Reject invalid store FQDN delimiters

[mbarak]

WHY are these changes introduced?

Store inputs are accepted as handles, domains, or supported admin URLs before the CLI builds requests from the normalized FQDN. Normalizing them with string replacements can preserve URL delimiter characters that are interpreted differently by URL parsing later.

This hardens store normalization by resolving supported inputs to a hostname first and rejecting unsupported URL components before the normalized FQDN can be used.

WHAT is this pull request doing?

• Parses store input through URL, adding https:// for bare handles/domains.
• Uses url.hostname as the store-domain candidate.
• Rejects fragments, query strings, credentials, ports, raw leading paths, and paths other than /, /admin, or /admin/.
• Validates hostname labels before returning the normalized store FQDN.
• Adds regression coverage for delimiter-based host confusion cases.
• Adds a patch changeset for @shopify/cli-kit.

How to test your changes?

git diff --check origin/main...HEAD
git diff --check
pnpm exec vitest run packages/cli-kit/src/public/node/context/fqdn.test.ts
pnpm exec eslint packages/cli-kit/src/public/node/context/fqdn.ts packages/cli-kit/src/public/node/context/fqdn.test.ts

Post-release steps

None.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

Co-authored-by: Pi AI noreply@pi.dev

[Copilot]

Pull request overview

Hardens normalizeStoreFqdn input handling by parsing store values through the WHATWG URL API, extracting the hostname as the canonical candidate, and rejecting unsupported URL components that could otherwise be reinterpreted later during URL construction/parsing.

Changes:

• Replace string-based normalization with URL parsing and hostname extraction, with explicit rejection of unsupported URL parts (credentials, port, query, fragment, and disallowed paths).
• Add hostname label validation to ensure the normalized store value is a valid DNS-style hostname before appending Shopify domains.
• Add regression tests for delimiter-based host confusion inputs and path rejection, plus a patch changeset for @shopify/cli-kit.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
packages/cli-kit/src/public/node/context/fqdn.ts	Switches store normalization to URL-based parsing + strict component/path validation and hostname label checks.
packages/cli-kit/src/public/node/context/fqdn.test.ts	Adds regression coverage for URL-delimiter reinterpretation cases and unsupported paths.
.changeset/reject-store-domain-delimiters.md	Adds a patch changeset documenting the user-facing hardening behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.