[cyyeh]

Potential fix for https://github.com/Agentic-System-Lab/agent-loop-visualizer/security/code-scanning/1

Use URL parsing and host validation instead of substring matching when selecting the GitHub-related markdown entry.

Best fix (without changing intended functionality): in tests/test_app.py around line 534, replace the list comprehension filter from:

• "github.com" in m.value

to a predicate that parses m.value with urlsplit and checks the hostname/netloc is GitHub (exact github.com or a *.github.com subdomain). Since urlsplit is already imported in this file, no new import is needed. This keeps the test intent (“find the GitHub invite markdown”) while avoiding incomplete substring sanitization.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

🟡 Changes recommended

The invitation test parses an entire paragraph as a URL, causing hostname validation to discard the invitation and raise a ValueError during unpacking.

1 open issue

• Extract invitation URL before validating hostname · New

What changed in this PR

This PR attempts to address a code-scanning alert by replacing substring matching with GitHub hostname validation in the unsupported-model UI test.

Changes:

• Uses urlsplit to check for github.com or its subdomains when selecting the invitation Markdown.

File	Description
tests/​test_app.py	Replaces the invitation’s substring filter with URL hostname checks.

_{Review effort: Balanced}