[Improve] Frame provider comment follow-ups as untrusted content

.changeset/provider-comment-untrusted-framing.md

@@ -0,0 +1,5 @@
+---
+"@roomote/web": patch
+---
+
+Apply the untrusted-content prompt framing to GitLab, Bitbucket, Azure DevOps, and Gitea comment follow-up messages, wrapping the triggering comment in a mention-request block and appending the shared injection-resistance policy

apps/api/src/handlers/ado/handleComment.ts

@@ -1,4 +1,10 @@
-import { enqueueTask, getTaskUrl } from '@roomote/cloud-agents/server';
+import {
+  buildMentionRequestBlock,
+  buildUntrustedContentPolicy,
+  enqueueTask,
+  escapeTaskContextText,
+  getTaskUrl,
+} from '@roomote/cloud-agents/server';
 import {
   findActiveGitHubPrReviewTask,
   findReusableGitHubPrFollowUpOwner,
@@ -207,14 +213,6 @@ function buildTaskStartFailedComment(): string {
   return 'I saw the mention, but I could not start a task for this pull request right now. Please try again in a moment.';
 }
 
-function formatQuotedText(text: string): string {
-  return text
-    .trim()
-    .split('\n')
-    .map((line) => `> ${line}`)
-    .join('\n');
-}
-
 function buildExistingTaskFollowUpMessage({
   repoFullName,
   pullRequest,
@@ -227,8 +225,7 @@ function buildExistingTaskFollowUpMessage({
   commentBody: string;
 }): string {
   const lines = [
-    `${commenter} mentioned Roomote in a comment on Azure DevOps pull request #${pullRequest.pullRequestId} (${pullRequest.title}) in ${repoFullName}:`,
-    formatQuotedText(commentBody),
+    `${commenter} mentioned Roomote in a comment on Azure DevOps pull request #${pullRequest.pullRequestId} (${escapeTaskContextText(pullRequest.title)}) in ${repoFullName}.`,
     '',
     'Please act on this comment as a follow-up to your existing work on this pull request.',
   ];
@@ -238,6 +235,14 @@ function buildExistingTaskFollowUpMessage({
     lines.push(`The pull request source branch is \`${branchName}\`.`);
   }
 
+  lines.push(
+    '',
+    'Mention comment (the request to act on):',
+    buildMentionRequestBlock(commentBody),
+    '',
+    buildUntrustedContentPolicy(),
+  );
+
   return lines.join('\n');
 }
 

apps/api/src/handlers/bitbucket/handleComment.ts

@@ -1,4 +1,10 @@
-import { enqueueTask, getTaskUrl } from '@roomote/cloud-agents/server';
+import {
+  buildMentionRequestBlock,
+  buildUntrustedContentPolicy,
+  enqueueTask,
+  escapeTaskContextText,
+  getTaskUrl,
+} from '@roomote/cloud-agents/server';
 import {
   findActiveGitHubPrReviewTask,
   findReusableGitHubPrFollowUpOwner,
@@ -141,14 +147,6 @@ function buildTaskStartFailedComment(): string {
   return 'I saw the mention, but Roomote could not queue a review task for this pull request. Please try again in a moment. If it keeps failing, an administrator should check the deployment logs.';
 }
 
-function formatQuotedText(text: string): string {
-  return text
-    .trim()
-    .split('\n')
-    .map((line) => `> ${line}`)
-    .join('\n');
-}
-
 function buildExistingTaskFollowUpMessage({
   repoFullName,
   pullRequestNumber,
@@ -165,8 +163,7 @@ function buildExistingTaskFollowUpMessage({
   commentBody: string;
 }): string {
   const lines = [
-    `${commenter} mentioned Roomote in a comment on Bitbucket pull request #${pullRequestNumber} (${pullRequestTitle}) in ${repoFullName}:`,
-    formatQuotedText(commentBody),
+    `${commenter} mentioned Roomote in a comment on Bitbucket pull request #${pullRequestNumber} (${escapeTaskContextText(pullRequestTitle)}) in ${repoFullName}.`,
     '',
     'Please act on this comment as a follow-up to your existing work on this pull request.',
   ];
@@ -175,6 +172,14 @@ function buildExistingTaskFollowUpMessage({
     lines.push(`The pull request source branch is \`${headRef}\`.`);
   }
 
+  lines.push(
+    '',
+    'Mention comment (the request to act on):',
+    buildMentionRequestBlock(commentBody),
+    '',
+    buildUntrustedContentPolicy(),
+  );
+
   return lines.join('\n');
 }
 

apps/api/src/handlers/gitea/handleComment.ts

@@ -1,4 +1,10 @@
-import { enqueueTask, getTaskUrl } from '@roomote/cloud-agents/server';
+import {
+  buildMentionRequestBlock,
+  buildUntrustedContentPolicy,
+  enqueueTask,
+  escapeTaskContextText,
+  getTaskUrl,
+} from '@roomote/cloud-agents/server';
 import {
   findActiveGitHubPrReviewTask,
   findReusableGitHubPrFollowUpOwner,
@@ -184,14 +190,6 @@ function buildTaskStartFailedComment(): string {
   return 'I saw the mention, but I could not start a task for this pull request right now. Please try again in a moment.';
 }
 
-function formatQuotedText(text: string): string {
-  return text
-    .trim()
-    .split('\n')
-    .map((line) => `> ${line}`)
-    .join('\n');
-}
-
 function buildExistingTaskFollowUpMessage({
   repoFullName,
   pullRequest,
@@ -204,8 +202,7 @@ function buildExistingTaskFollowUpMessage({
   commentBody: string;
 }): string {
   const lines = [
-    `${commenter} mentioned Roomote in a comment on Gitea pull request #${pullRequest.number} (${pullRequest.title}) in ${repoFullName}:`,
-    formatQuotedText(commentBody),
+    `${commenter} mentioned Roomote in a comment on Gitea pull request #${pullRequest.number} (${escapeTaskContextText(pullRequest.title)}) in ${repoFullName}.`,
     '',
     'Please act on this comment as a follow-up to your existing work on this pull request.',
   ];
@@ -216,6 +213,14 @@ function buildExistingTaskFollowUpMessage({
     );
   }
 
+  lines.push(
+    '',
+    'Mention comment (the request to act on):',
+    buildMentionRequestBlock(commentBody),
+    '',
+    buildUntrustedContentPolicy(),
+  );
+
   return lines.join('\n');
 }