fix(git-wrappers): #865 round-7 addendum — conservative YAML recognizer + review/comment hardening

Fold the remaining round-7 audit items into the tea-CLI comment-invocation fix.

Fallback token parser (detect-platform.sh, test-gitea-login-resolution.sh):
Replace the line-by-line scalar fallback with a strict CONSERVATIVE block-YAML
recognizer that reconstructs the same object PyYAML would or fails closed the
instant it meets anything outside the tea-config subset. Closes 5 structural
fail-open classes the old parser missed (nested-shadow logins, block-scalar
shadow, duplicate root key / login name / token field, malformed-after-valid,
extra-document / end-marker). Validated by a 360k-check differential fuzz vs
real PyYAML (0 fail-open) plus explicit forced-PyYAML-absence fixtures.

ITEM 1 (pr-review.sh) current-head TOCTOU: after the exact review-id read-back
succeeds, re-read the live PR head and fail closed if it advanced past the
submitted commit_id, so a review is never reported as covering a superseded tip.

ITEM 2 (pr-review.sh comment action): require the returned resource be a
pull_request (populated pull_request_url); reject a bare issue_url so a plain
issue #N cannot masquerade as a verified PR comment. issue-comment.sh keeps its
broader issue-or-PR acceptance.

ITEM 3a (both wrappers): move the Authorization bearer OUT of curl argv into a
private mode-0600 curl --config file (gitea_write_auth_config), removed on every
exit path, so the token never appears in the process table.

ITEM 3b (pr-review.sh): bind the review body with presence + string-type + exact
equality instead of `(body or "")`, so a non-empty submitted body persisted as
null/missing fails closed.

Tests: add race, plain-issue, argv-capture (no token printed), and null-body
fixtures; broaden temp-leak checks to the auth-config files. Full gate set green
(bash -n, shellcheck -x -S warning, prettier, all 3 REST/resolution suites with
PyYAML and forced-absent, cold TURBO_FORCE turbo 14/14).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/mosaic/framework/tools/git/pr-review.sh

@@ -90,7 +90,7 @@ detect_platform >/dev/null
 # Args: $1 = PR number, $2 = comment body, $3 = acting identity login.
 gitea_create_comment_verified() {
     local pr_number="$1" comment_body="$2" acting_login="$3"
-    local payload write_file readback_file write_status readback_status created_id
+    local payload write_file readback_file auth_config write_status readback_status created_id
 
     payload=$(COMMENT_BODY="$comment_body" python3 -c '
 import json
@@ -100,11 +100,16 @@ print(json.dumps({"body": os.environ["COMMENT_BODY"]}))
 ')
     write_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-write.XXXXXX")
     readback_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-getid.XXXXXX")
-    trap 'rm -f "$write_file" "$readback_file"' RETURN
+    auth_config=$(gitea_write_auth_config "$GITEA_API_TOKEN") || {
+        rm -f "$write_file" "$readback_file"
+        echo "Error: could not stage Gitea credential for comment write" >&2
+        return 1
+    }
+    trap 'rm -f "$write_file" "$readback_file" "$auth_config"' RETURN
 
     if ! write_status=$(curl -sS -o "$write_file" -w '%{http_code}' \
         -X POST \
-        -H "Authorization: token $GITEA_API_TOKEN" \
+        --config "$auth_config" \
         -H 'Content-Type: application/json' \
         -d "$payload" \
         "$GITEA_API_BASE/issues/$pr_number/comments"); then
@@ -134,7 +139,7 @@ PY
 ) || return 1
 
     if ! readback_status=$(curl -sS -o "$readback_file" -w '%{http_code}' \
-        -H "Authorization: token $GITEA_API_TOKEN" \
+        --config "$auth_config" \
         "$GITEA_API_BASE/issues/comments/$created_id"); then
         echo "Error: Gitea comment read-back transport failed" >&2
         return 1
@@ -181,12 +186,17 @@ try:
     # comment carries pull_request_url = <web_base>/<owner>/<repo>/pulls/<n> (with
     # issue_url empty), while a plain issue comment carries
     # issue_url = <web_base>/<owner>/<repo>/issues/<n> (with pull_request_url empty).
+    # This is the pr-review `comment` action, so the comment MUST land on a pull
+    # request: require pull_request_url. A plain issue_url is REJECTED — if issue
+    # #N exists but PR #N does not, POST /issues/N/comments creates an issue
+    # comment, and accepting that issue_url would let the wrapper falsely report a
+    # verified PR comment (issue-comment.sh legitimately keeps the broader
+    # issue-or-PR acceptance; a PR review does not).
     # Pin the returned URL's ORIGIN (scheme+host+port) and its FULL path to this
     # provider + repo + kind + number — an endswith/suffix test would accept a
     # look-alike host (evil.example/deceptive/<slug>/pulls/N) or a same-host
     # decoy prefix (/other/<slug>/pulls/N), so compare the whole thing.
     base_origin, base_path = _origin_and_path(web_base)
-    expected_issue_path = f"{base_path}/{slug}/issues/{number}"
     expected_pr_path = f"{base_path}/{slug}/pulls/{number}"
 
     def _belongs(url, expected_path):
@@ -201,11 +211,8 @@ try:
         raise ValueError("created comment is not authored by the acting identity")
     if comment.get("body") != expected_body:
         raise ValueError("created comment body does not match")
-    if not (
-        _belongs(comment.get("issue_url"), expected_issue_path)
-        or _belongs(comment.get("pull_request_url"), expected_pr_path)
-    ):
-        raise ValueError("created comment does not belong to this PR on this provider/repo")
+    if not _belongs(comment.get("pull_request_url"), expected_pr_path):
+        raise ValueError("claimed PR comment did not land on a pull request (kind=pulls) on this provider/repo")
 except (OSError, json.JSONDecodeError, KeyError, TypeError, ValueError) as error:
     print(f"Error: Gitea comment persistence verification failed: {error}", file=sys.stderr)
     raise SystemExit(1)
@@ -269,13 +276,18 @@ gitea_resolve_api_for_login() {
 # concurrent review from a DIFFERENT identity cannot satisfy verification.
 # Prints the login on success.
 gitea_authenticated_login() {
-    local response_file status
+    local response_file auth_config status
 
     response_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-whoami.XXXXXX")
-    trap 'rm -f "$response_file"' RETURN
+    auth_config=$(gitea_write_auth_config "$GITEA_API_TOKEN") || {
+        rm -f "$response_file"
+        echo "Error: could not stage Gitea credential for identity read" >&2
+        return 1
+    }
+    trap 'rm -f "$response_file" "$auth_config"' RETURN
 
     if ! status=$(curl -sS -o "$response_file" -w '%{http_code}' \
-        -H "Authorization: token $GITEA_API_TOKEN" \
+        --config "$auth_config" \
         "$GITEA_API_ROOT/user"); then
         echo "Error: Gitea authenticated-identity read transport failed" >&2
         return 1
@@ -302,18 +314,16 @@ print(login)
 PY
 }
 
-# Resolve the PR's current head commit SHA (GET /pulls/{n}). The review is
-# submitted against — and later verified as pinned to — this exact commit, so a
-# stale review left over from an earlier push cannot be mistaken for this one.
-# Prints the head SHA on success.
-gitea_pr_head_sha() {
-    local pr_number="$1" pr_file status
-
-    pr_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-head.XXXXXX")
-    trap 'rm -f "$pr_file"' RETURN
+# GET /pulls/{n} into a caller-owned response file and print its head commit
+# SHA. This core sets NO RETURN trap and reuses a caller-provided auth config +
+# response file, so it is safe to call from INSIDE another trapped function
+# (the post-verify re-read below) without clobbering that function's cleanup
+# trap. $1 = PR number, $2 = response file, $3 = curl auth config file.
+gitea_read_pr_head_into() {
+    local pr_number="$1" pr_file="$2" auth_config="$3" status
 
     if ! status=$(curl -sS -o "$pr_file" -w '%{http_code}' \
-        -H "Authorization: token $GITEA_API_TOKEN" \
+        --config "$auth_config" \
         "$GITEA_API_BASE/pulls/$pr_number"); then
         echo "Error: Gitea PR head read transport failed" >&2
         return 1
@@ -339,6 +349,24 @@ print(head_sha)
 PY
 }
 
+# Resolve the PR's current head commit SHA (GET /pulls/{n}). The review is
+# submitted against — and later verified as pinned to — this exact commit, so a
+# stale review left over from an earlier push cannot be mistaken for this one.
+# Prints the head SHA on success.
+gitea_pr_head_sha() {
+    local pr_number="$1" pr_file auth_config
+
+    pr_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-head.XXXXXX")
+    auth_config=$(gitea_write_auth_config "$GITEA_API_TOKEN") || {
+        rm -f "$pr_file"
+        echo "Error: could not stage Gitea credential for PR head read" >&2
+        return 1
+    }
+    trap 'rm -f "$pr_file" "$auth_config"' RETURN
+
+    gitea_read_pr_head_into "$pr_number" "$pr_file" "$auth_config"
+}
+
 # Submit a review to a Gitea PR via the supported REST API and verify it against
 # a PROVIDER-RETURNED created id. tea 0.11.1's `pr approve`/`reject` cannot emit
 # the id of the review it created and can silently no-op while exiting 0 (#865
@@ -356,7 +384,8 @@ PY
 #       $5 = PR head sha.
 gitea_submit_review_verified() {
     local pr_number="$1" event="$2" review_body="$3" acting_login="$4" head_sha="$5"
-    local payload write_file readback_file write_status readback_status created_id
+    local payload write_file readback_file recheck_file auth_config
+    local write_status readback_status created_id live_head
 
     payload=$(REVIEW_EVENT="$event" REVIEW_BODY="$review_body" REVIEW_COMMIT="$head_sha" python3 -c '
 import json
@@ -370,11 +399,17 @@ print(json.dumps({
 ')
     write_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-submit.XXXXXX")
     readback_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-getid.XXXXXX")
-    trap 'rm -f "$write_file" "$readback_file"' RETURN
+    recheck_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-recheck.XXXXXX")
+    auth_config=$(gitea_write_auth_config "$GITEA_API_TOKEN") || {
+        rm -f "$write_file" "$readback_file" "$recheck_file"
+        echo "Error: could not stage Gitea credential for review submit" >&2
+        return 1
+    }
+    trap 'rm -f "$write_file" "$readback_file" "$recheck_file" "$auth_config"' RETURN
 
     if ! write_status=$(curl -sS -o "$write_file" -w '%{http_code}' \
         -X POST \
-        -H "Authorization: token $GITEA_API_TOKEN" \
+        --config "$auth_config" \
         -H 'Content-Type: application/json' \
         -d "$payload" \
         "$GITEA_API_BASE/pulls/$pr_number/reviews"); then
@@ -405,7 +440,7 @@ PY
 ) || return 1
 
     if ! readback_status=$(curl -sS -o "$readback_file" -w '%{http_code}' \
-        -H "Authorization: token $GITEA_API_TOKEN" \
+        --config "$auth_config" \
         "$GITEA_API_BASE/pulls/$pr_number/reviews/$created_id"); then
         echo "Error: Gitea review read-back transport failed" >&2
         return 1
@@ -444,14 +479,42 @@ try:
     # finalize/reuse a pending review id whose Content was authored elsewhere;
     # the exact GET exposes the persisted body, so a mismatch (a reused/foreign
     # review carrying different Content) fails closed even when id/author/state/
-    # head all line up.
-    if (review.get("body") or "") != expected_body:
+    # head all line up. Require presence + string TYPE + exact equality rather
+    # than `(body or "")`: the old coalesce treated a missing/null persisted body
+    # as equal to an empty submitted one, so a non-empty submitted body that
+    # persisted as null (a suppressed/lost body) would have passed. When a
+    # non-empty body was submitted the persisted value MUST be that exact string;
+    # when an empty body was submitted the persisted value must be empty or
+    # absent (a non-empty persisted body is likewise a divergence — vice-versa).
+    persisted_body = review.get("body")
+    if expected_body == "":
+        if persisted_body not in (None, ""):
+            raise ValueError("created review carries a body but none was submitted")
+    elif not isinstance(persisted_body, str) or persisted_body != expected_body:
         raise ValueError("created review body does not match the submitted body")
 except (OSError, json.JSONDecodeError, KeyError, TypeError, ValueError) as error:
     print(f"Error: Gitea review persistence verification failed: {error}", file=sys.stderr)
     raise SystemExit(1)
 PY
 
+    # Current-head TOCTOU close-out: the review verified above is pinned to
+    # head_sha, but that head was read BEFORE the submit. Between then and now
+    # the PR branch may have advanced (a force-push or a new commit), which would
+    # leave this verified review attached to a now-superseded commit while the
+    # live tip carries unreviewed code — yet the wrapper would still report
+    # success. Re-read the LIVE PR head and require it STILL equals the submitted
+    # SHA; if it advanced, fail closed (nonzero, no created id emitted, no
+    # success line). This reuses the submit-scoped auth config + recheck file so
+    # it neither leaks the token to argv nor clobbers this function's cleanup.
+    live_head=$(gitea_read_pr_head_into "$pr_number" "$recheck_file" "$auth_config") || {
+        echo "Error: could not re-read Gitea PR head after review verification" >&2
+        return 1
+    }
+    if [[ "$live_head" != "$head_sha" ]]; then
+        echo "Error: Gitea PR head advanced from $head_sha to $live_head between review submit and verification; refusing to report a review pinned to a superseded commit (#865 current-head TOCTOU)" >&2
+        return 1
+    fi
+
     echo "$created_id"
     return 0
 }