forgedock 1.10.3 → 1.11.0

package/commands/recover-orphans.md

@@ -330,7 +330,7 @@ SWEEP_ID="sweep-$(date -u +%Y%m%dT%H%M%SZ)-$$"
 # Both reads run under pipefail in a subshell: the pipeline status would otherwise be jq's, and a gh failure
 # (rate limit, 403) would yield "[]" with exit 0, indistinguishable from "no live holder".
 claim_orphan() {
-  local num="$1" now cutoff comments live resp
+  local num="${1}" now cutoff comments live resp
   [ "$DRY_RUN" = "true" ] && return 0   # dry-run: no claim comment is posted (callers already skip dry-run resumes)
   now=$(date -u +%s); cutoff=$(( now - RECOVERY_CLAIM_TTL_MIN * 60 ))
   comments=$(set -o pipefail; gh api --paginate "repos/${GH_REPO}/issues/${num}/comments" 2>/dev/null \
@@ -380,7 +380,7 @@ Holder: /recover-orphans — resuming /work-on #${num}. Other sweeps and dispatc
 # every time (an identical-body edit may not bump updated_at). Never carries FORGE:HEARTBEAT or the RELEASED marker.
 refresh_orphan() {
   [ "$DRY_RUN" = "true" ] && return 0
-  [ -n "${CLAIM_COMMENT_ID:-}" ] && [ "${CLAIM_HELD_NUM:-}" = "$1" ] || return 0
+  [ -n "${CLAIM_COMMENT_ID:-}" ] && [ "${CLAIM_HELD_NUM:-}" = "${1}" ] || return 0
   gh api -X PATCH "repos/${GH_REPO}/issues/comments/${CLAIM_COMMENT_ID}" \
     -f body="${CLAIM_BODY}
 Refreshed: $(date -u +%Y-%m-%dT%H:%M:%SZ)" >/dev/null 2>&1 || true
@@ -390,7 +390,7 @@ Refreshed: $(date -u +%Y-%m-%dT%H:%M:%SZ)" >/dev/null 2>&1 || true
 start_claim_keepalive() {
   [ "$DRY_RUN" = "true" ] && return 0
   stop_claim_keepalive
-  local num="$1" interval=$(( RECOVERY_CLAIM_TTL_MIN * 60 / 3 ))
+  local num="${1}" interval=$(( RECOVERY_CLAIM_TTL_MIN * 60 / 3 ))
   [ "$interval" -ge 1 ] || interval=1
   ( while sleep "$interval"; do refresh_orphan "$num"; done ) >/dev/null 2>&1 &
   KEEPALIVE_PID=$!
@@ -408,9 +408,9 @@ stop_claim_keepalive() {
 release_orphan() {
   [ "$DRY_RUN" = "true" ] && return 0
   stop_claim_keepalive
-  [ "${CLAIM_HELD_NUM:-}" = "$1" ] || return 0
+  [ "${CLAIM_HELD_NUM:-}" = "${1}" ] || return 0
   unset CLAIM_HELD_NUM CLAIM_COMMENT_ID
-  gh issue comment "$1" ${GH_FLAG} --body "<!-- FORGE:RECOVERY_CLAIM_RELEASED -->
+  gh issue comment "${1}" ${GH_FLAG} --body "<!-- FORGE:RECOVERY_CLAIM_RELEASED -->
 **Sweep: ${SWEEP_ID}**
 Released by /recover-orphans." >/dev/null 2>&1 || true
 }
@@ -418,7 +418,7 @@ Released by /recover-orphans." >/dev/null 2>&1 || true
 # resume_orphan_inline <issue> — run after claim_orphan succeeded. The subshell EXIT trap releases the claim always:
 # on success and when the Skill call fails. The keepalive runs alongside the Skill call and is stopped by the release.
 resume_orphan_inline() {
-  local num="$1"
+  local num="${1}"
   (
     trap 'release_orphan "$num"' EXIT
     start_claim_keepalive "$num"

package/commands/review-pr-agents/protocols.md

@@ -177,6 +177,7 @@ Append this block at the very end of your comment (after the `---` footer line,
 7. **Empty block**: If no findings at all, include just the START/END markers
 8. **HTML comments**: The block is invisible in rendered markdown but parseable by the review system
 9. **Agent marker**: Include exactly one `<!-- FORGE:REVIEW-AGENT:{domain} -->` marker in the persisted body, where `{domain}` is the lowercase dispatched domain.
+10. **Reviewed SHA**: Include exactly one line `Reviewed-SHA: [REVIEW_SHA]` (the full 40-hex head you were pinned to) in the persisted body, outside the marker. `/review-pr` scopes its completion wait and idempotent re-entry to this line, so a comment without the current head does not count as a completed review. Do NOT put the SHA inside the `<!-- FORGE:REVIEW-AGENT:{domain} -->` marker.
 
 ### Domain Prefixes
 

package/commands/review-pr-staging.md

@@ -150,10 +150,31 @@ Agents receive `$IS_REENTRY`, `$PRIOR_OPEN_FINDINGS`, and `$PRIOR_RESOLVED_FINDI
 Resolve the staging→main PR number and post a routing marker immediately. This creates an audit trail — if a staging→main PR has no `FORGE:REVIEW_ROUTE` comment after this command was invoked, the review was bypassed or never started.
 
 ```bash
-# Resolve PR_NUMBER from $ARGUMENTS
-# $ARGUMENTS may be: a PR number, "staging", "feature", or "staging:feature"
-if echo "$ARGUMENTS" | grep -qE '^[0-9]+$'; then
-  PR_NUMBER="$ARGUMENTS"
+# Resolve PR_NUMBER from the argument string (never name the loader placeholder in this block: every
+# occurrence is substituted textually, comments included) <!-- Added: forge#3466 -->
+# The argument string may be: a PR number, "staging", "feature", or "staging:feature"
+# Only the first token is the PR ref; later tokens are flags (--auto-merge, --issue, ...) <!-- allowlist:check-command-side-effects -->
+# The loader substitutes the text before bash parses it, so read it from a quoted heredoc (never a quoted
+# assignment) and reject any string with a quote, backtick, dollar sign, backslash, newline or tab. <!-- Added: forge#3466 -->
+# NONCE RULE: before running, replace NONCE in BOTH delimiter lines with a fresh random hex string (e.g. `openssl rand -hex 16`) not present in the argument text. <!-- Added: forge#3466 -->
+IFS= read -r -d '' STAGING_ARGS_RAW <<'FORGE_ARGS_EOF_NONCE'
+$ARGUMENTS
+FORGE_ARGS_EOF_NONCE
+STAGING_ARGS_RAW="${STAGING_ARGS_RAW%$'\n'}"
+STAGING_ARGS_REJECTED=false
+case "$STAGING_ARGS_RAW" in
+  *'"'*|*'`'*|*'$'*|*'\'*|*$'\n'*|*$'\t'*)
+    echo "review-pr-staging: rejected argument string (contains a quote, backtick, dollar sign, backslash, newline or tab) - nothing parsed" >&2
+    STAGING_ARGS_REJECTED=true; STAGING_ARGS_RAW="" ;;
+esac
+PR_ARG="${STAGING_ARGS_RAW%% *}"
+PR_ARG_NUM=$(printf '%s' "$PR_ARG" | sed -nE 's#^(https?://[^ ]*/pull/)?([0-9]+)$#\2#p')
+if [ -n "$PR_ARG_NUM" ]; then
+  PR_NUMBER="$PR_ARG_NUM"
+elif [ "$STAGING_ARGS_REJECTED" = true ]; then
+  # Rejected string: stop. Never fall through to the open staging PR lookup or run later phases with no PR. <!-- Added: forge#3466 -->
+  echo "review-pr-staging: rejected argument string - stopping (nothing reviewed, nothing posted)" >&2
+  exit 1
 else
   # Find the open staging→main PR
   PR_NUMBER=$(gh pr list ${GH_FLAG} \
@@ -164,7 +185,8 @@ else
     --jq '.[0].number' 2>/dev/null || echo "")
 fi
 
-REVIEW_SHA_STAGING=$(gh pr view "$PR_NUMBER" ${GH_FLAG} --json headRefOid --jq '.headRefOid' 2>/dev/null | cut -c1-7 || echo "n/a")
+REVIEW_SHA_STAGING="n/a"  # gh pr view "" falls back to the current branch PR, so only look up a resolved number <!-- Added: forge#3466 -->
+[ -n "$PR_NUMBER" ] && REVIEW_SHA_STAGING=$(gh pr view "$PR_NUMBER" ${GH_FLAG} --json headRefOid --jq '.headRefOid' 2>/dev/null | cut -c1-7 || echo "n/a")
 
 if [ -n "$PR_NUMBER" ]; then
   gh pr comment "$PR_NUMBER" ${GH_FLAG} --body "<!-- FORGE:REVIEW_ROUTE mode=staging-deploy spec=review-pr-staging.md sha=${REVIEW_SHA_STAGING} -->"
@@ -330,7 +352,7 @@ If the gate exits with `RESULT: PASS` → a `<!-- FORGE:GATE_PASS -->` structure
 ```bash
 git fetch origin $DEFAULT_BRANCH $STAGING_BRANCH
 git diff origin/$DEFAULT_BRANCH...origin/$STAGING_BRANCH --stat | tail -20
-git diff origin/$DEFAULT_BRANCH...origin/$STAGING_BRANCH --numstat | awk '{add+=$1; del+=$2} END {print "Added:", add, "Deleted:", del, "Total:", add+del}'
+git diff origin/$DEFAULT_BRANCH...origin/$STAGING_BRANCH --numstat | awk '{add+=$(1); del+=$(2)} END {print "Added:", add, "Deleted:", del, "Total:", add+del}'
 git diff origin/$DEFAULT_BRANCH...origin/$STAGING_BRANCH --name-only | sort | uniq
 ```