fix(claude-code): allow dot-prefixed segments in git-subdir paths

[devin-ai-integration]

TLDR

Problem this solves:

• git-subdir paths starting with a dot (e.g. .claude/skills/...) are rejected

How it solves it:

• allow leading dots in segments while still blocking . and .. traversal

Relevant issues

Fixes #34778

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

Live proxy (litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml) with a local Postgres, hitting POST /claude-code/plugins

Before the fix (base regex, commit 48b5a5a), a dot-prefixed path is wrongly rejected

=== 1) dot-prefixed path .claude/skills/my-skill (bug: rejected) ===
{"detail":{"error":"git-subdir 'path' must be a relative path of the form 'segment/segment' (alphanumeric, dots, hyphens, underscores only)"}}
HTTP 400

=== 2) traversal ../secrets (rejected, correct) ===
{"detail":{"error":"git-subdir 'path' must be a relative path of the form 'segment/segment' (alphanumeric, dots, hyphens, underscores only)"}}
HTTP 400

After the fix (commit 57aa811), the dot-prefixed path is accepted and traversal stays blocked

=== 1) dot-prefixed path .claude/skills/my-skill ===
{"status":"success","action":"created","plugin":{"id":"ed614dbd-f16a-4169-b987-47eda93640f6","name":"my-skill","version":"1.0.0","description":null,"source":{"source":"git-subdir","url":"https://github.com/org/repo.git","path":".claude/skills/my-skill"},"enabled":true}}
HTTP 200

=== 2) traversal ../secrets (must stay 400) ===
{"detail":{"error":"git-subdir 'path' must be a relative path of the form 'segment/segment' (alphanumeric, dots, hyphens, underscores only)"}}
HTTP 400

=== 3) dot-prefixed then traversal .claude/../secrets (must stay 400) ===
{"detail":{"error":"git-subdir 'path' must be a relative path of the form 'segment/segment' (alphanumeric, dots, hyphens, underscores only)"}}
HTTP 400

Type

🐛 Bug Fix

Changes

The old _VALID_GIT_SUBDIR_PATH_RE required every segment to start with [a-zA-Z0-9], so a leading dot was never accepted even though the error message advertised dots as valid. Conventional directories like .claude/ (same as .git/, .github/) were unusable

Each segment now allows a leading dot, and a negative lookahead (?!\.{1,2}(?:/|$)) rejects the . and .. segments so path traversal, leading /, backslashes, and percent-encoded sequences remain blocked

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

Link to Devin session: https://app.devin.ai/sessions/4c075dd8b53c4c64ae34086c00530388

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR broadens git-subdirectory validation to accept dot-prefixed path segments while continuing to reject exact . and .. segments.

• Introduces a reusable segment expression with an explicit traversal-segment guard.
• Adds success cases for common hidden directories and rejection cases for current-directory and parent-directory traversal.

Confidence Score: 5/5

The PR appears safe to merge with no actionable regressions identified.

The revised expression admits the intended dot-prefixed names while still rejecting exact . and .. segments at every path level, and the remaining character allowlist excludes alternate separators and encoded traversal forms.

Important Files Changed

Filename	Overview
litellm/proxy/anthropic_endpoints/claude_code_endpoints/claude_code_marketplace.py	Safely broadens the allowlisted path grammar to support dot-prefixed segments while preserving relative-path and traversal restrictions.
tests/test_litellm/proxy/anthropic_endpoints/test_claude_code_marketplace.py	Adds meaningful regression coverage for accepted hidden-directory paths and rejected exact traversal segments.

_{Reviews (1): Last reviewed commit: "fix(claude-code): allow dot-prefixed seg..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_fix_git_subdir_dot_prefixed_paths (57aa811) with litellm_internal_staging (2412326)}