From db34fa2a21e7b68ebb6d0f7a9fc6908ffc35bce0 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <claude[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 06:42:16 +0000
Subject: [PATCH] fix: validate https:// scheme for hooks send webhook URL

The `hooks send` command accepted any user-supplied URL without validation.
This adds an https:// scheme check and a comment clarifying the intended use
(Zapier webhook catch hooks), matching Zapier's own webhook URL format.

Co-Authored-By: Claude Code <noreply@anthropic.com>
---
 tools/clis/zapier.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/clis/zapier.js b/tools/clis/zapier.js
index 082583d..ce18223 100755
--- a/tools/clis/zapier.js
+++ b/tools/clis/zapier.js
@@ -122,7 +122,9 @@ async function main() {
     case 'hooks':
       switch (sub) {
         case 'send': {
+          // Sends a POST to a Zapier webhook catch hook URL (e.g. https://hooks.zapier.com/hooks/catch/...)
           if (!args.url) { result = { error: '--url required' }; break }
+          if (!args.url.startsWith('https://')) { result = { error: '--url must use https://' }; break }
           if (!args.data) { result = { error: '--data required (JSON string)' }; break }
           let data
           try {