fix: avoid unsafe multiline commit suggestions

Author: 777genius

__tests__/unit/analysis/synthesis.test.ts

@@ -47,6 +47,31 @@ describe('SynthesisEngine', () => {
     expect(review.inlineComments[0].body).toContain('<summary>🤖 Prompt for AI Agents</summary>');
   });
 
+  it('does not render committable suggestions for multi-line suggestions without a range', () => {
+    const finding: Finding = {
+      file: 'src/users.js',
+      line: 10,
+      severity: 'major',
+      title: 'Email lookup bypass',
+      message: 'The query no longer filters by email.',
+      suggestion: [
+        'const normalized = normalizeEmail(email);',
+        "const rows = await db.query('SELECT * FROM users WHERE email = ? LIMIT 1', [normalized]);",
+      ].join('\n'),
+    };
+
+    const review = new SynthesisEngine({
+      ...DEFAULT_CONFIG,
+      inlineMinSeverity: 'minor',
+      inlineMaxComments: 5,
+    }).synthesize([finding], pr);
+
+    expect(review.inlineComments[0].body).toContain('<summary>Suggested fix</summary>');
+    expect(review.inlineComments[0].body).toContain('<summary>🤖 Prompt for AI Agents</summary>');
+    expect(review.inlineComments[0].body).not.toContain('<summary>📝 Committable suggestion</summary>');
+    expect(review.inlineComments[0].body).not.toContain('```suggestion');
+  });
+
   it('sorts inline comments by severity before applying the inline limit', () => {
     const findings: Finding[] = [
       {

dist/index.js

@@ -16457,9 +16457,11 @@ var SynthesisEngine = class {
     ];
     if (finding.suggestion) {
       parts.push("", this.suggestedFixDetails(finding.suggestion));
-      parts.push("", "<!-- suggestion_start -->");
-      parts.push("", this.committableSuggestionDetails(finding.suggestion));
-      parts.push("", "<!-- suggestion_end -->");
+      if (isSingleLineSuggestion(finding.suggestion)) {
+        parts.push("", "<!-- suggestion_start -->");
+        parts.push("", this.committableSuggestionDetails(finding.suggestion));
+        parts.push("", "<!-- suggestion_end -->");
+      }
     }
     parts.push("", this.agentPromptDetails(finding));
     if (finding.providers && finding.providers.length > 1) {
@@ -16532,6 +16534,9 @@ ${fence}`;
 function suggestionToDiff(suggestion) {
   return suggestion.trimEnd().split("\n").map((line) => `+${line}`).join("\n");
 }
+function isSingleLineSuggestion(suggestion) {
+  return suggestion.trimEnd().split("\n").length === 1;
+}
 
 // src/analysis/test-coverage.ts
 var fs8 = __toESM(require("fs"));

dist/index.js.map

@@ -157,9 +157,11 @@ export class SynthesisEngine {
     ];
     if (finding.suggestion) {
       parts.push('', this.suggestedFixDetails(finding.suggestion));
-      parts.push('', '<!-- suggestion_start -->');
-      parts.push('', this.committableSuggestionDetails(finding.suggestion));
-      parts.push('', '<!-- suggestion_end -->');
+      if (isSingleLineSuggestion(finding.suggestion)) {
+        parts.push('', '<!-- suggestion_start -->');
+        parts.push('', this.committableSuggestionDetails(finding.suggestion));
+        parts.push('', '<!-- suggestion_end -->');
+      }
     }
     parts.push('', this.agentPromptDetails(finding));
     if (finding.providers && finding.providers.length > 1) {
@@ -245,3 +247,7 @@ function suggestionToDiff(suggestion: string): string {
     .map((line) => `+${line}`)
     .join('\n');
 }
+
+function isSingleLineSuggestion(suggestion: string): boolean {
+  return suggestion.trimEnd().split('\n').length === 1;
+}