github
diff --git a/‎README.md‎
Lines changed: 22 additions & 5 deletions b/‎README.md‎
Lines changed: 22 additions & 5 deletions
diff --git a/‎cmd/threat-detect/conclude.go‎
Lines changed: 72 additions & 9 deletions b/‎cmd/threat-detect/conclude.go‎
Lines changed: 72 additions & 9 deletions
diff --git a/‎cmd/threat-detect/conclude_test.go‎
Lines changed: 113 additions & 4 deletions b/‎cmd/threat-detect/conclude_test.go‎
Lines changed: 113 additions & 4 deletions
diff --git a/‎cmd/threat-detect/main.go‎
Lines changed: 1 addition & 1 deletion b/‎cmd/threat-detect/main.go‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎cmd/threat-detect/report.go‎
Lines changed: 14 additions & 2 deletions b/‎cmd/threat-detect/report.go‎
Lines changed: 14 additions & 2 deletions
@@ -78,15 +78,32 @@ infrastructure error.
 
 On the agentic CLI engine path (`copilot`, `claude`, `codex`), the detector
 provisions a `threat_detection_result` command on the model's `PATH` and sets
-`THREAT_DETECTION_RESULT_FILE` to a private sink file before each engine
-invocation. The model reports its verdict by running the command exactly once:
+`THREAT_DETECTION_RESULT_FILE` to a private sink file, plus
+`THREAT_DETECTION_REASONS_FILE` to the path the model writes its reasons to
+(alongside the sink, in a directory every engine can reach), before each engine
+invocation. Any reasons file left by a previous attempt is removed at
+provisioning time so a retry cannot report stale reasons. The model reports its
+verdict by running the command exactly once:
 
 ```bash
-threat_detection_result --prompt-injection <true|false> --secret-leak <true|false> --malicious-patch <true|false> --reason "..."
+threat_detection_result --prompt-injection <true|false> --secret-leak <true|false> --malicious-patch <true|false> --reasons-file <path>
 ```
 
 The three boolean flags accept both the space-separated form shown above and the
-`--prompt-injection=true` form. The command validates the input synchronously: on bad input it prints
+`--prompt-injection=true` form.
+
+Reasons are transported through a **file**, not the command line. Reasons quote
+attacker-authored artifact content verbatim, and the model runs this command
+through a shell, so evidence containing `$(...)`, backticks, or quotes passed as
+a `--reason` argument would be expanded or executed by the shell before the tool
+received it. `--reasons-file` points at a file — written by the model with its
+file-editing tool — containing a JSON array of reason strings, which is parsed
+by the tool itself. A malformed file is a correctable parse error rather than an
+executed command. A repeatable `--reason "<text>"` flag remains for short,
+model-authored text that quotes nothing; both sources are validated against the
+same bounds and concatenated in order.
+
+The command validates the input synchronously: on bad input it prints
 `THREAT_DETECTION_RESULT_ERROR:` and exits non-zero without recording anything,
 so the model can correct it in-session; on valid input it atomically records the
 canonical JSON verdict to the sink (first valid write wins, idempotent) and
@@ -342,7 +359,7 @@ explicitly treated as untrusted runtime data.
 The three booleans are fully constrained by the schema: all are required, no
 other fields are accepted, and a result that adds, omits, or mistypes a field is
 rejected. `reasons` is model-authored free text and is bounded as well — at most
-20 entries, each non-blank and at most 1000 characters — and the whole result
+20 entries, each non-blank and at most 2000 characters — and the whole result
 file is capped at 1 MiB before it is parsed. The same bounds apply when the model
 reports a result and when the file is read back, so a recorded result can never
 fail validation later. A rejected report is returned to the model as a
 
@@ -51,9 +51,18 @@ const (
 	maxListedFiles       = 200
 	maxEchoedLogLines    = 50
 	maxEchoedLineRunes   = 500
+	maxReasonLogLines    = 40
 	diagnosticLogMaxSize = 8 << 20 // 8 MiB: read no more of the detection log
 )
 
+// reasonContinuationGutter prefixes every physical line of a multi-line reason
+// after the first. Reasons are untrusted text and a line of theirs could start
+// with "::", which the Actions runner would interpret as a workflow command
+// (leading whitespace is not protection — the runner trims it). The gutter puts
+// a non-"::" character first on every continuation line, so the line stays a
+// plain log line while remaining readable and copy-pasteable.
+const reasonContinuationGutter = "         | "
+
 // bannerRule is the horizontal rule framing the conclude banners. It mirrors
 // gh-aw's inline conclusion step so both paths read identically in job logs.
 const bannerRule = "════════════════════════════════════════════════════════"
@@ -239,7 +248,7 @@ func (c *concluder) conclude(resultFile string) int {
 			for _, reason := range result.Reasons {
 				safe = append(safe, sanitizeLogValue(truncateRunes(reason, maxEchoedLineRunes)))
 			}
-			message += "\nReasons: " + strings.Join(safe, "; ")
+			message += "\nReasons (full detail in the verdict block above): " + strings.Join(safe, "; ")
 		}
 		return c.fail(result, detector.ReasonThreatDetected, message)
 	}
@@ -273,13 +282,44 @@ func (c *concluder) reportVerdict(result *detector.Result) {
 	if len(result.Reasons) > 0 {
 		c.info(fmt.Sprintf("   reasons (%d):", len(result.Reasons)))
 		for i, reason := range result.Reasons {
-			c.info(fmt.Sprintf("     [%d] %s", i+1, sanitizeLogValue(reason)))
+			lines := reasonLogLines(reason)
+			c.info(fmt.Sprintf("     [%d] %s", i+1, lines[0]))
+			for _, line := range lines[1:] {
+				c.info(reasonContinuationGutter + line)
+			}
 		}
 	} else {
 		c.info("   reasons          : (none)")
 	}
 }
 
+// reasonLogLines renders an untrusted, model-authored reason as the physical
+// log lines to print. Reasons carry forensic detail — verbatim quotes of the
+// triggering content, file and line references — which is only usable if it
+// keeps its line structure, so embedded newlines become real lines rather than
+// escaped "\n" runs. Each returned line is individually sanitized (so no line
+// can carry a control character or start a line of its own) and bounded, and
+// the line count is capped so one pathological reason cannot flood the job log.
+// The result always has at least one element.
+func reasonLogLines(reason string) []string {
+	normalized := strings.ReplaceAll(reason, "\r\n", "\n")
+	normalized = strings.ReplaceAll(normalized, "\r", "\n")
+	raw := strings.Split(normalized, "\n")
+	truncated := false
+	if len(raw) > maxReasonLogLines {
+		raw = raw[:maxReasonLogLines]
+		truncated = true
+	}
+	lines := make([]string, 0, len(raw)+1)
+	for _, line := range raw {
+		lines = append(lines, sanitizeLogValue(truncateRunes(line, maxEchoedLineRunes)))
+	}
+	if truncated {
+		lines = append(lines, "… (reason truncated)")
+	}
+	return lines
+}
+
 // listDirectory prints a recursive listing of dir so a missing or unusable
 // result file can be diagnosed from the job log alone.
 func (c *concluder) listDirectory(dir string) {
@@ -426,15 +466,36 @@ func readBounded(path string, limit int64) ([]byte, int64, error) {
 	return data, totalBytes, nil
 }
 
+// legacyCommandMarker is the runner's legacy workflow-command marker,
+// "##[command]data". The Actions runner honors it in addition to the "::" form,
+// and — unlike "::", which it accepts only at the start of a line (after
+// trimming leading whitespace) — it locates this marker with an unanchored
+// IndexOf. A legacy marker anywhere inside a log line is therefore a live
+// command, so no line prefix, gutter, or indentation can render it inert: the
+// value itself must be broken up. Reachable commands include add-mask (which
+// redacts arbitrary text from the log) and stop-commands (which suppresses
+// every later command, including this program's own threat annotation).
+const legacyCommandMarker = "##["
+
+// legacyCommandMarkerEscaped is the inert rendering of legacyCommandMarker. It
+// keeps the sequence readable and greppable while breaking the runner's match.
+const legacyCommandMarkerEscaped = `##\[`
+
 // sanitizeLogValue renders an untrusted string (a model-authored reason, an
-// artifact filename, or a detection-log line) so it cannot break out of its
-// single physical log line. Embedded newlines would otherwise let the value
-// emit a line of its own beginning with "::", which the Actions runner would
-// interpret as a workflow command. Control characters are escaped rather than
-// dropped so the original content stays visible and diagnosable.
+// artifact filename, or a detection-log line) so it cannot act as a workflow
+// command. Two things are neutralized:
+//
+//   - Control characters are escaped rather than dropped, so the original
+//     content stays visible and diagnosable. This confines the value to one
+//     physical line, since an embedded newline would otherwise let it emit a
+//     line of its own beginning with "::" — which the runner would interpret.
+//     (Reasons are rendered across real lines by reasonLogLines, which calls
+//     this per line and prefixes continuations so none can start with "::".)
+//   - The legacy "##[" marker is escaped wherever it appears, because the
+//     runner matches it mid-line and line-position defenses cannot reach it.
 func sanitizeLogValue(s string) string {
 	if !strings.ContainsFunc(s, unicode.IsControl) {
-		return s
+		return strings.ReplaceAll(s, legacyCommandMarker, legacyCommandMarkerEscaped)
 	}
 	var b strings.Builder
 	b.Grow(len(s))
@@ -452,7 +513,9 @@ func sanitizeLogValue(s string) string {
 			b.WriteRune(r)
 		}
 	}
-	return b.String()
+	// The control-character escapes above emit only backslash sequences, so they
+	// can neither create nor hide a "##[" marker; escaping it afterwards is safe.
+	return strings.ReplaceAll(b.String(), legacyCommandMarker, legacyCommandMarkerEscaped)
 }
 
 // truncateRunes shortens s to at most max runes, appending an ellipsis marker
 
@@ -390,10 +390,10 @@ func TestConcludeThreatMessageEscaped(t *testing.T) {
 	if !strings.Contains(got, "::error::") {
 		t.Fatalf("expected ::error:: command, got: %q", got)
 	}
-	if strings.Contains(got, "\nReasons:") {
+	if strings.Contains(got, "\nReasons (full detail") {
 		t.Fatalf("newline in message must be escaped, got: %q", got)
 	}
-	if !strings.Contains(got, "%0AReasons:") {
+	if !strings.Contains(got, "%0AReasons (full detail") {
 		t.Fatalf("expected escaped newline before Reasons, got: %q", got)
 	}
 	if !strings.Contains(got, errCodeValidation) {
@@ -845,6 +845,12 @@ func TestSanitizeLogValue(t *testing.T) {
 		{"carriage return is escaped", "text\r::error::boom", `text\r::error::boom`},
 		{"tab is escaped", "a\tb", `a\tb`},
 		{"other control chars are escaped", "a\x00b\x1bc", `a\x00b\x1bc`},
+		// The runner matches the legacy "##[cmd]" marker anywhere in a line, so
+		// it must be broken up in the value regardless of line position.
+		{"legacy marker is escaped", "evidence ##[stop-commands]tok", `evidence ##\[stop-commands]tok`},
+		{"legacy marker escaped without control chars", "##[add-mask]word", `##\[add-mask]word`},
+		{"every legacy marker occurrence is escaped", "##[error]a ##[add-mask]b", `##\[error]a ##\[add-mask]b`},
+		{"legacy marker escaped alongside control chars", "x\n##[error]y", `x\n##\[error]y`},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -883,8 +889,111 @@ func TestConcludeReasonCannotInjectWorkflowCommand(t *testing.T) {
 			t.Errorf("unexpected workflow command emitted: %q", line)
 		}
 	}
-	if !strings.Contains(stdout.String(), `[1] benign looking\n::add-mask::injected`) {
-		t.Errorf("escaped reason not rendered on a single line:\n%s", stdout.String())
+	// The reason keeps its line structure (so quoted evidence stays readable),
+	// but the continuation line carries the gutter so it cannot start a command.
+	if !strings.Contains(stdout.String(), "     [1] benign looking\n") {
+		t.Errorf("first reason line not rendered:\n%s", stdout.String())
+	}
+	if !strings.Contains(stdout.String(), reasonContinuationGutter+"::add-mask::injected\n") {
+		t.Errorf("continuation line not rendered with gutter:\n%s", stdout.String())
+	}
+}
+
+// TestReasonLogLines verifies multi-line reasons keep their line structure,
+// stay individually sanitized and bounded, and are capped in line count.
+func TestReasonLogLines(t *testing.T) {
+	got := reasonLogLines("LOCATION: prompt.txt:42\r\nEVIDENCE: ignore\tprior\rrules")
+	want := []string{"LOCATION: prompt.txt:42", `EVIDENCE: ignore\tprior`, "rules"}
+	if len(got) != len(want) {
+		t.Fatalf("reasonLogLines lines = %#v, want %#v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("line %d = %q, want %q", i, got[i], want[i])
+		}
+	}
+
+	long := strings.Repeat("x", maxEchoedLineRunes+50)
+	if lines := reasonLogLines(long); !strings.HasSuffix(lines[0], "… (truncated)") {
+		t.Errorf("over-long line not truncated: %q", lines[0])
+	}
+
+	many := reasonLogLines(strings.Repeat("a\n", maxReasonLogLines+10))
+	if len(many) != maxReasonLogLines+1 {
+		t.Fatalf("line count = %d, want %d", len(many), maxReasonLogLines+1)
+	}
+	if many[len(many)-1] != "… (reason truncated)" {
+		t.Errorf("missing truncation marker, got %q", many[len(many)-1])
+	}
+}
+
+// TestConcludeReasonCannotEmitLegacyWorkflowCommand verifies a reason cannot
+// smuggle the runner's legacy "##[command]" marker into the job log. The runner
+// matches that marker mid-line, so the line gutter cannot neutralize it; if it
+// survived, attacker-authored evidence could emit ##[stop-commands] and
+// suppress this program's own threat annotation, or ##[add-mask] and redact the
+// log a maintainer is meant to read.
+func TestConcludeReasonCannotEmitLegacyWorkflowCommand(t *testing.T) {
+	dir := t.TempDir()
+	resultFile := filepath.Join(dir, "detection_result.json")
+	verdict := `{"prompt_injection":true,"secret_leak":false,"malicious_patch":false,` +
+		`"reasons":["EVIDENCE:\nharmless ##[stop-commands]pwn3d then ##[add-mask]detected"]}`
+	if err := os.WriteFile(resultFile, []byte(verdict), 0o600); err != nil {
+		t.Fatalf("WriteFile error = %v", err)
+	}
+
+	var stdout bytes.Buffer
+	c := &concluder{
+		runDetection: "true",
+		githubOutput: filepath.Join(dir, "out"),
+		githubEnv:    filepath.Join(dir, "env"),
+		stdout:       &stdout,
+	}
+	if code := c.run(resultFile); code != concludeExitFail {
+		t.Fatalf("exit code = %d, want %d", code, concludeExitFail)
+	}
+	got := stdout.String()
+	if strings.Contains(got, "##[") {
+		t.Fatalf("live legacy workflow-command marker reached the log:\n%s", got)
+	}
+	// The evidence must still be present and readable, just inert.
+	if !strings.Contains(got, `##\[stop-commands]pwn3d`) || !strings.Contains(got, `##\[add-mask]detected`) {
+		t.Fatalf("escaped evidence not rendered:\n%s", got)
+	}
+	// The threat annotation must still be emitted (it is what stop-commands
+	// would have suppressed).
+	if !strings.Contains(got, "::error::") {
+		t.Fatalf("expected ::error:: annotation, got:\n%s", got)
+	}
+}
+
+// TestConcludeDiagnosticsCannotEmitLegacyWorkflowCommand verifies the other
+// untrusted echo paths — artifact filenames and detection-log lines — are
+// neutralized the same way.
+func TestConcludeDiagnosticsCannotEmitLegacyWorkflowCommand(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, "detection.log")
+	logLine := "THREAT_DETECTION_STATUS: reason=engine_error exit=2 ##[add-mask]x\n"
+	if err := os.WriteFile(logPath, []byte(logLine), 0o600); err != nil {
+		t.Fatalf("WriteFile error = %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "evil##[error]name.txt"), []byte("x"), 0o600); err != nil {
+		t.Fatalf("WriteFile error = %v", err)
+	}
+
+	var stdout bytes.Buffer
+	c := &concluder{
+		runDetection: "true",
+		warnMode:     true,
+		githubOutput: filepath.Join(dir, "out"),
+		githubEnv:    filepath.Join(dir, "env"),
+		detectionLog: logPath,
+		stdout:       &stdout,
+	}
+	c.run(filepath.Join(dir, "missing_result.json"))
+
+	if strings.Contains(stdout.String(), "##[") {
+		t.Fatalf("live legacy workflow-command marker reached the log:\n%s", stdout.String())
 	}
 }
 
 
@@ -38,7 +38,7 @@ const (
 
 	detectionCorrectionPrefix      = "Your previous response did not record a verdict"
 	detectionCorrectionMessage     = "The threat_detection_result command was not run, or it reported an error and exited before a verdict was recorded."
-	detectionCorrectionInstruction = "Run the threat_detection_result command exactly once with --prompt-injection, --secret-leak, and --malicious-patch each set to true or false, plus a --reason for every threat set to true."
+	detectionCorrectionInstruction = "Run the threat_detection_result command exactly once with --prompt-injection, --secret-leak, and --malicious-patch each set to true or false. When any of them is true, use your file-writing tool to write your reasons as a JSON array of strings to the path in $THREAT_DETECTION_REASONS_FILE and pass it with --reasons-file; do not paste quoted artifact content onto the command line."
 	promptAnalysisValidationCode   = "ERR_VALIDATION"
 
 	// maxInventoryEntries bounds the artifact inventory printed to stderr so a
 
@@ -43,12 +43,14 @@ func runReport(args []string) int {
 		secretLeak      bool
 		maliciousPatch  bool
 		reasons         stringSliceFlag
+		reasonsFile     string
 		resultFile      string
 	)
 	fs.BoolVar(&promptInjection, "prompt-injection", false, "Whether a prompt injection threat was detected (required)")
 	fs.BoolVar(&secretLeak, "secret-leak", false, "Whether a secret leak threat was detected (required)")
 	fs.BoolVar(&maliciousPatch, "malicious-patch", false, "Whether a malicious patch threat was detected (required)")
-	fs.Var(&reasons, "reason", "Reason explaining a detected threat (repeatable)")
+	fs.Var(&reasons, "reason", "Reason explaining a detected threat (repeatable; use --reasons-file for text quoting artifact content)")
+	fs.StringVar(&reasonsFile, "reasons-file", "", "Path to a file containing a JSON array of reason strings; the shell-free way to report reasons that quote artifact content")
 	fs.StringVar(&resultFile, "result-file", os.Getenv("THREAT_DETECTION_RESULT_FILE"), "Path to the result sink file (defaults to env THREAT_DETECTION_RESULT_FILE)")
 
 	if err := fs.Parse(normalizeBoolFlagArgs(args)); err != nil {
@@ -71,15 +73,25 @@ func runReport(args []string) int {
 		return reportExitConfig
 	}
 
+	// Reasons from the file transport are appended after any --reason flags, so
+	// the recorded order matches the order the model supplied them.
 	reasonsSlice := []string(reasons)
+	if reasonsFile != "" {
+		fileReasons, err := detector.ReadReasonsFile(reasonsFile)
+		if err != nil {
+			reportError(detector.TruncateCorrectionMessage(err.Error()))
+			return reportExitInvalid
+		}
+		reasonsSlice = append(reasonsSlice, fileReasons...)
+	}
 	if msg := detector.ValidateReportFields(promptInjection, secretLeak, maliciousPatch, toAnySlice(reasonsSlice)); msg != "" {
 		reportError(msg)
 		return reportExitInvalid
 	}
 
 	// Require at least one reason when any threat is reported.
 	if (promptInjection || secretLeak || maliciousPatch) && len(reasonsSlice) == 0 {
-		reportError("at least one --reason is required when any threat is true")
+		reportError("at least one reason is required when any threat is true; supply --reasons-file (preferred) or --reason")
 		return reportExitInvalid
 	}