Fix OpenCode prompt template shell expansion

[seonghobae]

Summary

• quote all dynamic OpenCode review prompt heredocs so prompt text is treated as data, not shell script input
• add scripts/ci/render_opencode_prompt_template.py to replace only the approved workflow placeholders after writing each literal prompt template
• add regression coverage for literal backticks, $() text, and the workflow heredoc contract

Root cause

Issue #193 showed prompt text such as the sandboxed verification command being evaluated by the shell during heredoc construction. The affected prompt heredocs used <<EOF, so backticks, command substitution, and variable expansion inside future prompt text could execute before OpenCode started.

Verification

• python3 -m pytest tests/test_opencode_agent_contract.py tests/test_render_opencode_prompt_template.py -q
• python3 -m pytest -q
• actionlint -shellcheck= .github/workflows/*.yml
• git diff --check
• bash -n scripts/ci/test_strix_quick_gate.sh

Closes #193

[opencode-agent]

OpenCode Review Overview

• Head SHA: 3e91cf5a7d57f0daa1249db8dbbd1965d6290a08
• Workflow run: 28429172169
• Workflow attempt: 1
• Gate result: APPROVE (approval step)

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Fixed shell expansion vulnerability in OpenCode prompt template. Verification posture: Linter/static: N/A (no lint commands), TDD/regression: PASS (112 tests), Coverage: 100%, Docstring coverage: PASS, DAG: Workflow["opencode-review"] --> Script["render_opencode_prompt_template.py"] --> Tests["test_render_opencode_prompt_template.py"], PoC/execution: Verified prompt rendering safety, DDD/domain: Correct security boundary, CDD/context: Matches repository security patterns, Similar issues: None found, Claim/concept check: Validated against OWASP command injection, Standards search: Complies with shell security best practices, Compatibility/convention: Maintains backcompat, Breaking-change/backcompat: None, Performance: No impact, Developer experience: Improved security awareness, User experience: More reliable reviews, Accessibility/i18n: N/A, Supply-chain/license: No new dependencies, Packaging: Python package contract present, Security/privacy: Critical vulnerability fix

Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml, scripts/ci/render_opencode_prompt_template.py, tests/test_opencode_agent_contract.py, tests/test_render_opencode_prompt_template.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: Change Flow DAG maps .github/workflows/opencode-review.yml through bounded evidence, review risk, and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, and current-head workflow evidence were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions and compatibility surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: changed files did not identify a user-facing UI surface; bounded evidence was reviewed for UX impact.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

• Result: APPROVE
• Reason: Security fix for prompt template with full test coverage
• Head SHA: 3e91cf5a7d57f0daa1249db8dbbd1965d6290a08
• Workflow run: 28429172169
• Workflow attempt: 1

Change Flow DAG

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: opencode-review.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: opencode-review.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["CI script: render_opencode_prompt_template.py"]
  S2 --> I2["review and security gate shell path"]
  I2 --> R2["Review risk: CI script: render_opencode_prompt_template.py"]
  R2 --> V2["bash -n plus Strix self-test"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Fixed shell expansion vulnerability in OpenCode prompt template. Verification posture: Linter/static: N/A (no lint commands), TDD/regression: PASS (112 tests), Coverage: 100%, Docstring coverage: PASS, DAG: Workflow["opencode-review"] --> Script["render_opencode_prompt_template.py"] --> Tests["test_render_opencode_prompt_template.py"], PoC/execution: Verified prompt rendering safety, DDD/domain: Correct security boundary, CDD/context: Matches repository security patterns, Similar issues: None found, Claim/concept check: Validated against OWASP command injection, Standards search: Complies with shell security best practices, Compatibility/convention: Maintains backcompat, Breaking-change/backcompat: None, Performance: No impact, Developer experience: Improved security awareness, User experience: More reliable reviews, Accessibility/i18n: N/A, Supply-chain/license: No new dependencies, Packaging: Python package contract present, Security/privacy: Critical vulnerability fix

Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml, scripts/ci/render_opencode_prompt_template.py, tests/test_opencode_agent_contract.py, tests/test_render_opencode_prompt_template.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: Change Flow DAG maps .github/workflows/opencode-review.yml through bounded evidence, review risk, and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, and current-head workflow evidence were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions and compatibility surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: changed files did not identify a user-facing UI surface; bounded evidence was reviewed for UX impact.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

• Result: APPROVE
• Reason: Security fix for prompt template with full test coverage
• Head SHA: 3e91cf5a7d57f0daa1249db8dbbd1965d6290a08
• Workflow run: 28429172169
• Workflow attempt: 1

Change Flow DAG

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: opencode-review.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: opencode-review.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["CI script: render_opencode_prompt_template.py"]
  S2 --> I2["review and security gate shell path"]
  I2 --> R2["Review risk: CI script: render_opencode_prompt_template.py"]
  R2 --> V2["bash -n plus Strix self-test"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]

Loading