fix(sec-004): sanitize body field in assign_to_agent.cjs

[Copilot]

assign_to_agent.cjs was posting failure comments to GitHub issues/PRs with an unsanitized body field containing r.error — potentially user-influenced content — violating SEC-004 of the Safe Outputs specification.

Changes

• actions/setup/js/assign_to_agent.cjs: Import sanitizeContent from sanitize_content.cjs, wrap the failure comment body with sanitizeContent(..., { maxLength: 65000 }) before it is passed to github.rest.issues.createComment, capping it at GitHub's comment size limit.

// Before
body: `⚠️ **Assignment failed**: Failed to assign ${r.agent} coding agent to this ${failedType}.\n\nError: ${r.error}`,

// After
body: sanitizeContent(
  `⚠️ **Assignment failed**: Failed to assign ${r.agent} coding agent to this ${failedType}.\n\nError: ${r.error}`,
  { maxLength: 65000 }
),

• actions/setup/js/assign_to_agent.test.cjs: Added a test case should sanitize dangerous content in failure comment body that injects an @mention and an HTML comment into r.error and asserts the mention is neutralized and the HTML comment is stripped from the posted body.

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[Copilot]

Pull request overview

Addresses SEC-004 Safe Outputs compliance by sanitizing the GitHub issue/PR failure comment body generated by assign_to_agent.cjs, preventing user-influenced error content from being posted unsanitized.

Changes:

• Import sanitizeContent in actions/setup/js/assign_to_agent.cjs.
• Wrap the failure comment body passed to github.rest.issues.createComment with sanitizeContent(...).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

When posting the failure comment, the sanitized string can still exceed GitHub’s issue comment body limit (65536). Other callers cap this (e.g., handle_agent_failure.cjs uses sanitizeContent(..., { maxLength: 65000 })). Consider passing an explicit maxLength (or enforcing comment limits) here to avoid createComment failing on unusually large error messages.

Suggested change

	body: sanitizeContent(`⚠️ **Assignment failed**: Failed to assign ${r.agent} coding agent to this ${failedType}.\n\nError: ${r.error}`),
	body: sanitizeContent(
	`⚠️ **Assignment failed**: Failed to assign ${r.agent} coding agent to this ${failedType}.\n\nError: ${r.error}`,
	{ maxLength: 65000 }
	),

[Copilot]

This change introduces a security-relevant behavior (sanitizing the failure comment body), but the existing unit tests only assert that a failure comment is posted, not that potentially dangerous content is neutralized. Please add a test case in assign_to_agent.test.cjs that makes r.error include something like an @mention and/or leading slash-command and asserts the posted comment body contains the sanitized/escaped form.

[pelikhan]

@copilot apply comments

[Copilot]

@copilot apply comments

Applied both reviewer comments in commit 200b18c:

1. Added { maxLength: 65000 } to the sanitizeContent call to stay within GitHub's comment body limit (matching the pattern used in handle_agent_failure.cjs).
2. Added a new test should sanitize dangerous content in failure comment body that passes an error message containing a raw @mention and an HTML comment injection, then asserts the @mention is neutralized (wrapped in backticks) and the HTML comment is stripped from the posted body.