Allow semicolons in branch names

src/create-prompt/index.ts

@@ -454,7 +454,7 @@ function getCommitInstructions(
           Bash(git commit -m "<message>\\n\\n${coAuthorLine}")`
             : ""
         }
-        - Push to the remote: Bash(${GIT_PUSH_WRAPPER} origin ${branchName})`;
+        - Push to the remote: Bash(${GIT_PUSH_WRAPPER} origin '${branchName}')`;
     }
   }
 }

src/github/operations/branch.ts

@@ -74,12 +74,15 @@ export function validateBranchName(branchName: string): void {
   //   "_release/v1.2.3"), which previously failed validation as a PR's base branch.
   // Parentheses are valid per git-check-ref-format and commonly appear in branch names that
   //   use Conventional Commit-style scopes (e.g. "feat(parser)-handle-empty-input").
+  // ; is valid per git-check-ref-format and appears in branch names generated from ticket
+  //   titles by some trackers (e.g. "FIDA-3971;-adjust-mapping"), which previously failed
+  //   validation as a PR's head ref and blocked review-only runs on those PRs entirely.
   // All git calls use execFileSync (not shell interpolation), so none of these characters carry injection risk.
-  const validPattern = /^[a-zA-Z0-9@_][a-zA-Z0-9/_.#+,@()-]*$/;
+  const validPattern = /^[a-zA-Z0-9@_][a-zA-Z0-9/_.#+,@();-]*$/;
 
   if (!validPattern.test(branchName)) {
     throw new Error(
-      `Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character, underscore, or '@' and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), plus signs (+), commas (,), at signs (@), or parentheses.`,
+      `Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character, underscore, or '@' and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), plus signs (+), commas (,), at signs (@), parentheses, or semicolons (;).`,
     );
   }
 

test/create-prompt.test.ts

@@ -181,6 +181,30 @@ describe("generatePrompt", () => {
     ); // from review comments
   });
 
+  test("should single-quote the branch in the push instruction", async () => {
+    // The live grant is Bash(<wrapper>:*), a prefix match, so anything the model appends to
+    // that command is permitted and the shell splits it. An unquoted branch carrying a
+    // metacharacter would turn the suggested push into two commands.
+    const envVars: PreparedContext = {
+      repository: "owner/repo",
+      claudeCommentId: "12345",
+      triggerPhrase: "@claude",
+      eventData: {
+        eventName: "issues",
+        eventAction: "opened",
+        isPR: false,
+        issueNumber: "789",
+        baseBranch: "main",
+        claudeBranch: "feat;-scoped-branch",
+      },
+    };
+
+    const prompt = await generatePrompt(envVars, mockGitHubData, false, "tag");
+
+    expect(prompt).toContain("origin 'feat;-scoped-branch'");
+    expect(prompt).not.toContain("origin feat;-scoped-branch");
+  });
+
   test("should generate prompt for issue opened event", async () => {
     const envVars: PreparedContext = {
       repository: "owner/repo",

test/validate-branch-name.test.ts

@@ -38,6 +38,15 @@ describe("validateBranchName", () => {
       ).not.toThrow();
     });
 
+    it("should accept branch names containing semicolons", () => {
+      expect(() =>
+        validateBranchName("FIDA-3971;-adjust-mapping"),
+      ).not.toThrow();
+      expect(() =>
+        validateBranchName("FIDA-3983;-+3P-prod-costs-fix"),
+      ).not.toThrow();
+    });
+
     it("should accept typical branch name formats", () => {
       expect(() =>
         validateBranchName("claude/issue-123-20250101-1234"),