From 13a2ec5716e3f1c7a36260696611687feeb59f97 Mon Sep 17 00:00:00 2001
From: Nicky Leach <nicky@paperclip.ing>
Date: Sat, 20 Jun 2026 02:04:05 +0000
Subject: [PATCH] Harden gate confirmation mirror comments

---
 server/src/__tests__/issues-service.test.ts | 14 ++++++++++++--
 server/src/services/issues.ts               |  9 ++++++++-
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/server/src/__tests__/issues-service.test.ts b/server/src/__tests__/issues-service.test.ts
index 8c3ca65eee6..1d6c13a6593 100644
--- a/server/src/__tests__/issues-service.test.ts
+++ b/server/src/__tests__/issues-service.test.ts
@@ -2936,7 +2936,7 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
     });
 
     const { issue: child } = await svc.createChild(parentIssueId, {
-      title: "Security gate",
+      title: "Security <gate> **bold** [x](y) `code` # heading | table!",
       status: "todo",
       gateConfirmationMirror: true,
     });
@@ -2950,6 +2950,12 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
 
     await svc.addComment(child.id, "Approved. The implementation keeps the system write bounded.", {});
     await db.update(issues).set({ status: "done" }).where(eq(issues.id, child.id));
+    await db.insert(issueComments).values({
+      companyId,
+      issueId: parentIssueId,
+      authorType: "user",
+      body: `A user pasted the mirror marker: <!-- gate-confirmation-mirror:${child.id} -->`,
+    });
 
     const mirrored = await svc.mirrorGateConfirmationToParent(child.id);
     expect(mirrored).toMatchObject({
@@ -2958,6 +2964,10 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
     });
     expect(mirrored?.body).toContain("## Gate Confirmation");
     expect(mirrored?.body).toContain(child.identifier);
+    expect(mirrored?.body).toContain(
+      String.raw`Security &lt;gate&gt; \*\*bold\*\* \[x\]\(y\) \`code\` \# heading \| table\!`,
+    );
+    expect(mirrored?.body).not.toContain("Security <gate> **bold** [x](y) `code` # heading | table!");
     expect(mirrored?.body).toContain("Approved. The implementation keeps the system write bounded.");
 
     await expect(svc.mirrorGateConfirmationToParent(child.id)).resolves.toBeNull();
@@ -2965,7 +2975,7 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
       .select()
       .from(issueComments)
       .where(eq(issueComments.issueId, parentIssueId));
-    expect(parentComments).toHaveLength(1);
+    expect(parentComments).toHaveLength(2);
   });
 
   it("does not mirror unflagged done children", async () => {
diff --git a/server/src/services/issues.ts b/server/src/services/issues.ts
index 55daba7dc3d..d4e6d260de7 100644
--- a/server/src/services/issues.ts
+++ b/server/src/services/issues.ts
@@ -484,7 +484,13 @@ function buildGateConfirmationMirrorMarker(childIssueId: string) {
 }
 
 function escapeMarkdownText(value: string) {
-  return value.replace(/[\\[\]()]/g, "\\$&").replace(/\s+/g, " ").trim();
+  return value
+    .replace(/\s+/g, " ")
+    .trim()
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/[\\`*_{}[\]()#+\-.!|]/g, "\\$&");
 }
 
 function indentMarkdownCodeBlock(value: string) {
@@ -4665,6 +4671,7 @@ export function issueService(db: Db) {
         .where(and(
           eq(issueComments.companyId, child.companyId),
           eq(issueComments.issueId, child.parentId),
+          eq(issueComments.authorType, "system"),
           like(issueComments.body, `%${marker}%`),
         ))
         .limit(1)