Skip to content

fix(ai): harden public rewrite sanitizer #491

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JSONbored merged 1 commit into from
Jun 10, 2026
Merged

fix(ai): harden public rewrite sanitizer #491

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions src/queue-intelligence.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,10 @@ export const FORBIDDEN_PUBLIC_COMMENT_WORDS = [
"wallet",
"hotkey",
"raw trust score",
"trust score",
"coldkey",
"seed phrase",
"mnemonic",
"payout",
"reward estimate",
"estimated rewards",
Expand All @@ -52,7 +56,14 @@ export const FORBIDDEN_PUBLIC_COMMENT_WORDS = [
"reward",
"farming",
"private reviewability",
"reviewability internals",
"reviewability",
"private scoreability",
"scoreability",
"score preview",
"estimated score",
"public score estimate",
"score estimate",
"private rankings",
"private ranking",
"rankings",
Expand Down
11 changes: 6 additions & 5 deletions src/services/ai-summaries.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,10 @@ const PR_INTELLIGENCE_MARKER = "<!-- gittensory-pr-intelligence -->";
type AiSummaryVisibility = "private" | "public";

const PRIVATE_CONTEXT_PATTERN =
/\b(wallets?|hotkeys?|coldkeys?|seed phrases?|mnemonics?|raw trust scores?|trust scores?|private reviewability|private scoreability|public score estimates?)\b/gi;
/\b(wallets?|hotkeys?|coldkeys?|seed phrases?|mnemonics?|raw trust scores?|trust scores?|scoreability|reviewability(?: internals?)?|private reviewability|private scoreability|public score estimates?)\b/gi;
const PRIVATE_OUTCOME_PATTERN = /\b(payouts?|farming|rewards?|reward estimates?|reward optimization)\b/gi;
const PUBLIC_FORBIDDEN_TEXT_PATTERN =
/\b(wallets?|hotkeys?|coldkeys?|seed phrases?|mnemonics?|raw trust scores?|trust scores?|estimated scores?|score estimates?|public score estimates?|estimated rewards?|rewards?|reward estimates?|payouts?|farming|private reviewability|private scoreability|private rankings?|rankings?|reward optimization)\b/i;
/\b(wallets?|hotkeys?|coldkeys?|seed phrases?|mnemonics?|raw trust scores?|trust scores?|estimated scores?|score estimates?|scoreability|score preview|public score estimates?|estimated rewards?|rewards?|reward estimates?|payouts?|farming|reviewability(?: internals?)?|private reviewability|private scoreability|private rankings?|rankings?|reward optimization)\b/i;

export type AiSummaryResult =
| { status: "disabled"; reason: string }
Expand Down Expand Up @@ -55,7 +55,7 @@ export async function summarizeAgentBundleWithAi(env: Env, bundle: AgentRunBundl
role: "system",
content:
visibility === "public"
? "Summarize deterministic Gittensory signals for a public GitHub comment. Do not mention rewards, rankings, payouts, wallets, hotkeys, raw trust scores, or private reviewability."
? "Summarize deterministic Gittensory signals for a public GitHub comment. Do not mention rewards, rankings, payouts, wallets, hotkeys, raw trust scores, scoreability, or reviewability."
: "Summarize deterministic Gittensory signals for an authenticated MCP/API user. Be concise and preserve scoreability blockers and next actions.",
},
{ role: "user", content: prompt },
Expand Down Expand Up @@ -175,7 +175,8 @@ function sanitizeAiText(value: string, visibility: AiSummaryVisibility): string
function containsPublicForbiddenText(value: string): boolean {
// Route every public AI output through the canonical public/private sanitizer (issue #151).
// `sanitizePublicComment` throws on any forbidden public term (wallet, hotkey, raw trust score,
// payout, reward language, farming, private reviewability, public score estimate, or ranking language).
// scoreability/reviewability terms, payout, reward language, farming, public score estimate,
// or ranking language).
try {
sanitizePublicComment(value);
} catch {
Expand Down Expand Up @@ -327,7 +328,7 @@ export async function rewritePublicPrIntelligenceComment(
bundle: args.bundle,
fallbackText: args.deterministicBody,
instructions:
"Rewrite this deterministic Gittensory PR signal bundle as a short, friendly public GitHub comment with 3-5 bullet points. Only restate the facts provided. Never mention rewards, rankings, payouts, wallets, hotkeys, raw or estimated trust scores, score estimates, farming, or private reviewability, and never claim a guaranteed outcome.",
"Rewrite this deterministic Gittensory PR signal bundle as a short, friendly public GitHub comment with 3-5 bullet points. Only restate the facts provided. Never mention rewards, rankings, payouts, wallets, hotkeys, raw or estimated trust scores, score estimates, scoreability, reviewability, or farming, and never claim a guaranteed outcome.",
actor: args.actor,
route: args.route,
});
Expand Down
9 changes: 7 additions & 2 deletions test/unit/ai-summaries.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ import { FORBIDDEN_PUBLIC_COMMENT_WORDS } from "../../src/queue-intelligence";
import { createTestEnv } from "../helpers/d1";

const PUBLIC_FORBIDDEN_TEXT =
/\b(wallets?|hotkeys?|raw trust scores?|trust scores?|payouts?|estimated rewards?|rewards?|reward estimates?|farming|private reviewability|private scoreability|private rankings?|rankings?|public score estimates?)\b/i;
/\b(wallets?|hotkeys?|raw trust scores?|trust scores?|payouts?|estimated rewards?|rewards?|reward estimates?|farming|scoreability|reviewability(?: internals?)?|private reviewability|private scoreability|private rankings?|rankings?|public score estimates?)\b/i;
type AiRunRequest = { messages: Array<{ role: string; content: string }> };

describe("Workers AI summaries", () => {
Expand Down Expand Up @@ -152,6 +152,9 @@ describe("Workers AI summaries", () => {
"rewards",
"reward",
"farming",
"scoreability",
"reviewability",
"reviewability internals",
"private reviewability",
"private scoreability",
"public score estimate",
Expand Down Expand Up @@ -350,12 +353,14 @@ describe("optional deterministic-summary rewrite layer", () => {
}
});

it("rejects reward and ranking variants in public AI rewrites", async () => {
it("rejects reward, ranking, scoreability, and reviewability variants in public AI rewrites", async () => {
const unsafeOutputs = [
"The estimated reward is high.",
"Rewards look likely for this PR.",
"This PR may improve contributor rewards and scoreability.",
"The private ranking looks strong.",
"This ranking should improve.",
"Reviewability internals look healthy.",
];

for (const output of unsafeOutputs) {
Expand Down