fix(repair): verify pushed revision safely

Author: CompleteDotTech

src/adapter.ts

@@ -2127,7 +2127,10 @@ async function maybeRunRepair(config: AdapterConfig, taskId: string, inputTask?:
       } else if (live.headSha !== preparedCommit || live.baseSha !== evidenceRevision.baseSha) {
         return repairStop(path, task, "repair_stale_head_during_push_recovery");
       }
-      const liveAfter = await currentPullRevision(String(task.repository), prNumber, repairToken);
+      const liveAfter = await waitForExpectedPullRevision(
+        () => currentPullRevision(String(task.repository), prNumber, repairToken),
+        {headSha: preparedCommit, baseSha: evidenceRevision.baseSha},
+      );
       if (liveAfter.headSha !== preparedCommit || liveAfter.baseSha !== evidenceRevision.baseSha) return repairStop(path, task, "repair_pushed_revision_unverified");
       const followupTaskId = await createFollowupReviewTask(config, task, currentPolicy, preparedCommit, liveAfter.baseSha, String(task.repair_finding_signature || signature), preparedCommit);
       task.repair_state = "repair_committed";
@@ -2260,7 +2263,10 @@ async function maybeRunRepair(config: AdapterConfig, taskId: string, inputTask?:
     const push = runCommand([config.hostGitBin, "-c", "core.hooksPath=/dev/null", "push", "origin", `HEAD:refs/heads/${headRef}`], repairWorkspace, gitEnv, 180);
     writeJsonAtomic(join(artifactDir, "repair-push.json"), redactedCommandResult(push));
     if (push.returncode !== 0) return repairStop(path, task, "repair_push_failed", push.stderr);
-    const liveAfterPush = await currentPullRevision(String(task.repository), prNumber, repairToken);
+    const liveAfterPush = await waitForExpectedPullRevision(
+      () => currentPullRevision(String(task.repository), prNumber, repairToken),
+      {headSha: commitSha, baseSha: evidenceRevision.baseSha},
+    );
     if (liveAfterPush.headSha !== commitSha || liveAfterPush.baseSha !== evidenceRevision.baseSha) return repairStop(path, task, "repair_pushed_revision_unverified");
     const followupTaskId = await createFollowupReviewTask(config, task, refreshedPolicy, commitSha, liveAfterPush.baseSha, signature, commitSha);
     task.repair_state = "repair_committed";
@@ -3658,7 +3664,7 @@ interface SubmittedReview {
   staleEvidence: boolean;
 }
 
-interface PullRevision {
+export interface PullRevision {
   headSha: string;
   baseSha: string;
 }
@@ -3672,6 +3678,24 @@ function samePullRevision(left: PullRevision, right: PullRevision): boolean {
   return Boolean(left.headSha && left.baseSha && left.headSha === right.headSha && left.baseSha === right.baseSha);
 }
 
+export async function waitForExpectedPullRevision(
+  readRevision: () => Promise<PullRevision>,
+  expected: PullRevision,
+  attempts = 6,
+  delayMs = 500,
+): Promise<PullRevision> {
+  const boundedAttempts = Math.max(1, Math.min(20, Math.trunc(attempts)));
+  let latest: PullRevision = {headSha: "", baseSha: ""};
+  for (let attempt = 0; attempt < boundedAttempts; attempt += 1) {
+    latest = await readRevision();
+    if (samePullRevision(latest, expected)) return latest;
+    if (attempt + 1 < boundedAttempts && delayMs > 0) {
+      await new Promise((resolveDelay) => setTimeout(resolveDelay, delayMs));
+    }
+  }
+  return latest;
+}
+
 async function currentPullRevision(repo: string, prNumber: number, token: string): Promise<PullRevision> {
   const pr = (await githubRequest("GET", `https://api.github.com/repos/${repo}/pulls/${prNumber}`, token)) as JsonObject;
   return {
@@ -4562,7 +4586,7 @@ export function runtimeDiagnostic(result: CommandResult): string | null {
     return `Coven Code exited ${result.returncode} without a diagnostic.`;
   }
   const safe = redactTokenish(raw)
-    .replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[redacted email]")
+    .replace(/[A-Z0-9._%+-]+(?:\[[A-Z0-9_-]+\])?@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "[redacted email]")
     .replace(/\bon account\s+[^\n.]+/gi, "on the configured account")
     .replace(/\s+/g, " ")
     .trim();
@@ -4604,7 +4628,7 @@ export function redactTokenish(text: string): string {
     .replace(/\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_-]{6,}/g, "[redacted github token]")
     .replace(/\bsk-(?:proj-)?[A-Za-z0-9_-]{8,}/g, "[redacted OpenAI token]")
     .replace(/\bBearer\s+[^\s'\"]+/gi, "Bearer [redacted]")
-    .replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[redacted email]")
+    .replace(/[A-Z0-9._%+-]+(?:\[[A-Z0-9_-]+\])?@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "[redacted email]")
     .replace(/\bon account\s+`?[^`\n.]+`?/gi, "on the configured account")
     .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[redacted JWT]");
 }

tests/webhook-adapter.test.ts

@@ -41,6 +41,7 @@ import {
   sanitizedRuntimeEnvironment,
   sessionBrief,
   trustedValidationFindings,
+  waitForExpectedPullRevision,
   withEphemeralCodexCredential,
   type JsonObject,
   type JsonValue,
@@ -805,6 +806,25 @@ test("a successful repair creates one deterministic new-SHA follow-up task with
   assert.equal((followup.repair_history as JsonObject[])[0].finding_signature, "finding-signature");
 });
 
+test("repair verification waits for GitHub to expose the pushed head", async () => {
+  const expected = {headSha: "c".repeat(40), baseSha: "b".repeat(40)};
+  let reads = 0;
+  const observed = await waitForExpectedPullRevision(async () => {
+    reads += 1;
+    return reads < 3 ? {headSha: "a".repeat(40), baseSha: expected.baseSha} : expected;
+  }, expected, 6, 0);
+  assert.deepEqual(observed, expected);
+  assert.equal(reads, 3);
+
+  reads = 0;
+  const stale = await waitForExpectedPullRevision(async () => {
+    reads += 1;
+    return {headSha: "a".repeat(40), baseSha: expected.baseSha};
+  }, expected, 2, 0);
+  assert.equal(stale.headSha, "a".repeat(40));
+  assert.equal(reads, 2);
+});
+
 test("repair eligibility fails closed for forks, protected branches, limits, repeats, and kill switches", () => {
   const finding = {severity: "high", file: "src/app.ts", line: 12, title: "Validate input", body: "Missing validation.", recommendation: "Validate it."};
   const result = completeReview([finding]);
@@ -3279,7 +3299,7 @@ test("redacts credentials and passes only allowlisted ambient environment keys",
   const redacted = redactTokenish(secretText);
   assert.doesNotMatch(redacted, /1234567890|topsecret|password|private-data|eyJabc|reviewer@example\.com|reviewer \(/);
   const artifact = redactedCommandResult({
-    args: ["git", "-c", "user.email=reviewer@example.com", "https://x-access-token:ghs_1234567890@github.com/OpenCoven/example.git"],
+    args: ["git", "-c", "user.email=covencat[bot]@users.noreply.github.com", "https://x-access-token:ghs_1234567890@github.com/OpenCoven/example.git"],
     returncode: 1,
     stdout: "Bearer topsecret",
     stderr: "reviewer@example.com",
@@ -3291,7 +3311,7 @@ test("redacts credentials and passes only allowlisted ambient environment keys",
     output_limit_bytes: 1024,
     spawn_error: "failed for reviewer@example.com",
   });
-  assert.doesNotMatch(JSON.stringify(artifact), /1234567890|topsecret|reviewer@example\.com/);
+  assert.doesNotMatch(JSON.stringify(artifact), /1234567890|topsecret|covencat\[bot\]@users\.noreply\.github\.com/);
   assert.deepEqual(artifact.args, ["git", "-c", "user.email=[redacted email]", "https://[redacted]@github.com/OpenCoven/example.git"]);
   const env = sanitizedRuntimeEnvironment({
     PATH: "/bin", LANG: "C.UTF-8", SSH_AUTH_SOCK: "/tmp/agent.sock",