qwen-code Puts the Reviewed Repo's Own Commands Behind a Container After Finding CI Secrets in the Blast Radius

GitHub·high signalXBlueskyLinkedInCopy link

PR #9723, merged 2026-08-25, routes both call sites that execute a reviewed pull request's code (`build-test.ts` running `npm ci` with its preinstall/postinstall hooks, and `test-efficacy.ts` running the suite per baseline/control/mutant/probe) through a `sandboxed-exec` layer. The PR body is blunt about why: both sites handed the PR's code `process.env` entire, which on CI carries `OPENAI_API_KEY` and `GH_TOKEN`, and "a postinstall script reading process.env is one line." The design note matters for anyone building review agents: the boundary goes around the executions, not around the review agent, because wrapping the agent kills its own secrets at the container env allowlist.