From d26308bed9fa7e5178b0a17a350dad8250323332 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:46:21 +0000
Subject: [PATCH 01/10] Initial plan


From 5342f5a1b22d015590829ec02128b9d4b9eadd8a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:49:24 +0000
Subject: [PATCH 02/10] Address review feedback: sanitization, state
 management, and validation improvements

Co-authored-by: DimaBir <28827735+DimaBir@users.noreply.github.com>
---
 .github/issue-assistant/src/security.js | 18 ++------
 .github/workflows/issue-assistant.yml   | 55 +++++++++++++++++++++----
 2 files changed, 49 insertions(+), 24 deletions(-)

diff --git a/.github/issue-assistant/src/security.js b/.github/issue-assistant/src/security.js
index a4d3f9b9..60bdace6 100644
--- a/.github/issue-assistant/src/security.js
+++ b/.github/issue-assistant/src/security.js
@@ -227,21 +227,9 @@ async function validateRequest({
     errors.push('Rate limit exceeded');
   }
   
-  if (comment && maxBotResponses !== undefined) {
-    const { data: comments } = await github.rest.issues.listComments({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      issue_number: issue.number
-    });
-    
-    const botComments = comments.filter(c => 
-      c.body && c.body.includes('<!-- msdo-issue-assistant -->')
-    );
-    
-    if (botComments.length >= maxBotResponses) {
-      errors.push('Maximum bot responses reached');
-    }
-  }
+  // Note: Bot response count per issue is now validated in the conversation-state step
+  // of the workflow, not here. This avoids redundant validation and keeps state
+  // management centralized.
   
   return {
     shouldRespond: errors.length === 0,
diff --git a/.github/workflows/issue-assistant.yml b/.github/workflows/issue-assistant.yml
index d32a4f92..9228fba4 100644
--- a/.github/workflows/issue-assistant.yml
+++ b/.github/workflows/issue-assistant.yml
@@ -37,7 +37,6 @@ jobs:
       should_respond: ${{ (steps.conversation-state.outputs.should_respond == 'true' && steps.validation.outputs.validation_passed == 'true') ? 'true' : 'false' }}
       conversation_state: ${{ steps.conversation-state.outputs.state }}
       conversation_history: ${{ steps.conversation-state.outputs.history }}
-      sanitized_content: ${{ steps.validation.outputs.sanitized_content }}
       issue_type: ${{ steps.validation.outputs.issue_type }}
       wiki_context: ${{ steps.wiki.outputs.context }}
 
@@ -96,7 +95,7 @@ jobs:
             }
 
             // 2. Terminal states - don't respond further
-            if (['resolved', 'escalated', 'closed'].includes(currentState)) {
+            if (['resolved', 'escalated'].includes(currentState)) {
               console.log(`Terminal state "${currentState}" - no more responses`);
               core.setOutput('should_respond', 'false');
               core.setOutput('state', currentState);
@@ -142,19 +141,40 @@ jobs:
             }
 
             // === BUILD CONVERSATION HISTORY ===
+            // Simple sanitization function to prevent injection attacks
+            const sanitizeContent = (content, maxLength = 10000) => {
+              if (!content) return '';
+              let sanitized = content
+                .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '')
+                .replace(/[^\S\r\n]+/g, ' ')
+                .replace(/\n{3,}/g, '\n\n')
+                .trim();
+              if (sanitized.length > maxLength) {
+                sanitized = sanitized.substring(0, maxLength) + '... [truncated]';
+              }
+              return sanitized;
+            };
+            
             const history = [];
             
-            // Add issue body as first message
+            // Add issue body as first message (sanitize it)
+            const issueContent = `[Issue opened] ${issue.title}\n\n${issue.body || '(no description)'}`;
             history.push({
               role: 'user',
               author: issueAuthor,
-              content: `[Issue opened] ${issue.title}\n\n${issue.body || '(no description)'}`,
+              content: sanitizeContent(issueContent),
               timestamp: issue.created_at
             });
 
-            // Add all comments in order
+            // Add comments from issue author and bot only (filter out other users)
             for (const comment of comments) {
               const isBot = comment.body.includes('<!-- msdo-issue-assistant');
+              const isIssueAuthor = comment.user.login === issueAuthor;
+              
+              // Only include bot comments and comments from the issue author
+              if (!isBot && !isIssueAuthor) {
+                continue;
+              }
               
               // Strip bot metadata from display
               let content = comment.body;
@@ -164,6 +184,11 @@ jobs:
                   .replace(/<details>[\s\S]*?<\/details>/g, '')
                   .trim();
               }
+              
+              // Sanitize all user content before adding to history
+              if (!isBot) {
+                content = sanitizeContent(content);
+              }
 
               history.push({
                 role: isBot ? 'assistant' : 'user',
@@ -174,11 +199,18 @@ jobs:
             }
 
             // Determine next state based on conversation flow
-            let nextState = 'gathering';
+            // Preserve existing terminal states; only set initial state for new conversations
+            let nextState = currentState;
+            
             if (botComments.length === 0) {
               nextState = 'initial';
-            } else if (botComments.length >= maxResponses - 1) {
-              nextState = 'final_attempt';
+            } else if (!['resolved', 'escalated'].includes(currentState)) {
+              // Only update state if not already in a terminal state
+              if (botComments.length >= maxResponses - 1) {
+                nextState = 'final_attempt';
+              } else {
+                nextState = 'gathering';
+              }
             }
 
             console.log(`Will respond. Next state: ${nextState}`);
@@ -383,7 +415,12 @@ jobs:
 3. Do NOT ask more questions - either answer or escalate`
             };
 
-            systemPrompt += `\n\n--- CONVERSATION STATE: ${conversationState.toUpperCase()} ---\n`;
+            // Only append state instructions if we have a system prompt or need to provide one
+            if (systemPrompt) {
+              systemPrompt += `\n\n--- CONVERSATION STATE: ${conversationState.toUpperCase()} ---\n`;
+            } else {
+              systemPrompt = `--- CONVERSATION STATE: ${conversationState.toUpperCase()} ---\n`;
+            }
             systemPrompt += stateInstructions[conversationState] || stateInstructions.gathering;
             
             systemPrompt += `\n\n--- RESPONSE FORMAT ---

From 437e020c2f9a6a529e94c9e88b5b7e8c54ce18ae Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:50:37 +0000
Subject: [PATCH 03/10] Add clarifying comment for system prompt formatting
 logic

Co-authored-by: DimaBir <28827735+DimaBir@users.noreply.github.com>
---
 .github/workflows/issue-assistant.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/issue-assistant.yml b/.github/workflows/issue-assistant.yml
index 9228fba4..02dec96a 100644
--- a/.github/workflows/issue-assistant.yml
+++ b/.github/workflows/issue-assistant.yml
@@ -415,7 +415,9 @@ jobs:
 3. Do NOT ask more questions - either answer or escalate`
             };
 
-            // Only append state instructions if we have a system prompt or need to provide one
+            // Build system prompt with state instructions
+            // If SYSTEM_PROMPT exists, append state marker with spacing
+            // If not, start directly with state marker (no leading whitespace)
             if (systemPrompt) {
               systemPrompt += `\n\n--- CONVERSATION STATE: ${conversationState.toUpperCase()} ---\n`;
             } else {

From 1c9ddd9bce304e433036fda702375c1bd709e83b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:51:29 +0000
Subject: [PATCH 04/10] Add clarifying comments about state determination logic
 and terminal state handling

Co-authored-by: DimaBir <28827735+DimaBir@users.noreply.github.com>
---
 .github/workflows/issue-assistant.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/issue-assistant.yml b/.github/workflows/issue-assistant.yml
index 02dec96a..49b2ca58 100644
--- a/.github/workflows/issue-assistant.yml
+++ b/.github/workflows/issue-assistant.yml
@@ -199,13 +199,15 @@ jobs:
             }
 
             // Determine next state based on conversation flow
+            // Note: We can only reach this point if currentState is NOT a terminal state,
+            // as terminal states are checked earlier (lines 98-103) and cause an early return.
             // Preserve existing terminal states; only set initial state for new conversations
             let nextState = currentState;
             
             if (botComments.length === 0) {
               nextState = 'initial';
             } else if (!['resolved', 'escalated'].includes(currentState)) {
-              // Only update state if not already in a terminal state
+              // Only update state if not already in a terminal state (defensive check)
               if (botComments.length >= maxResponses - 1) {
                 nextState = 'final_attempt';
               } else {

From 613c881d2854624727be5adf0f6273c4436712f7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:52:22 +0000
Subject: [PATCH 05/10] Simplify state logic and add documentation to
 sanitization function

Co-authored-by: DimaBir <28827735+DimaBir@users.noreply.github.com>
---
 .github/workflows/issue-assistant.yml | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/issue-assistant.yml b/.github/workflows/issue-assistant.yml
index 49b2ca58..91211ada 100644
--- a/.github/workflows/issue-assistant.yml
+++ b/.github/workflows/issue-assistant.yml
@@ -145,9 +145,9 @@ jobs:
             const sanitizeContent = (content, maxLength = 10000) => {
               if (!content) return '';
               let sanitized = content
-                .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '')
-                .replace(/[^\S\r\n]+/g, ' ')
-                .replace(/\n{3,}/g, '\n\n')
+                .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Remove control characters
+                .replace(/[^\S\r\n]+/g, ' ')                      // Normalize whitespace (except newlines)
+                .replace(/\n{3,}/g, '\n\n')                       // Collapse excessive newlines
                 .trim();
               if (sanitized.length > maxLength) {
                 sanitized = sanitized.substring(0, maxLength) + '... [truncated]';
@@ -201,18 +201,15 @@ jobs:
             // Determine next state based on conversation flow
             // Note: We can only reach this point if currentState is NOT a terminal state,
             // as terminal states are checked earlier (lines 98-103) and cause an early return.
-            // Preserve existing terminal states; only set initial state for new conversations
             let nextState = currentState;
             
             if (botComments.length === 0) {
               nextState = 'initial';
-            } else if (!['resolved', 'escalated'].includes(currentState)) {
-              // Only update state if not already in a terminal state (defensive check)
-              if (botComments.length >= maxResponses - 1) {
-                nextState = 'final_attempt';
-              } else {
-                nextState = 'gathering';
-              }
+            } else if (botComments.length >= maxResponses - 1) {
+              nextState = 'final_attempt';
+            } else if (currentState !== 'final_attempt') {
+              // Keep 'final_attempt' if already set, otherwise use 'gathering'
+              nextState = 'gathering';
             }
 
             console.log(`Will respond. Next state: ${nextState}`);

From 9e4544de83b30200707cfdc3ad32c64bea9aa7ab Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:53:12 +0000
Subject: [PATCH 06/10] Improve documentation for sanitization function and
 state logic

Co-authored-by: DimaBir <28827735+DimaBir@users.noreply.github.com>
---
 .github/workflows/issue-assistant.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/issue-assistant.yml b/.github/workflows/issue-assistant.yml
index 91211ada..4c0d98a3 100644
--- a/.github/workflows/issue-assistant.yml
+++ b/.github/workflows/issue-assistant.yml
@@ -141,7 +141,12 @@ jobs:
             }
 
             // === BUILD CONVERSATION HISTORY ===
-            // Simple sanitization function to prevent injection attacks
+            /**
+             * Sanitizes user input to prevent injection attacks and normalize formatting.
+             * @param {string} content - The raw user input to sanitize
+             * @param {number} maxLength - Maximum allowed length (default: 10000)
+             * @returns {string} Sanitized content, truncated if exceeds maxLength
+             */
             const sanitizeContent = (content, maxLength = 10000) => {
               if (!content) return '';
               let sanitized = content
@@ -208,9 +213,10 @@ jobs:
             } else if (botComments.length >= maxResponses - 1) {
               nextState = 'final_attempt';
             } else if (currentState !== 'final_attempt') {
-              // Keep 'final_attempt' if already set, otherwise use 'gathering'
+              // If not already in final_attempt, transition to gathering state
               nextState = 'gathering';
             }
+            // Otherwise keep the current state (e.g., preserve 'final_attempt')
 
             console.log(`Will respond. Next state: ${nextState}`);
             console.log(`Conversation turns: ${history.length}`);

From 1ed7fb5dbe9846cff528282df5fd8e5531d59a72 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:54:13 +0000
Subject: [PATCH 07/10] Simplify and clarify state determination logic

Co-authored-by: DimaBir <28827735+DimaBir@users.noreply.github.com>
---
 .github/workflows/issue-assistant.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/issue-assistant.yml b/.github/workflows/issue-assistant.yml
index 4c0d98a3..425eb3ac 100644
--- a/.github/workflows/issue-assistant.yml
+++ b/.github/workflows/issue-assistant.yml
@@ -148,6 +148,7 @@ jobs:
              * @returns {string} Sanitized content, truncated if exceeds maxLength
              */
             const sanitizeContent = (content, maxLength = 10000) => {
+              // Return empty string for any falsy value (null, undefined, '', 0, false, NaN)
               if (!content) return '';
               let sanitized = content
                 .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Remove control characters
@@ -206,17 +207,18 @@ jobs:
             // Determine next state based on conversation flow
             // Note: We can only reach this point if currentState is NOT a terminal state,
             // as terminal states are checked earlier (lines 98-103) and cause an early return.
-            let nextState = currentState;
+            let nextState;
             
             if (botComments.length === 0) {
+              // First bot response - always start in 'initial' state
               nextState = 'initial';
             } else if (botComments.length >= maxResponses - 1) {
+              // At the limit - this is the final attempt
               nextState = 'final_attempt';
-            } else if (currentState !== 'final_attempt') {
-              // If not already in final_attempt, transition to gathering state
+            } else {
+              // Normal conversation flow - use 'gathering' state
               nextState = 'gathering';
             }
-            // Otherwise keep the current state (e.g., preserve 'final_attempt')
 
             console.log(`Will respond. Next state: ${nextState}`);
             console.log(`Conversation turns: ${history.length}`);

From 1772ddcb1201738ac9b4590742179ddfc05566e4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:55:09 +0000
Subject: [PATCH 08/10] Improve sanitization function with explicit null
 handling and line ending normalization

Co-authored-by: DimaBir <28827735+DimaBir@users.noreply.github.com>
---
 .github/workflows/issue-assistant.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/issue-assistant.yml b/.github/workflows/issue-assistant.yml
index 425eb3ac..757f7dd3 100644
--- a/.github/workflows/issue-assistant.yml
+++ b/.github/workflows/issue-assistant.yml
@@ -148,10 +148,16 @@ jobs:
              * @returns {string} Sanitized content, truncated if exceeds maxLength
              */
             const sanitizeContent = (content, maxLength = 10000) => {
-              // Return empty string for any falsy value (null, undefined, '', 0, false, NaN)
-              if (!content) return '';
-              let sanitized = content
-                .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Remove control characters
+              // Handle null, undefined, or empty string
+              if (content == null || content === '') return '';
+              
+              // Coerce to string if needed (though content should always be a string)
+              const str = String(content);
+              
+              let sanitized = str
+                .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Remove control characters (preserves \t, \n, \r)
+                .replace(/\r\n/g, '\n')                           // Normalize Windows line endings
+                .replace(/\r/g, '\n')                             // Normalize old Mac line endings
                 .replace(/[^\S\r\n]+/g, ' ')                      // Normalize whitespace (except newlines)
                 .replace(/\n{3,}/g, '\n\n')                       // Collapse excessive newlines
                 .trim();

From c5aa917b3c067af50c5e3ed88fb77b413dc866d3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:56:13 +0000
Subject: [PATCH 09/10] Add defensive initialization and clarify terminal state
 handling

Co-authored-by: DimaBir <28827735+DimaBir@users.noreply.github.com>
---
 .github/workflows/issue-assistant.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/issue-assistant.yml b/.github/workflows/issue-assistant.yml
index 757f7dd3..cd35841e 100644
--- a/.github/workflows/issue-assistant.yml
+++ b/.github/workflows/issue-assistant.yml
@@ -155,7 +155,7 @@ jobs:
               const str = String(content);
               
               let sanitized = str
-                .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Remove control characters (preserves \t, \n, \r)
+                .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Remove control chars (preserves \t=tab, \n=newline, \r=CR)
                 .replace(/\r\n/g, '\n')                           // Normalize Windows line endings
                 .replace(/\r/g, '\n')                             // Normalize old Mac line endings
                 .replace(/[^\S\r\n]+/g, ' ')                      // Normalize whitespace (except newlines)
@@ -213,7 +213,8 @@ jobs:
             // Determine next state based on conversation flow
             // Note: We can only reach this point if currentState is NOT a terminal state,
             // as terminal states are checked earlier (lines 98-103) and cause an early return.
-            let nextState;
+            // Note: Issues that are closed don't trigger this workflow (see line 29 condition).
+            let nextState = 'gathering'; // Default to gathering for defensive programming
             
             if (botComments.length === 0) {
               // First bot response - always start in 'initial' state

From 92cc11efdf224f648da21869e5a9790bcae06c28 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:57:08 +0000
Subject: [PATCH 10/10] Remove redundant else branch in state determination
 logic

Co-authored-by: DimaBir <28827735+DimaBir@users.noreply.github.com>
---
 .github/workflows/issue-assistant.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/issue-assistant.yml b/.github/workflows/issue-assistant.yml
index cd35841e..33b8c88d 100644
--- a/.github/workflows/issue-assistant.yml
+++ b/.github/workflows/issue-assistant.yml
@@ -222,10 +222,8 @@ jobs:
             } else if (botComments.length >= maxResponses - 1) {
               // At the limit - this is the final attempt
               nextState = 'final_attempt';
-            } else {
-              // Normal conversation flow - use 'gathering' state
-              nextState = 'gathering';
             }
+            // else: keep the default 'gathering' state for normal conversation flow
 
             console.log(`Will respond. Next state: ${nextState}`);
             console.log(`Conversation turns: ${history.length}`);