From 9d42491881fb1e618c8602df6b1437ece0990a42 Mon Sep 17 00:00:00 2001
From: ghost <49853598+JSONbored@users.noreply.github.com>
Date: Mon, 6 Jul 2026 00:26:58 -0700
Subject: [PATCH] fix(review): preserve safe enrichment lines

---
 src/review/enrichment-wire.ts     | 26 ++++++++++++++++++++++----
 test/unit/enrichment-wire.test.ts | 30 ++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/src/review/enrichment-wire.ts b/src/review/enrichment-wire.ts
index f7b082b349..ba67d81b7c 100644
--- a/src/review/enrichment-wire.ts
+++ b/src/review/enrichment-wire.ts
@@ -166,10 +166,28 @@ function sanitizeEnrichmentPromptSection(value: unknown): string | undefined {
   const trimmed = value.trim();
   if (!trimmed) return undefined;
   const defanged = neutralizePromptInjection(trimmed).text;
-  return sanitizePublicComment(defanged).slice(
-    0,
-    MAX_ENRICHMENT_PROMPT_SECTION_CHARS,
-  );
+  try {
+    return sanitizePublicComment(defanged).slice(
+      0,
+      MAX_ENRICHMENT_PROMPT_SECTION_CHARS,
+    );
+  } catch {
+    const safeLines = defanged
+      .split("\n")
+      .filter((line) => {
+        try {
+          sanitizePublicComment(line);
+          return true;
+        } catch {
+          return false;
+        }
+      })
+      .join("\n")
+      .trim();
+    return safeLines
+      ? safeLines.slice(0, MAX_ENRICHMENT_PROMPT_SECTION_CHARS)
+      : undefined;
+  }
 }
 
 export function resolveReesTransportTimeoutMs(value: string | undefined): number {
diff --git a/test/unit/enrichment-wire.test.ts b/test/unit/enrichment-wire.test.ts
index 56160409c9..3c7752b71b 100644
--- a/test/unit/enrichment-wire.test.ts
+++ b/test/unit/enrichment-wire.test.ts
@@ -490,6 +490,36 @@ describe("buildReviewEnrichment", () => {
     ).resolves.toBeUndefined();
   });
 
+  it("drops non-public-safe enrichment lines without discarding the rest of the brief", async () => {
+    globalThis.fetch = vi.fn(
+      async () =>
+        ({
+          ok: true,
+          json: async () => ({
+            promptSection: [
+              "## EXTERNAL REVIEW BRIEF",
+              "### Non-conforming commit subjects",
+              "- abc123 — unrecognized commit type: unsafe subject mentions wallet",
+              "### Dependency advisory",
+              "- package left-pad has CVE-2099-0001",
+            ].join("\n"),
+            systemSuffix: "verified CVE context",
+          }),
+        }) as Response,
+    ) as unknown as typeof fetch;
+
+    const result = await buildReviewEnrichment(
+      env({ REES_URL: "https://r" }),
+      input,
+    );
+
+    expect(result?.promptSection).toContain("## EXTERNAL REVIEW BRIEF");
+    expect(result?.promptSection).toContain("### Dependency advisory");
+    expect(result?.promptSection).toContain("CVE-2099-0001");
+    expect(result?.promptSection).not.toContain("unsafe subject");
+    expect(result?.systemSuffix).toContain("untrusted advisory context");
+  });
+
   it("undefined on a fetch throw (timeout/network) — fail-safe", async () => {
     globalThis.fetch = vi.fn(async () => {
       throw new Error("timeout");