fix(ci): neutralize legacy ##[ commands in autofix stdout echoes (#9871)

* fix(ci): neutralize legacy ##[ commands in autofix stdout echoes

A review finding about workflow-command injection carried its payload
strings (::error::forged, ##[add-matcher]) verbatim as example text.
Prepare echoed feedback.md raw, the runner parsed the mid-line
##[add-matcher] and failed the step before the agent ran, and the
consecutive-failure breaker burned the takeover window of #9761 in
about 70 minutes while reporting it as a 100/100 round cap.

The existing neutralization covered only the modern :: syntax; the
runner also parses the legacy ##[name] form, even mid-line. Extend
every untrusted-content echo in the autofix family (prepare feedback
echo, both artifact dump loops, the gate's failure/handoff/no-action
echoes, the deferred-findings dumps and upsert re-emit loops) to
neutralize both prefixes, and pin the census plus a behavioral ##[
case in the contract tests.

* fix(ci): unify the autofix neutralizer on one canonical spelling

Review feedback on #9871: the two upsert re-emit loops neutralized with
a hybrid spelling (bash expansion for :: plus a single-syntax sed for
##[) while the other fourteen sites used the canonical two-expression
sed, establishing two implementations of one normalization. A future
edit fixing one spelling could miss the other and recreate the
single-syntax half-guard that let #9761 through. Unify both loops on
the canonical sed and consolidate the pinned test shapes.

The census test's comment also promised more than its assertions
deliver: it pins the known enumeration, it does not auto-detect new
un-neutralized echoes. Reword it to state the actual guarantee, ban
the ##[-only sed and the bare bash expansion alongside the existing
::-only ban, and fold the script-side re-emit loop into the census.

* test(ci): assert the neutralizer pairing property instead of banning shapes

The three shape bans only matched the no--e spellings, so the canonical
line's natural half-copies (sed -e 's/::/;;/g' alone, or the ##[-only -e
mirror) passed every ban while guarding only one syntax. Assert the
pairing property instead: every occurrence of either substitution
expression must belong to the canonical two-expression pair, so a
half-guard in ANY spelling unbalances the count and fails the census —
verified by probe against all four half-guard shapes.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

---------

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

Author: wenshao

.github/scripts/autofix-push-and-report.sh

@@ -324,8 +324,9 @@ run_deferred_upsert() {
   if [[ "${UPSERT_OUT}" != *'__upsert_child_live__'* ]]; then
     echo "::warning::deferred-findings upsert child never started (loader trace mode or exec failure); NOT persisted this round"
   fi
-  # The child's output is agent-reachable content, so a line-start
-  # `::` is neutralized before it reaches this step's stdout.
+  # The child's output is agent-reachable content, so both workflow-command
+  # syntaxes are neutralized before it reaches this step's stdout (`##[`
+  # parses mid-line too — #9761).
   while IFS= read -r _upsert_line; do
     # Wrapper-authored lines carry a marker and are emitted
     # VERBATIM so they still render as GitHub annotations; the
@@ -335,7 +336,10 @@ run_deferred_upsert() {
     elif [[ "${_upsert_line}" == __upsert_trusted__* ]]; then
       printf '%s\n' "${_upsert_line#__upsert_trusted__}"
     else
-      printf '%s\n' "${_upsert_line//::/;;}"
+      # The canonical two-expression neutralizer, identical to every other
+      # echo site — one spelling for the whole family, so a syntax change
+      # cannot drift across two implementations.
+      printf '%s\n' "${_upsert_line}" | sed -e 's/::/;;/g' -e 's/##\[/##［/g'
     fi
   done <<< "${UPSERT_OUT}"
 }

.github/scripts/run-autofix-review-verification.sh

@@ -236,7 +236,10 @@ fi
 if [[ -f "${WORKDIR}/failure.md" && -n "$(git status --porcelain)" ]]; then
   echo "❌ Agent wrote failure.md after leaving a dirty workspace:"
   git status --short
-  cat "${WORKDIR}/failure.md"
+  # Agent-written content on step stdout: both workflow-command syntaxes
+  # parse here (`##[` mid-line too — measured on #9761). Same reason
+  # 'Show run artifacts' neutralizes these files.
+  sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/failure.md"
   echo "outcome=failed" >> "${GITHUB_OUTPUT}"
   echo "kiss_audit=${KISS_AUDIT:-false}" >> "${GITHUB_OUTPUT}"
   if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
@@ -247,7 +250,7 @@ fi
 
 if [[ -f "${WORKDIR}/failure.md" ]]; then
   echo "🛑 Agent aborted intentionally:"
-  cat "${WORKDIR}/failure.md"
+  sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/failure.md"
   echo "outcome=failed" >> "${GITHUB_OUTPUT}"
   echo "kiss_audit=${KISS_AUDIT:-false}" >> "${GITHUB_OUTPUT}"
   if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
@@ -277,7 +280,7 @@ if [[ -s "${WORKDIR}/handoff.md" && -n "$(git status --porcelain)" \
   && "${AUDIT_VERDICT:-}" != 'conflict' ]]; then
   echo "❌ Agent wrote handoff.md after leaving a dirty workspace:"
   git status --short
-  sed 's/::/;;/g' "${WORKDIR}/handoff.md"
+  sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/handoff.md"
   echo "outcome=dirty_handoff" >> "${GITHUB_OUTPUT}"
   echo "kiss_audit=${KISS_AUDIT:-false}" >> "${GITHUB_OUTPUT}"
   if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
@@ -299,7 +302,7 @@ if [[ -s "${WORKDIR}/handoff.md" && "${committed_rc:-0}" -eq 1 \
   && "${AUDIT_VERDICT:-}" != 'conflict' ]]; then
   echo "❌ Agent wrote handoff.md but the round HAS a commit — a brake violation:"
   git log --oneline "origin/${BRANCH}..${BRANCH}"
-  sed 's/::/;;/g' "${WORKDIR}/handoff.md"
+  sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/handoff.md"
   echo "outcome=committed_handoff" >> "${GITHUB_OUTPUT}"
   echo "kiss_audit=${KISS_AUDIT:-false}" >> "${GITHUB_OUTPUT}"
   if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
@@ -321,10 +324,11 @@ if git diff --quiet "origin/${BRANCH}...${BRANCH}" \
   && [[ -s "${WORKDIR}/handoff.md" ]] \
   && [[ "${AUDIT_VERDICT:-}" != 'conflict' ]]; then
   echo "🤝 Branch unchanged with a handoff — the agent stopped under instruction and deferred this item to a human:"
-  # Agent-written content: a line-start `::` would be parsed as a workflow
-  # command (::error::, ::add-mask::), the same reason 'Show run artifacts'
-  # neutralizes these files.
-  sed 's/::/;;/g' "${WORKDIR}/handoff.md"
+  # Agent-written content: both workflow-command syntaxes parse on step
+  # stdout — a line-start `::` (::error::, ::add-mask::) AND `##[` even
+  # mid-line (a quoted `##[add-matcher]` fails the step; measured on
+  #9761). The same reason 'Show run artifacts' neutralizes these files.
+  sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/handoff.md"
   echo "outcome=handoff" >> "${GITHUB_OUTPUT}"
   echo "kiss_audit=${KISS_AUDIT:-false}" >> "${GITHUB_OUTPUT}"
   if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
@@ -586,7 +590,9 @@ if git diff --quiet "origin/${BRANCH}...${BRANCH}"; then
   # no-commit handoff was classified before the structural checks above.
   if [[ -s "${WORKDIR}/no-action.md" ]]; then
     echo "🟰 No action needed:"
-    cat "${WORKDIR}/no-action.md"
+    # Both command syntaxes, like every other echo of agent-written files
+    # (`##[` parses mid-line too — #9761).
+    sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/no-action.md"
     echo "verified_head=$(git rev-parse HEAD)" >> "${GITHUB_OUTPUT}"
     echo "outcome=noop" >> "${GITHUB_OUTPUT}"
     echo "kiss_audit=${KISS_AUDIT:-false}" >> "${GITHUB_OUTPUT}"

.github/scripts/upsert-deferred-issue.sh

@@ -49,9 +49,10 @@ gh_reason() {
   local r=''
   [[ -n "${GH_ERR}" && -s "${GH_ERR}" ]] &&
     r="$(tr '\r\n\t' '   ' < "${GH_ERR}" | head -c 200)"
-  # `::` neutralized like every other agent/API-derived echo: an API error
-  # body is not trusted to be free of workflow-command syntax.
-  r="$(printf '%s' "${r}" | sed 's/::/;;/g')"
+  # Both workflow-command syntaxes neutralized like every other
+  # agent/API-derived echo: an API error body is not trusted to be free of
+  # them (`##[` parses mid-line too — #9761).
+  r="$(printf '%s' "${r}" | sed -e 's/::/;;/g' -e 's/##\[/##［/g')"
   [[ -n "${r// /}" ]] && printf '%s' "${r}" || printf 'no stderr captured'
 }
 gh_err_reset() { [[ -n "${GH_ERR}" ]] && : > "${GH_ERR}"; }
@@ -67,9 +68,10 @@ OWN_FINDINGS="${WORKDIR}/deferred-findings.json"
 # filters this round's feedback out of every later round, and the next run's
 # workspace reset deletes the file — nothing re-derives them. So each abort
 # says so and dumps what it had, for manual recovery from the run log.
-# `::` is neutralized in the dump: the content is agent-influenced and a
-# raw `::` at line start would be parsed as a workflow command (same reason
-# `<!--` is neutralized at every publish site).
+# Both workflow-command syntaxes are neutralized in the dump: the content is
+# agent-influenced and would otherwise be parsed as a command — `::` at line
+# start AND `##[` even mid-line (measured on #9761). Same reason `<!--` is
+# neutralized at every publish site.
 dump_file() {
   [[ -s "$1" ]] || return 0
   local size
@@ -85,7 +87,7 @@ dump_file() {
   else
     echo "--- $1"
   fi
-  head -c 4000 "$1" | sed 's/::/;;/g'
+  head -c 4000 "$1" | sed -e 's/::/;;/g' -e 's/##\[/##［/g'
   echo
 }
 lost() {

.github/workflows/qwen-autofix.yml

@@ -1318,13 +1318,15 @@ jobs:
           if [[ -f "${WORKDIR}/failure.md" && -n "$(git status --porcelain)" ]]; then
             echo "❌ Agent wrote failure.md after leaving a dirty workspace:"
             git status --short
-            cat "${WORKDIR}/failure.md"
+            # Agent-written content on step stdout: neutralize both command
+            # syntaxes (`##[` parses mid-line too — #9761).
+            sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/failure.md"
             exit 1
           fi
 
           if [[ -f "${WORKDIR}/failure.md" ]]; then
             echo "🛑 Agent aborted intentionally:"
-            cat "${WORKDIR}/failure.md"
+            sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/failure.md"
             exit 1
           fi
 
@@ -1395,12 +1397,14 @@ jobs:
           for f in decision.json pr-title.txt pr-body.md e2e-report.md failure.md failure.zh.md fix.diff; do
             if [[ -f "${WORKDIR}/${f}" ]]; then
               echo "=============== ${f} ==============="
-              # Agent-written content on step STDOUT: a line-start `::` would
-              # be parsed as a workflow command (::error::, ::add-mask::), the
-              # same reason the PR-lane dump loop neutralizes it. (The two
-              # step-SUMMARY loops write to a file, where `::` is not
+              # Agent-written content on step STDOUT: both workflow-command
+              # syntaxes parse here — a line-start `::` (::error::,
+              # ::add-mask::) AND `##[` even mid-line (a quoted
+              # `##[add-matcher]` fails THIS step; measured on #9761). The
+              # same reason the PR-lane dump loop neutralizes both. (The two
+              # step-SUMMARY loops write to a file, where commands are not
               # parsed.)
-              sed 's/::/;;/g' "${WORKDIR}/${f}"
+              sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/${f}"
               echo
             fi
           done
@@ -4699,7 +4703,17 @@ jobs:
             fi
           } > "${WORKDIR}/feedback.md"
           echo '--- feedback.md ---'
-          cat "${WORKDIR}/feedback.md"
+          # Reviewer/bot comment bodies ride this file VERBATIM and this echo
+          # puts them on step stdout, which the runner scans for workflow
+          # commands in BOTH syntaxes: `::name::` AND the legacy `##[name]`,
+          # the latter parsed MID-line too — a quoted `##[add-matcher]` makes
+          # the runner load the rest of the line as a matcher file and fail
+          # THIS step before the agent runs. Measured on #9761: a review
+          # finding about that injection channel carried the payload strings
+          # as its example text, and five consecutive pre-agent crashes
+          # burned the takeover window in ~70 minutes. Neutralize both
+          # prefixes like every other untrusted echo.
+          cat "${WORKDIR}/feedback.md" | sed -e 's/::/;;/g' -e 's/##\[/##［/g'
 
       # The agent below runs for up to 130 minutes and the verification gate adds
       # more, but nothing reaches the PR thread until "Push and report" at the
@@ -5072,7 +5086,9 @@ jobs:
                 else
                   echo "::warning::could not merge carried deferrals across the repair (one of the two sets is unparseable); keeping the carried set and preserving this round's as deferred-findings.unmerged.json. Raw content follows:"
                 fi
-                head -c 4000 "${WORKDIR}/deferred-findings.json" | sed 's/::/;;/g'
+                # Both command syntaxes, like every other untrusted echo
+                # (`##[` parses mid-line too — #9761).
+                head -c 4000 "${WORKDIR}/deferred-findings.json" | sed -e 's/::/;;/g' -e 's/##\[/##［/g'
                 echo
                 rm -f "${WORKDIR}/deferred-findings.carry.next"
                 # Keep the discarded set ON DISK so the warning's pointer at
@@ -5300,10 +5316,12 @@ jobs:
           for f in feedback.md address-summary.md no-action.md failure.md failure.zh.md handoff.md gate-rejection.md gate-advisories.md growth-audit.json agent-api-error agent-api-error-kind agent-timeout resolved-comments.txt comment-replies.json deferred-findings.json deferred-findings.carry.json deferred-findings.unmerged.json pr.diff; do
             if [[ -f "${WORKDIR}/${f}" ]]; then
               echo "=============== ${f} ==============="
-              # Agent-written content: a line-start `::` would be parsed as a
-              # workflow command (::error::, ::add-mask::), the same reason
-              # every other echo of these files neutralizes it.
-              sed 's/::/;;/g' "${WORKDIR}/${f}"
+              # Agent/reviewer-written content: both workflow-command syntaxes
+              # parse here — a line-start `::` (::error::, ::add-mask::) AND
+              # `##[` even mid-line (a quoted `##[add-matcher]` fails THIS
+              # step; measured on #9761 via the prepare echo of this same
+              # file). Neutralize both, like every other echo of these files.
+              sed -e 's/::/;;/g' -e 's/##\[/##［/g' "${WORKDIR}/${f}"
               echo
             fi
           done
@@ -5995,7 +6013,11 @@ jobs:
                 elif [[ "${_upsert_line}" == __upsert_trusted__* ]]; then
                   printf '%s\n' "${_upsert_line#__upsert_trusted__}"
                 else
-                  printf '%s\n' "${_upsert_line//::/;;}"
+                  # The canonical two-expression neutralizer, identical to
+                  # every other echo site — one spelling for the whole
+                  # family, so a syntax change cannot drift across two
+                  # implementations (`##[` parses mid-line too — #9761).
+                  printf '%s\n' "${_upsert_line}" | sed -e 's/::/;;/g' -e 's/##\[/##［/g'
                 fi
               done <<< "${UPSERT_OUT}"
             fi