[Dan Cristoloveanu (dcristoloveanu)]

Replaces #441, which came from a fork (ewertons/c-build-tools). The required Azure-C-Build-Tools-Gate check does not build fork PRs, so #441 could never be merged.

The branch here is the same commit as #441's head (2db8eb6). Nothing in it has changed.

Original author: Ewerton Scaboro da Silva (@ewertons). Description below copied from #441.

---

Problem

update_deps/helper_scripts/autofix.ps1 builds the prompt it passes to the Copilot CLI by interpolating CI build log text directly:

## CI build failure logs

$build_logs

$build_logs is raw Azure DevOps failed-task log content fetched by get-azure-build-failure-details / get-failed-build-logs. It is appended to the prompt verbatim, and the prompt is then run with copilot -p $prompt --autopilot --allow-all --no-ask-user.

A build echoes a lot of text that is not written by the person running the propagation: source snippets, test output, file names, commit messages. Because that text lands in the prompt with no delimitation, anything in a log that reads like a markdown heading, a code fence, or an instruction is indistinguishable from the tool's own instructions to the agent.

Fix

Build log text is now handled as data:

• New get-sanitized-log-block normalizes the log text before it reaches the prompt:
  • strips ANSI/VT escape sequences and remaining control/format characters (keeping tab and newline), so the block cannot be visually reformatted;
  • prefixes every line with | , so no line can close the block or start a new markdown section or code fence;
  • truncates to $global:MAX_BUILD_LOG_CHARS (20000), so a large log cannot push the task instructions out of the prompt.
• The block is wrapped in a per-run, unguessable delimiter (BUILD-LOG-<guid>); any occurrence of that delimiter inside the log text is replaced, so the log cannot spoof its own end marker.
• The prompt now states that the delimited block is reference data only, that instructions found inside it must be ignored, that the numbered task list is the only instruction set for the session, and that the agent should report it if the block looks like it contains instructions.
• $branch_name and $pr_url are validated before interpolation ($branch_name is also placed into a git push origin ... command in the prompt). Unexpected values skip AutoFix instead of being embedded.

Testing

Ran get-sanitized-log-block over log text containing ANSI colour codes, an OSC title-set sequence, a copy of the delimiter, markdown headings, code fences, and an instruction-shaped line. Verified the output contains no ESC or CR characters, no occurrence of the delimiter, and that every line is quoted. Verified truncation on a 60000-character input and that empty input returns an empty string. Script parses clean, line endings and tabs unchanged.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Dan Cristoloveanu (dcristoloveanu)]

/azp run Azure-C-Build-Tools-Gate

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).