code-mower 0.5.0b5__py3-none-any.whl

code_mower/templates/lane_prompts/package-runtime.md

@@ -0,0 +1,12 @@
+# Package Runtime Lens
+
+Use this lens when a PR changes packaging, bootstrap, doctor, provider catalog, CLI dispatch, or extracted-package imports.
+
+Focus on:
+
+- Repo execution and extracted package execution both work.
+- Runtime choices are explicit: Python version, CLI command, environment variables, token requirements, and optional spend boundaries.
+- Package manifests include every file needed at runtime, including templates, lane configs, adapters, and prompt lenses.
+- Doctor checks reveal missing local CLIs or configuration instead of allowing silent fallback to random system tooling.
+
+Block if the reference repo passes but the generated package would import, dispatch, or locate templates incorrectly.

code_mower/templates/lane_prompts/security-threat-model.md

@@ -0,0 +1,22 @@
+# Security Threat Model Lens
+
+Use this lens for authentication, authorization, billing, entitlements, debug upload, secrets, storage, network APIs, and any change that crosses a trust boundary.
+
+Stance:
+
+- Reason from attacker capability, asset value, and trust boundaries before judging code shape.
+- Prefer least privilege, explicit authorization, scoped tokens, auditable decisions, and fail-closed behavior.
+- Treat logs, diagnostics, previews, artifacts, and exported benchmark bundles as possible disclosure surfaces.
+- Consider STRIDE-style threats: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
+
+Review focus:
+
+- Flag missing server-side authorization, quota, entitlement, ownership, or replay checks.
+- Flag token, secret, account-state, debug payload, or customer-data exposure in logs, artifacts, comments, client state, or shareable reports.
+- Flag client-side-only controls for protected actions.
+- Flag unsafe defaults, broad permissions, ambiguous identity binding, or failure paths that grant access.
+- Flag security-sensitive changes whose tests or diagnostics do not exercise the threat boundary.
+
+Block only when the PR creates a plausible security, privacy, billing, entitlement, or data-exposure risk. Do not block on generic hardening suggestions without a concrete exploit path or sensitive asset.
+
+When useful, phrase findings with: asset, actor, trust boundary, threat, control, failure mode, exploit path, and expected server-side invariant.

code_mower/templates/product-support/code_mower

@@ -0,0 +1,216 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+repo_root="$(CDPATH= cd -- "${script_dir}/.." && pwd -P)"
+standalone_shadow="${script_dir}/code_mower_standalone_shadow.sh"
+install_lock_acquired=0
+install_lock_dir=""
+
+python_is_supported() {
+  "$1" -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else 1)' >/dev/null 2>&1
+}
+
+resolve_python_candidate() {
+  case "$1" in
+    */*)
+      if [ -x "$1" ]; then
+        printf '%s\n' "$1"
+      fi
+      return 0
+      ;;
+    *) command -v "$1" 2>/dev/null || true ;;
+  esac
+}
+
+find_bootstrap_python() {
+  local candidate resolved
+  if [ -n "${CODE_MOWER_BOOTSTRAP_PYTHON:-}" ]; then
+    printf '%s\n' "${CODE_MOWER_BOOTSTRAP_PYTHON}"
+    return
+  fi
+  if [ -n "${CODE_MOWER_PYTHON:-}" ]; then
+    printf '%s\n' "${CODE_MOWER_PYTHON}"
+    return
+  fi
+
+  for candidate in ${CODE_MOWER_BOOTSTRAP_PYTHON_CANDIDATES:-python3.13 python3.12 python3.11 /opt/homebrew/bin/python3 /usr/local/bin/python3 /opt/homebrew/bin/python3.13 /opt/homebrew/bin/python3.12 /opt/homebrew/bin/python3.11 /usr/local/bin/python3.13 /usr/local/bin/python3.12 /usr/local/bin/python3.11 python3 python}; do
+    resolved="$(resolve_python_candidate "${candidate}")"
+    if [ -n "${resolved}" ] && python_is_supported "${resolved}"; then
+      printf '%s\n' "${resolved}"
+      return
+    fi
+  done
+
+  resolved="$(command -v python3 2>/dev/null || command -v python 2>/dev/null || true)"
+  printf '%s\n' "${resolved:-python3}"
+}
+
+bootstrap_python="$(find_bootstrap_python)"
+
+if [ "${CODE_MOWER_USE_LOCAL:-}" = "1" ] || [ "${CODE_MOWER_USE_STANDALONE:-1}" = "0" ]; then
+  unset CODE_MOWER_STANDALONE_COMMAND
+  unset CODE_MOWER_STANDALONE_PATH
+fi
+
+if [ -z "${CODE_MOWER_STANDALONE_COMMAND:-}" ] \
+  && [ -z "${CODE_MOWER_STANDALONE_PATH:-}" ] \
+  && [ -z "${CODE_MOWER_STANDALONE_DELEGATING:-}" ] \
+  && [ "${CODE_MOWER_USE_LOCAL:-}" != "1" ] \
+  && [ "${CODE_MOWER_USE_STANDALONE:-1}" != "0" ]; then
+  if [ -x "${standalone_shadow}" ]; then
+    export CODE_MOWER_STANDALONE_DELEGATING=1
+    exec "${standalone_shadow}" "$@"
+  fi
+  echo "warning: standalone delegation expected but ${standalone_shadow} is missing or not executable; running repo-local mirror" >&2
+fi
+
+release_install_lock() {
+  if [ "${install_lock_acquired}" = "1" ] && [ -n "${install_lock_dir}" ]; then
+    rm -rf "${install_lock_dir}"
+  fi
+  install_lock_acquired=0
+  install_lock_dir=""
+}
+trap release_install_lock EXIT
+
+acquire_install_lock() {
+  local lock_age lock_mtime lock_pid now parent_dir stale_seconds started timeout_seconds
+  install_lock_dir="${venv_dir}.install.lock"
+  parent_dir="$(dirname -- "${install_lock_dir}")"
+  stale_seconds="${CODE_MOWER_STANDALONE_LOCK_STALE_SECONDS:-30}"
+  timeout_seconds="${CODE_MOWER_STANDALONE_LOCK_TIMEOUT_SECONDS:-120}"
+  started="$(date +%s)"
+  mkdir -p "${parent_dir}"
+  while ! mkdir "${install_lock_dir}" 2>/dev/null; do
+    now="$(date +%s)"
+    lock_pid=""
+    if [ -f "${install_lock_dir}/pid" ]; then
+      lock_pid="$(cat "${install_lock_dir}/pid" 2>/dev/null || true)"
+    fi
+    lock_mtime="$(stat -c %Y "${install_lock_dir}" 2>/dev/null || stat -f %m "${install_lock_dir}" 2>/dev/null || echo "${now}")"
+    case "${lock_mtime}" in
+      ''|*[!0-9]*) lock_mtime="${now}" ;;
+    esac
+    lock_age=$((now - lock_mtime))
+    if [ -z "${lock_pid}" ] && [ "${lock_age}" -ge "${stale_seconds}" ]; then
+      rm -rf "${install_lock_dir}" 2>/dev/null || true
+      continue
+    fi
+    if [ -n "${lock_pid}" ] && ! kill -0 "${lock_pid}" 2>/dev/null; then
+      rm -rf "${install_lock_dir}" 2>/dev/null || true
+      continue
+    fi
+    if [ $((now - started)) -ge "${timeout_seconds}" ]; then
+      echo "error: timed out waiting for standalone install lock: ${install_lock_dir}" >&2
+      exit 1
+    fi
+    sleep 0.2
+  done
+  install_lock_acquired=1
+  printf '%s\n' "$$" > "${install_lock_dir}/pid"
+}
+
+check_standalone_python() {
+  if [ "${CODE_MOWER_SKIP_STANDALONE_PYTHON_CHECK:-}" = "1" ]; then
+    return
+  fi
+  if ! "${bootstrap_python}" -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else 1)' >/dev/null 2>&1; then
+    echo "error: Code Mower standalone install requires Python >= 3.11; ${bootstrap_python} is unsupported. Set CODE_MOWER_BOOTSTRAP_PYTHON=/path/to/python3.11+ or install python3.11/python3.12." >&2
+    exit 1
+  fi
+}
+
+if [ -n "${CODE_MOWER_STANDALONE_COMMAND:-}" ]; then
+  exec "${CODE_MOWER_STANDALONE_COMMAND}" "$@"
+fi
+
+if [ -n "${CODE_MOWER_STANDALONE_PATH:-}" ]; then
+  standalone_path="${CODE_MOWER_STANDALONE_PATH}"
+  if [ ! -f "${standalone_path}/pyproject.toml" ]; then
+    echo "error: CODE_MOWER_STANDALONE_PATH does not look like a Code Mower package: ${standalone_path}" >&2
+    exit 1
+  fi
+  standalone_path="$(CDPATH= cd -- "${standalone_path}" && pwd -P)"
+
+  venv_dir="${CODE_MOWER_STANDALONE_VENV:-${repo_root}/.code-mower-standalone-venv}"
+  case "${venv_dir}" in
+    /*) ;;
+    *) venv_dir="${repo_root}/${venv_dir}" ;;
+  esac
+  allowed_standalone_venv="${repo_root}/.code-mower-standalone-venv"
+  allowed_managed_venv_root="${repo_root}/.code-mower/standalone-venvs"
+  venv_parent="$(dirname -- "${venv_dir}")"
+  venv_name="$(basename -- "${venv_dir}")"
+  if [ -d "${venv_parent}" ]; then
+    venv_parent="$(CDPATH= cd -- "${venv_parent}" && pwd -P)"
+    venv_dir="${venv_parent}/${venv_name}"
+  fi
+  marker="${venv_dir}/.code-mower-standalone-path"
+  installed_path=""
+  if [ -f "${marker}" ]; then
+    installed_path="$(cat "${marker}")"
+  fi
+  if [ ! -x "${venv_dir}/bin/code-mower" ] || [ "${installed_path}" != "${standalone_path}" ] || [ "${CODE_MOWER_STANDALONE_REINSTALL:-}" = "1" ]; then
+    acquire_install_lock
+    installed_path=""
+    if [ -f "${marker}" ]; then
+      installed_path="$(cat "${marker}")"
+    fi
+    if [ ! -x "${venv_dir}/bin/code-mower" ] || [ "${installed_path}" != "${standalone_path}" ] || [ "${CODE_MOWER_STANDALONE_REINSTALL:-}" = "1" ]; then
+      if [ -d "${venv_dir}" ] && [ "${CODE_MOWER_STANDALONE_REINSTALL:-}" = "1" ]; then
+        case "${venv_dir}" in
+          "${allowed_standalone_venv}"|"${allowed_standalone_venv}"/*|"${allowed_managed_venv_root}"/*) rm -rf "${venv_dir}" ;;
+          *)
+            if [ ! -x "${venv_dir}/bin/python" ]; then
+              echo "error: refusing to recreate unsafe custom standalone venv without an existing Python: ${venv_dir}" >&2
+              echo "Choose a venv under ${allowed_standalone_venv} or ${allowed_managed_venv_root}, or remove/recreate the custom venv yourself." >&2
+              exit 1
+            fi
+            ;;
+        esac
+      fi
+      if [ ! -x "${venv_dir}/bin/python" ]; then
+        check_standalone_python
+        "${bootstrap_python}" -m venv "${venv_dir}"
+      fi
+      "${venv_dir}/bin/python" -m pip install -e "${standalone_path}" 1>&2
+      printf '%s\n' "${standalone_path}" > "${marker}"
+    fi
+    release_install_lock
+  fi
+  release_install_lock
+  exec "${venv_dir}/bin/code-mower" "$@"
+fi
+
+if [ ! -f "${script_dir}/code_mower_bootstrap.py" ]; then
+  echo "error: repo-local Code Mower mirror is unavailable. Use the pinned standalone path via tools/code_mower_standalone_shadow.sh, or unset CODE_MOWER_USE_LOCAL/CODE_MOWER_USE_STANDALONE=0." >&2
+  exit 1
+fi
+
+case "${1:-}" in
+  bootstrap)
+    shift
+    exec "${bootstrap_python}" "${script_dir}/code_mower_bootstrap.py" "$@"
+    ;;
+  trailer-comment-labeler)
+    shift
+    python_bin="$("${bootstrap_python}" "${script_dir}/code_mower_bootstrap.py" --repo-root "${repo_root}" --print-python)"
+    exec "${python_bin}" "${script_dir}/trailer_comment_labeler.py" "$@"
+    ;;
+  saas-reviewer-labeler)
+    shift
+    python_bin="$("${bootstrap_python}" "${script_dir}/code_mower_bootstrap.py" --repo-root "${repo_root}" --print-python)"
+    exec "${python_bin}" "${script_dir}/saas_reviewer_labeler.py" "$@"
+    ;;
+  clear-stale)
+    if [ -f "${script_dir}/clear_stale.py" ]; then
+      shift
+      python_bin="$("${bootstrap_python}" "${script_dir}/code_mower_bootstrap.py" --repo-root "${repo_root}" --print-python)"
+      exec "${python_bin}" "${script_dir}/clear_stale.py" "$@"
+    fi
+    ;;
+esac
+
+python_bin="$("${bootstrap_python}" "${script_dir}/code_mower_bootstrap.py" --repo-root "${repo_root}" --print-python)"
+exec "${python_bin}" "${script_dir}/code_mower_cli.py" "$@"

code_mower/templates/product-support/code_mower_standalone_pin.env

@@ -0,0 +1,7 @@
+# Pinned standalone Code Mower source for product-repo wrapper mode.
+#
+# Replace OWNER/code-mower.git and the ref before copying into a live
+# repository, or set CODE_MOWER_STANDALONE_REPO_URL / CODE_MOWER_STANDALONE_REF
+# in the workflow environment.
+CODE_MOWER_STANDALONE_REPO_URL="https://github.com/OWNER/code-mower.git"
+CODE_MOWER_STANDALONE_REF="<pin-a-reviewed-code-mower-commit-or-tag>"

code_mower/templates/product-support/code_mower_standalone_shadow.sh

@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+repo_root="$(CDPATH= cd -- "${script_dir}/.." && pwd -P)"
+pin_file="${CODE_MOWER_STANDALONE_PIN_FILE:-${script_dir}/code_mower_standalone_pin.env}"
+override_repo_url="${CODE_MOWER_STANDALONE_REPO_URL:-}"
+override_ref="${CODE_MOWER_STANDALONE_REF:-}"
+override_source_dir="${CODE_MOWER_STANDALONE_SOURCE_DIR:-}"
+pin_file_missing=0
+
+if [ -f "${pin_file}" ]; then
+  # shellcheck disable=SC1090
+  . "${pin_file}"
+else
+  pin_file_missing=1
+fi
+if [ -n "${override_repo_url}" ]; then
+  CODE_MOWER_STANDALONE_REPO_URL="${override_repo_url}"
+fi
+if [ -n "${override_ref}" ]; then
+  CODE_MOWER_STANDALONE_REF="${override_ref}"
+fi
+if [ -n "${override_source_dir}" ]; then
+  CODE_MOWER_STANDALONE_SOURCE_DIR="${override_source_dir}"
+fi
+
+repo_url="${CODE_MOWER_STANDALONE_REPO_URL:-https://github.com/OWNER/code-mower.git}"
+source_dir="${CODE_MOWER_STANDALONE_SOURCE_DIR:-}"
+checkout_lock_acquired=0
+checkout_lock_dir=""
+
+release_checkout_lock() {
+  if [ "${checkout_lock_acquired}" = "1" ] && [ -n "${checkout_lock_dir}" ]; then
+    rm -rf "${checkout_lock_dir}"
+  fi
+  checkout_lock_acquired=0
+  checkout_lock_dir=""
+}
+trap release_checkout_lock EXIT
+
+acquire_checkout_lock() {
+  local lock_age lock_mtime lock_pid now parent_dir stale_seconds started timeout_seconds
+  checkout_lock_dir="${source_dir}.checkout.lock"
+  parent_dir="$(dirname -- "${checkout_lock_dir}")"
+  stale_seconds="${CODE_MOWER_STANDALONE_CHECKOUT_LOCK_STALE_SECONDS:-30}"
+  timeout_seconds="${CODE_MOWER_STANDALONE_CHECKOUT_LOCK_TIMEOUT_SECONDS:-7200}"
+  started="$(date +%s)"
+  mkdir -p "${parent_dir}"
+  while ! mkdir "${checkout_lock_dir}" 2>/dev/null; do
+    now="$(date +%s)"
+    lock_pid=""
+    if [ -f "${checkout_lock_dir}/pid" ]; then
+      lock_pid="$(cat "${checkout_lock_dir}/pid" 2>/dev/null || true)"
+    fi
+    lock_mtime="$(stat -c %Y "${checkout_lock_dir}" 2>/dev/null || stat -f %m "${checkout_lock_dir}" 2>/dev/null || echo "${now}")"
+    case "${lock_mtime}" in
+      ''|*[!0-9]*) lock_mtime="${now}" ;;
+    esac
+    lock_age=$((now - lock_mtime))
+    if [ -z "${lock_pid}" ] && [ "${lock_age}" -ge "${stale_seconds}" ]; then
+      rm -rf "${checkout_lock_dir}" 2>/dev/null || true
+      continue
+    fi
+    if [ -n "${lock_pid}" ] && ! kill -0 "${lock_pid}" 2>/dev/null; then
+      rm -rf "${checkout_lock_dir}" 2>/dev/null || true
+      continue
+    fi
+    if [ $((now - started)) -ge "${timeout_seconds}" ]; then
+      echo "error: timed out waiting for standalone checkout lock: ${checkout_lock_dir}" >&2
+      exit 1
+    fi
+    sleep 0.2
+  done
+  checkout_lock_acquired=1
+  printf '%s\n' "$$" > "${checkout_lock_dir}/pid"
+}
+
+hash_ref_name() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$1" | sha256sum | cut -d ' ' -f1
+    return
+  fi
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$1" | shasum -a 256 | cut -d ' ' -f1
+    return
+  fi
+  if command -v openssl >/dev/null 2>&1; then
+    printf '%s' "$1" | openssl dgst -sha256 -r | cut -d ' ' -f1
+    return
+  fi
+  printf '%s' "$1" | cksum | cut -d ' ' -f1
+}
+
+if [ -n "${CODE_MOWER_STANDALONE_COMMAND:-}" ]; then
+  exec "${script_dir}/code_mower" "$@"
+fi
+
+if [ -z "${CODE_MOWER_STANDALONE_PATH:-}" ]; then
+  if [ -z "${CODE_MOWER_STANDALONE_REF:-}" ]; then
+    if [ "${pin_file_missing}" = "1" ]; then
+      echo "error: missing Code Mower standalone pin file: ${pin_file}" >&2
+      echo "Restore tools/code_mower_standalone_pin.env or set CODE_MOWER_STANDALONE_REF explicitly." >&2
+    else
+      echo "error: CODE_MOWER_STANDALONE_REF is required for standalone shadow mode." >&2
+      echo "Add CODE_MOWER_STANDALONE_REF to ${pin_file} or set it explicitly." >&2
+    fi
+    exit 1
+  fi
+  ref="${CODE_MOWER_STANDALONE_REF}"
+  if [ "${repo_url}" = "https://github.com/OWNER/code-mower.git" ] || [ "${ref}" = "<pin-a-reviewed-code-mower-commit-or-tag>" ]; then
+    echo "error: replace the placeholder Code Mower standalone repository URL and ref before using standalone shadow mode." >&2
+    echo "Update ${pin_file}, or set CODE_MOWER_STANDALONE_REPO_URL and CODE_MOWER_STANDALONE_REF explicitly." >&2
+    exit 1
+  fi
+  if [ -z "${source_dir}" ]; then
+    ref_slug="$(printf '%s' "${ref}" | tr -c 'A-Za-z0-9._-' '_' | cut -c1-48)"
+    ref_hash="$(hash_ref_name "${ref}" | cut -c1-12)"
+    source_dir="${repo_root}/.code-mower/standalone/code-mower-${ref_slug}-${ref_hash}"
+    if [ -z "${CODE_MOWER_STANDALONE_VENV:-}" ]; then
+      export CODE_MOWER_STANDALONE_VENV="${repo_root}/.code-mower/standalone-venvs/code-mower-${ref_slug}-${ref_hash}"
+    fi
+  fi
+  acquire_checkout_lock
+  if [ ! -d "${source_dir}/.git" ]; then
+    mkdir -p "$(dirname -- "${source_dir}")"
+    git clone --quiet "${repo_url}" "${source_dir}"
+  fi
+  repo_url_changed=""
+  existing_origin="$(git -C "${source_dir}" remote get-url origin 2>/dev/null || true)"
+  if [ "${existing_origin}" != "${repo_url}" ]; then
+    git -C "${source_dir}" remote set-url origin "${repo_url}"
+    repo_url_changed=1
+  fi
+  previous_head="$(git -C "${source_dir}" rev-parse --verify HEAD 2>/dev/null || true)"
+  if [ -n "${repo_url_changed}" ] || ! git -C "${source_dir}" cat-file -e "${ref}^{commit}" 2>/dev/null; then
+    git -C "${source_dir}" fetch --quiet --tags origin "${ref}" || git -C "${source_dir}" fetch --quiet --tags origin
+  fi
+  git -C "${source_dir}" checkout --quiet --detach "${ref}"
+  checked_out_head="$(git -C "${source_dir}" rev-parse --verify HEAD)"
+  if [ -n "${previous_head}" ] && [ "${previous_head}" != "${checked_out_head}" ] && [ -z "${CODE_MOWER_STANDALONE_REINSTALL:-}" ]; then
+    export CODE_MOWER_STANDALONE_REINSTALL=1
+  fi
+  export CODE_MOWER_STANDALONE_PATH="${source_dir}"
+fi
+
+set +e
+"${script_dir}/code_mower" "$@"
+rc=$?
+set -e
+exit "${rc}"

code_mower/templates/product-support/run_claude_audit_pr.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+code_mower="${script_dir}/code_mower"
+unset CODE_MOWER_USE_LOCAL
+unset CODE_MOWER_USE_STANDALONE
+
+token_from_stdin=""
+filtered_args=()
+for arg in "$@"; do
+  case "${arg}" in
+    --token-from-stdin|--read-token-from-stdin)
+      token_from_stdin=1
+      ;;
+    *)
+      filtered_args+=("${arg}")
+      ;;
+  esac
+done
+
+if [ -n "${token_from_stdin}" ]; then
+  exec env -u GITHUB_TOKEN -u GH_TOKEN "${code_mower}" claude-audit --read-token-from-stdin "${filtered_args[@]}"
+fi
+
+env_token="${GITHUB_TOKEN:-${GH_TOKEN:-}}"
+if [ -n "${env_token}" ]; then
+  printf '%s\n' "${env_token}" | env -u GITHUB_TOKEN -u GH_TOKEN "${code_mower}" claude-audit --read-token-from-stdin "${filtered_args[@]}"
+  exit $?
+fi
+
+exec env -u GITHUB_TOKEN -u GH_TOKEN "${code_mower}" claude-audit "${filtered_args[@]}"

code_mower/templates/product-support/run_codex_audit_pr.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+code_mower="${script_dir}/code_mower"
+unset CODE_MOWER_USE_LOCAL
+unset CODE_MOWER_USE_STANDALONE
+
+token_from_stdin=""
+filtered_args=()
+for arg in "$@"; do
+  case "${arg}" in
+    --token-from-stdin|--read-token-from-stdin)
+      token_from_stdin=1
+      ;;
+    *)
+      filtered_args+=("${arg}")
+      ;;
+  esac
+done
+
+if [ -n "${token_from_stdin}" ]; then
+  exec env -u GITHUB_TOKEN -u GH_TOKEN "${code_mower}" codex-audit --read-token-from-stdin "${filtered_args[@]}"
+fi
+
+env_token="${GITHUB_TOKEN:-${GH_TOKEN:-}}"
+if [ -n "${env_token}" ]; then
+  printf '%s\n' "${env_token}" | env -u GITHUB_TOKEN -u GH_TOKEN "${code_mower}" codex-audit --read-token-from-stdin "${filtered_args[@]}"
+  exit $?
+fi
+
+exec env -u GITHUB_TOKEN -u GH_TOKEN "${code_mower}" codex-audit "${filtered_args[@]}"

code_mower/templates/product-support/safe_gh_comment.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""Post or edit GitHub issue/PR comments without shell-interpreting Markdown.
+
+Never pass Markdown through `gh ... --body "..."`: backticks and `$()` inside
+the body are shell syntax before GitHub ever sees them. This helper reads the
+body from a file or stdin, serializes it as JSON, and invokes `gh api` with
+argument-list subprocess calls.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import sys
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, Callable, Optional, Sequence
+
+if TYPE_CHECKING:
+    RunFn = Callable[..., subprocess.CompletedProcess[str]]
+else:
+    # Keep the generated helper importable under older ambient Python 3.x
+    # interpreters that cannot evaluate subprocess.CompletedProcess[str].
+    RunFn = Callable[..., Any]
+
+
+def _read_body(*, body_file: Optional[Path], stdin_text: Optional[str] = None) -> str:
+    if body_file is not None:
+        return body_file.read_text(encoding="utf-8")
+    if stdin_text is not None:
+        return stdin_text
+    return sys.stdin.read()
+
+
+def _repo_from_gh(run: RunFn = subprocess.run) -> str:
+    result = run(
+        ["gh", "repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"],
+        check=True,
+        text=True,
+        capture_output=True,
+    )
+    return result.stdout.strip()
+
+
+def _run_gh_api(args: Sequence[str], payload: "dict[str, str]", run: RunFn = subprocess.run) -> None:
+    run(
+        ["gh", "api", *args, "--input", "-"],
+        input=json.dumps(payload),
+        check=True,
+        text=True,
+        capture_output=True,
+    )
+
+
+def post_comment(repo: str, issue_or_pr: int, body: str, run: RunFn = subprocess.run) -> None:
+    _run_gh_api(
+        ["-X", "POST", f"repos/{repo}/issues/{issue_or_pr}/comments"],
+        {"body": body},
+        run,
+    )
+
+
+def edit_comment(repo: str, comment_id: int, body: str, run: RunFn = subprocess.run) -> None:
+    _run_gh_api(
+        ["-X", "PATCH", f"repos/{repo}/issues/comments/{comment_id}"],
+        {"body": body},
+        run,
+    )
+
+
+def _parse_args(argv: Optional[Sequence[str]] = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    target = parser.add_mutually_exclusive_group(required=True)
+    target.add_argument("--issue", "--pr", dest="issue_or_pr", type=int)
+    target.add_argument("--edit-comment-id", type=int)
+    parser.add_argument("--repo", help="owner/repo. Defaults to `gh repo view`.")
+    parser.add_argument("--body-file", type=Path, help="Markdown file to post/edit. Defaults to stdin.")
+    return parser.parse_args(argv)
+
+
+def main(argv: Optional[Sequence[str]] = None) -> int:
+    args = _parse_args(argv)
+    try:
+        repo = args.repo or _repo_from_gh()
+        body = _read_body(body_file=args.body_file)
+        if args.edit_comment_id is not None:
+            edit_comment(repo, args.edit_comment_id, body)
+        else:
+            post_comment(repo, args.issue_or_pr, body)
+    except (OSError, subprocess.CalledProcessError) as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())