fix(review): preserve safe enrichment lines when sanitizer finds forbidden terms

src/review/enrichment-wire.ts

@@ -166,10 +166,28 @@ function sanitizeEnrichmentPromptSection(value: unknown): string | undefined {
   const trimmed = value.trim();
   if (!trimmed) return undefined;
   const defanged = neutralizePromptInjection(trimmed).text;
-  return sanitizePublicComment(defanged).slice(
-    0,
-    MAX_ENRICHMENT_PROMPT_SECTION_CHARS,
-  );
+  try {
+    return sanitizePublicComment(defanged).slice(
+      0,
+      MAX_ENRICHMENT_PROMPT_SECTION_CHARS,
+    );
+  } catch {
+    const safeLines = defanged
+      .split("\n")
+      .filter((line) => {
+        try {
+          sanitizePublicComment(line);
+          return true;
+        } catch {
+          return false;
+        }
+      })
+      .join("\n")
+      .trim();
+    return safeLines
+      ? safeLines.slice(0, MAX_ENRICHMENT_PROMPT_SECTION_CHARS)
+      : undefined;
+  }
 }
 
 export function resolveReesTransportTimeoutMs(value: string | undefined): number {

test/unit/enrichment-wire.test.ts

@@ -490,6 +490,36 @@ describe("buildReviewEnrichment", () => {
     ).resolves.toBeUndefined();
   });
 
+  it("drops non-public-safe enrichment lines without discarding the rest of the brief", async () => {
+    globalThis.fetch = vi.fn(
+      async () =>
+        ({
+          ok: true,
+          json: async () => ({
+            promptSection: [
+              "## EXTERNAL REVIEW BRIEF",
+              "### Non-conforming commit subjects",
+              "- abc123 — unrecognized commit type: unsafe subject mentions wallet",
+              "### Dependency advisory",
+              "- package left-pad has CVE-2099-0001",
+            ].join("\n"),
+            systemSuffix: "verified CVE context",
+          }),
+        }) as Response,
+    ) as unknown as typeof fetch;
+
+    const result = await buildReviewEnrichment(
+      env({ REES_URL: "https://r" }),
+      input,
+    );
+
+    expect(result?.promptSection).toContain("## EXTERNAL REVIEW BRIEF");
+    expect(result?.promptSection).toContain("### Dependency advisory");
+    expect(result?.promptSection).toContain("CVE-2099-0001");
+    expect(result?.promptSection).not.toContain("unsafe subject");
+    expect(result?.systemSuffix).toContain("untrusted advisory context");
+  });
+
   it("undefined on a fetch throw (timeout/network) — fail-safe", async () => {
     globalThis.fetch = vi.fn(async () => {
       throw new Error("timeout");