[iscekic]

Evidence

Evidence: demonstrated — the real GitHub webhook route processed a locally signed fixture event and called a loopback model endpoint; the captured prompt retained one named GitHub context block as untrusted background material and kept the triggering user's message in its user turn.

Local end-to-end run on this VM at branch head 3e0ed935a927daa69398ddc6d7f595caf8c85532:

• A signed GitHub issue-comment event ran through POST /api/webhooks/github. GitHub API traffic and model inference were restricted to loopback fixtures. The captured model request contained exactly one GitHub context block, its expected trust framing, and the separate triggering-user message.
• The context-formatting fixture remained within the expected prompt structure. The actual webhook returned HTTP 200 and the local model fixture received one request.
• pnpm --filter web exec jest --runInBand src/lib/bot/agent-runner.test.ts src/lib/bot/prompt.test.ts src/lib/discord-bot.test.ts src/lib/discord-bot/discord-channel-context.test.ts — 4 suites, 35 tests passed.
• pnpm --filter web exec jest --runInBand --testPathPatterns 'bot-session-callback/.+route\\.test\\.ts' — 1 suite, 36 tests passed.
• Web typecheck passed with pnpm --filter web exec tsgo --noEmit --checkers 1 --tsBuildInfoFile /tmp/tsgo-web.tsbuildinfo.

The change is server-side prompt composition; no visual surface is affected, so screenshots do not apply. All accounts and provider responses were local fixtures in this non-production VM.

Change

Bot prompt composition uses shared data-block formatting and keeps repository selection guidance. The shared composer and the Discord prompt describe the requesting user's role in task selection. Continuation prompt copies use the shared formatting helper and a bounded result excerpt; storage and user-visible messages retain the full result.

Existing platform context limits remain in place. The scope is prompt composition and continuation formatting; server-side authorization policy is unchanged.

Production prerequisites

None.

Proxy answers

The owner's proxy gave these answers in the owner's place.

1. Question: Context placement. Answer: Delimited untrusted block in the system prompt. Confidence: 0.62.
2. Question: Authorization scope. Answer: Prompt-level restriction only. Confidence: 0.75.
3. Question: Continuation formatting scope. Answer: Extend this pull request to include continuation prompt formatting. Confidence: 0.80.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the incremental commit 3e0ed935 ("Preserve bound repository prompt guidance"), which adds a bound-repository sentence to the bot system prompt and clarifies the repository-selection guidance; the branch/ternary logic correctly handles the null, empty-context, and bound-repository cases, and no correctness, security, or memory-leak issues were found.

Assumptions: [INFERENCE] Test execution was not repeated in this read-only review; the prompt and agent-runner suites covering this path were not run.

Files Reviewed (2 files)

• apps/web/src/lib/bot/agent-runner.ts
• apps/web/src/lib/bot/prompt.ts

Previous Review Summaries (5 snapshots, latest commit 4948960)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 4948960)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the incremental commit 4948960 ("Handle optional repository context"), which makes the GitHub/GitLab repository context nullable in the bot system-prompt builder; the optional chaining and empty-string fallbacks correctly handle the null case, and no correctness, security, or memory-leak issues were found.

Assumptions: [INFERENCE] Test execution was not repeated in this read-only review; the prompt and callback suites covering this path were not run.

Files Reviewed (1 file)

• apps/web/src/lib/bot/agent-runner.ts

Previous review (commit 8496e40)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the new discord-bot test that asserts Discord conversation context is rendered inside the named <platform_conversation_context platform="discord"> block; the branch's source changes are unchanged since the previous review, the merge with main left the PR-authored hunks intact, and no correctness, security, or memory-leak issues were found.

Assumptions: [INFERENCE] Test execution was not repeated in this read-only review; the repository's existing discord-channel-context tests cover delimiter sanitization separately from the new prompt-block assertion.

Files Reviewed (1 file)

• apps/web/src/lib/discord-bot.test.ts

Previous review (commit 5e2edea)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the incremental commit that removes the callback payload's over-long-summary deletion, bounds only the prompt copies of the result in both the legacy and tracked paths, and updates the tests; truncation is applied after escaping-safe helpers, the stored and chat copies intentionally retain the full text, and no correctness, security, or memory-leak issues were found.

Files Reviewed (2 files)

• apps/web/src/app/api/internal/bot-session-callback/[botRequestId]/route.ts
• apps/web/src/app/api/internal/bot-session-callback/[botRequestId]/route.test.ts

Previous review (commit 8cbf2e7)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the incremental commit that applies escapeClosingTag to the callback continuation prompt's result, partial-activity, and original-request blocks and bounds the callback final summary; escaping is idempotent across tracked and legacy paths, the bound is covered by tests, and no correctness, security, or memory-leak issues were found.

Files Reviewed (3 files)

• apps/web/src/app/api/internal/bot-session-callback/[botRequestId]/route.ts
• apps/web/src/app/api/internal/bot-session-callback/[botRequestId]/route.test.ts
• apps/web/src/lib/bot/platforms/shared.ts

Previous review (commit 33f6e1e)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the prompt-composition refactor and Discord context sanitization across 7 files; delimiter escaping, empty-context handling, trust framing, and the new tests are consistent, and no correctness, security, or memory-leak issues were found.

Files Reviewed (7 files)

• apps/web/src/lib/bot/agent-runner.ts
• apps/web/src/lib/bot/platforms/shared.ts
• apps/web/src/lib/bot/prompt.ts
• apps/web/src/lib/bot/prompt.test.ts
• apps/web/src/lib/discord-bot.ts
• apps/web/src/lib/discord-bot/discord-channel-context.ts
• apps/web/src/lib/discord-bot/discord-channel-context.test.ts

---

_{Reviewed by deepseek-flash-latest · Input: 30.3K · Output: 5.2K · Cached: 270.5K}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

bot: Follow-up check: the reported CI events belong to earlier commits. The current head, 3e0ed93, has 57 passing checks, a completed review recommending merge, and no unresolved review threads. The prior session recorded local webhook E2E proof on this same head; this follow-up did not repeat that run or change source.

[eshurakov]

Shallow review: no critical issues found.