and a port, and prints nothing unless the host is exactly github.com, which is the rule SKILL.md already states.

Verification

• All 9 samples pass validate-samples.sh. They already use full shas.
• A test page linking /blob/abc1234/ now fails.
• The remote snippet was run on 9 URL forms (scp, https, token-bearing https, ssh, ssh with a port, trailing slash, GitLab, GitHub Enterprise). Only the github.com forms produce a base, and none keeps credentials.

For the reviewer

• Check that the multi-line sed reads clearly in SKILL.md. The paragraph under it explains why it shouldn't be shortened.

🤖 Generated with Claude Code

[malav2110]

Hey @andyhorn, thanks for sending these! I'll start with this one since #18 builds on it, then go through #19 and #20. I'll aim to get you feedback on all four this week.

[andyhorn]

Great! I've just been having Claude review and find improvements before I start testing this skill at work.

[malav2110]

Thanks for the PR, @andyhorn ! I tried the token fix and the full-sha check, and both work. One small fix before I merge, inline below.