hive-forge: credential-helper fails closed when the configured forge URL won't parse

hive-forge/tests/credential_helper.rs

@@ -91,6 +91,29 @@ fn credential_helper_get_refuses_a_mismatched_host_and_withholds_the_token() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// A configured forge URL that doesn't parse must refuse like a genuine
+/// mismatch, not silently skip the check because there was nothing to
+/// compare against — the previous shape failed open exactly where this
+/// check exists to close a reported credential leak.
+#[test]
+fn credential_helper_get_refuses_when_the_configured_forge_url_does_not_parse() {
+    let dir = scratch_state_dir("unparseable");
+    let (ok, stdout, stderr) = run_get(
+        "this is not a url",
+        &dir,
+        "protocol=https\nhost=not-the-forge.example\n",
+    );
+    assert!(
+        !ok,
+        "an unparseable configured URL must fail, stderr={stderr}"
+    );
+    assert!(
+        !stdout.contains(TOKEN),
+        "the token must never reach stdout when the forge URL won't parse: stdout={stdout}"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// The other side of the same check: a `host=` that matches the
 /// configured forge must still print the credentials, or every real git
 /// fetch/push would break.