use strict equality rather than starts with and mock a sha for the revparse mock.

packages/cli/src/config/extension.test.ts

@@ -57,7 +57,9 @@ const mockGit = {
   fetch: vi.fn(),
   checkout: vi.fn(),
   listRemote: vi.fn(),
-  revparse: vi.fn(),
+  revparse: vi
+    .fn()
+    .mockResolvedValue('mock-sha-1234567890123456789012345678901234567890'),
   // Not a part of the actual API, but we need to use this to do the correct
   // file system interactions.
   path: vi.fn(),
@@ -170,6 +172,9 @@ describe('extension tests', () => {
 
   beforeEach(() => {
     vi.clearAllMocks();
+    mockGit.revparse.mockResolvedValue(
+      'mock-sha-1234567890123456789012345678901234567890',
+    );
     resetSettingsCacheForTesting();
     keychainData = {};
     mockKeychainStorage = {

packages/cli/src/config/extensions/github.ts

@@ -88,7 +88,7 @@ export async function cloneFromGit(
       // This prevents short hex-only branch/tag names (e.g. ticket numbers or 'deadbeef') from triggering false-positive security errors.
       const hexRegex = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
       if (hexRegex.test(refLower)) {
-        if (!checkedOutSha.toLowerCase().startsWith(refLower)) {
+        if (checkedOutSha.toLowerCase() !== refLower) {
           throw new Error(
             `Security verification failed: checked out SHA (${checkedOutSha}) does not match the requested pin (${installMetadata.ref}).`,
           );