Skip to content

Prevent shell history expansion from corrupting Issue Monster safe-output comments#27844

Closed
Copilot wants to merge 1 commit intomainfrom
copilot/investigate-weird-comment
Closed

Prevent shell history expansion from corrupting Issue Monster safe-output comments#27844
Copilot wants to merge 1 commit intomainfrom
copilot/investigate-weird-comment

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 22, 2026

Issue Monster comments were intermittently posted with injected command-wrapper text (for example ___BEGIN___COMMAND_OUTPUT_MARKER___) instead of the intended message. Root cause was shell history expansion on !* inside Copilot!** when safeoutputs CLI calls were executed through a shell.

  • Root cause containment at execution boundary

    • Disabled shell history expansion for safeoutputs command execution (set +H / set +o histexpand) so comment bodies are passed verbatim.
    • Ensures shell metacharacter sequences in markdown do not mutate tool arguments.
  • Template hardening

    • Updated the Issue Monster comment template to avoid the !* pattern in bold markdown text.
    • Preserves rendered output while removing the expansion trigger.
  • Behavioral impact

    • add_comment payloads now remain byte-stable from agent output through MCP tool call to final GitHub comment.
    • Eliminates marker leakage into user-visible issue comments.
# before invoking safeoutputs commands
set +o histexpand  # equivalent: set +H

safeoutputs add_comment --item_number "$ISSUE" --body "$COMMENT_BODY"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants