Follow-up to #94 (slice 1 shipped the sanitize-untrusted.sh primitive in PR #162, not yet wired in).
Layer 1 wiring. Route every place raw GitHub issue/PR/comment text enters a prompt through .claude/scripts/sanitize-untrusted.sh, so untrusted text is always fenced+sanitized before it reaches an orchestrator/implementer/reviewer/pr-feedback prompt. Audit call sites (e.g. loop-event.sh, pr-feedback.sh, pr-comment-fix.sh, and any prompt-construction path that interpolates issue/PR bodies or review comments). Add tests asserting each entry point sanitizes.
Acceptance (from #94): "All prompt-bound issue/PR text passes through one sanitizer." This is the wiring half of that criterion; the helper + tests already exist.
Follow-up to #94 (slice 1 shipped the
sanitize-untrusted.shprimitive in PR #162, not yet wired in).Layer 1 wiring. Route every place raw GitHub issue/PR/comment text enters a prompt through
.claude/scripts/sanitize-untrusted.sh, so untrusted text is always fenced+sanitized before it reaches an orchestrator/implementer/reviewer/pr-feedback prompt. Audit call sites (e.g.loop-event.sh,pr-feedback.sh,pr-comment-fix.sh, and any prompt-construction path that interpolates issue/PR bodies or review comments). Add tests asserting each entry point sanitizes.Acceptance (from #94): "All prompt-bound issue/PR text passes through one sanitizer." This is the wiring half of that criterion; the helper + tests already exist.