Summary

Two P1 findings from the same review batch on the recent staging→main merge PR, both independently verified before fixing.

1. Multiline when_to_use/description frontmatter gets silently discarded on write

Both frontmatter parsers in this codebase , reference-resolver.ts's parseFrontmatter (used almost everywhere, including the now-completed when_to_use migration) and services/aop/subagent-frontmatter.ts's parseEntries (used internally by applySubagentFrontmatterPatch for every subagent-doc write) , split each frontmatter line on its first colon. A YAML block-scalar (when_to_use: | followed by indented continuation lines) has no colon on its continuation lines, so they were silently skipped during parsing , never captured as part of any value, meaning a later write through either function permanently discarded them, not merely left them unpatched.

Confirmed architecturally real by tracing both parsers by hand , and my own first-pass fix caught that I'd only fixed one of the two before its own test could pass. Confirmed via direct production database query that zero real documents were actually affected , no real data was lost by the already-completed migration.

Fix: a colon-less non-blank line now appends to the immediately preceding free-text entry's value instead of being dropped, in both parsers. Regression tests added at both the low-level parser and the round-trip patch+reparse level, including the exact "folds losslessly into description via the merge the retired migration used" scenario.

2. CRM/Slack values inject instruction-shaped text into agent prompts (security)

formatIntegrationMetadataForAgent inserts CRM-controlled deal names/stages and Slack channel names verbatim into XML-like prompt blocks (<linked_crm_deal>, <linked_crm_account>, <linked_slack_channel>) with no escaping. A deal named e.g. Acme</linked_crm_deal><urgent_instruction>... could close the real tag early and inject instruction-shaped text into the same prompt updateNextStepsAndTasksTool reads , a tool that runs autonomously (no human approval) on ordinary CRM-sync events, with real create/update/cancel-task and conversation-mutation tools available. This function also feeds the general conversation-context builder used by every other agent surface, not just next-steps , the blast radius is broader than the one call site the review flagged.

Fix: new escapeIntegrationValueForPrompt() replaces </> with </> in every genuinely externally-controlled field (dealId, dealName, dealStage, accountId, dealUrl, accountUrl, instanceUrl, Slack channelName) before interpolation , escaping, not stripping, so the value stays fully visible to the agent as literal data. provider (a closed, code-controlled enum) and isClosed (a Cedar-derived boolean) are left untouched. Regression tests prove a closing-tag-plus-fake-instruction payload can no longer manufacture a second block or a new tag, while the underlying text remains present and readable.

Verified

• pnpm --filter @zero/server run types , clean.
• oxlint --deny-warnings , clean on all 6 files.
• deps:check , clean (1773 modules).
• Full test sweep across playbook/aop/agent-workspace/context-formatting/task directories , 1930+ tests, all pass.
• Direct production database query confirming zero documents affected by the multiline-frontmatter issue.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E3AhwqADAFeqe9wEhz6Mk7

Greptile Summary

This PR escapes externally sourced CRM and Slack values before adding them to agent prompts and attempts to preserve multiline subagent frontmatter during parsing and rewriting. The prompt hardening is effective on the inspected assembly paths, but the frontmatter fix remains incomplete and introduces a separate metadata-corruption path.

• Escapes angle brackets in rende