@expo/code-review-cli 0.6.0 → 0.7.0

package/build/core/exec.js

@@ -1,36 +1,271 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { tmpdir } from "node:os";
+import path from "node:path";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
 /**
  * Run a command capturing stdout/stderr. Never interpolates a shell, so
  * arguments are passed verbatim and are not subject to shell injection.
+ *
+ * With `input`, the call routes through spawn so the text can be streamed to
+ * stdin; every other caller keeps the execFile path unchanged.
  */
 export async function run(command, args, options = {}) {
+    if (options.input !== undefined) {
+        return runWithInput(command, args, options, options.input);
+    }
     const check = options.check ?? true;
     try {
         const { stdout, stderr } = await execFileAsync(command, args, {
             cwd: options.cwd,
             maxBuffer: options.maxBuffer ?? 64 * 1024 * 1024,
             encoding: "utf8",
+            env: options.env,
+            timeout: options.timeout,
+            killSignal: options.killSignal,
         });
         return { stdout, stderr, code: 0 };
     }
     catch (error) {
         const err = error;
-        if (!check) {
-            return { stdout: err.stdout ?? "", stderr: err.stderr ?? "", code: err.code ?? 1 };
+        // Same timeout contract as runWithInput: a child our own `timeout` killed
+        // resolves with `timedOut: true` (even under check) instead of a generic
+        // throw, so callers see one shape regardless of which path ran.
+        const timedOut = options.timeout !== undefined && err.killed === true;
+        if (!check || timedOut) {
+            return {
+                stdout: err.stdout ?? "",
+                stderr: err.stderr ?? "",
+                code: err.code ?? 1,
+                signal: err.signal,
+                timedOut: timedOut || undefined,
+            };
         }
         throw new Error(`Command failed: ${command} ${args.join(" ")}\n${err.stderr ?? err.message ?? ""}`.trim());
     }
 }
+/**
+ * Kill callbacks for children still running, so an interrupt or exit never
+ * orphans them. Detached children live in their own process group (see
+ * runWithInput), so SIGINT from Ctrl-C reaches only this process — without this,
+ * an aborted review leaves a credential-bearing `claude` running unbounded.
+ */
+const liveChildKillers = new Set();
+let childCleanupInstalled = false;
+function installChildCleanup() {
+    if (childCleanupInstalled) {
+        return;
+    }
+    childCleanupInstalled = true;
+    const killAll = () => {
+        for (const kill of liveChildKillers) {
+            kill();
+        }
+    };
+    process.on("exit", killAll);
+    for (const signal of ["SIGINT", "SIGTERM"]) {
+        process.on(signal, () => {
+            killAll();
+            // Re-raise the conventional exit code; registering a handler suppressed
+            // Node's default termination.
+            process.exitCode = signal === "SIGINT" ? 130 : 143;
+            process.exit();
+        });
+    }
+}
+/**
+ * spawn-based variant that feeds `input` to the child's stdin. Collects
+ * stdout/stderr up to `maxBuffer`, enforces `timeout`/`killSignal` manually, and
+ * resolves the same RunResult shape (with `timedOut`/`overflowed` set).
+ *
+ * The deadline is enforced with our own timers rather than spawn's native
+ * `timeout`: spawn sends `killSignal` once, to the direct child only, with no
+ * SIGKILL escalation — a child that traps SIGTERM, or a shim wrapper
+ * (volta/mise/asdf) whose grandchild holds the work, would run unbounded. Here a
+ * child launched detached forms its own process group, we signal the whole group,
+ * and a grace timer escalates to SIGKILL.
+ */
+function runWithInput(command, args, options, input) {
+    const check = options.check ?? true;
+    const maxBuffer = options.maxBuffer ?? 64 * 1024 * 1024;
+    return new Promise((resolve, reject) => {
+        const detached = process.platform !== "win32";
+        const child = spawn(command, args, {
+            cwd: options.cwd,
+            env: options.env,
+            detached,
+        });
+        let stdout = "";
+        let stderr = "";
+        let overflowed = false;
+        let timedOut = false;
+        let killTimer;
+        let graceTimer;
+        const clearTimers = () => {
+            if (killTimer)
+                clearTimeout(killTimer);
+            if (graceTimer)
+                clearTimeout(graceTimer);
+        };
+        // Signal the whole process group when detached so a shim wrapper's grandchild
+        // is killed too. On Windows there are no process groups — kill the tree via
+        // taskkill instead, for the same reason.
+        const killChild = (sig) => {
+            try {
+                if (process.platform === "win32" && child.pid !== undefined) {
+                    // A no-op error handler is required: an async spawn failure (ENOENT/EPERM)
+                    // has no other listener here and would otherwise throw unhandled and
+                    // crash the parent, defeating the point of this cleanup path.
+                    spawn(taskkillPath(), ["/pid", String(child.pid), "/T", "/F"]).on("error", () => { });
+                }
+                else if (detached && child.pid !== undefined) {
+                    process.kill(-child.pid, sig);
+                }
+                else {
+                    child.kill(sig);
+                }
+            }
+            catch {
+                // Already exited, or the group is gone — nothing to kill.
+            }
+        };
+        const emergencyKill = () => killChild("SIGKILL");
+        installChildCleanup();
+        liveChildKillers.add(emergencyKill);
+        if (options.timeout && options.timeout > 0) {
+            killTimer = setTimeout(() => {
+                timedOut = true;
+                killChild(options.killSignal ?? "SIGTERM");
+                graceTimer = setTimeout(() => killChild("SIGKILL"), 5000);
+                graceTimer.unref?.();
+            }, options.timeout);
+            killTimer.unref?.();
+        }
+        const cap = (current, chunk) => {
+            if (current.length >= maxBuffer) {
+                overflowed = true;
+                return current;
+            }
+            const next = current + chunk;
+            // Check AFTER appending too — a single oversized chunk must both flag the
+            // overflow and stay capped, not sail through because the pre-append length
+            // was still under the limit.
+            if (next.length > maxBuffer) {
+                overflowed = true;
+                return next.slice(0, maxBuffer);
+            }
+            return next;
+        };
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            stdout = cap(stdout, chunk);
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr = cap(stderr, chunk);
+        });
+        // A late I/O error on either stream (e.g. the process group getting
+        // SIGKILLed mid-read) would otherwise throw unhandled and crash the
+        // parent; the close handler reports the real outcome regardless.
+        child.stdout.on("error", () => { });
+        child.stderr.on("error", () => { });
+        child.on("error", (error) => {
+            clearTimers();
+            liveChildKillers.delete(emergencyKill);
+            if (!check) {
+                // A spawn error (ENOENT/EACCES) fires before any stderr can be
+                // captured, so fall back to error.message rather than resolving
+                // with an unexplained empty stderr.
+                resolve({ stdout, stderr: stderr || error.message, code: 1, timedOut, overflowed });
+                return;
+            }
+            reject(new Error(`Command failed: ${command} ${args.join(" ")}\n${error.message}`.trim()));
+        });
+        child.on("close", (code, signal) => {
+            clearTimers();
+            liveChildKillers.delete(emergencyKill);
+            const exitCode = code ?? 1;
+            if (overflowed && check) {
+                reject(new Error(`Command output exceeded ${maxBuffer} bytes: ${command}`));
+                return;
+            }
+            if (exitCode !== 0 && check && !timedOut) {
+                reject(new Error(`Command failed: ${command} ${args.join(" ")}\n${stderr}`.trim()));
+                return;
+            }
+            resolve({
+                stdout,
+                stderr,
+                code: exitCode,
+                signal: signal ?? undefined,
+                timedOut,
+                overflowed,
+            });
+        });
+        child.stdin.on("error", () => {
+            // A child that exits before reading stdin (e.g. bad args) closes the pipe;
+            // ignore EPIPE — the close handler reports the real outcome.
+        });
+        child.stdin.end(input);
+    });
+}
+/**
+ * Memoized trusted resolutions for the host `git`/`gh` binaries, keyed by name so
+ * git()'s many callers share ONE which/where lookup instead of each spawning their
+ * own. See resolveTrustedTool.
+ */
+const trustedToolResolutions = new Map();
+/**
+ * Resolve `git`/`gh` to a trusted ABSOLUTE path, refusing any binary that resolves
+ * INSIDE the reviewed tree. Every git/gh spawn goes through this, never a bare name.
+ *
+ * A review has chdir'd into the untrusted PR-head tree (and `ecr review` of a local
+ * branch, plus `ecr ci`/doctor, operate on an untrusted checkout). libuv on Windows
+ * searches the child's cwd BEFORE PATH when the command is a BARE NAME, so a
+ * PR-committed `git.bat`/`gh.exe` at the repo root would win the lookup and run with
+ * ambient secrets (GH_TOKEN, model creds) in its environment. Spawning a resolved
+ * absolute path does no cwd search at all — the same property that fixed `claude`
+ * and `opencode`. resolveOnPath itself does the which/where lookup from tmpdir(), so
+ * the in-tree shim is never even FOUND on POSIX or Windows; pathInside is the backstop.
+ *
+ * Memoized per name: resolveOnPath is cwd-INDEPENDENT (it looks up from tmpdir), so a
+ * first call can never cache a cwd-tainted value, and the host binary is stable for
+ * the process. The caller's cwd is NOT changed — only the binary is resolved, so
+ * git/gh keep operating on their target tree. Throws (not null) so callers that
+ * assume a working git/gh fail loudly rather than silently spawning nothing.
+ */
+export function resolveTrustedTool(name) {
+    let resolution = trustedToolResolutions.get(name);
+    if (!resolution) {
+        resolution = (async () => {
+            const resolved = await resolveOnPath(name);
+            if (!resolved) {
+                throw new Error(`The \`${name}\` CLI is not installed or not on PATH.`);
+            }
+            if (pathInside(resolved, process.cwd())) {
+                throw new Error(`refusing to run a \`${name}\` binary found inside the reviewed tree (${resolved}) — ` +
+                    `install ${name} on the host and remove it from the repository.`);
+            }
+            return resolved;
+        })();
+        trustedToolResolutions.set(name, resolution);
+    }
+    return resolution;
+}
+/** Test-only: drop memoized git/gh resolutions so a test can re-resolve under a changed cwd/PATH. */
+export function resetTrustedToolCache() {
+    trustedToolResolutions.clear();
+}
 export async function git(args, cwd) {
-    const { stdout } = await run("git", args, { cwd });
+    const gitPath = await resolveTrustedTool("git");
+    const { stdout } = await run(gitPath, args, { cwd });
     return stdout;
 }
 /** Resolve owner/repo from the current checkout via gh (for PR-targeting commands). */
 export async function resolveRepo(cwd) {
     try {
-        const { stdout } = await run("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], {
+        const gh = await resolveTrustedTool("gh");
+        const { stdout } = await run(gh, ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], {
             cwd,
         });
         const repo = stdout.trim();
@@ -52,10 +287,44 @@ export async function repoRoot(cwd) {
         return null;
     }
 }
-/** Whether an executable is resolvable on PATH. */
-export async function onPath(command) {
-    const { code } = await run(process.platform === "win32" ? "where" : "which", [command], {
+/** Absolute path of an executable on PATH (first match), or null if unresolved. */
+export async function resolveOnPath(command) {
+    // SECURITY: run the lookup from a trusted directory, never the inherited cwd.
+    // During a review the process has chdir'd into the untrusted PR-head tree, and
+    // Windows `where` searches the CURRENT DIRECTORY before PATH — a committed
+    // `claude.exe` at the repo root would win the lookup and be executed with the
+    // engine's credentials in its environment. tmpdir() is host-controlled.
+    const { stdout, code } = await run(process.platform === "win32" ? "where" : "which", [command], {
         check: false,
+        cwd: tmpdir(),
     });
-    return code === 0;
+    if (code !== 0) {
+        return null;
+    }
+    return stdout.trim().split("\n")[0]?.trim() || null;
+}
+/**
+ * Whether `filePath` lies inside `dir` (after resolution). Used as the backstop
+ * that refuses to execute a binary resolved from inside the reviewed tree.
+ */
+export function pathInside(filePath, dir) {
+    const rel = path.relative(path.resolve(dir), path.resolve(filePath));
+    return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+/**
+ * Absolute path to Windows' `taskkill`, so a process-tree kill never spawns a BARE
+ * `taskkill` — during a review the cwd is the untrusted PR-head tree, and Windows
+ * resolves a bare name against the current directory before PATH, so a PR-committed
+ * `taskkill.exe`/`.bat` at the tree root could otherwise run in place of the real one
+ * (with ambient secrets in its env) on the timeout-kill path. An absolute path does no
+ * search at all. `taskkill` always lives in System32, and `SystemRoot` is set by
+ * Windows, never by the PR. Callers stay win32-guarded.
+ */
+export function taskkillPath() {
+    const root = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+    return path.join(root, "System32", "taskkill.exe");
+}
+/** Whether an executable is resolvable on PATH. */
+export async function onPath(command) {
+    return (await resolveOnPath(command)) !== null;
 }

package/build/core/opencode.js

@@ -1,9 +1,41 @@
 import { createRequire } from "node:module";
 import path from "node:path";
 import { createOpencode } from "@opencode-ai/sdk";
+import { pathInside, resolveOnPath } from "./exec.js";
 import { RateLimitWatch } from "./throttle.js";
 import { toolMap } from "./tools.js";
 import { errorMessage, sleep } from "./util.js";
+/** Discriminant for the Claude Code CLI engine (see core/claude-code.ts). */
+export const CLAUDE_CODE_ENGINE = "claude-code";
+/**
+ * Resolve which engine an agent's pass dispatches to, and (when claude) which
+ * claude handle to run it against. The per-agent router (engineOf) wins; absent it
+ * the carrier's own single `engine` decides. When the pass is claude-routed the
+ * claude handle is the carrier itself (a claude-only run, where the carrier IS the
+ * claude handle) or its `.claude` field (any run that also drives OpenCode). Pure
+ * and side-effect-free so the seam's dispatch is unit-testable without spawning.
+ */
+export function resolveEngineDispatch(handle, agent) {
+    const engine = handle.engineOf?.(agent) ?? handle.engine ?? "opencode";
+    if (engine !== CLAUDE_CODE_ENGINE) {
+        return { engine };
+    }
+    // A claude-only run: the carrier itself IS the claude handle. Cast is safe (and
+    // still needed) because `handle` is typed OpencodeHandle here regardless.
+    if (handle.engine === CLAUDE_CODE_ENGINE) {
+        return { engine, claudeHandle: handle };
+    }
+    // Mixed run: engineOf routed this agent to claude-code, so the carrier's `.claude`
+    // field must be set. If it isn't, that's an invariant violation in how the handle
+    // was assembled, not a runtime fluke — fail loudly here instead of letting a bad
+    // cast smuggle `undefined` past the type checker and crash deep inside
+    // runClaudePrompt with no clue what went wrong.
+    if (!handle.claude) {
+        throw new Error(`Agent "${agent}" is routed to the claude-code engine but this handle has no ` +
+            `.claude carrier — the handle was assembled inconsistently.`);
+    }
+    return { engine, claudeHandle: handle.claude };
+}
 /** Sum token usage across attempts (for per-task/run totals). */
 export function addTokenUsage(into, from) {
     if (!from) {
@@ -158,11 +190,50 @@ export function opencodeBinSource() {
     const dir = bundledOpencodeBinDir();
     return { dir, pinned: dir !== null };
 }
+/**
+ * Resolve the `opencode` binary the way we trust it: OUR bundled shim when the
+ * dependency resolves, else a PATH lookup from a trusted cwd (resolveOnPath, never
+ * the inherited one) with a refusal of any binary that resolves INSIDE the current
+ * tree. Null when unresolved or in-tree.
+ *
+ * `ecr doctor`/`ecr setup-auth` may run inside a cloned untrusted repo, so a bare
+ * `opencode` handed to execFile/spawn resolves against the inherited cwd — and Windows
+ * checks the current directory before PATH, letting a PR-committed `opencode` shim run
+ * with ambient secrets in its env. Every opencode spawn in those commands goes through
+ * this, mirroring resolveClaudeCli for the `claude` binary.
+ */
+export async function resolveOpencodeCli() {
+    const bundled = bundledOpencodeBinDir();
+    if (bundled) {
+        // Our own dependency tree (require.resolve is relative to THIS module, not cwd), so
+        // it's trusted by construction — and NO in-tree refusal here: ecr's node_modules
+        // commonly sits under cwd when run from its own repo, which pathInside would then
+        // wrongly reject.
+        return path.join(bundled, "opencode");
+    }
+    // PATH fallback: resolved from a trusted cwd, and refused if it lands in-tree.
+    const cliPath = await resolveOnPath("opencode");
+    if (!cliPath || pathInside(cliPath, process.cwd())) {
+        return null;
+    }
+    return cliPath;
+}
 /** Start an in-process OpenCode server with the given inline config. */
 export async function startOpencode(config) {
     // Make our pinned CLI win over any global install (see bundledOpencodeBinDir).
     // The SDK takes no `env`, so PATH is the only lever; it spreads `process.env` at
     // spawn time, so setting it here reaches the child.
+    //
+    // SECURITY residual (accepted, POSIX-only deployment): the SDK spawns a BARE
+    // `opencode` (cross-spawn `launch("opencode")`), which on Windows resolves the name
+    // against the current directory before PATH — during a review the cwd is the
+    // untrusted PR-head tree, so a PR-committed `opencode.exe` at its root could run in
+    // its place. We deliberately do NOT reimplement the SDK's server bootstrap to inject
+    // an absolute path here: on POSIX (the supported platform) `execvp` never searches
+    // the cwd, so the hijack cannot fire, and forking the launch would mean silently
+    // maintaining our own copy of it against SDK drift. The direct-spawn `opencode`
+    // callers we own (`ecr doctor`/`ecr setup-auth`) are still hardened via
+    // resolveOpencodeCli. Revisit if Windows becomes a supported target.
     const binDir = bundledOpencodeBinDir();
     if (binDir) {
         process.env.PATH = `${binDir}${path.delimiter}${process.env.PATH ?? ""}`;
@@ -257,27 +328,19 @@ export function formatUnknownModels(unknown, auths) {
         // Do NOT blame the token alone: the most common causes have nothing to do with
         // the credential's validity (see below). An earlier version of this message sent
         // us to re-issue two perfectly good tokens.
-        const oauth = auth?.mode === "oauth";
-        const deadOauth = oauth && provider === "anthropic";
+        // No anthropic special case here anymore: anthropic models never reach the
+        // OpenCode preflight (engineForModel routes every anthropic/… id to the Claude
+        // Code engine), so this message only ever names non-anthropic providers.
         return (`The OpenCode server does not offer the "${provider}" provider, even though this run ` +
             `supplied a ${auth?.mode ?? "configured"} credential for it. OpenCode drops a provider whose ` +
             `credential it could not use, which makes every ${provider} model look nonexistent: ` +
             `${refused.map((entry) => entry.model).join(", ")}.\n` +
             `The credential itself is often FINE. Check these in order:\n` +
-            (deadOauth
-                ? `  1. anthropic OAuth cannot work through OpenCode at all. Anthropic does not permit ` +
-                    `Pro/Max subscription tokens in third-party tools, and OpenCode (since 1.3.0) ships no ` +
-                    `anthropic OAuth support — an oauth credential never registers the provider, no matter ` +
-                    `how valid the token is. Switch auth in .expo-code-review/config.jsonc to ` +
-                    `{ "mode": "api-key", "provider": "anthropic", "tokenEnv": "ANTHROPIC_API_KEY" } with a ` +
-                    `Console API key, or run with REVIEWER_MODEL set to a model you are logged into ` +
-                    `(e.g. REVIEWER_MODEL=openai/gpt-5.5).\n`
-                : "") +
             (tokenEnv
-                ? `  ${deadOauth ? "2" : "1"}. The credential is wrong for the mode. ` +
+                ? `  1. The credential is wrong for the mode. ` +
                     `auth.mode "api-key" expects a plain API key for ${provider}; an OAuth/subscription ` +
                     `token is not an API key. A truncated or half-pasted ${tokenEnv} fails the same way.\n`
-                : `  ${deadOauth ? "2" : "1"}. The credential is wrong for the configured auth.mode.\n`) +
+                : `  1. The credential is wrong for the configured auth.mode.\n`) +
             `Providers the server does offer: ${refused[0].suggestions.join(", ") || "(none)"}.`);
     }
     const lines = unknown.map((entry) => entry.reason === "provider"
@@ -295,6 +358,10 @@ export function formatUnknownModels(unknown, auths) {
  * per-pass as before.
  */
 export async function assertModelsResolvable(handle, models, auths) {
+    if (handle.engine === CLAUDE_CODE_ENGINE) {
+        const { assertClaudeModels } = await import("./claude-code.js");
+        return assertClaudeModels(handle, models);
+    }
     let available;
     try {
         available = await fetchProviderModels(handle);
@@ -502,6 +569,14 @@ export class AgentTimeoutError extends Error {
  * message completes.
  */
 export async function promptAgent(handle, args) {
+    // A Claude handle never runs OpenCode's session/polling machinery: consumers
+    // use promptAndParse, but guard here too so a direct call can't run this code
+    // against a Claude handle. Dispatch is per-agent (see resolveEngineDispatch).
+    const dispatch = resolveEngineDispatch(handle, args.agent);
+    if (dispatch.engine === CLAUDE_CODE_ENGINE) {
+        const { runClaudePrompt } = await import("./claude-code.js");
+        return runClaudePrompt(dispatch.claudeHandle, args);
+    }
     const maxWaitMs = args.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
     // ONE deadline for the whole pass, shared by the first attempt and any stall
     // retry, so retrying a wedged request can never push the pass past its declared
@@ -628,7 +703,7 @@ export async function promptAgent(handle, args) {
         }
     }
 }
-const CORRECTIVE = "\n\nIMPORTANT: your previous reply could not be parsed. Reply with ONLY the single " +
+export const CORRECTIVE = "\n\nIMPORTANT: your previous reply could not be parsed. Reply with ONLY the single " +
     "JSON object described above — no prose, no code fences, no partial output.";
 // Budget for a corrective "re-emit the JSON" reply — no fresh investigation, so
 // it should return almost immediately.
@@ -684,7 +759,7 @@ export function isTransientApiError(error) {
  * drop the whole pass with no retry, reported as a coverage gap. Non-transient
  * errors (incl. AgentTimeoutError) propagate immediately.
  */
-async function withTransientRetry(label, onActivity, fn) {
+export async function withTransientRetry(label, onActivity, fn) {
     for (let attempt = 0;; attempt++) {
         try {
             return await fn();
@@ -712,6 +787,11 @@ async function withTransientRetry(label, onActivity, fn) {
  * the task instead of retrying a non-convergent run.
  */
 export async function promptAndParse(handle, args, parse) {
+    const dispatch = resolveEngineDispatch(handle, args.agent);
+    if (dispatch.engine === CLAUDE_CODE_ENGINE) {
+        const { claudeCodePromptAndParse } = await import("./claude-code.js");
+        return claudeCodePromptAndParse(dispatch.claudeHandle, args, parse);
+    }
     let cost = 0;
     let truncated = false;
     let model;

package/build/core/prompts.js

@@ -57,6 +57,15 @@ export function sanitizeUntrusted(input, maxLength = 4000) {
     }
     return out.trim();
 }
+/**
+ * sanitizeUntrusted for a value that must stay on ONE line — a single-line bullet in a
+ * prompt. Collapsing newlines stops injected text from forging a standalone boundary
+ * line (e.g. a bare `EVIDENCE` fence delimiter) that the token-oriented
+ * sanitizeUntrusted does not itself remove.
+ */
+export function flattenUntrusted(input, maxLength = 4000) {
+    return sanitizeUntrusted(input, maxLength).replace(/\s*\n\s*/g, " ");
+}
 function withShared(config, rolePrompt) {
     return config.sharedPromptText
         ? `${config.sharedPromptText}\n\n---\n\n${rolePrompt}`
@@ -285,8 +294,16 @@ export function buildVerifierTask(finding, opts = {}) {
         `- line: ${finding.line ?? "(unspecified)"}`,
         `- severity: ${finding.severity}`,
         `- category: ${finding.category}`,
-        `- title: ${finding.title}`,
-        `- rationale: ${finding.rationale}`,
+        // title/rationale are LLM-authored over the untrusted diff (a reviewer may quote an
+        // adjacent malicious comment straight into them), and buildVerifierSystem is
+        // deliberately NOT wrapped in the shared injection-defense rules — so, like
+        // finding.file above, neutralize their prompt-boundary constructs rather than
+        // interpolating them raw. Flatten to one line too: these are single-line bullet
+        // values, so collapsing newlines stops injected text from forging a standalone
+        // boundary line (e.g. a bare `EVIDENCE` fence delimiter) that sanitizeUntrusted,
+        // which targets role/PR tokens, would not catch.
+        `- title: ${flattenUntrusted(finding.title)}`,
+        `- rationale: ${flattenUntrusted(finding.rationale)}`,
     ];
     if (finding.evidence) {
         lines.push("- code the finding claims is present (UNTRUSTED — verify it against the file):", "<<<EVIDENCE", finding.evidence, "EVIDENCE");

package/build/core/render.js

@@ -157,14 +157,33 @@ function renderSeveritySections(findings, link, idFor = fingerprintFinding) {
     }
     return out;
 }
+/**
+ * Indent every line of a multi-line value to a list item's content column.
+ *
+ * Rationales embed a `<details>` block, and only indenting the first line let
+ * that HTML escape the list item: GitHub then treated the closing `</details>`
+ * as ending a top-level HTML block, and because the next finding's bullet
+ * followed after a single newline it was emitted as raw text instead of
+ * Markdown. Every finding after the first in a group rendered with visible
+ * `**` and backticks.
+ *
+ * Blank lines stay truly empty — trailing whitespace would make them
+ * non-blank and reopen the same class of parsing bug.
+ */
+function indentContinuation(value, indent = "  ") {
+    return value.split("\n").map((line) => (line.trim() === "" ? "" : `${indent}${line}`));
+}
 function renderFindingLines(finding, link, id = fingerprintFinding(finding)) {
     const out = [
         `- **${finding.title}** — ${location(finding, link)} _(${finding.category})_ · \`id:${id}\``,
-        `  ${finding.rationale}`,
+        ...indentContinuation(finding.rationale),
     ];
     if (finding.suggestion) {
-        out.push(`  _Suggestion:_ ${finding.suggestion}`);
+        out.push(...indentContinuation(`_Suggestion:_ ${finding.suggestion}`));
     }
+    // Separator so a rationale ending in `</details>` cannot swallow the next
+    // bullet. Findings are already loose list items, so this changes no spacing.
+    out.push("");
     return out;
 }
 /** Parse the fingerprints embedded in a previously-posted comment body. */