fix: address PR #63 review findings

1. Refactor err2 to use scoped loadErr variable (MINOR - sonnet-review-bot)
   The else-if branches are mutually exclusive, so the error variable
   should be scoped inside the block, not declared outside with err2.

2. Sanitize DisplayName before embedding in Markdown (MINOR - security-review-bot)
   Remote persona metadata is untrusted. Added sanitizeMarkdownText() to
   escape Markdown special characters and strip control characters.
   Applied to both the header title and the footer attribution.

3. Document YAML DoS mitigations (MINOR - security-review-bot)
   Added comprehensive comment in remote_persona.go explaining existing
   defenses: file size limit, file count cap, depth limit, node count cap,
   and alias cycle detection. These collectively mitigate billion-laughs
   and stack exhaustion attacks.

.gitea/workflows/ci.yml

@@ -38,8 +38,6 @@ jobs:
           - name: security
             token_secret: SECURITY_REVIEW_TOKEN
             model: gpt-5
-            patterns_repo: rodin/security-patterns
-            patterns_files: "."
             system_prompt_file: SECURITY_REVIEW.md
     steps:
       - uses: actions/checkout@v4
@@ -62,8 +60,8 @@ jobs:
           AICORE_API_URL: ${{ secrets.AICORE_API_URL }}
           AICORE_RESOURCE_GROUP: ${{ secrets.AICORE_RESOURCE_GROUP }}
           CONVENTIONS_FILE: "CONVENTIONS.md"
-          PATTERNS_REPO: ${{ matrix.patterns_repo || 'rodin/go-patterns' }}
+          PATTERNS_REPO: "rodin/go-patterns"
-          PATTERNS_FILES: ${{ matrix.patterns_files || 'README.md,patterns/' }}
+          PATTERNS_FILES: "README.md,patterns/"
           LLM_TIMEOUT: "600"
           SYSTEM_PROMPT_FILE: ${{ matrix.system_prompt_file }}
         run: ./review-bot

CONVENTIONS.md

@@ -9,7 +9,7 @@
 
 | Package | Use Case | Scope |
 |---------|----------|-------|
-| `github.com/goccy/go-yaml` | YAML parsing and AST inspection (subpkgs: `ast`, `parser`) | production |
+| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
 | `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | test only |
 
 **Any import not in this table or the Go standard library is forbidden.**

README.md

@@ -329,12 +329,11 @@ All flags have environment variable equivalents:
 ### Token Scopes Required
 
 | Scope | Purpose |
-|-------|--------|
+|-------|---------|
 | `write:issue` | Post and delete reviews |
 | `write:repository` | Read PR diffs, file content, commit statuses |
-| `read:user` | Self-request as reviewer (optional but recommended) |
 
-Without `read:user`, the bot still works but cannot add itself to the PR's reviewer list.
+No `read:user` scope needed — the bot identifies itself from the review response.
 
 ## Development
 
@@ -460,6 +459,41 @@ YAML is the recommended format for personas because it supports:
 
 JSON is also supported for backwards compatibility—just use `.json` extension.
 
+### Repository Personas (Auto-Discovery)
+
+Repositories can ship their own personas in `.review-bot/personas/`. When you specify `--persona <name>`, review-bot will:
+
+1. **Try to load from the target repo** — Checks `.review-bot/personas/<name>.yaml` (or `.yml`)
+2. **Fall back to built-in** — If not found in repo, uses the built-in persona
+
+This lets each repo define domain-specific personas without modifying CI config:
+
+```
+my-trading-repo/
+├── .review-bot/
+│   └── personas/
+│       ├── trading.yaml      # Custom trading persona
+│       └── regulatory.yaml   # Compliance-focused reviews
+├── lib/
+└── ...
+```
+
+```yaml
+# CI config (no persona-file needed)
+- uses: rodin/review-bot/.gitea/actions/review@v1
+  with:
+    reviewer-name: trading
+    persona: trading           # Will find .review-bot/personas/trading.yaml
+    ...
+```
+
+**Priority order:**
+1. Repo's `.review-bot/personas/<name>.yaml`
+2. Built-in persona with matching name
+3. Error if neither exists
+
+This allows repos to override built-in personas (e.g., a custom `security` persona that adds project-specific rules) while keeping the simple `persona: security` syntax in CI.
+
 
 ### Persona vs system-prompt-file
 

cmd/review-bot/main.go

@@ -65,7 +65,7 @@ func main() {
 	conventionsFile := flag.String("conventions-file", envOrDefault("CONVENTIONS_FILE", ""), "Conventions file path in repo (e.g. CLAUDE.md)")
 	systemPromptFile := flag.String("system-prompt-file", envOrDefault("SYSTEM_PROMPT_FILE", ""), "Local file with additional system prompt instructions")
 	patternsRepo := flag.String("patterns-repo", envOrDefault("PATTERNS_REPO", ""), "Repo with language patterns (e.g. rodin/elixir-patterns)")
-	patternsFiles := flag.String("patterns-files", envOrDefault("PATTERNS_FILES", ""), "Comma-separated file paths to fetch from patterns repo (empty = all files)")
+	patternsFiles := flag.String("patterns-files", envOrDefault("PATTERNS_FILES", "README.md"), "Comma-separated file paths to fetch from patterns repo")
 	dryRun := flag.Bool("dry-run", false, "Print review to stdout instead of posting")
 	llmTemp := flag.Float64("llm-temperature", envOrDefaultFloat("LLM_TEMPERATURE", 0), "LLM temperature (0 = server default)")
 	llmTimeout := flag.Int("llm-timeout", envOrDefaultInt("LLM_TIMEOUT", 300), "LLM request timeout in seconds (default 300)")
@@ -115,7 +115,9 @@ func main() {
 		os.Exit(1)
 	}
 
-	// NOTE: Persona loading deferred until after Gitea client init to support repo personas
+	// Persona loading is deferred until after giteaClient is initialized,
+	// so we can try loading from the target repo first.
+	var persona *review.Persona
 
 	// Validate reviewer-name: only safe characters allowed in sentinel
 	if err := validateReviewerName(*reviewerName); err != nil {
@@ -173,22 +175,23 @@ func main() {
 	ctx, cancel := context.WithTimeout(context.Background(), overallTimeout)
 	defer cancel()
 
-	// Load persona if specified (after Gitea client init to support repo personas)
+	// Load persona: try remote repo first, then fall back to built-in
-	var persona *review.Persona
 	if *personaName != "" {
-		// Try loading from repo first, then fall back to built-in
+		// Try loading from target repo's .review-bot/personas/ directory
-		repoPersonas, err := review.LoadRepoPersonas(ctx, newGiteaClientAdapter(giteaClient), owner, repoName)
+		fetcher := &giteaFetcher{client: giteaClient}
+		remotePersonas, err := review.LoadRemotePersonas(ctx, fetcher, owner, repoName)
 		if err != nil {
-			slog.Warn("could not load repo personas", "repo", owner+"/"+repoName, "error", err)
+			slog.Warn("could not load remote personas", "repo", fmt.Sprintf("%s/%s", owner, repoName), "error", err)
-			// Continue with built-in personas only.
+			// Assign empty map so the lookup below doesn't panic
-			// NOTE: repoPersonas is nil here, but map indexing on a nil map is safe in Go
+			remotePersonas = map[string]*review.Persona{}
-			// (returns the zero value), so the fallback to built-in below works correctly.
 		}
-		if p, ok := repoPersonas[*personaName]; ok {
+
+		if p, ok := remotePersonas[*personaName]; ok {
 			persona = p
-			slog.Info("loaded repo persona", "persona", persona.Name, "display", persona.DisplayName, "repo", owner+"/"+repoName)
+			slog.Info("loaded persona from target repo", "persona", persona.Name, "display", persona.DisplayName)
 		} else {
-			// Fall back to built-in
+			// Fall back to built-in persona
+			var err error
 			persona, err = review.LoadBuiltinPersona(*personaName)
 			if err != nil {
 				slog.Error("failed to load persona", "persona", *personaName, "error", err)
@@ -202,11 +205,12 @@ func main() {
 			slog.Error("invalid persona-file path", "error", err)
 			os.Exit(1)
 		}
-		persona, err = review.LoadPersona(resolvedPath)
+		loadedPersona, loadErr := review.LoadPersona(resolvedPath)
-		if err != nil {
+		if loadErr != nil {
-			slog.Error("failed to load persona file", "file", *personaFile, "error", err)
+			slog.Error("failed to load persona file", "file", *personaFile, "error", loadErr)
 			os.Exit(1)
 		}
+		persona = loadedPersona
 		slog.Info("loaded persona from file", "file", *personaFile, "persona", persona.Name)
 	}
 
@@ -523,25 +527,11 @@ func fetchFileContext(ctx context.Context, client *gitea.Client, owner, repo, re
 // patternsRepo is comma-separated list of owner/name repos.
 // patternsFiles is comma-separated list of file paths or directories.
 // If a path ends with / or is a directory, all files within it are fetched recursively.
-// If patternsFiles is empty, all files from the repo root are fetched.
 func fetchPatterns(ctx context.Context, client *gitea.Client, patternsRepo, patternsFiles string) string {
 	var sb strings.Builder
 
 	repos := strings.Split(patternsRepo, ",")
-
+	paths := strings.Split(patternsFiles, ",")
-	// Build the list of paths to fetch
-	var paths []string
-	if patternsFiles == "" {
-		// Empty patternsFiles means "fetch all files from repo root"
-		paths = []string{""}
-	} else {
-		for _, p := range strings.Split(patternsFiles, ",") {
-			p = strings.TrimSpace(p)
-			if p != "" {
-				paths = append(paths, p)
-			}
-		}
-	}
 
 	for _, repoRef := range repos {
 		if ctx.Err() != nil {
@@ -558,10 +548,12 @@ func fetchPatterns(ctx context.Context, client *gitea.Client, patternsRepo, patt
 		}
 		owner, repo := parts[0], parts[1]
 
-		var repoLoadedFiles []string
-		var repoSkippedFiles []string
-
 		for _, path := range paths {
+			path = strings.TrimSpace(path)
+			if path == "" {
+				continue
+			}
+
 			files, err := client.GetAllFilesInPath(ctx, owner, repo, path)
 			if err != nil {
 				slog.Warn("could not fetch patterns", "path", path, "repo", repoRef, "error", err)
@@ -571,22 +563,11 @@ func fetchPatterns(ctx context.Context, client *gitea.Client, patternsRepo, patt
 			for filePath, content := range files {
 				// Only include markdown and text files as patterns
 				if !isPatternFile(filePath) {
-					repoSkippedFiles = append(repoSkippedFiles, filePath)
 					continue
 				}
-				repoLoadedFiles = append(repoLoadedFiles, filePath)
 				sb.WriteString(fmt.Sprintf("### %s/%s\n\n%s\n\n", repoRef, filePath, content))
 			}
 		}
-
-		if len(repoLoadedFiles) > 0 {
-			slog.Info("loaded pattern files", "repo", repoRef, "count", len(repoLoadedFiles), "files", repoLoadedFiles)
-		} else {
-			slog.Warn("no pattern files loaded", "repo", repoRef, "paths", paths)
-		}
-		if len(repoSkippedFiles) > 0 {
-			slog.Debug("skipped non-pattern files", "repo", repoRef, "count", len(repoSkippedFiles), "files", repoSkippedFiles)
-		}
 	}
 	return sb.String()
 }
@@ -821,20 +802,17 @@ func shouldSkipStaleReview(evaluatedSHA, currentSHA string) bool {
 	return evaluatedSHA != currentSHA
 }
 
-// giteaClientAdapter adapts gitea.Client to review.GiteaClient interface.
+// giteaFetcher adapts gitea.Client to review.PersonaFetcher interface.
-type giteaClientAdapter struct {
+type giteaFetcher struct {
 	client *gitea.Client
 }
 
-func newGiteaClientAdapter(c *gitea.Client) *giteaClientAdapter {
+func (f *giteaFetcher) ListContents(ctx context.Context, owner, repo, path string) ([]review.ContentEntry, error) {
-	return &giteaClientAdapter{client: c}
+	entries, err := f.client.ListContents(ctx, owner, repo, path)
-}
-
-func (a *giteaClientAdapter) ListContents(ctx context.Context, owner, repo, path string) ([]review.ContentEntry, error) {
-	entries, err := a.client.ListContents(ctx, owner, repo, path)
 	if err != nil {
 		return nil, err
 	}
+	// Convert gitea.ContentEntry to review.ContentEntry
 	result := make([]review.ContentEntry, len(entries))
 	for i, e := range entries {
 		result[i] = review.ContentEntry{
@@ -846,6 +824,6 @@ func (a *giteaClientAdapter) ListContents(ctx context.Context, owner, repo, path
 	return result, nil
 }
 
-func (a *giteaClientAdapter) GetFileContent(ctx context.Context, owner, repo, filepath string) (string, error) {
+func (f *giteaFetcher) GetFileContent(ctx context.Context, owner, repo, filepath string) (string, error) {
-	return a.client.GetFileContent(ctx, owner, repo, filepath)
+	return f.client.GetFileContent(ctx, owner, repo, filepath)
 }

cmd/review-bot/main_test.go

@@ -504,52 +504,6 @@ func TestIsPatternFile(t *testing.T) {
 	}
 }
 
-// TestBuildPatternPaths verifies the path-building logic for fetchPatterns.
-// Empty patternsFiles means "fetch all from root" (represented as [""]).
-func TestBuildPatternPaths(t *testing.T) {
-	buildPaths := func(patternsFiles string) []string {
-		if patternsFiles == "" {
-			return []string{""}
-		}
-		var paths []string
-		for _, p := range strings.Split(patternsFiles, ",") {
-			p = strings.TrimSpace(p)
-			if p != "" {
-				paths = append(paths, p)
-			}
-		}
-		return paths
-	}
-
-	tests := []struct {
-		name  string
-		input string
-		want  []string
-	}{
-		{"empty fetches root", "", []string{""}},
-		{"single file", "README.md", []string{"README.md"}},
-		{"multiple files", "README.md,PATTERNS.md", []string{"README.md", "PATTERNS.md"}},
-		{"trims whitespace", " foo.md , bar.md ", []string{"foo.md", "bar.md"}},
-		{"skips empty between commas", "foo.md,,bar.md", []string{"foo.md", "bar.md"}},
-		{"directory path", "patterns/", []string{"patterns/"}},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := buildPaths(tc.input)
-			if len(got) != len(tc.want) {
-				t.Errorf("buildPaths(%q) = %v, want %v", tc.input, got, tc.want)
-				return
-			}
-			for i := range got {
-				if got[i] != tc.want[i] {
-					t.Errorf("buildPaths(%q)[%d] = %q, want %q", tc.input, i, got[i], tc.want[i])
-				}
-			}
-		})
-	}
-}
-
 func TestEvaluateCIStatus(t *testing.T) {
 	tests := []struct {
 		name       string

docs/DESIGN-57-yaml-persona.md

@@ -9,7 +9,7 @@ JSON is awkward for persona files that contain multi-line text (identity, severi
 - Backwards compatibility: existing JSON personas must continue to work
 - Security: protect against DoS via deeply nested YAML (AIKIDO-2024-10486)
 - Consistency: use `.yaml` extension (not `.yml`)
-- Library: use `github.com/goccy/go-yaml` v1.16.0+ (approved in CONVENTIONS.md); we implement custom AST-based depth/node-count checks for precise alias-aware validation
+- Library: use `gopkg.in/yaml.v3` (approved in CONVENTIONS.md) with explicit depth limiting
 
 ## Proposed Approach
 
@@ -33,16 +33,37 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 
 ### YAML Parsing with Depth Protection
 
-We implement a custom AST-based depth/node-count walk (`checkYAMLDepth` in
+```go
-`review/persona.go`) rather than relying on library decoder options. Key design
+func unmarshalYAMLWithDepthLimit(data []byte, out any, maxDepth int) error {
-decisions:
+    var node yaml.Node
+    dec := yaml.NewDecoder(bytes.NewReader(data))
+    if err := dec.Decode(&node); err != nil {
+        return err
+    }
+    if err := checkYAMLDepth(&node, 0, maxDepth); err != nil {
+        return err
+    }
+    return node.Decode(out)
+}
 
-- **Library:** `github.com/goccy/go-yaml` with `ast.Node`-based traversal
+func checkYAMLDepth(node *yaml.Node, depth, maxDepth int) error {
-- **Dual-map tracking:** `validated` (depth-aware short-circuit) + `visiting` (cycle detection)
+    if depth > maxDepth {
-- **Node-count limit:** Conservative overcounting bounds total validation work
+        return fmt.Errorf("YAML nesting depth exceeds maximum (%d)", maxDepth)
-- **Alias-aware depth:** Aliases increment depth and are re-checked when encountered at greater depths
+    }
+    // Handle alias nodes by following the Alias pointer
+    if node.Kind == yaml.AliasNode && node.Alias != nil {
+        return checkYAMLDepth(node.Alias, depth, maxDepth)
+    }
+    for _, child := range node.Content {
+        if err := checkYAMLDepth(child, depth+1, maxDepth); err != nil {
+            return err
+        }
+    }
+    return nil
+}
+```
 
-See `review/persona.go:checkYAMLDepth` for the authoritative implementation.
+The `gopkg.in/yaml.v3` library does not have built-in depth protection, so we implement explicit depth checking by first decoding into a `yaml.Node`, walking the tree to verify depth (including alias resolution), then decoding into the target struct.
 
 ## State/Data Model
 
@@ -53,7 +74,7 @@ No new state. Same `Persona` struct, just different parsing.
 | Error | Handling |
 |-------|----------|
 | Invalid YAML syntax | Return parse error with source file |
-| Deeply nested YAML | Custom AST walk (`checkYAMLDepth`) rejects before decode |
+| Deeply nested YAML | Library rejects (v1.16.0+ fix) |
 | Unknown extension | Fall back to JSON parsing |
 | Missing required fields | Validation rejects after parse |
 

gitea/client.go

@@ -11,12 +11,9 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
-	"math"
-	"net"
 	"net/http"
 	"net/url"
 	"strings"
-	"syscall"
 	"time"
 )
 
@@ -42,68 +39,12 @@ func IsNotFound(err error) bool {
 	return errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusNotFound
 }
 
-// IsServerError reports whether an error is an API 5xx response.
-func IsServerError(err error) bool {
-	var apiErr *APIError
-	return errors.As(err, &apiErr) && apiErr.StatusCode >= 500 && apiErr.StatusCode < 600
-}
-
-// DefaultMaxDiffSize is the default maximum diff size in bytes (10 MB).
-const DefaultMaxDiffSize = 10 * 1024 * 1024
-
-// ErrDiffTooLarge is returned when a PR diff exceeds the configured MaxDiffSize.
-var ErrDiffTooLarge = errors.New("diff size exceeds maximum allowed size")
-
 // Client interacts with the Gitea API.
 // A Client is safe for concurrent use by multiple goroutines.
 type Client struct {
 	baseURL string
 	token   string
 	http    *http.Client
-
-	// RetryBackoff defines the delays between retry attempts.
-	// RetryBackoff[i] is the delay before attempt i+1 (after attempt i fails).
-	// If nil, defaults to {1s, 2s}. Set to shorter durations in tests.
-	//
-	// This field must be configured before the first request is made.
-	// Modifying it while requests are in flight is not safe.
-	RetryBackoff []time.Duration
-
-	// MaxDiffSize is the maximum number of bytes allowed when fetching a PR diff.
-	// If zero, defaults to DefaultMaxDiffSize (10 MB). Set to any negative value
-	// (or math.MaxInt64) to disable the limit.
-	//
-	// This field must be configured before the first request is made.
-	// Modifying it while requests are in flight is not safe.
-	MaxDiffSize int64
-}
-
-// defaultCheckRedirect is the redirect policy used by NewClient.
-// NOTE: This function is intentionally duplicated in github/client.go (and vice versa)
-// because the packages are separate. Changes here must be mirrored there.
-// It rejects HTTPS->HTTP protocol downgrades (to prevent plaintext leakage)
-// and cross-host redirects (to prevent following responses from untrusted
-// endpoints). Same-host, same-or-upgraded-scheme redirects are allowed.
-func defaultCheckRedirect(req *http.Request, via []*http.Request) error {
-	if len(via) >= 10 {
-		return fmt.Errorf("stopped after 10 redirects")
-	}
-	// Guard for direct invocation in tests and any future callers;
-	// net/http guarantees len(via) >= 1 during actual redirects.
-	if len(via) == 0 {
-		return nil
-	}
-	prev := via[len(via)-1]
-	// Reject protocol downgrade: HTTPS->HTTP leaks request metadata over plaintext.
-	if prev.URL.Scheme == "https" && req.URL.Scheme == "http" {
-		return fmt.Errorf("refusing redirect: HTTPS to HTTP downgrade (%s -> %s)", prev.URL.Host, req.URL.Host)
-	}
-	// Reject cross-host redirect entirely to avoid consuming responses
-	// from untrusted endpoints.
-	if req.URL.Host != prev.URL.Host {
-		return fmt.Errorf("refusing redirect: cross-host (%s -> %s)", prev.URL.Host, req.URL.Host)
-	}
-	return nil
 }
 
 // NewClient creates a new Gitea API client.
@@ -111,33 +52,10 @@ func NewClient(baseURL, token string) *Client {
 	return &Client{
 		baseURL: strings.TrimRight(baseURL, "/"),
 		token:   token,
-		http: &http.Client{
+		http:    &http.Client{Timeout: 30 * time.Second},
-			Timeout:       30 * time.Second,
-			CheckRedirect: defaultCheckRedirect,
-		},
 	}
 }
 
-// SetHTTPClient sets the underlying HTTP client used for requests.
-// This is intended for test setup only to inject mock transports; it must be
-// called before any goroutines issue requests.
-//
-// Passing nil restores the default client (30s timeout + redirect-rejecting
-// CheckRedirect policy matching NewClient).
-//
-// Callers providing a non-nil client are responsible for configuring a safe
-// CheckRedirect policy. Without one, the default net/http behavior will follow
-// redirects and may forward the Authorization header to untrusted hosts.
-func (c *Client) SetHTTPClient(hc *http.Client) {
-	if hc == nil {
-		hc = &http.Client{
-			Timeout:       30 * time.Second,
-			CheckRedirect: defaultCheckRedirect,
-		}
-	}
-	c.http = hc
-}
-
 // PullRequest holds relevant PR metadata.
 type PullRequest struct {
 	Title string `json:"title"`
@@ -185,28 +103,9 @@ func (c *Client) GetPullRequest(ctx context.Context, owner, repo string, number
 }
 
 // GetPullRequestDiff fetches the unified diff for a PR.
-// It enforces MaxDiffSize to prevent unbounded memory allocation.
-// Returns ErrDiffTooLarge if the diff exceeds the configured limit.
 func (c *Client) GetPullRequestDiff(ctx context.Context, owner, repo string, number int) (string, error) {
 	reqURL := fmt.Sprintf("%s/api/v1/repos/%s/%s/pulls/%d.diff", c.baseURL, url.PathEscape(owner), url.PathEscape(repo), number)
-
+	body, err := c.doGet(ctx, reqURL)
-	maxSize := c.MaxDiffSize
-	if maxSize == 0 {
-		maxSize = DefaultMaxDiffSize
-	}
-
-	// When the limit is disabled (negative) or set to math.MaxInt64 (which
-	// would overflow the +1 detection and silently disable enforcement),
-	// use the standard unlimited doGet path.
-	if maxSize < 0 || maxSize == math.MaxInt64 {
-		body, err := c.doGet(ctx, reqURL)
-		if err != nil {
-			return "", fmt.Errorf("fetch diff: %w", err)
-		}
-		return string(body), nil
-	}
-
-	body, err := c.doGetLimited(ctx, reqURL, maxSize)
 	if err != nil {
 		return "", fmt.Errorf("fetch diff: %w", err)
 	}
@@ -311,218 +210,24 @@ func (c *Client) PostReview(ctx context.Context, owner, repo string, number int,
 	return &review, nil
 }
 
-// isTemporaryNetError reports whether err is a temporary network error worth retrying.
-// This includes connection refused, network unreachable, connection reset, and DNS
-// timeouts. It explicitly excludes permanent errors like permission denied or
-// "no such host" DNS failures.
-func isTemporaryNetError(err error) bool {
-	if err == nil {
-		return false
-	}
-
-	// Check for OpError and inspect the underlying syscall error.
-	// Not all OpErrors are transient — permission denied, for example, is permanent.
-	var opErr *net.OpError
-	if errors.As(err, &opErr) {
-		return isRetriableSyscallError(opErr.Err)
-	}
-
-	// DNS errors: only retry on timeout, not on "no such host" which is permanent.
-	var dnsErr *net.DNSError
-	if errors.As(err, &dnsErr) {
-		return dnsErr.IsTimeout
-	}
-
-	// Check for net.Error with Timeout() (Temporary is deprecated)
-	var netErr net.Error
-	if errors.As(err, &netErr) {
-		return netErr.Timeout()
-	}
-
-	return false
-}
-
-// isRetriableSyscallError reports whether the underlying error from a net.OpError
-// is a transient syscall error worth retrying.
-func isRetriableSyscallError(err error) bool {
-	if err == nil {
-		return false
-	}
-
-	// Check for syscall.Errno directly or wrapped
-	var errno syscall.Errno
-	if errors.As(err, &errno) {
-		switch errno {
-		case syscall.ECONNREFUSED, // connection refused — server not listening
-			syscall.ECONNRESET,   // connection reset by peer
-			syscall.ENETUNREACH,  // network unreachable
-			syscall.EHOSTUNREACH, // host unreachable
-			syscall.ETIMEDOUT:    // connection timed out
-			return true
-		default:
-			// EACCES, EPERM, etc. are permanent — don't retry
-			return false
-		}
-	}
-
-	// If we can't identify the specific syscall error, be conservative and retry.
-	// This handles wrapped errors or platform-specific error types.
-	// The retry count is limited, so erring on the side of retrying is safe.
-	return true
-}
-
-// redactURL strips query parameters and userinfo credentials from a URL for
-// safe logging. This prevents accidental exposure of sensitive data (tokens in
-// query strings, or user:pass in the authority) in log output.
-func redactURL(rawURL string) string {
-	parsed, err := url.Parse(rawURL)
-	if err != nil {
-		// If we cannot parse it, return a safe placeholder rather than
-		// potentially logging something sensitive.
-		return "[invalid URL]"
-	}
-	if parsed.User != nil {
-		parsed.User = url.User("REDACTED")
-	}
-	if parsed.RawQuery != "" {
-		parsed.RawQuery = "[redacted]"
-	}
-	return parsed.String()
-}
-
-// sanitizeErrorForLog returns a loggable version of an error that omits
-// potentially sensitive content like response bodies. For APIError, only
-// the status code is included; for other errors, the type is preserved.
-func sanitizeErrorForLog(err error) string {
-	if err == nil {
-		return "<nil>"
-	}
-	var apiErr *APIError
-	if errors.As(err, &apiErr) {
-		return fmt.Sprintf("HTTP %d", apiErr.StatusCode)
-	}
-	return err.Error()
-}
-
-// doGetWithReader performs an HTTP GET request with retry on 5xx errors and
-// temporary network errors. Retries up to 3 times with exponential backoff
-// (1s, 2s delays by default; configurable via Client.RetryBackoff for testing).
-// The readBody function is called with the response body on success (2xx) and
-// is responsible for reading and closing it.
-func (c *Client) doGetWithReader(ctx context.Context, reqURL string, readBody func(io.ReadCloser) ([]byte, error)) ([]byte, error) {
-	const maxAttempts = 3
-	// backoff[i] is the delay before attempt i+1 (i.e., after attempt i fails).
-	// First attempt (i=0) has no delay; retries wait 1s then 2s by default.
-	backoff := c.RetryBackoff
-	if backoff == nil {
-		backoff = []time.Duration{1 * time.Second, 2 * time.Second}
-	}
-
-	// maxErrorBodyBytes limits how much of an error response body we read
-	// to protect against malicious servers sending unbounded data.
-	const maxErrorBodyBytes = 64 * 1024 // 64 KB
-
-	var lastErr error
-	for attempt := 0; attempt < maxAttempts; attempt++ {
-		if attempt > 0 {
-			// Determine delay: use backoff slice if available, otherwise retry immediately.
-			// An empty RetryBackoff slice means "retry without delay" — this is intentional
-			// as the caller explicitly configured no delays.
-			var delay time.Duration
-			if attempt-1 < len(backoff) {
-				delay = backoff[attempt-1]
-			}
-
-			if delay > 0 {
-				slog.Warn("retrying request after error",
-					"attempt", attempt+1,
-					"url", redactURL(reqURL),
-					"delay", delay.String(),
-					"lastError", sanitizeErrorForLog(lastErr))
-
-				timer := time.NewTimer(delay)
-				select {
-				case <-timer.C:
-				case <-ctx.Done():
-					timer.Stop()
-					return nil, ctx.Err()
-				}
-			}
-		}
-
-		req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil)
-		if err != nil {
-			return nil, err
-		}
-		req.Header.Set("Authorization", "token "+c.token)
-
-		resp, err := c.http.Do(req)
-		if err != nil {
-			// Always capture the error for consistent return at loop end.
-			// This ensures both network errors and HTTP 5xx return lastErr.
-			lastErr = err
-
-			// Only retry temporary network errors when attempts remain.
-			if attempt < maxAttempts-1 && isTemporaryNetError(err) {
-				slog.Warn("temporary network error, will retry",
-					"attempt", attempt+1,
-					"url", redactURL(reqURL),
-					"error", err)
-				continue
-			}
-			// Non-retryable network error or final attempt exhausted.
-			return nil, lastErr
-		}
-		if resp.StatusCode >= 200 && resp.StatusCode < 300 {
-			return readBody(resp.Body)
-		}
-
-		// Error path: limit how much we read from potentially malicious server
-		errBody, _ := io.ReadAll(io.LimitReader(resp.Body, maxErrorBodyBytes))
-		resp.Body.Close()
-
-		lastErr = &APIError{StatusCode: resp.StatusCode, Body: string(errBody)}
-
-		// Only retry on 5xx server errors
-		if resp.StatusCode < 500 || resp.StatusCode >= 600 {
-			return nil, lastErr
-		}
-	}
-
-	return nil, lastErr
-}
-
-// doGet performs an HTTP GET request with retry, reading the full response body.
 func (c *Client) doGet(ctx context.Context, reqURL string) ([]byte, error) {
-	return c.doGetWithReader(ctx, reqURL, func(body io.ReadCloser) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil)
-		defer body.Close()
+	if err != nil {
-		return io.ReadAll(body)
+		return nil, err
-	})
+	}
-}
+	req.Header.Set("Authorization", "token "+c.token)
 
-// doGetLimited performs an HTTP GET request with retry but enforces a maximum
+	resp, err := c.http.Do(req)
-// response body size. Returns ErrDiffTooLarge if the response exceeds maxBytes.
+	if err != nil {
-// It reads maxBytes+1 (clamped to avoid overflow) to detect truncation without
+		return nil, err
-// buffering the entire body.
+	}
-func (c *Client) doGetLimited(ctx context.Context, reqURL string, maxBytes int64) ([]byte, error) {
+	defer resp.Body.Close()
-	return c.doGetWithReader(ctx, reqURL, func(body io.ReadCloser) ([]byte, error) {
+
-		defer body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		// Read up to maxBytes+1 to detect overflow.
+		body, _ := io.ReadAll(resp.Body)
-		// Clamp to prevent integer overflow when maxBytes == math.MaxInt64.
+		return nil, &APIError{StatusCode: resp.StatusCode, Body: string(body)}
-		limitBytes := maxBytes + 1
+	}
-		if limitBytes <= 0 {
+	return io.ReadAll(resp.Body)
-			limitBytes = math.MaxInt64
-		}
-		limited := io.LimitReader(body, limitBytes)
-		data, err := io.ReadAll(limited)
-		if err != nil {
-			return nil, err
-		}
-		if int64(len(data)) > maxBytes {
-			return nil, fmt.Errorf("%w: response exceeds %d bytes", ErrDiffTooLarge, maxBytes)
-		}
-		return data, nil
-	})
 }
 
 // escapePath escapes each segment of a relative file path for use in URLs.
@@ -546,13 +251,7 @@ type ContentEntry struct {
 
 // ListContents lists files and directories at a given path in a repo.
 // Pass an empty path to list the repository root.
-// If the path points to a file (not a directory), Gitea returns a single
-// object instead of an array; this method normalizes both cases to a slice.
 func (c *Client) ListContents(ctx context.Context, owner, repo, path string) ([]ContentEntry, error) {
-	// Normalize "." to empty string — Gitea API rejects "." with 500
-	if path == "." {
-		path = ""
-	}
 	var reqURL string
 	if path == "" {
 		reqURL = fmt.Sprintf("%s/api/v1/repos/%s/%s/contents", c.baseURL, url.PathEscape(owner), url.PathEscape(repo))
@@ -565,16 +264,7 @@ func (c *Client) ListContents(ctx context.Context, owner, repo, path string) ([]
 	}
 	var entries []ContentEntry
 	if err := json.Unmarshal(body, &entries); err != nil {
-		// Gitea returns a single object (not an array) when path is a file
+		return nil, fmt.Errorf("parse contents JSON: %w", err)
-		var single ContentEntry
-		if err2 := json.Unmarshal(body, &single); err2 != nil {
-			return nil, fmt.Errorf("parse contents JSON: %w", err)
-		}
-		// Guard against empty/malformed responses
-		if single.Name == "" && single.Path == "" {
-			return nil, fmt.Errorf("parse contents JSON: empty response for path %q", path)
-		}
-		entries = []ContentEntry{single}
 	}
 	return entries, nil
 }
@@ -627,9 +317,9 @@ func (c *Client) GetAllFilesInPath(ctx context.Context, owner, repo, path string
 
 // Review represents a pull request review from the Gitea API.
 type Review struct {
-	ID   int64  `json:"id"`
+	ID       int64  `json:"id"`
-	Body string `json:"body"`
+	Body     string `json:"body"`
-	User struct {
+	User     struct {
 		Login string `json:"login"`
 	} `json:"user"`
 	State    string `json:"state"`

gitea/client_test.go

@@ -6,15 +6,10 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"net"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"strings"
-	"sync/atomic"
-	"syscall"
 	"testing"
-	"time"
 )
 
 func TestGetPullRequest(t *testing.T) {
@@ -281,64 +276,11 @@ func TestListContents(t *testing.T) {
 	}
 }
 
-func TestListContents_DotPath(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// "." should be normalized to empty path, which hits the root contents endpoint
-		if r.URL.Path != "/api/v1/repos/owner/repo/contents" {
-			t.Errorf("expected root contents path, got: %s", r.URL.Path)
-		}
-		w.Header().Set("Content-Type", "application/json")
-		fmt.Fprintf(w, `[{"name":"README.md","path":"README.md","type":"file"}]`)
-	}))
-	defer server.Close()
-
-	client := NewClient(server.URL, "test-token")
-	entries, err := client.ListContents(context.Background(), "owner", "repo", ".")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 entry, got %d", len(entries))
-	}
-	if entries[0].Name != "README.md" {
-		t.Errorf("expected README.md, got %s", entries[0].Name)
-	}
-}
-
-func TestListContents_FilePath(t *testing.T) {
-	// Gitea returns a single object (not an array) when path is a file
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/api/v1/repos/owner/repo/contents/README.md" {
-			t.Errorf("unexpected path: %s", r.URL.Path)
-		}
-		w.Header().Set("Content-Type", "application/json")
-		// Single object, not an array
-		fmt.Fprintf(w, `{"name":"README.md","path":"README.md","type":"file"}`)
-	}))
-	defer server.Close()
-
-	client := NewClient(server.URL, "test-token")
-	entries, err := client.ListContents(context.Background(), "owner", "repo", "README.md")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 entry, got %d", len(entries))
-	}
-	if entries[0].Name != "README.md" {
-		t.Errorf("expected README.md, got %s", entries[0].Name)
-	}
-	if entries[0].Type != "file" {
-		t.Errorf("expected type file, got %s", entries[0].Type)
-	}
-}
-
 func TestGetAllFilesInPath_File(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/api/v1/repos/owner/repo/contents/README.md" {
-			// Gitea returns a single object (not array) when path is a file
+			// Gitea returns 404 for contents API on files (it's not a dir)
-			w.Header().Set("Content-Type", "application/json")
+			http.NotFound(w, r)
-			fmt.Fprintf(w, `{"name":"README.md","path":"README.md","type":"file"}`)
 			return
 		}
 		if r.URL.Path == "/api/v1/repos/owner/repo/raw/README.md" {
@@ -642,9 +584,9 @@ func TestGetAllFilesInPath_403Propagates(t *testing.T) {
 
 func TestIsNotFound(t *testing.T) {
 	tests := []struct {
-		name string
+		name   string
-		err  error
+		err    error
-		want bool
+		want   bool
 	}{
 		{"nil error", nil, false},
 		{"non-API error", fmt.Errorf("network timeout"), false},
@@ -801,463 +743,3 @@ func TestResolveComment_Error(t *testing.T) {
 		t.Fatal("expected error for 404 response")
 	}
 }
-
-func TestIsServerError(t *testing.T) {
-	tests := []struct {
-		name string
-		err  error
-		want bool
-	}{
-		{"nil error", nil, false},
-		{"non-API error", fmt.Errorf("network timeout"), false},
-		{"404 APIError", &APIError{StatusCode: 404, Body: "not found"}, false},
-		{"500 APIError", &APIError{StatusCode: 500, Body: "server error"}, true},
-		{"502 APIError", &APIError{StatusCode: 502, Body: "bad gateway"}, true},
-		{"503 APIError", &APIError{StatusCode: 503, Body: "unavailable"}, true},
-		{"599 APIError", &APIError{StatusCode: 599, Body: "edge case"}, true},
-		{"600 not server error", &APIError{StatusCode: 600, Body: "edge"}, false},
-		{"400 not server error", &APIError{StatusCode: 400, Body: "bad request"}, false},
-		{"wrapped 500", fmt.Errorf("fetch: %w", &APIError{StatusCode: 500, Body: "err"}), true},
-		{"wrapped 404", fmt.Errorf("fetch: %w", &APIError{StatusCode: 404, Body: "err"}), false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := IsServerError(tt.err)
-			if got != tt.want {
-				t.Errorf("IsServerError(%v) = %v, want %v", tt.err, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestDoGet_RetriesOn500(t *testing.T) {
-	attempts := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		if attempts < 3 {
-			w.WriteHeader(http.StatusInternalServerError)
-			w.Write([]byte(`{"message":"transient error"}`))
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`{"data":"success"}`))
-	}))
-	defer server.Close()
-
-	client := NewClient(server.URL, "test-token")
-	// Use short backoff for fast tests
-	client.RetryBackoff = []time.Duration{1 * time.Millisecond, 1 * time.Millisecond}
-
-	body, err := client.doGet(context.Background(), server.URL+"/test")
-	if err != nil {
-		t.Fatalf("expected success after retry, got error: %v", err)
-	}
-	if string(body) != `{"data":"success"}` {
-		t.Errorf("body = %q, want %q", string(body), `{"data":"success"}`)
-	}
-	if attempts != 3 {
-		t.Errorf("attempts = %d, want 3", attempts)
-	}
-}
-
-func TestDoGet_FailsAfterMaxRetries(t *testing.T) {
-	attempts := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		w.WriteHeader(http.StatusInternalServerError)
-		w.Write([]byte(`{"message":"persistent error"}`))
-	}))
-	defer server.Close()
-
-	client := NewClient(server.URL, "test-token")
-	// Use short backoff for fast tests
-	client.RetryBackoff = []time.Duration{1 * time.Millisecond, 1 * time.Millisecond}
-
-	_, err := client.doGet(context.Background(), server.URL+"/test")
-	if err == nil {
-		t.Fatal("expected error after max retries")
-	}
-	var apiErr *APIError
-	if !errors.As(err, &apiErr) {
-		t.Fatalf("expected APIError, got: %v", err)
-	}
-	if apiErr.StatusCode != http.StatusInternalServerError {
-		t.Errorf("status = %d, want 500", apiErr.StatusCode)
-	}
-	if attempts != 3 {
-		t.Errorf("attempts = %d, want 3 (max retries)", attempts)
-	}
-}
-
-func TestDoGet_NoRetryOn4xx(t *testing.T) {
-	attempts := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		w.WriteHeader(http.StatusForbidden)
-		w.Write([]byte(`{"message":"forbidden"}`))
-	}))
-	defer server.Close()
-
-	client := NewClient(server.URL, "test-token")
-	_, err := client.doGet(context.Background(), server.URL+"/test")
-	if err == nil {
-		t.Fatal("expected error for 403")
-	}
-	var apiErr *APIError
-	if !errors.As(err, &apiErr) {
-		t.Fatalf("expected APIError, got: %v", err)
-	}
-	if apiErr.StatusCode != http.StatusForbidden {
-		t.Errorf("status = %d, want 403", apiErr.StatusCode)
-	}
-	if attempts != 1 {
-		t.Errorf("attempts = %d, want 1 (no retry on 4xx)", attempts)
-	}
-}
-
-func TestDoGet_RespectsContextCancellation(t *testing.T) {
-	attempts := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		w.WriteHeader(http.StatusInternalServerError)
-		w.Write([]byte(`{"message":"error"}`))
-	}))
-	defer server.Close()
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	client := NewClient(server.URL, "test-token")
-	// Use longer backoff to give us time to cancel during the wait
-	client.RetryBackoff = []time.Duration{100 * time.Millisecond, 100 * time.Millisecond}
-
-	// Cancel after first attempt returns and retry begins
-	go func() {
-		time.Sleep(20 * time.Millisecond)
-		cancel()
-	}()
-
-	_, err := client.doGet(ctx, server.URL+"/test")
-	if err == nil {
-		t.Fatal("expected error on context cancellation")
-	}
-	// Should have made 1 attempt, then context cancelled during backoff
-	if attempts != 1 {
-		t.Errorf("attempts = %d, expected 1 before context cancel during backoff", attempts)
-	}
-}
-
-
-// mockTransport is a test helper that returns errors for the first N calls,
-// then delegates to a real server.
-type mockTransport struct {
-	failCount    int32 // number of failures remaining (atomic)
-	failErr      error // error to return on failure
-	realServer   *httptest.Server
-	attemptsMade atomic.Int32 // tracks total attempts
-}
-
-func (m *mockTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	m.attemptsMade.Add(1)
-	remaining := atomic.AddInt32(&m.failCount, -1)
-	if remaining >= 0 {
-		// Still have failures to return
-		return nil, m.failErr
-	}
-	// Redirect to real server
-	req.URL.Host = m.realServer.Listener.Addr().String()
-	req.URL.Scheme = "http"
-	return http.DefaultTransport.RoundTrip(req)
-}
-
-func TestDoGet_RetriesOnTemporaryNetError(t *testing.T) {
-	// Real server that will handle successful requests
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`{"status":"ok"}`))
-	}))
-	defer server.Close()
-
-	// Mock transport: fail twice with ECONNREFUSED, then succeed
-	mt := &mockTransport{
-		failCount:  2,
-		failErr:    &net.OpError{Op: "dial", Net: "tcp", Err: syscall.ECONNREFUSED},
-		realServer: server,
-	}
-
-	client := NewClient("http://fake-host/", "test-token")
-	client.SetHTTPClient(&http.Client{Transport: mt})
-	client.RetryBackoff = []time.Duration{1 * time.Millisecond, 1 * time.Millisecond}
-
-	body, err := client.doGet(context.Background(), "http://fake-host/test")
-	if err != nil {
-		t.Fatalf("expected success after retries, got error: %v", err)
-	}
-	if string(body) != `{"status":"ok"}` {
-		t.Errorf("body = %q, want %q", string(body), `{"status":"ok"}`)
-	}
-
-	// Should have made exactly 3 attempts: 2 failures + 1 success
-	if got := mt.attemptsMade.Load(); got != 3 {
-		t.Errorf("attempts = %d, want 3 (2 failures + 1 success)", got)
-	}
-}
-
-func TestIsTemporaryNetError(t *testing.T) {
-	tests := []struct {
-		name string
-		err  error
-		want bool
-	}{
-		{"nil error", nil, false},
-		{"plain error", fmt.Errorf("some error"), false},
-		// OpError with retriable syscall errors
-		{"OpError ECONNREFUSED", &net.OpError{Op: "dial", Err: syscall.ECONNREFUSED}, true},
-		{"OpError ECONNRESET", &net.OpError{Op: "read", Err: syscall.ECONNRESET}, true},
-		{"OpError ENETUNREACH", &net.OpError{Op: "dial", Err: syscall.ENETUNREACH}, true},
-		{"OpError EHOSTUNREACH", &net.OpError{Op: "dial", Err: syscall.EHOSTUNREACH}, true},
-		{"OpError ETIMEDOUT", &net.OpError{Op: "dial", Err: syscall.ETIMEDOUT}, true},
-		// OpError with permanent syscall errors — should NOT retry
-		{"OpError EACCES", &net.OpError{Op: "dial", Err: syscall.EACCES}, false},
-		{"OpError EPERM", &net.OpError{Op: "dial", Err: syscall.EPERM}, false},
-		// OpError with unknown inner error — conservative retry
-		{"OpError unknown inner", &net.OpError{Op: "dial", Err: fmt.Errorf("unknown")}, true},
-		// DNS errors
-		{"DNS timeout", &net.DNSError{IsTimeout: true}, true},
-		{"DNS no such host", &net.DNSError{IsTimeout: false, Name: "bad.host"}, false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := isTemporaryNetError(tt.err)
-			if got != tt.want {
-				t.Errorf("isTemporaryNetError(%v) = %v, want %v", tt.err, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestIsRetriableSyscallError(t *testing.T) {
-	tests := []struct {
-		name string
-		err  error
-		want bool
-	}{
-		{"nil", nil, false},
-		{"ECONNREFUSED", syscall.ECONNREFUSED, true},
-		{"ECONNRESET", syscall.ECONNRESET, true},
-		{"ENETUNREACH", syscall.ENETUNREACH, true},
-		{"EHOSTUNREACH", syscall.EHOSTUNREACH, true},
-		{"ETIMEDOUT", syscall.ETIMEDOUT, true},
-		{"EACCES (permanent)", syscall.EACCES, false},
-		{"EPERM (permanent)", syscall.EPERM, false},
-		{"ENOENT (permanent)", syscall.ENOENT, false},
-		{"unknown error", fmt.Errorf("something"), true}, // conservative retry
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := isRetriableSyscallError(tt.err)
-			if got != tt.want {
-				t.Errorf("isRetriableSyscallError(%v) = %v, want %v", tt.err, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestRedactURL(t *testing.T) {
-	tests := []struct {
-		name  string
-		input string
-		want  string
-	}{
-		{
-			name:  "no query params",
-			input: "https://gitea.example.com/api/v1/repos/owner/repo/pulls/1",
-			want:  "https://gitea.example.com/api/v1/repos/owner/repo/pulls/1",
-		},
-		{
-			name:  "with query params - redacts",
-			input: "https://gitea.example.com/api/v1/repos/owner/repo/raw/file?ref=main",
-			want:  "https://gitea.example.com/api/v1/repos/owner/repo/raw/file?[redacted]",
-		},
-		{
-			name:  "multiple query params",
-			input: "https://example.com/path?token=secret&page=1",
-			want:  "https://example.com/path?[redacted]",
-		},
-		{
-			name:  "invalid URL",
-			input: "://invalid",
-			want:  "[invalid URL]",
-		},
-		{
-			name:  "empty string",
-			input: "",
-			want:  "",
-		},
-		{
-			name:  "with userinfo - redacts credentials",
-			input: "https://admin:secret@gitea.example.com/api/v1/repos",
-			want:  "https://REDACTED@gitea.example.com/api/v1/repos",
-		},
-		{
-			name:  "with userinfo and query params",
-			input: "https://user:pass@example.com/path?token=abc",
-			want:  "https://REDACTED@example.com/path?[redacted]",
-		},
-		{
-			name:  "username only - no password",
-			input: "https://user@example.com/path",
-			want:  "https://REDACTED@example.com/path",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := redactURL(tt.input)
-			if got != tt.want {
-				t.Errorf("redactURL(%q) = %q, want %q", tt.input, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestSanitizeErrorForLog(t *testing.T) {
-	tests := []struct {
-		name string
-		err  error
-		want string
-	}{
-		{
-			name: "nil error",
-			err:  nil,
-			want: "<nil>",
-		},
-		{
-			name: "APIError omits body",
-			err:  &APIError{StatusCode: 500, Body: "internal error: database connection failed"},
-			want: "HTTP 500",
-		},
-		{
-			name: "APIError with large body still only shows status",
-			err:  &APIError{StatusCode: 502, Body: strings.Repeat("x", 1000)},
-			want: "HTTP 502",
-		},
-		{
-			name: "non-API error preserved",
-			err:  fmt.Errorf("connection refused"),
-			want: "connection refused",
-		},
-		{
-			name: "wrapped APIError",
-			err:  fmt.Errorf("request failed: %w", &APIError{StatusCode: 503, Body: "service unavailable"}),
-			want: "HTTP 503",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := sanitizeErrorForLog(tt.err)
-			if got != tt.want {
-				t.Errorf("sanitizeErrorForLog() = %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestNewClient_HasCheckRedirect(t *testing.T) {
-	c := NewClient("https://gitea.example.com", "token")
-	if c.http.CheckRedirect == nil {
-		t.Fatal("expected CheckRedirect to be set")
-	}
-}
-
-func TestDefaultCheckRedirect_RejectsHTTPSToHTTP(t *testing.T) {
-	prev := &http.Request{URL: &url.URL{Scheme: "https", Host: "gitea.example.com", Path: "/foo"}}
-	req := &http.Request{
-		URL:    &url.URL{Scheme: "http", Host: "gitea.example.com", Path: "/foo"},
-		Header: http.Header{"Authorization": []string{"token abc"}},
-	}
-	err := defaultCheckRedirect(req, []*http.Request{prev})
-	if err == nil {
-		t.Fatal("expected error on HTTPS->HTTP redirect")
-	}
-	if !strings.Contains(err.Error(), "HTTPS to HTTP downgrade") {
-		t.Errorf("unexpected error message: %v", err)
-	}
-}
-
-func TestDefaultCheckRedirect_RejectsCrossHost(t *testing.T) {
-	prev := &http.Request{URL: &url.URL{Scheme: "https", Host: "gitea.example.com", Path: "/foo"}}
-	req := &http.Request{
-		URL:    &url.URL{Scheme: "https", Host: "cdn.example.com", Path: "/bar"},
-		Header: http.Header{"Authorization": []string{"token abc"}},
-	}
-	err := defaultCheckRedirect(req, []*http.Request{prev})
-	if err == nil {
-		t.Fatal("expected error on cross-host redirect")
-	}
-	if !strings.Contains(err.Error(), "cross-host") {
-		t.Errorf("unexpected error message: %v", err)
-	}
-}
-
-func TestDefaultCheckRedirect_AllowsSameHost(t *testing.T) {
-	prev := &http.Request{URL: &url.URL{Scheme: "https", Host: "gitea.example.com", Path: "/foo"}}
-	req := &http.Request{
-		URL:    &url.URL{Scheme: "https", Host: "gitea.example.com", Path: "/bar"},
-		Header: http.Header{"Authorization": []string{"token abc"}},
-	}
-	err := defaultCheckRedirect(req, []*http.Request{prev})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if auth := req.Header.Get("Authorization"); auth != "token abc" {
-		t.Errorf("expected Authorization to be preserved, got %q", auth)
-	}
-}
-
-func TestDefaultCheckRedirect_AllowsSameHostHTTPToHTTP(t *testing.T) {
-	prev := &http.Request{URL: &url.URL{Scheme: "http", Host: "localhost:3000", Path: "/foo"}}
-	req := &http.Request{
-		URL:    &url.URL{Scheme: "http", Host: "localhost:3000", Path: "/bar"},
-		Header: http.Header{},
-	}
-	err := defaultCheckRedirect(req, []*http.Request{prev})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-}
-
-func TestDefaultCheckRedirect_RejectsTooManyRedirects(t *testing.T) {
-	via := make([]*http.Request, 10)
-	for i := range via {
-		via[i] = &http.Request{URL: &url.URL{Scheme: "https", Host: "gitea.example.com", Path: "/"}}
-	}
-	req := &http.Request{URL: &url.URL{Scheme: "https", Host: "gitea.example.com", Path: "/final"}}
-	err := defaultCheckRedirect(req, via)
-	if err == nil {
-		t.Fatal("expected error after 10 redirects")
-	}
-	if !strings.Contains(err.Error(), "10 redirects") {
-		t.Errorf("unexpected error message: %v", err)
-	}
-}
-
-func TestDefaultCheckRedirect_EmptyViaAllowed(t *testing.T) {
-	req := &http.Request{URL: &url.URL{Scheme: "https", Host: "gitea.example.com", Path: "/foo"}}
-	err := defaultCheckRedirect(req, nil)
-	if err != nil {
-		t.Fatalf("unexpected error with empty via: %v", err)
-	}
-}
-
-func TestSetHTTPClient_NilRestoresDefault(t *testing.T) {
-	c := NewClient("https://gitea.example.com", "token")
-	c.SetHTTPClient(nil)
-	if c.http == nil {
-		t.Fatal("expected non-nil http client after SetHTTPClient(nil)")
-	}
-	if c.http.Timeout != 30*time.Second {
-		t.Errorf("expected 30s timeout, got %v", c.http.Timeout)
-	}
-	if c.http.CheckRedirect == nil {
-		t.Fatal("expected CheckRedirect policy after SetHTTPClient(nil)")
-	}
-}

gitea/diff_size_test.go

@@ -1,97 +0,0 @@
-package gitea
-
-import (
-	"context"
-	"errors"
-	"math"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestGetPullRequestDiff_SizeLimits(t *testing.T) {
-	tests := []struct {
-		name        string
-		diff        string
-		maxDiffSize int64
-		wantErr     error
-		wantDiff    string
-	}{
-		{
-			name:        "exceeds max size",
-			diff:        strings.Repeat("+ added line\n", 1000), // ~13 KB
-			maxDiffSize: 100,
-			wantErr:     ErrDiffTooLarge,
-		},
-		{
-			name:        "within max size",
-			diff:        "diff --git a/f.go b/f.go\n--- a/f.go\n+++ b/f.go\n@@ -1 +1 @@\n-old\n+new\n",
-			maxDiffSize: 1024,
-			wantDiff:    "diff --git a/f.go b/f.go\n--- a/f.go\n+++ b/f.go\n@@ -1 +1 @@\n-old\n+new\n",
-		},
-		{
-			name:        "exactly at limit",
-			diff:        strings.Repeat("x", 50),
-			maxDiffSize: 50,
-			wantDiff:    strings.Repeat("x", 50),
-		},
-		{
-			name:        "one byte over limit",
-			diff:        strings.Repeat("x", 51),
-			maxDiffSize: 50,
-			wantErr:     ErrDiffTooLarge,
-		},
-		{
-			name:        "disabled limit",
-			diff:        strings.Repeat("x", 10000),
-			maxDiffSize: -1,
-			wantDiff:    strings.Repeat("x", 10000),
-		},
-		{
-			name:        "math.MaxInt64 treated as disabled",
-			diff:        strings.Repeat("x", 10000),
-			maxDiffSize: math.MaxInt64,
-			wantDiff:    strings.Repeat("x", 10000),
-		},
-		{
-			name:        "default limit",
-			diff:        "diff content",
-			maxDiffSize: 0, // zero means use DefaultMaxDiffSize
-			wantDiff:    "diff content",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Write([]byte(tt.diff)) //nolint:errcheck // test handler
-			}))
-			defer server.Close()
-
-			client := NewClient(server.URL, "test-token")
-			client.MaxDiffSize = tt.maxDiffSize
-			client.RetryBackoff = []time.Duration{}
-
-			got, err := client.GetPullRequestDiff(context.Background(), "owner", "repo", 1)
-
-			if tt.wantErr != nil {
-				if err == nil {
-					t.Fatal("expected error, got nil")
-				}
-				if !errors.Is(err, tt.wantErr) {
-					t.Errorf("expected %v, got: %v", tt.wantErr, err)
-				}
-				return
-			}
-
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tt.wantDiff {
-				t.Errorf("diff mismatch: got length %d, want length %d", len(got), len(tt.wantDiff))
-			}
-		})
-	}
-}

github/client.go

@@ -1,305 +0,0 @@
-// Package github provides a client for the GitHub API.
-// It supports pull request operations, file content retrieval,
-// and review submission for both github.com and GitHub Enterprise.
-package github
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-)
-
-const (
-	defaultBaseURL = "https://api.github.com"
-
-	// maxRetryAttempts is the number of times doRequest will attempt a request.
-	maxRetryAttempts = 3
-
-	// maxRetryAfter caps the maximum delay from a Retry-After header to prevent
-	// a server from stalling the client indefinitely.
-	maxRetryAfter = 60 * time.Second
-
-	// maxErrorBodyBytes limits how much of an error response body we read
-	// to protect against malicious servers sending unbounded data.
-	maxErrorBodyBytes = 64 * 1024 // 64 KB
-
-	// maxResponseBodyBytes limits how much of a successful response body we read
-	// for defense-in-depth against servers returning excessively large payloads.
-	maxResponseBodyBytes = 10 * 1024 * 1024 // 10 MB
-)
-
-// APIError represents an HTTP error response from the GitHub API.
-// It carries the status code so callers can distinguish between
-// different failure modes (e.g. 404 vs 500).
-//
-// The Body field stores up to 64 KiB of the raw response for programmatic
-// inspection. Error() truncates to 200 bytes for safe logging, but callers
-// should avoid logging or propagating Body directly in production since it may
-// contain sensitive details from the upstream server.
-type APIError struct {
-	StatusCode int
-	Body       string
-}
-
-func (e *APIError) Error() string {
-	body := e.Body
-	if len(body) > 200 {
-		body = body[:200] + "...(truncated)"
-	}
-	// Sanitize newlines to prevent log injection from upstream response bodies.
-	body = strings.ReplaceAll(body, "\n", " ")
-	body = strings.ReplaceAll(body, "\r", " ")
-	return fmt.Sprintf("HTTP %d: %s", e.StatusCode, body)
-}
-
-// IsNotFound reports whether an error is an API 404 response.
-func IsNotFound(err error) bool {
-	if apiErr, ok := asAPIError(err); ok {
-		return apiErr.StatusCode == http.StatusNotFound
-	}
-	return false
-}
-
-// IsUnauthorized reports whether an error is an API 401 response.
-func IsUnauthorized(err error) bool {
-	if apiErr, ok := asAPIError(err); ok {
-		return apiErr.StatusCode == http.StatusUnauthorized
-	}
-	return false
-}
-
-func asAPIError(err error) (*APIError, bool) {
-	if err == nil {
-		return nil, false
-	}
-	var target *APIError
-	if errors.As(err, &target) {
-		return target, true
-	}
-	return nil, false
-}
-
-// Client interacts with the GitHub API.
-// A Client is safe for concurrent use by multiple goroutines.
-// SetHTTPClient and SetRetryBackoff are intended for test setup only and must
-// be called before any goroutines issue requests; they have no synchronization.
-type Client struct {
-	// TODO: baseURL is populated by NewClient but not yet consumed by doRequest/doGet.
-	// Higher-level exported methods (GetPullRequest, etc.) will use it to
-	// construct request URLs; remove this field if those methods end up
-	// accepting full URLs instead.
-	baseURL string
-	token   string
-	httpClient *http.Client
-
-	// retryBackoff defines the delays between retry attempts for 429 responses.
-	// retryBackoff[i] is the delay before attempt i+1 (after attempt i fails).
-	// If nil, defaults to {1s, 2s}.
-	retryBackoff []time.Duration
-
-	// now returns the current time. Defaults to time.Now.
-	// Override in tests to control HTTP-date Retry-After calculations.
-	now func() time.Time
-}
-
-// defaultCheckRedirect is the redirect policy used by NewClient.
-// NOTE: This function is intentionally duplicated in gitea/client.go (and vice versa)
-// because the packages are separate. Changes here must be mirrored there.
-// It rejects HTTPS->HTTP protocol downgrades (to prevent plaintext leakage)
-// and cross-host redirects (to prevent following responses from untrusted
-// endpoints). Same-host, same-or-upgraded-scheme redirects are allowed.
-func defaultCheckRedirect(req *http.Request, via []*http.Request) error {
-	if len(via) >= 10 {
-		return fmt.Errorf("stopped after 10 redirects")
-	}
-	// Guard for direct invocation in tests and any future callers;
-	// net/http guarantees len(via) >= 1 during actual redirects.
-	if len(via) == 0 {
-		return nil
-	}
-	prev := via[len(via)-1]
-	// Reject protocol downgrade: HTTPS->HTTP leaks request metadata over plaintext.
-	if prev.URL.Scheme == "https" && req.URL.Scheme == "http" {
-		return fmt.Errorf("refusing redirect: HTTPS to HTTP downgrade (%s -> %s)", prev.URL.Host, req.URL.Host)
-	}
-	// Reject cross-host redirect entirely to avoid consuming responses
-	// from untrusted endpoints.
-	if req.URL.Host != prev.URL.Host {
-		return fmt.Errorf("refusing redirect: cross-host (%s -> %s)", prev.URL.Host, req.URL.Host)
-	}
-	return nil
-}
-
-// NewClient creates a new GitHub API client.
-// If baseURL is empty, it defaults to https://api.github.com.
-// For GitHub Enterprise, pass the API base URL (e.g. https://github.concur.com/api/v3).
-func NewClient(token, baseURL string) *Client {
-	if baseURL == "" {
-		baseURL = defaultBaseURL
-	}
-	return &Client{
-		baseURL: strings.TrimRight(baseURL, "/"),
-		token:   token,
-		httpClient: &http.Client{
-			Timeout:       30 * time.Second,
-			CheckRedirect: defaultCheckRedirect,
-		},
-		now: time.Now,
-	}
-}
-
-// SetHTTPClient sets the underlying HTTP client used for requests.
-// This is intended for test setup only to inject mock transports; it must be
-// called before any goroutines issue requests.
-//
-// Passing nil restores the default client (30s timeout + redirect-rejecting
-// CheckRedirect policy matching NewClient).
-//
-// Callers providing a non-nil client are responsible for configuring a safe
-// CheckRedirect policy. Without one, the default net/http behavior will follow
-// redirects and may forward the Authorization header to untrusted hosts.
-func (c *Client) SetHTTPClient(hc *http.Client) {
-	if hc == nil {
-		hc = &http.Client{
-			Timeout:       30 * time.Second,
-			CheckRedirect: defaultCheckRedirect,
-		}
-	}
-	c.httpClient = hc
-}
-
-// SetRetryBackoff sets the delays between retry attempts.
-// This is intended for testing to speed up retry tests.
-//
-// Note: if an empty non-nil slice is provided, Retry-After delays parsed from
-// server responses will be computed and capped but not applied (because
-// attempt < len(backoff) is always false). This is acceptable for the
-// test-only use case but callers should be aware of this edge case.
-func (c *Client) SetRetryBackoff(backoff []time.Duration) {
-	c.retryBackoff = backoff
-}
-
-// parseRetryAfter parses a Retry-After header value, supporting both integer
-// seconds (e.g. "120") and HTTP-date format (e.g. "Thu, 01 Dec 2025 16:00:00 GMT")
-// as specified in RFC 7231 §7.1.3.
-//
-// For integer values, it returns the duration directly.
-// For HTTP-date values, it computes the delay as the difference between the
-// parsed time and now. If the date is in the past, it returns 0.
-//
-// Returns (0, false) if the value cannot be parsed as either format.
-func (c *Client) parseRetryAfter(value string) (time.Duration, bool) {
-	value = strings.TrimSpace(value)
-
-	// Try integer seconds first (most common from GitHub).
-	// RFC 7231 allows delta-seconds of 0 to indicate immediate retry.
-	if seconds, err := strconv.Atoi(value); err == nil && seconds >= 0 {
-		return time.Duration(seconds) * time.Second, true
-	}
-
-	// Try HTTP-date format (RFC 7231 §7.1.3).
-	// http.ParseTime handles RFC 1123, RFC 850, and ASCTIME formats.
-	if retryAt, err := http.ParseTime(value); err == nil {
-		delay := retryAt.Sub(c.now())
-		if delay < 0 {
-			delay = 0
-		}
-		return delay, true
-	}
-
-	return 0, false
-}
-
-// doRequest performs an HTTP request with retry on 429 rate limit responses.
-// It respects the Retry-After header when present, supporting both integer
-// seconds and HTTP-date formats (capped at maxRetryAfter).
-func (c *Client) doRequest(ctx context.Context, method, reqURL string, accept string) ([]byte, error) {
-	var backoff []time.Duration
-	if c.retryBackoff != nil {
-		backoff = append([]time.Duration(nil), c.retryBackoff...)
-	} else {
-		backoff = []time.Duration{1 * time.Second, 2 * time.Second}
-	}
-
-	var lastErr error
-	for attempt := 0; attempt < maxRetryAttempts; attempt++ {
-		if attempt > 0 {
-			var delay time.Duration
-			if attempt-1 < len(backoff) {
-				delay = backoff[attempt-1]
-			}
-			if delay > 0 {
-				timer := time.NewTimer(delay)
-				select {
-				case <-timer.C:
-					timer.Stop()
-				case <-ctx.Done():
-					timer.Stop()
-					return nil, ctx.Err()
-				}
-			}
-		}
-
-		req, err := http.NewRequestWithContext(ctx, method, reqURL, nil)
-		if err != nil {
-			return nil, fmt.Errorf("create request: %w", err)
-		}
-		req.Header.Set("Authorization", "Bearer "+c.token)
-		if accept != "" {
-			req.Header.Set("Accept", accept)
-		} else {
-			req.Header.Set("Accept", "application/vnd.github+json")
-		}
-
-		resp, err := c.httpClient.Do(req)
-		if err != nil {
-			return nil, fmt.Errorf("do request: %w", err)
-		}
-
-		if resp.StatusCode >= 200 && resp.StatusCode < 300 {
-			body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBodyBytes))
-			resp.Body.Close()
-			if err != nil {
-				return nil, fmt.Errorf("read response body: %w", err)
-			}
-			return body, nil
-		}
-
-		errBody, _ := io.ReadAll(io.LimitReader(resp.Body, maxErrorBodyBytes))
-		resp.Body.Close()
-
-		lastErr = &APIError{StatusCode: resp.StatusCode, Body: string(errBody)}
-
-		// Retry on 429 rate limit
-		if resp.StatusCode == http.StatusTooManyRequests && attempt < maxRetryAttempts-1 {
-			// Check for Retry-After header and override backoff if present.
-			// Supports both integer seconds (common) and HTTP-date format (RFC 7231).
-			if ra := resp.Header.Get("Retry-After"); ra != "" {
-				if delay, ok := c.parseRetryAfter(ra); ok {
-					if delay > maxRetryAfter {
-						delay = maxRetryAfter
-					}
-					if attempt < len(backoff) {
-						backoff[attempt] = delay
-					}
-				}
-			}
-			continue
-		}
-
-		// Don't retry other errors
-		return nil, lastErr
-	}
-
-	return nil, lastErr
-}
-
-// doGet is a convenience wrapper for GET requests with the default Accept header.
-func (c *Client) doGet(ctx context.Context, url string) ([]byte, error) {
-	return c.doRequest(ctx, http.MethodGet, url, "")
-}

github/client_test.go

@@ -1,513 +0,0 @@
-package github
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestNewClient_DefaultBaseURL(t *testing.T) {
-	c := NewClient("tok", "")
-	if c.baseURL != defaultBaseURL {
-		t.Errorf("baseURL = %q, want %q", c.baseURL, defaultBaseURL)
-	}
-}
-
-func TestNewClient_CustomBaseURL(t *testing.T) {
-	c := NewClient("tok", "https://github.concur.com/api/v3/")
-	if c.baseURL != "https://github.concur.com/api/v3" {
-		t.Errorf("baseURL = %q, want trailing slash stripped", c.baseURL)
-	}
-}
-
-func TestDoRequest_Success(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if got := r.Header.Get("Authorization"); got != "Bearer test-token" {
-			t.Errorf("Authorization = %q, want Bearer test-token", got)
-		}
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`{"ok":true}`))
-	}))
-	defer srv.Close()
-
-	c := NewClient("test-token", srv.URL)
-	body, err := c.doGet(context.Background(), srv.URL+"/test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if string(body) != `{"ok":true}` {
-		t.Errorf("body = %q, want %q", body, `{"ok":true}`)
-	}
-}
-
-func TestDoRequest_429_RetryAfter_IntegerSeconds(t *testing.T) {
-	attempts := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		if attempts == 1 {
-			w.Header().Set("Retry-After", "0")
-			w.WriteHeader(http.StatusTooManyRequests)
-			w.Write([]byte("rate limited"))
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("success"))
-	}))
-	defer srv.Close()
-
-	c := NewClient("tok", srv.URL)
-	c.SetRetryBackoff([]time.Duration{0, 0})
-
-	body, err := c.doGet(context.Background(), srv.URL+"/test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if string(body) != "success" {
-		t.Errorf("body = %q, want %q", body, "success")
-	}
-	if attempts != 2 {
-		t.Errorf("attempts = %d, want 2", attempts)
-	}
-}
-
-func TestDoRequest_429_RetryAfter_HTTPDate(t *testing.T) {
-	// Fix "now" to a known time for deterministic testing.
-	fixedNow := time.Date(2025, 12, 1, 15, 59, 59, 0, time.UTC)
-	retryAt := "Mon, 01 Dec 2025 16:00:00 GMT" // 1 second in the future
-
-	attempts := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		if attempts == 1 {
-			w.Header().Set("Retry-After", retryAt)
-			w.WriteHeader(http.StatusTooManyRequests)
-			w.Write([]byte("rate limited"))
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("success"))
-	}))
-	defer srv.Close()
-
-	c := NewClient("tok", srv.URL)
-	c.now = func() time.Time { return fixedNow }
-	// Initial backoff is 0; the HTTP-date parser will compute 1s and override.
-	c.SetRetryBackoff([]time.Duration{0, 0})
-
-	body, err := c.doGet(context.Background(), srv.URL+"/test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if string(body) != "success" {
-		t.Errorf("body = %q, want %q", body, "success")
-	}
-	if attempts != 2 {
-		t.Errorf("attempts = %d, want 2", attempts)
-	}
-}
-
-func TestDoRequest_429_RetryAfter_HTTPDate_InPast(t *testing.T) {
-	// If the HTTP-date is in the past, delay should be 0 (retry immediately).
-	fixedNow := time.Date(2025, 12, 1, 17, 0, 0, 0, time.UTC)
-	retryAt := "Mon, 01 Dec 2025 16:00:00 GMT" // 1 hour in the past
-
-	attempts := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		if attempts == 1 {
-			w.Header().Set("Retry-After", retryAt)
-			w.WriteHeader(http.StatusTooManyRequests)
-			w.Write([]byte("rate limited"))
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("success"))
-	}))
-	defer srv.Close()
-
-	c := NewClient("tok", srv.URL)
-	c.now = func() time.Time { return fixedNow }
-	c.SetRetryBackoff([]time.Duration{0, 0})
-
-	body, err := c.doGet(context.Background(), srv.URL+"/test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if string(body) != "success" {
-		t.Errorf("body = %q, want %q", body, "success")
-	}
-}
-
-func TestDoRequest_429_NoRetryAfter_UsesDefaultBackoff(t *testing.T) {
-	attempts := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		if attempts == 1 {
-			w.WriteHeader(http.StatusTooManyRequests)
-			w.Write([]byte("rate limited"))
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("success"))
-	}))
-	defer srv.Close()
-
-	c := NewClient("tok", srv.URL)
-	c.SetRetryBackoff([]time.Duration{0, 0})
-
-	body, err := c.doGet(context.Background(), srv.URL+"/test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if string(body) != "success" {
-		t.Errorf("body = %q, want %q", body, "success")
-	}
-	if attempts != 2 {
-		t.Errorf("attempts = %d, want 2", attempts)
-	}
-}
-
-func TestDoRequest_429_InvalidRetryAfter_UsesDefaultBackoff(t *testing.T) {
-	attempts := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		if attempts == 1 {
-			w.Header().Set("Retry-After", "not-a-number-or-date")
-			w.WriteHeader(http.StatusTooManyRequests)
-			w.Write([]byte("rate limited"))
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("success"))
-	}))
-	defer srv.Close()
-
-	c := NewClient("tok", srv.URL)
-	c.SetRetryBackoff([]time.Duration{0, 0})
-
-	body, err := c.doGet(context.Background(), srv.URL+"/test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if string(body) != "success" {
-		t.Errorf("body = %q, want %q", body, "success")
-	}
-}
-
-func TestDoRequest_404_NoRetry(t *testing.T) {
-	attempts := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		w.WriteHeader(http.StatusNotFound)
-		w.Write([]byte("not found"))
-	}))
-	defer srv.Close()
-
-	c := NewClient("tok", srv.URL)
-	_, err := c.doGet(context.Background(), srv.URL+"/test")
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !IsNotFound(err) {
-		t.Errorf("expected IsNotFound, got %v", err)
-	}
-	if attempts != 1 {
-		t.Errorf("attempts = %d, want 1 (no retry on 404)", attempts)
-	}
-}
-
-func TestDoRequest_401_NoRetry(t *testing.T) {
-	attempts := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		attempts++
-		w.WriteHeader(http.StatusUnauthorized)
-		w.Write([]byte("unauthorized"))
-	}))
-	defer srv.Close()
-
-	c := NewClient("tok", srv.URL)
-	_, err := c.doGet(context.Background(), srv.URL+"/test")
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !IsUnauthorized(err) {
-		t.Errorf("expected IsUnauthorized, got %v", err)
-	}
-	if attempts != 1 {
-		t.Errorf("attempts = %d, want 1 (no retry on 401)", attempts)
-	}
-}
-
-func TestDoRequest_ContextCanceled(t *testing.T) {
-	// This test exercises the timer-cancel path in the retry select:
-	//   select { case <-timer.C; case <-ctx.Done() }
-	// The server returns 429 with a long Retry-After, and we cancel the
-	// context shortly after the first response so that cancellation races
-	// against the timer rather than preventing the initial HTTP round-trip.
-	requestReceived := make(chan struct{}, 1)
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		select {
-		case requestReceived <- struct{}{}:
-		default:
-		}
-		w.Header().Set("Retry-After", "10")
-		w.WriteHeader(http.StatusTooManyRequests)
-	}))
-	defer srv.Close()
-
-	c := NewClient("tok", srv.URL)
-	c.SetRetryBackoff([]time.Duration{10 * time.Second, 10 * time.Second})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	// Cancel the context after the first request completes, while the
-	// client is blocked in the retry timer select.
-	go func() {
-		<-requestReceived
-		// Small delay to ensure we're inside the timer select.
-		time.Sleep(50 * time.Millisecond)
-		cancel()
-	}()
-
-	_, err := c.doGet(ctx, srv.URL+"/test")
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !errors.Is(err, context.Canceled) {
-		t.Errorf("err = %v, want context.Canceled", err)
-	}
-}
-
-func TestParseRetryAfter_IntegerSeconds(t *testing.T) {
-	c := NewClient("tok", "")
-	delay, ok := c.parseRetryAfter("42")
-	if !ok {
-		t.Fatal("expected ok=true")
-	}
-	if delay != 42*time.Second {
-		t.Errorf("delay = %v, want 42s", delay)
-	}
-}
-
-func TestParseRetryAfter_ZeroSeconds(t *testing.T) {
-	c := NewClient("tok", "")
-	delay, ok := c.parseRetryAfter("0")
-	if !ok {
-		t.Fatal("expected ok=true for zero seconds (RFC 7231 allows immediate retry)")
-	}
-	if delay != 0 {
-		t.Errorf("delay = %v, want 0", delay)
-	}
-}
-
-func TestParseRetryAfter_NegativeSeconds(t *testing.T) {
-	c := NewClient("tok", "")
-	_, ok := c.parseRetryAfter("-5")
-	if ok {
-		t.Error("expected ok=false for negative seconds")
-	}
-}
-
-func TestParseRetryAfter_HTTPDate_Future(t *testing.T) {
-	fixedNow := time.Date(2025, 12, 1, 15, 59, 50, 0, time.UTC)
-	c := NewClient("tok", "")
-	c.now = func() time.Time { return fixedNow }
-
-	delay, ok := c.parseRetryAfter("Mon, 01 Dec 2025 16:00:00 GMT")
-	if !ok {
-		t.Fatal("expected ok=true")
-	}
-	// Should be 10 seconds in the future.
-	if delay != 10*time.Second {
-		t.Errorf("delay = %v, want 10s", delay)
-	}
-}
-
-func TestParseRetryAfter_HTTPDate_Past(t *testing.T) {
-	fixedNow := time.Date(2025, 12, 1, 17, 0, 0, 0, time.UTC)
-	c := NewClient("tok", "")
-	c.now = func() time.Time { return fixedNow }
-
-	delay, ok := c.parseRetryAfter("Mon, 01 Dec 2025 16:00:00 GMT")
-	if !ok {
-		t.Fatal("expected ok=true")
-	}
-	if delay != 0 {
-		t.Errorf("delay = %v, want 0 (past date)", delay)
-	}
-}
-
-func TestParseRetryAfter_RFC850_Format(t *testing.T) {
-	fixedNow := time.Date(2025, 12, 1, 15, 59, 50, 0, time.UTC)
-	c := NewClient("tok", "")
-	c.now = func() time.Time { return fixedNow }
-
-	// RFC 850 format
-	delay, ok := c.parseRetryAfter("Monday, 01-Dec-25 16:00:00 GMT")
-	if !ok {
-		t.Fatal("expected ok=true for RFC 850 format")
-	}
-	if delay != 10*time.Second {
-		t.Errorf("delay = %v, want 10s", delay)
-	}
-}
-
-func TestParseRetryAfter_Invalid(t *testing.T) {
-	c := NewClient("tok", "")
-	_, ok := c.parseRetryAfter("not-valid")
-	if ok {
-		t.Error("expected ok=false for invalid value")
-	}
-}
-
-func TestParseRetryAfter_EmptyString(t *testing.T) {
-	c := NewClient("tok", "")
-	_, ok := c.parseRetryAfter("")
-	if ok {
-		t.Error("expected ok=false for empty string")
-	}
-}
-
-func TestParseRetryAfter_MaxCap(t *testing.T) {
-	// Verify that parseRetryAfter returns the raw value (capping is done by caller).
-	c := NewClient("tok", "")
-	delay, ok := c.parseRetryAfter("3600")
-	if !ok {
-		t.Fatal("expected ok=true")
-	}
-	if delay != 3600*time.Second {
-		t.Errorf("delay = %v, want 3600s (caller is responsible for capping)", delay)
-	}
-}
-
-func TestAPIError_Error_Truncation(t *testing.T) {
-	longBody := make([]byte, 300)
-	for i := range longBody {
-		longBody[i] = 'x'
-	}
-	apiErr := &APIError{StatusCode: 500, Body: string(longBody)}
-	msg := apiErr.Error()
-	if len(msg) > 250 {
-		// "HTTP 500: " (10) + 200 + "...(truncated)" (14) = 224
-		t.Errorf("error message too long: %d chars", len(msg))
-	}
-}
-
-func TestAPIError_Error_NewlineSanitized(t *testing.T) {
-	apiErr := &APIError{StatusCode: 400, Body: "line1\nline2\rline3"}
-	msg := apiErr.Error()
-	for _, c := range msg {
-		if c == '\n' || c == '\r' {
-			t.Errorf("error message contains unsanitized newline: %q", msg)
-			break
-		}
-	}
-}
-
-func TestNewClient_HasCheckRedirect(t *testing.T) {
-	c := NewClient("secret-token", "https://api.github.com")
-	if c.httpClient.CheckRedirect == nil {
-		t.Fatal("expected CheckRedirect to be set")
-	}
-}
-
-func TestDefaultCheckRedirect_RejectsHTTPSToHTTP(t *testing.T) {
-	prev := &http.Request{URL: &url.URL{Scheme: "https", Host: "api.github.com", Path: "/foo"}}
-	req := &http.Request{
-		URL:    &url.URL{Scheme: "http", Host: "api.github.com", Path: "/foo"},
-		Header: http.Header{"Authorization": []string{"Bearer token"}},
-	}
-	err := defaultCheckRedirect(req, []*http.Request{prev})
-	if err == nil {
-		t.Fatal("expected error on HTTPS->HTTP redirect")
-	}
-	if !strings.Contains(err.Error(), "HTTPS to HTTP downgrade") {
-		t.Errorf("unexpected error message: %v", err)
-	}
-}
-
-func TestDefaultCheckRedirect_RejectsCrossHost(t *testing.T) {
-	prev := &http.Request{URL: &url.URL{Scheme: "https", Host: "api.github.com", Path: "/foo"}}
-	req := &http.Request{
-		URL:    &url.URL{Scheme: "https", Host: "objects.githubusercontent.com", Path: "/bar"},
-		Header: http.Header{"Authorization": []string{"Bearer token"}},
-	}
-	err := defaultCheckRedirect(req, []*http.Request{prev})
-	if err == nil {
-		t.Fatal("expected error on cross-host redirect")
-	}
-	if !strings.Contains(err.Error(), "cross-host") {
-		t.Errorf("unexpected error message: %v", err)
-	}
-}
-
-func TestDefaultCheckRedirect_AllowsSameHost(t *testing.T) {
-	prev := &http.Request{URL: &url.URL{Scheme: "https", Host: "api.github.com", Path: "/foo"}}
-	req := &http.Request{
-		URL:    &url.URL{Scheme: "https", Host: "api.github.com", Path: "/bar"},
-		Header: http.Header{"Authorization": []string{"Bearer token"}},
-	}
-	err := defaultCheckRedirect(req, []*http.Request{prev})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	// Auth should be preserved on same-host redirect
-	if auth := req.Header.Get("Authorization"); auth != "Bearer token" {
-		t.Errorf("expected Authorization to be preserved, got %q", auth)
-	}
-}
-
-func TestDefaultCheckRedirect_AllowsSameHostHTTPToHTTP(t *testing.T) {
-	prev := &http.Request{URL: &url.URL{Scheme: "http", Host: "localhost:8080", Path: "/foo"}}
-	req := &http.Request{
-		URL:    &url.URL{Scheme: "http", Host: "localhost:8080", Path: "/bar"},
-		Header: http.Header{},
-	}
-	err := defaultCheckRedirect(req, []*http.Request{prev})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-}
-
-func TestDefaultCheckRedirect_RejectsTooManyRedirects(t *testing.T) {
-	via := make([]*http.Request, 10)
-	for i := range via {
-		via[i] = &http.Request{URL: &url.URL{Scheme: "https", Host: "api.github.com", Path: "/"}}
-	}
-	req := &http.Request{URL: &url.URL{Scheme: "https", Host: "api.github.com", Path: "/final"}}
-	err := defaultCheckRedirect(req, via)
-	if err == nil {
-		t.Fatal("expected error after 10 redirects")
-	}
-	if !strings.Contains(err.Error(), "10 redirects") {
-		t.Errorf("unexpected error message: %v", err)
-	}
-}
-
-func TestDefaultCheckRedirect_EmptyViaAllowed(t *testing.T) {
-	req := &http.Request{URL: &url.URL{Scheme: "https", Host: "api.github.com", Path: "/foo"}}
-	err := defaultCheckRedirect(req, nil)
-	if err != nil {
-		t.Fatalf("unexpected error with empty via: %v", err)
-	}
-}
-
-func TestSetHTTPClient_NilRestoresDefault(t *testing.T) {
-	c := NewClient("token", "https://api.github.com")
-	c.SetHTTPClient(nil)
-	if c.httpClient == nil {
-		t.Fatal("expected non-nil httpClient after SetHTTPClient(nil)")
-	}
-	if c.httpClient.Timeout != 30*time.Second {
-		t.Errorf("expected 30s timeout, got %v", c.httpClient.Timeout)
-	}
-	if c.httpClient.CheckRedirect == nil {
-		t.Fatal("expected CheckRedirect policy after SetHTTPClient(nil)")
-	}
-}

go.mod

@@ -2,4 +2,4 @@ module gitea.weiker.me/rodin/review-bot
 
 go 1.26.2
 
-require github.com/goccy/go-yaml v1.19.2
+require gopkg.in/yaml.v3 v3.0.1

go.sum

@@ -1,2 +1,4 @@
-github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

review/formatter.go

@@ -2,6 +2,7 @@ package review
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 )
 
@@ -22,10 +23,29 @@ func GiteaEvent(verdict string) string {
 	}
 }
 
+// markdownSpecialChars matches characters that have special meaning in Markdown.
+// We escape these to prevent untrusted input from breaking formatting.
+// Uses a quoted string since raw strings can't contain backticks.
+var markdownSpecialChars = regexp.MustCompile("([\\\\*_`\\[\\]()#<>|~])")
+
+// sanitizeMarkdownText escapes special Markdown characters in untrusted text.
+// This prevents markdown injection attacks where a malicious display name could
+// break formatting, inject links, or create unexpected rendering.
+func sanitizeMarkdownText(s string) string {
+	// First, remove any control characters and null bytes
+	cleaned := strings.Map(func(r rune) rune {
+		if r < 32 && r != '\t' && r != '\n' {
+			return -1 // drop the character
+		}
+		return r
+	}, s)
+	// Escape special Markdown characters by prepending backslash
+	return markdownSpecialChars.ReplaceAllString(cleaned, `\$1`)
+}
+
 // FormatMarkdownWithDisplay formats a ReviewResult with separate display name and sentinel name.
-// Note: displayName is not HTML-escaped as Gitea sanitizes rendered Markdown.
+// displayName is sanitized to prevent Markdown injection from untrusted remote persona metadata.
-// Persona display names are controlled by repo owners (trusted input).
+// sentinelName is used for the cleanup sentinel comment (machine-readable, not rendered).
-// displayName is used for the header title, sentinelName is used for the cleanup sentinel.
 // If displayName is empty, sentinelName is used for both.
 func FormatMarkdownWithDisplay(result *ReviewResult, displayName, sentinelName string) string {
 	var sb strings.Builder
@@ -37,7 +57,8 @@ func FormatMarkdownWithDisplay(result *ReviewResult, displayName, sentinelName s
 	}
 
 	if headerName != "" {
-		title := CapitalizeFirst(headerName)
+		// Sanitize the header name to prevent Markdown injection
+		title := CapitalizeFirst(sanitizeMarkdownText(headerName))
 		sb.WriteString(fmt.Sprintf("# %s Review\n\n", title))
 	}
 
@@ -61,7 +82,8 @@ func FormatMarkdownWithDisplay(result *ReviewResult, displayName, sentinelName s
 	sb.WriteString(fmt.Sprintf("**%s** — %s\n", result.Verdict, result.Recommendation))
 
 	if sentinelName != "" {
-		sb.WriteString(fmt.Sprintf("\n---\n*Review by %s*\n", headerName))
+		// Sanitize headerName for the footer as well
+		sb.WriteString(fmt.Sprintf("\n---\n*Review by %s*\n", sanitizeMarkdownText(headerName)))
 		// Hidden sentinel for identifying this bot's reviews during cleanup
 		sb.WriteString(fmt.Sprintf("\n<!-- review-bot:%s -->\n", sentinelName))
 	}

review/formatter_test.go

@@ -214,3 +214,71 @@ func TestFormatMarkdownWithDisplay(t *testing.T) {
 		}
 	})
 }
+
+func TestSanitizeMarkdownText(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "plain text unchanged",
+			input: "Security Specialist",
+			want:  "Security Specialist",
+		},
+		{
+			name:  "escapes asterisks",
+			input: "**bold** attack",
+			want:  `\*\*bold\*\* attack`,
+		},
+		{
+			name:  "escapes brackets for links",
+			input: "[click me](http://evil.com)",
+			want:  `\[click me\]\(http://evil.com\)`,
+		},
+		{
+			name:  "escapes backticks",
+			input: "`code` injection",
+			want:  "\\`code\\` injection",
+		},
+		{
+			name:  "escapes angle brackets",
+			input: "<script>alert(1)</script>",
+			want:  `\<script\>alert\(1\)\</script\>`,
+		},
+		{
+			name:  "escapes hash for headers",
+			input: "# Fake Header",
+			want:  `\# Fake Header`,
+		},
+		{
+			name:  "escapes pipe for tables",
+			input: "col1 | col2",
+			want:  `col1 \| col2`,
+		},
+		{
+			name:  "removes control characters",
+			input: "hello\x00world\x1f",
+			want:  "helloworld",
+		},
+		{
+			name:  "preserves tabs and newlines",
+			input: "line1\n\tindented",
+			want:  "line1\n\tindented",
+		},
+		{
+			name:  "escapes tilde for strikethrough",
+			input: "~~strikethrough~~",
+			want:  `\~\~strikethrough\~\~`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := sanitizeMarkdownText(tt.input)
+			if got != tt.want {
+				t.Errorf("sanitizeMarkdownText(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}

review/persona.go

@@ -5,15 +5,12 @@ import (
 	"embed"
 	"encoding/json"
 	"fmt"
-	"io"
 	"os"
 	"sort"
 	"strings"
 	"unicode/utf8"
 
-	"github.com/goccy/go-yaml"
+	"gopkg.in/yaml.v3"
-	"github.com/goccy/go-yaml/ast"
-	"github.com/goccy/go-yaml/parser"
 )
 
 //go:embed personas/*.yaml
@@ -121,7 +118,9 @@ func ListBuiltinPersonas() []string {
 		default:
 			continue
 		}
-		seen[personaName] = true
+		if !seen[personaName] {
+			seen[personaName] = true
+		}
 	}
 	names := make([]string, 0, len(seen))
 	for name := range seen {
@@ -143,19 +142,10 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 		err = unmarshalYAMLWithDepthLimit(data, &p, MaxYAMLDepth)
 	} else {
 		// Use json.Decoder with DisallowUnknownFields for consistency with
-		// YAML's Strict() - both reject unknown fields to catch typos.
+		// YAML's KnownFields(true) - both reject unknown fields to catch typos.
 		dec := json.NewDecoder(bytes.NewReader(data))
 		dec.DisallowUnknownFields()
 		err = dec.Decode(&p)
-		if err == nil {
-			// Reject trailing content after the first valid JSON object.
-			// Without this check, input like `{"name":"x"}garbage` would
-			// silently succeed because Decoder stops after one object.
-			var dummy json.RawMessage
-			if err2 := dec.Decode(&dummy); err2 != io.EOF {
-				err = fmt.Errorf("unexpected trailing content after JSON object")
-			}
-		}
 	}
 	if err != nil {
 		return nil, fmt.Errorf("parse persona %s: %w", source, err)
@@ -166,179 +156,74 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 	return &p, nil
 }
 
-// unmarshalYAMLWithDepthLimit unmarshals YAML data with three safety checks:
+// unmarshalYAMLWithDepthLimit unmarshals YAML data with explicit depth limiting
-//   - Depth limiting: rejects AST trees exceeding maxDepth to prevent stack exhaustion.
+// and strict field checking. This protects against stack exhaustion from deeply
-//   - Multi-document rejection: prevents silent data loss from ignored extra documents.
+// nested structures and catches typos in field names.
-//   - Strict field checking: rejects unknown YAML keys to catch typos early.
+// Multi-document YAML files are rejected to prevent silent data loss.
 func unmarshalYAMLWithDepthLimit(data []byte, out any, maxDepth int) error {
-	// First pass: parse into AST to check depth limits, node counts, and
+	// First pass: decode into a yaml.Node to check depth limits and node counts.
-	// multi-document rejection. This prevents stack exhaustion before we
+	// This prevents stack exhaustion before we attempt to decode into structs.
-	// attempt to decode into structs.
+	var node yaml.Node
-	file, err := parser.ParseBytes(data, 0)
+	dec := yaml.NewDecoder(bytes.NewReader(data))
-	if err != nil {
+	if err := dec.Decode(&node); err != nil {
 		return err
 	}
 
-	// Reject empty YAML input (whitespace-only, comment-only, or truly empty files).
-	// The parser returns a single doc with nil body for these cases.
-	if len(file.Docs) == 0 || file.Docs[0].Body == nil {
-		return fmt.Errorf("empty YAML document")
-	}
-
 	// Reject multi-document YAML files - silently ignoring additional documents
 	// could lead to confusing behavior where users think their changes take effect.
-	if len(file.Docs) > 1 {
+	var extra yaml.Node
+	if dec.Decode(&extra) == nil {
 		return fmt.Errorf("multi-document YAML is not supported; only single-document files are allowed")
 	}
 
 	nodeCount := 0
-	if err := checkYAMLDepth(file.Docs[0].Body, 0, maxDepth, MaxYAMLNodes, make(map[ast.Node]int), make(map[ast.Node]bool), &nodeCount); err != nil {
+	if err := checkYAMLDepth(&node, 0, maxDepth, MaxYAMLNodes, make(map[*yaml.Node]struct{}), &nodeCount); err != nil {
 		return err
 	}
 
 	// Second pass: decode with strict field checking enabled.
-	// Strict() rejects unknown keys, catching typos like "focuss" or "identiy".
+	// KnownFields(true) rejects unknown keys, catching typos like "focuss" or "identiy".
-	//
+	// We must re-decode from the original data because yaml.Node.Decode() doesn't
-	// Safety note: goccy/go-yaml's decoder does not expand YAML aliases
+	// support the KnownFields option.
-	// recursively — it resolves them via the pre-built AST, which our first
+	strictDec := yaml.NewDecoder(bytes.NewReader(data))
-	// pass already depth-checked. Alias chains that would exceed depth limits
+	strictDec.KnownFields(true)
-	// are caught above; the decoder merely reads the resolved scalar values.
+	return strictDec.Decode(out)
-	dec := yaml.NewDecoder(bytes.NewReader(data), yaml.Strict())
-	return dec.Decode(out)
 }
 
-// checkYAMLDepth recursively checks that YAML AST nodes don't exceed the depth
+// checkYAMLDepth recursively checks that YAML nodes don't exceed the depth limit
-// limit or the total node count limit. It uses two tracking maps:
+// or the total node count limit. It also detects alias cycles to prevent infinite
-//   - validated: maps each node to the maximum depth at which it was previously
+// recursion from crafted YAML with self-referential aliases.
-//     checked. If a node is revisited at a deeper depth (e.g., via an alias),
+func checkYAMLDepth(node *yaml.Node, depth, maxDepth, maxNodes int, seen map[*yaml.Node]struct{}, nodeCount *int) error {
-//     we re-check it to ensure the combined effective depth doesn't exceed limits.
-//   - visiting: per-path recursion stack for true cycle detection. A node on the
-//     current path is a cycle (alias loop); we return nil to avoid infinite recursion.
-//
-// This design prevents the alias depth bypass where an anchored subtree validated
-// at a shallow depth could be referenced via alias at a greater depth, effectively
-// exceeding MaxYAMLDepth.
-func checkYAMLDepth(node ast.Node, depth, maxDepth, maxNodes int, validated map[ast.Node]int, visiting map[ast.Node]bool, nodeCount *int) error {
-	if node == nil {
-		return nil
-	}
-
 	if depth > maxDepth {
 		return fmt.Errorf("YAML nesting depth exceeds maximum (%d)", maxDepth)
 	}
 
-	// Cycle detection: if we're currently visiting this node on the current
-	// recursion path, it's a cycle (e.g., alias pointing to an ancestor).
-	// Return nil to break the cycle without error — cycles are a structural
-	// property, not a depth violation.
-	if visiting[node] {
-		return nil
-	}
-
 	// Track total nodes visited as defense-in-depth against wide-but-shallow attacks.
-	// Placed after cycle detection but before the depth-aware short-circuit. This means
-	// nodes revisited at shallower depths (via aliases) are counted each time they are
-	// encountered — intentional conservative overcounting. This bounds the total work
-	// performed during validation rather than tracking unique nodes, which is the safer
-	// security posture for untrusted YAML input.
 	*nodeCount++
 	if *nodeCount > maxNodes {
 		return fmt.Errorf("YAML node count exceeds maximum (%d)", maxNodes)
 	}
 
-	// Depth-aware short-circuit: skip re-validation only when the current visit
+	// Cycle detection: if we've seen this node before, we're in a cycle.
-	// depth is the same or shallower than the depth at which this node was
+	if _, ok := seen[node]; ok {
-	// previously validated. A shallower (or equal) current depth means the
+		return nil // Already validated this subtree, skip to avoid infinite recursion.
-	// prior, deeper validation already covered any subtree depth violations.
-	// If the current depth exceeds the previous validation depth (e.g., an alias
-	// references this node deeper in the tree), we must re-traverse to ensure
-	// the combined effective depth doesn't exceed maxDepth.
-	//
-	// Note: using ast.Node (interface) as map key relies on pointer identity,
-	// which is correct because all goccy/go-yaml AST node types are pointer
-	// receivers (*MappingNode, *SequenceNode, etc.), never value types.
-	if prevDepth, ok := validated[node]; ok && depth <= prevDepth {
-		return nil
 	}
-	validated[node] = depth
+	seen[node] = struct{}{}
 
-	// Mark as visiting (on the current recursion path) for cycle detection.
+	// Handle alias nodes: follow the alias to its anchor target.
-	visiting[node] = true
+	// Increment depth when following aliases since they expand the effective structure.
-	defer func() { visiting[node] = false }()
+	if node.Kind == yaml.AliasNode && node.Alias != nil {
+		return checkYAMLDepth(node.Alias, depth+1, maxDepth, maxNodes, seen, nodeCount)
+	}
 
-	// Walk children based on node type.
+	for _, child := range node.Content {
-	switch n := node.(type) {
+		if err := checkYAMLDepth(child, depth+1, maxDepth, maxNodes, seen, nodeCount); err != nil {
-	case *ast.MappingNode:
-		for _, value := range n.Values {
-			if err := checkYAMLDepth(value, depth+1, maxDepth, maxNodes, validated, visiting, nodeCount); err != nil {
-				return err
-			}
-		}
-	case *ast.MappingValueNode:
-		// Both Key and Value are visited at depth+1 relative to this
-		// MappingValueNode. Since MappingNode visits its MappingValueNode
-		// children at depth+1 as well, keys and values end up at depth+2
-		// from the parent MappingNode. This is intentional: it mirrors the
-		// actual nesting structure (mapping → key-value pair → key/value).
-		if err := checkYAMLDepth(n.Key, depth+1, maxDepth, maxNodes, validated, visiting, nodeCount); err != nil {
 			return err
 		}
-		if err := checkYAMLDepth(n.Value, depth+1, maxDepth, maxNodes, validated, visiting, nodeCount); err != nil {
-			return err
-		}
-	case *ast.SequenceNode:
-		for _, value := range n.Values {
-			if err := checkYAMLDepth(value, depth+1, maxDepth, maxNodes, validated, visiting, nodeCount); err != nil {
-				return err
-			}
-		}
-	case *ast.AliasNode:
-		// Follow alias to its target, incrementing depth since aliases expand
-		// the effective structure.
-		if err := checkYAMLDepth(n.Value, depth+1, maxDepth, maxNodes, validated, visiting, nodeCount); err != nil {
-			return err
-		}
-	case *ast.AnchorNode:
-		// Increment depth for anchor values as a conservative measure: the
-		// anchor definition itself is structural, and treating it as a depth
-		// level ensures that deeply nested anchors are caught at definition
-		// time rather than only when referenced via alias. This +1 is
-		// asymmetric with alias (which also increments) — by design, the
-		// effective depth budget for anchored-then-aliased content is reduced
-		// because both the definition site and the reference site each consume
-		// a level, making deeply nested anchor/alias pairs hit the limit sooner.
-		if err := checkYAMLDepth(n.Value, depth+1, maxDepth, maxNodes, validated, visiting, nodeCount); err != nil {
-			return err
-		}
-	case *ast.TagNode:
-		if err := checkYAMLDepth(n.Value, depth+1, maxDepth, maxNodes, validated, visiting, nodeCount); err != nil {
-			return err
-		}
-	case *ast.MergeKeyNode:
-		// MergeKeyNode represents the literal "<<" merge key token. It has no
-		// child nodes — the value side of a merge (e.g., *alias) lives in the
-		// parent MappingValueNode.Value, which is already recursed into above.
-		// Explicitly listed here (rather than in the default case) to prevent
-		// future library changes from silently bypassing depth checks.
-	default:
-		// Scalar leaf nodes (StringNode, IntegerNode, FloatNode, BoolNode,
-		// NullNode, InfinityNode, NanNode, LiteralNode) have no children to
-		// recurse into.
 	}
 	return nil
 }
 
-// ParsePersonaBytes parses persona data from bytes with a source label for errors.
-// This is useful for parsing personas fetched from external sources (e.g., Gitea API)
-// without requiring filesystem access. Format is detected by source extension.
-// Input is bounded by MaxPersonaFileSize to prevent resource exhaustion.
-func ParsePersonaBytes(data []byte, source string) (*Persona, error) {
-	if len(data) > MaxPersonaFileSize {
-		return nil, fmt.Errorf("persona data from %s exceeds maximum size (%d bytes, limit %d)", source, len(data), MaxPersonaFileSize)
-	}
-	return parsePersona(data, source)
-}
-
 func validatePersona(p *Persona, source string) error {
 	if p.Name == "" {
 		return fmt.Errorf("persona %s: name is required", source)

review/persona_test.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/goccy/go-yaml/ast"
+	"gopkg.in/yaml.v3"
 )
 
 func TestLoadBuiltinPersona(t *testing.T) {
@@ -459,14 +459,7 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	path := filepath.Join(dir, "deeply-nested.yaml")
 
 	// Build a deeply nested YAML structure that exceeds MaxYAMLDepth (20).
-	// Depth accumulation trace for "nested: \n  level0: \n    level1: ...":
+	// Each level adds 2 to the depth count (key + value mapping).
-	//   - Document root parsed at depth 0
-	//   - Root MappingNode children (MappingValueNodes) visited at depth 1
-	//   - "nested" MappingValueNode: key at depth 2, value at depth 2
-	//   - Each levelN adds depth via MappingValueNode traversal (key + value)
-	//   - Exact depth per level depends on AST structure (MappingNode wrapping),
-	//     but 25 levels reliably exceeds MaxYAMLDepth (20) with comfortable margin.
-	// The test uses 25 levels rather than exactly 21 to avoid brittleness.
 	var sb strings.Builder
 	sb.WriteString("name: test\nidentity: test\nnested:\n")
 	indent := "  "
@@ -490,35 +483,6 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	}
 }
 
-func TestYAMLEmptyFileRejection(t *testing.T) {
-	tests := []struct {
-		name    string
-		content string
-	}{
-		{"completely_empty", ""},
-		{"whitespace_only", "   \n\n  "},
-		{"comment_only", "# just a comment\n"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			path := filepath.Join(dir, tc.name+".yaml")
-			if err := os.WriteFile(path, []byte(tc.content), 0644); err != nil {
-				t.Fatalf("failed to write test file: %v", err)
-			}
-
-			_, err := LoadPersona(path)
-			if err == nil {
-				t.Fatal("expected error for empty YAML input, got nil")
-			}
-			if !strings.Contains(err.Error(), "empty YAML document") {
-				t.Errorf("expected error containing %q, got: %v", "empty YAML document", err)
-			}
-		})
-	}
-}
-
 func TestYAMLFileSizeLimit(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "huge.yaml")
@@ -540,41 +504,41 @@ func TestYAMLFileSizeLimit(t *testing.T) {
 
 func TestYAMLAliasCycleDetection(t *testing.T) {
 	// Test that our checkYAMLDepth function handles alias cycles gracefully
-	// by using the visiting map to prevent infinite recursion.
+	// by using the seen map to prevent infinite recursion.
+	// We test this directly because go-yaml's parser handles most cycles
+	// at parse time, but we need to ensure our checker is robust.
 
 	// Create a node structure where an alias points to a parent node,
-	// simulating what could happen with crafted input.
+	// simulating what could happen with malicious input that bypasses
-	parent := &ast.MappingNode{
+	// go-yaml's cycle detection.
-		Values: []*ast.MappingValueNode{
+	parent := &yaml.Node{
-			{
+		Kind: yaml.MappingNode,
-				Key:   &ast.StringNode{Value: "name"},
+		Content: []*yaml.Node{
-				Value: &ast.StringNode{Value: "test"},
+			{Kind: yaml.ScalarNode, Value: "name"},
-			},
+			{Kind: yaml.ScalarNode, Value: "test"},
+			{Kind: yaml.ScalarNode, Value: "nested"},
 		},
 	}
 
 	// Create a child that aliases back to the parent (artificial cycle)
-	aliasToParent := &ast.AliasNode{
+	aliasToParent := &yaml.Node{
-		Value: parent,
+		Kind:  yaml.AliasNode,
+		Alias: parent,
 	}
-	parent.Values = append(parent.Values, &ast.MappingValueNode{
+	parent.Content = append(parent.Content, aliasToParent)
-		Key:   &ast.StringNode{Value: "nested"},
-		Value: aliasToParent,
-	})
 
 	nodeCount := 0
-	validated := make(map[ast.Node]int)
+	seen := make(map[*yaml.Node]struct{})
-	visiting := make(map[ast.Node]bool)
 
-	// This should NOT hang or stack overflow - cycle detection prevents infinite recursion
+	// This should NOT hang or stack overflow - the seen map prevents infinite recursion
-	err := checkYAMLDepth(parent, 0, MaxYAMLDepth, MaxYAMLNodes, validated, visiting, &nodeCount)
+	err := checkYAMLDepth(parent, 0, MaxYAMLDepth, MaxYAMLNodes, seen, &nodeCount)
 	if err != nil {
 		t.Errorf("unexpected error traversing cyclic structure: %v", err)
 	}
 
-	// Verify we tracked the parent in the validated map
+	// Verify we tracked the parent in the seen map
-	if _, ok := validated[parent]; !ok {
+	if _, ok := seen[parent]; !ok {
-		t.Error("parent node not tracked in validated map")
+		t.Error("parent node not tracked in seen map")
 	}
 }
 
@@ -630,82 +594,36 @@ func TestYAMLNodeCountLimit(t *testing.T) {
 func TestCheckYAMLDepthCycleDetectionDirect(t *testing.T) {
 	// Direct test of cycle detection in checkYAMLDepth by creating
 	// a node structure with an artificial cycle.
-	node := &ast.MappingNode{
+	// This tests the seen map logic independent of go-yaml's parsing.
-		Values: []*ast.MappingValueNode{
+	node := &yaml.Node{
-			{
+		Kind: yaml.MappingNode,
-				Key:   &ast.StringNode{Value: "key"},
+		Content: []*yaml.Node{
-				Value: &ast.StringNode{Value: "value"},
+			{Kind: yaml.ScalarNode, Value: "key"},
-			},
+			{Kind: yaml.ScalarNode, Value: "value"},
 		},
 	}
 
 	// Create a cycle by making a child reference the parent
-	cycleChild := &ast.AliasNode{
+	cycleChild := &yaml.Node{
-		Value: node, // Points back to the parent
+		Kind:  yaml.AliasNode,
+		Alias: node, // Points back to the parent
 	}
-	node.Values = append(node.Values, &ast.MappingValueNode{
+	node.Content = append(node.Content,
-		Key:   &ast.StringNode{Value: "cyclic"},
+		&yaml.Node{Kind: yaml.ScalarNode, Value: "cyclic"},
-		Value: cycleChild,
+		cycleChild,
-	})
+	)
 
 	nodeCount := 0
-	validated := make(map[ast.Node]int)
+	seen := make(map[*yaml.Node]struct{})
-	visiting := make(map[ast.Node]bool)
+	err := checkYAMLDepth(node, 0, MaxYAMLDepth, MaxYAMLNodes, seen, &nodeCount)
-	err := checkYAMLDepth(node, 0, MaxYAMLDepth, MaxYAMLNodes, validated, visiting, &nodeCount)
 
 	// Should complete without infinite recursion due to cycle detection
 	if err != nil {
 		t.Errorf("unexpected error: %v", err)
 	}
-	// The validated map should contain multiple entries
+	// The seen map should contain multiple entries
-	if len(validated) < 2 {
+	if len(seen) < 2 {
-		t.Errorf("validated map has %d entries, expected at least 2", len(validated))
+		t.Errorf("seen map has %d entries, expected at least 2", len(seen))
-	}
-}
-
-func TestYAMLAliasDepthBypass(t *testing.T) {
-	// Test that an anchored subtree first validated at a shallow depth is
-	// re-checked when referenced via alias at a deeper position. Without the
-	// depth-aware validated map, the alias reference would skip re-checking
-	// and allow the effective nesting to exceed MaxYAMLDepth.
-
-	dir := t.TempDir()
-	path := filepath.Join(dir, "alias-depth-bypass.yaml")
-
-	// Build YAML with an anchor at shallow depth containing a subtree near the limit,
-	// then reference it via alias deep enough that effective depth exceeds MaxYAMLDepth.
-	var sb strings.Builder
-	sb.WriteString("name: test\nidentity: test\n")
-
-	// Create the anchored subtree at depth 1 (key level) that nests 15 levels deep.
-	sb.WriteString("anchor_key: &deep_anchor\n")
-	for i := 0; i < 15; i++ {
-		sb.WriteString(strings.Repeat("  ", i+1))
-		sb.WriteString(fmt.Sprintf("level%d:\n", i))
-	}
-	sb.WriteString(strings.Repeat("  ", 16))
-	sb.WriteString("leaf: value\n")
-
-	// Create a wrapper that nests 6 levels deep, then references the anchor.
-	// Effective depth at alias target = 6 (wrapper nesting) + 1 (alias) + 15 (subtree) = 22 > 20
-	sb.WriteString("wrapper:\n")
-	for i := 0; i < 6; i++ {
-		sb.WriteString(strings.Repeat("  ", i+1))
-		sb.WriteString(fmt.Sprintf("n%d:\n", i))
-	}
-	sb.WriteString(strings.Repeat("  ", 7))
-	sb.WriteString("alias_ref: *deep_anchor\n")
-
-	if err := os.WriteFile(path, []byte(sb.String()), 0644); err != nil {
-		t.Fatalf("failed to write test file: %v", err)
-	}
-
-	_, err := LoadPersona(path)
-	if err == nil {
-		t.Fatal("expected error for alias depth bypass, got nil")
-	}
-	if !strings.Contains(err.Error(), "nesting depth exceeds") {
-		t.Errorf("error = %q, want containing 'nesting depth exceeds'", err.Error())
 	}
 }
 
@@ -858,102 +776,3 @@ identity: test identity
 		t.Errorf("Name = %q, want %q", p.Name, "test")
 	}
 }
-
-func TestJSONTrailingContentRejected(t *testing.T) {
-	tests := []struct {
-		name    string
-		content string
-	}{
-		{
-			name:    "trailing garbage after object",
-			content: `{"name":"test","identity":"test identity"}garbage`,
-		},
-		{
-			name:    "two JSON objects",
-			content: `{"name":"test","identity":"test identity"}{"name":"other"}`,
-		},
-		{
-			name:    "trailing array",
-			content: `{"name":"test","identity":"test identity"}[]`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			dir := t.TempDir()
-			path := filepath.Join(dir, "test.json")
-			if err := os.WriteFile(path, []byte(tt.content), 0644); err != nil {
-				t.Fatalf("failed to write test file: %v", err)
-			}
-
-			_, err := LoadPersona(path)
-			if err == nil {
-				t.Fatal("expected error for trailing content, got nil")
-			}
-			if !strings.Contains(err.Error(), "trailing content") {
-				t.Errorf("error = %q, want to contain 'trailing content'", err.Error())
-			}
-		})
-	}
-}
-
-func TestParsePersonaBytesSizeLimit(t *testing.T) {
-	// ParsePersonaBytes should reject input exceeding MaxPersonaFileSize
-	oversized := make([]byte, MaxPersonaFileSize+1)
-	for i := range oversized {
-		oversized[i] = 'x'
-	}
-
-	_, err := ParsePersonaBytes(oversized, "oversized.yaml")
-	if err == nil {
-		t.Fatal("expected error for oversized input, got nil")
-	}
-	if !strings.Contains(err.Error(), "exceeds maximum size") {
-		t.Errorf("error = %q, want to contain 'exceeds maximum size'", err.Error())
-	}
-
-	// Just under the limit should not trigger size error (may fail parse, but not size)
-	underLimit := []byte("name: test\nidentity: test persona\n")
-	p, err := ParsePersonaBytes(underLimit, "valid.yaml")
-	if err != nil {
-		t.Fatalf("unexpected error for valid input: %v", err)
-	}
-	if p.Name != "test" {
-		t.Errorf("Name = %q, want %q", p.Name, "test")
-	}
-}
-
-func TestYAMLMergeKeyDepthCheck(t *testing.T) {
-	// Verify that YAML merge keys (<<: *alias) are properly handled by the
-	// depth checker. The merge key content is in the MappingValueNode.Value
-	// (an AliasNode), not in the MergeKeyNode itself.
-	p, err := ParsePersonaBytes([]byte("name: merge-test\nidentity: test\n"), "merge.yaml")
-	if err != nil {
-		t.Fatalf("basic parse failed: %v", err)
-	}
-	if p.Name != "merge-test" {
-		t.Errorf("Name = %q, want %q", p.Name, "merge-test")
-	}
-
-	// Test that deeply nested merge keys still hit depth limit.
-	// Build YAML with merge key content nested beyond MaxYAMLDepth.
-	var sb strings.Builder
-	sb.WriteString("name: deep-merge\nidentity: deep merge persona\n")
-	sb.WriteString("anchor: &deep\n")
-	indent := "  "
-	for i := 0; i < MaxYAMLDepth+5; i++ {
-		sb.WriteString(indent)
-		sb.WriteString(fmt.Sprintf("level%d:\n", i))
-		indent += "  "
-	}
-	sb.WriteString(indent + "leaf: value\n")
-	sb.WriteString("target:\n  <<: *deep\n")
-
-	_, err = ParsePersonaBytes([]byte(sb.String()), "deep-merge.yaml")
-	if err == nil {
-		t.Fatal("expected error for deeply nested merge key content, got nil")
-	}
-	if !strings.Contains(err.Error(), "depth") {
-		t.Errorf("error = %q, want to contain 'depth'", err.Error())
-	}
-}

review/remote_persona.go

@@ -0,0 +1,171 @@
+package review
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"sort"
+	"strings"
+)
+
+// PersonaFetcher abstracts fetching files from a remote repository.
+// This allows persona loading to work with any Git host API.
+type PersonaFetcher interface {
+	// ListContents returns file/directory entries at a path.
+	// Returns an error if the path doesn't exist or isn't accessible.
+	ListContents(ctx context.Context, owner, repo, path string) ([]ContentEntry, error)
+
+	// GetFileContent returns the raw content of a file from the default branch.
+	GetFileContent(ctx context.Context, owner, repo, filepath string) (string, error)
+}
+
+// ContentEntry represents a file or directory entry.
+type ContentEntry struct {
+	Name string // filename or directory name
+	Path string // full path from repo root
+	Type string // "file" or "dir"
+}
+
+// DefaultPersonasPath is the conventional location for repo-specific personas.
+const DefaultPersonasPath = ".review-bot/personas"
+
+// LoadRemotePersonas fetches personas from a remote repository's .review-bot/personas/ directory.
+// Returns a map of persona name to Persona. If the directory doesn't exist or is empty,
+// returns an empty map with no error (graceful fallback to built-in personas).
+//
+// Files larger than MaxPersonaFileSize are logged and skipped.
+// Invalid YAML files are logged and skipped (partial success model).
+// Only .yaml and .yml files are processed; other files are ignored.
+func LoadRemotePersonas(ctx context.Context, fetcher PersonaFetcher, owner, repo string) (map[string]*Persona, error) {
+	return LoadRemotePersonasFromPath(ctx, fetcher, owner, repo, DefaultPersonasPath)
+}
+
+// LoadRemotePersonasFromPath loads personas from a custom path in a remote repository.
+// It behaves the same as LoadRemotePersonas but allows specifying a path other than
+// the default .review-bot/personas directory.
+func LoadRemotePersonasFromPath(ctx context.Context, fetcher PersonaFetcher, owner, repo, path string) (map[string]*Persona, error) {
+	entries, err := fetcher.ListContents(ctx, owner, repo, path)
+	if err != nil {
+		// 404 is expected when repo doesn't have personas — return empty, not error
+		if isNotFoundError(err) {
+			slog.Debug("no remote personas directory found", "repo", fmt.Sprintf("%s/%s", owner, repo), "path", path)
+			return map[string]*Persona{}, nil
+		}
+		return nil, fmt.Errorf("list remote personas: %w", err)
+	}
+
+	// Cap the number of files to process to prevent resource exhaustion
+	// from repos with thousands of small files.
+	const maxPersonaFiles = 50
+
+	result := make(map[string]*Persona)
+	processed := 0
+	for _, entry := range entries {
+		if processed >= maxPersonaFiles {
+			slog.Warn("persona file limit reached", "limit", maxPersonaFiles, "repo", fmt.Sprintf("%s/%s", owner, repo))
+			break
+		}
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
+
+		// Skip directories and non-YAML files
+		if entry.Type != "file" {
+			continue
+		}
+		if !isYAMLFile(entry.Name) {
+			continue
+		}
+
+		content, err := fetcher.GetFileContent(ctx, owner, repo, entry.Path)
+		if err != nil {
+			slog.Warn("could not fetch remote persona file", "file", entry.Path, "error", err)
+			continue
+		}
+
+		// Check size before parsing (defense in depth)
+		if len(content) > MaxPersonaFileSize {
+			slog.Warn("remote persona file exceeds size limit", "file", entry.Path, "size", len(content), "limit", MaxPersonaFileSize)
+			continue
+		}
+
+		// YAML parsing uses parsePersona which has defenses against YAML DoS attacks:
+		// - MaxPersonaFileSize (above) caps raw input size before any parsing
+		// - maxPersonaFiles (above) limits the number of files processed per repo
+		// - unmarshalYAMLWithDepthLimit enforces MaxYAMLDepth to prevent stack exhaustion
+		// - checkYAMLDepth tracks node counts (MaxYAMLNodes) against "billion laughs" expansion
+		// - Alias cycles are detected and capped by seen-node tracking
+		// See persona.go for the implementation details.
+		persona, err := parsePersona([]byte(content), entry.Path)
+		if err != nil {
+			slog.Warn("could not parse remote persona file", "file", entry.Path, "error", err)
+			continue
+		}
+
+		result[persona.Name] = persona
+		processed++
+		slog.Debug("loaded remote persona", "name", persona.Name, "file", entry.Path)
+	}
+
+	return result, nil
+}
+
+// MergePersonas combines remote and built-in personas.
+// Remote personas take precedence on name collision.
+// Returns the merged map and a list of persona names in sorted order.
+func MergePersonas(remote, builtin map[string]*Persona) (map[string]*Persona, []string) {
+	merged := make(map[string]*Persona)
+
+	// Add built-in first
+	for name, p := range builtin {
+		merged[name] = p
+	}
+
+	// Remote overrides built-in on collision
+	for name, p := range remote {
+		if _, exists := merged[name]; exists {
+			slog.Debug("remote persona overrides built-in", "name", name)
+		}
+		merged[name] = p
+	}
+
+	// Collect sorted names
+	names := make([]string, 0, len(merged))
+	for name := range merged {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+
+	return merged, names
+}
+
+// LoadAllBuiltinPersonas loads all built-in personas into a map.
+func LoadAllBuiltinPersonas() map[string]*Persona {
+	result := make(map[string]*Persona)
+	for _, name := range ListBuiltinPersonas() {
+		p, err := LoadBuiltinPersona(name)
+		if err != nil {
+			slog.Warn("could not load built-in persona", "name", name, "error", err)
+			continue
+		}
+		result[name] = p
+	}
+	return result
+}
+
+// isYAMLFile returns true if the filename has a YAML extension.
+func isYAMLFile(name string) bool {
+	lower := strings.ToLower(name)
+	return strings.HasSuffix(lower, ".yaml") || strings.HasSuffix(lower, ".yml")
+}
+
+// isNotFoundError checks if an error indicates a 404 response.
+// This is a simple string check to avoid importing the gitea package
+// (which would create a circular dependency).
+func isNotFoundError(err error) bool {
+	if err == nil {
+		return false
+	}
+	errStr := err.Error()
+	return strings.Contains(errStr, "HTTP 404")
+}

review/remote_persona_test.go

@@ -0,0 +1,394 @@
+package review
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+// mockFetcher implements PersonaFetcher for testing.
+type mockFetcher struct {
+	contents     map[string][]ContentEntry // path -> entries
+	files        map[string]string         // path -> content
+	listErr      error                     // error to return from ListContents
+	getFileErr   map[string]error          // path -> error for GetFileContent
+	listNotFound bool                      // return 404-style error
+}
+
+func newMockFetcher() *mockFetcher {
+	return &mockFetcher{
+		contents:   make(map[string][]ContentEntry),
+		files:      make(map[string]string),
+		getFileErr: make(map[string]error),
+	}
+}
+
+func (m *mockFetcher) ListContents(ctx context.Context, owner, repo, path string) ([]ContentEntry, error) {
+	if m.listNotFound {
+		return nil, errors.New("HTTP 404: not found")
+	}
+	if m.listErr != nil {
+		return nil, m.listErr
+	}
+	entries, ok := m.contents[path]
+	if !ok {
+		return nil, errors.New("HTTP 404: not found")
+	}
+	return entries, nil
+}
+
+func (m *mockFetcher) GetFileContent(ctx context.Context, owner, repo, filepath string) (string, error) {
+	if err, ok := m.getFileErr[filepath]; ok {
+		return "", err
+	}
+	content, ok := m.files[filepath]
+	if !ok {
+		return "", errors.New("HTTP 404: file not found")
+	}
+	return content, nil
+}
+
+func TestLoadRemotePersonas_NoDirectory(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.listNotFound = true
+
+	result, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err != nil {
+		t.Fatalf("expected no error for missing directory, got: %v", err)
+	}
+	if len(result) != 0 {
+		t.Errorf("expected empty map, got %d personas", len(result))
+	}
+}
+
+func TestLoadRemotePersonas_EmptyDirectory(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.contents[DefaultPersonasPath] = []ContentEntry{}
+
+	result, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(result) != 0 {
+		t.Errorf("expected empty map, got %d personas", len(result))
+	}
+}
+
+func TestLoadRemotePersonas_SinglePersona(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.contents[DefaultPersonasPath] = []ContentEntry{
+		{Name: "trading.yaml", Path: ".review-bot/personas/trading.yaml", Type: "file"},
+	}
+	fetcher.files[".review-bot/personas/trading.yaml"] = `
+name: trading
+display_name: Trading Expert
+identity: You are a trading systems expert.
+focus:
+  - order execution
+  - market data
+`
+
+	result, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(result) != 1 {
+		t.Fatalf("expected 1 persona, got %d", len(result))
+	}
+	if result["trading"] == nil {
+		t.Fatal("expected 'trading' persona")
+	}
+	if result["trading"].DisplayName != "Trading Expert" {
+		t.Errorf("expected display name 'Trading Expert', got %q", result["trading"].DisplayName)
+	}
+}
+
+func TestLoadRemotePersonas_MultiplePersonas(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.contents[DefaultPersonasPath] = []ContentEntry{
+		{Name: "one.yaml", Path: ".review-bot/personas/one.yaml", Type: "file"},
+		{Name: "two.yml", Path: ".review-bot/personas/two.yml", Type: "file"},
+	}
+	fetcher.files[".review-bot/personas/one.yaml"] = `
+name: one
+identity: First persona.
+`
+	fetcher.files[".review-bot/personas/two.yml"] = `
+name: two
+identity: Second persona.
+`
+
+	result, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(result) != 2 {
+		t.Fatalf("expected 2 personas, got %d", len(result))
+	}
+	if result["one"] == nil || result["two"] == nil {
+		t.Error("expected both personas to be loaded")
+	}
+}
+
+func TestLoadRemotePersonas_SkipsNonYAML(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.contents[DefaultPersonasPath] = []ContentEntry{
+		{Name: "valid.yaml", Path: ".review-bot/personas/valid.yaml", Type: "file"},
+		{Name: "readme.md", Path: ".review-bot/personas/readme.md", Type: "file"},
+		{Name: "config.json", Path: ".review-bot/personas/config.json", Type: "file"},
+	}
+	fetcher.files[".review-bot/personas/valid.yaml"] = `
+name: valid
+identity: Valid persona.
+`
+
+	result, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(result) != 1 {
+		t.Fatalf("expected 1 persona (skipping non-YAML), got %d", len(result))
+	}
+}
+
+func TestLoadRemotePersonas_SkipsDirectories(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.contents[DefaultPersonasPath] = []ContentEntry{
+		{Name: "valid.yaml", Path: ".review-bot/personas/valid.yaml", Type: "file"},
+		{Name: "subdir", Path: ".review-bot/personas/subdir", Type: "dir"},
+	}
+	fetcher.files[".review-bot/personas/valid.yaml"] = `
+name: valid
+identity: Valid persona.
+`
+
+	result, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(result) != 1 {
+		t.Fatalf("expected 1 persona (skipping dir), got %d", len(result))
+	}
+}
+
+func TestLoadRemotePersonas_SkipsInvalidYAML(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.contents[DefaultPersonasPath] = []ContentEntry{
+		{Name: "valid.yaml", Path: ".review-bot/personas/valid.yaml", Type: "file"},
+		{Name: "invalid.yaml", Path: ".review-bot/personas/invalid.yaml", Type: "file"},
+	}
+	fetcher.files[".review-bot/personas/valid.yaml"] = `
+name: valid
+identity: Valid persona.
+`
+	fetcher.files[".review-bot/personas/invalid.yaml"] = `
+this is not valid yaml: [unclosed bracket
+`
+
+	result, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(result) != 1 {
+		t.Fatalf("expected 1 persona (skipping invalid), got %d", len(result))
+	}
+	if result["valid"] == nil {
+		t.Error("expected valid persona to be loaded")
+	}
+}
+
+func TestLoadRemotePersonas_SkipsOversizedFiles(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.contents[DefaultPersonasPath] = []ContentEntry{
+		{Name: "huge.yaml", Path: ".review-bot/personas/huge.yaml", Type: "file"},
+	}
+	// Create content larger than MaxPersonaFileSize (64KB)
+	fetcher.files[".review-bot/personas/huge.yaml"] = `
+name: huge
+identity: ` + string(make([]byte, MaxPersonaFileSize+1000))
+
+	result, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(result) != 0 {
+		t.Errorf("expected 0 personas (oversized file skipped), got %d", len(result))
+	}
+}
+
+func TestLoadRemotePersonas_SkipsFetchErrors(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.contents[DefaultPersonasPath] = []ContentEntry{
+		{Name: "valid.yaml", Path: ".review-bot/personas/valid.yaml", Type: "file"},
+		{Name: "error.yaml", Path: ".review-bot/personas/error.yaml", Type: "file"},
+	}
+	fetcher.files[".review-bot/personas/valid.yaml"] = `
+name: valid
+identity: Valid persona.
+`
+	fetcher.getFileErr[".review-bot/personas/error.yaml"] = errors.New("network error")
+
+	result, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(result) != 1 {
+		t.Fatalf("expected 1 persona (skipping error), got %d", len(result))
+	}
+}
+
+func TestLoadRemotePersonas_ListContentsError(t *testing.T) {
+	fetcher := newMockFetcher()
+	fetcher.listErr = errors.New("server error")
+
+	_, err := LoadRemotePersonas(context.Background(), fetcher, "owner", "repo")
+	if err == nil {
+		t.Fatal("expected error for list contents failure")
+	}
+}
+
+func TestLoadRemotePersonas_ContextCancellation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // Cancel immediately
+
+	fetcher := newMockFetcher()
+	fetcher.contents[DefaultPersonasPath] = []ContentEntry{
+		{Name: "one.yaml", Path: ".review-bot/personas/one.yaml", Type: "file"},
+	}
+	fetcher.files[".review-bot/personas/one.yaml"] = `
+name: one
+identity: One.
+`
+
+	_, err := LoadRemotePersonas(ctx, fetcher, "owner", "repo")
+	if err == nil {
+		t.Fatal("expected context cancellation error")
+	}
+}
+
+func TestMergePersonas_NoOverlap(t *testing.T) {
+	remote := map[string]*Persona{
+		"trading": {Name: "trading", Identity: "Trading expert."},
+	}
+	builtin := map[string]*Persona{
+		"security": {Name: "security", Identity: "Security expert."},
+	}
+
+	merged, names := MergePersonas(remote, builtin)
+
+	if len(merged) != 2 {
+		t.Fatalf("expected 2 personas, got %d", len(merged))
+	}
+	if len(names) != 2 {
+		t.Fatalf("expected 2 names, got %d", len(names))
+	}
+	// Names should be sorted
+	if names[0] != "security" || names[1] != "trading" {
+		t.Errorf("expected sorted names [security, trading], got %v", names)
+	}
+}
+
+func TestMergePersonas_RemoteOverridesBuiltin(t *testing.T) {
+	remote := map[string]*Persona{
+		"security": {Name: "security", Identity: "Custom security expert."},
+	}
+	builtin := map[string]*Persona{
+		"security": {Name: "security", Identity: "Default security expert."},
+	}
+
+	merged, _ := MergePersonas(remote, builtin)
+
+	if merged["security"].Identity != "Custom security expert." {
+		t.Errorf("expected remote to override builtin, got identity: %q", merged["security"].Identity)
+	}
+}
+
+func TestMergePersonas_EmptyRemote(t *testing.T) {
+	remote := map[string]*Persona{}
+	builtin := map[string]*Persona{
+		"security": {Name: "security", Identity: "Security."},
+	}
+
+	merged, names := MergePersonas(remote, builtin)
+
+	if len(merged) != 1 {
+		t.Fatalf("expected 1 persona, got %d", len(merged))
+	}
+	if names[0] != "security" {
+		t.Errorf("expected 'security', got %q", names[0])
+	}
+}
+
+func TestMergePersonas_EmptyBuiltin(t *testing.T) {
+	remote := map[string]*Persona{
+		"trading": {Name: "trading", Identity: "Trading."},
+	}
+	builtin := map[string]*Persona{}
+
+	merged, names := MergePersonas(remote, builtin)
+
+	if len(merged) != 1 {
+		t.Fatalf("expected 1 persona, got %d", len(merged))
+	}
+	if names[0] != "trading" {
+		t.Errorf("expected 'trading', got %q", names[0])
+	}
+}
+
+func TestLoadAllBuiltinPersonas(t *testing.T) {
+	personas := LoadAllBuiltinPersonas()
+
+	// Should load at least the known built-in personas
+	expected := []string{"architect", "docs", "security"}
+	for _, name := range expected {
+		if personas[name] == nil {
+			t.Errorf("expected built-in persona %q to be loaded", name)
+		}
+	}
+}
+
+func TestIsYAMLFile(t *testing.T) {
+	tests := []struct {
+		name     string
+		expected bool
+	}{
+		{"test.yaml", true},
+		{"test.yml", true},
+		{"test.YAML", true},
+		{"test.YML", true},
+		{"test.json", false},
+		{"test.md", false},
+		{"yaml", false},
+		{"", false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isYAMLFile(tc.name); got != tc.expected {
+				t.Errorf("isYAMLFile(%q) = %v, want %v", tc.name, got, tc.expected)
+			}
+		})
+	}
+}
+
+func TestIsNotFoundError(t *testing.T) {
+	tests := []struct {
+		name     string
+		err      error
+		expected bool
+	}{
+		{"nil error", nil, false},
+		{"HTTP 404", errors.New("HTTP 404: not found"), true},
+		{"not found text", errors.New("path not found"), false},
+		{"server error", errors.New("server error"), false},
+		{"HTTP 500", errors.New("HTTP 500: internal error"), false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isNotFoundError(tc.err); got != tc.expected {
+				t.Errorf("isNotFoundError(%v) = %v, want %v", tc.err, got, tc.expected)
+			}
+		})
+	}
+}

review/repo_persona.go

@@ -1,150 +0,0 @@
-package review
-
-import (
-	"context"
-	"log/slog"
-	"strings"
-)
-
-// RepoPersonaPath is the directory path where repo-specific personas are stored.
-const RepoPersonaPath = ".review-bot/personas"
-
-// GiteaClient defines the subset of gitea.Client methods needed for loading repo personas.
-// This interface allows for easier testing and decouples the review package from gitea.
-type GiteaClient interface {
-	ListContents(ctx context.Context, owner, repo, path string) ([]ContentEntry, error)
-	GetFileContent(ctx context.Context, owner, repo, filepath string) (string, error)
-}
-
-// ContentEntry represents a file or directory entry from the contents API.
-// This mirrors gitea.ContentEntry to avoid import cycles.
-type ContentEntry struct {
-	Name string `json:"name"`
-	Path string `json:"path"`
-	Type string `json:"type"` // "file" or "dir"
-}
-
-// LoadRepoPersonas fetches personas from a repository's .review-bot/personas/ directory.
-// Returns an empty map (not nil) if the directory doesn't exist or is empty.
-// Individual parse failures are logged and skipped; the remaining personas are still returned.
-// Auth errors and other non-404 errors are propagated.
-// Files exceeding MaxPersonaFileSize are rejected to prevent resource exhaustion.
-func LoadRepoPersonas(ctx context.Context, client GiteaClient, owner, repo string) (map[string]*Persona, error) {
-	result := make(map[string]*Persona)
-
-	entries, err := client.ListContents(ctx, owner, repo, RepoPersonaPath)
-	if err != nil {
-		// Check if this is a 404 (directory doesn't exist) - expected case
-		if isNotFoundError(err) {
-			slog.Debug("no repo personas directory found", "repo", owner+"/"+repo)
-			return result, nil
-		}
-		// Other errors (auth, server) should propagate
-		return nil, err
-	}
-
-	if len(entries) == 0 {
-		slog.Debug("repo personas directory is empty", "repo", owner+"/"+repo)
-		return result, nil
-	}
-
-	for _, entry := range entries {
-		if entry.Type != "file" {
-			continue
-		}
-		// Only process YAML files
-		if !isYAMLFile(entry.Name) {
-			continue
-		}
-
-		content, err := client.GetFileContent(ctx, owner, repo, entry.Path)
-		if err != nil {
-			slog.Warn("could not fetch repo persona file",
-				"file", entry.Path,
-				"repo", owner+"/"+repo,
-				"error", err)
-			continue
-		}
-
-		// Enforce size limit before parsing to prevent resource exhaustion
-		if len(content) > MaxPersonaFileSize {
-			slog.Warn("repo persona file exceeds maximum size",
-				"file", entry.Path,
-				"repo", owner+"/"+repo,
-				"size", len(content),
-				"max", MaxPersonaFileSize)
-			continue
-		}
-
-		persona, err := ParsePersonaBytes([]byte(content), entry.Path)
-		if err != nil {
-			slog.Warn("could not parse repo persona file",
-				"file", entry.Path,
-				"repo", owner+"/"+repo,
-				"error", err)
-			continue
-		}
-
-		result[persona.Name] = persona
-		slog.Debug("loaded repo persona",
-			"name", persona.Name,
-			"file", entry.Path,
-			"repo", owner+"/"+repo)
-	}
-
-	return result, nil
-}
-
-// MergePersonas combines built-in personas with repo personas.
-// Repo personas take precedence on name collision.
-// Returns a new map; inputs are not modified.
-func MergePersonas(builtin, repo map[string]*Persona) map[string]*Persona {
-	result := make(map[string]*Persona, len(builtin)+len(repo))
-
-	// Copy built-in personas first
-	for name, p := range builtin {
-		result[name] = p
-	}
-
-	// Overlay repo personas (override on collision)
-	for name, p := range repo {
-		if _, exists := result[name]; exists {
-			slog.Debug("repo persona overrides built-in", "name", name)
-		}
-		result[name] = p
-	}
-
-	return result
-}
-
-// GetBuiltinPersonasMap returns all built-in personas as a map keyed by name.
-// Returns an empty map (not nil) if loading fails.
-func GetBuiltinPersonasMap() map[string]*Persona {
-	result := make(map[string]*Persona)
-	for _, name := range ListBuiltinPersonas() {
-		p, err := LoadBuiltinPersona(name)
-		if err != nil {
-			slog.Warn("could not load built-in persona", "name", name, "error", err)
-			continue
-		}
-		result[name] = p
-	}
-	return result
-}
-
-// isYAMLFile checks if a filename has a YAML extension.
-func isYAMLFile(name string) bool {
-	lower := strings.ToLower(name)
-	return strings.HasSuffix(lower, ".yaml") || strings.HasSuffix(lower, ".yml")
-}
-
-// isNotFoundError checks if an error represents a 404 response.
-// This uses a specific "HTTP 404" substring match rather than a generic "not found"
-// match to avoid masking authentication failures or transport errors that might
-// contain "not found" in their message.
-func isNotFoundError(err error) bool {
-	if err == nil {
-		return false
-	}
-	return strings.Contains(err.Error(), "HTTP 404")
-}

review/repo_persona_test.go

@@ -1,443 +0,0 @@
-package review
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-)
-
-func TestParsePersonaBytes(t *testing.T) {
-	tests := []struct {
-		name       string
-		data       string
-		source     string
-		wantName   string
-		wantErr    string
-	}{
-		{
-			name: "valid yaml",
-			data: `name: test
-identity: test identity
-focus:
-  - testing
-`,
-			source:   "test.yaml",
-			wantName: "test",
-		},
-		{
-			name:    "missing name",
-			data:    "identity: test\n",
-			source:  "test.yaml",
-			wantErr: "name is required",
-		},
-		{
-			name:    "invalid yaml",
-			data:    "not: valid:\n  yaml: [broken",
-			source:  "test.yaml",
-			wantErr: "parse",
-		},
-		{
-			name: "json format by extension",
-			data: `{"name": "jsontest", "identity": "json identity"}`,
-			source:   "test.json",
-			wantName: "jsontest",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			p, err := ParsePersonaBytes([]byte(tt.data), tt.source)
-			if tt.wantErr != "" {
-				if err == nil {
-					t.Fatalf("expected error containing %q, got nil", tt.wantErr)
-				}
-				if !strings.Contains(err.Error(), tt.wantErr) {
-					t.Errorf("error = %q, want containing %q", err.Error(), tt.wantErr)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if p.Name != tt.wantName {
-				t.Errorf("Name = %q, want %q", p.Name, tt.wantName)
-			}
-		})
-	}
-}
-
-// mockGiteaClient implements GiteaClient for testing.
-type mockGiteaClient struct {
-	contents map[string][]ContentEntry // path -> entries
-	files    map[string]string         // path -> content
-	listErr  error
-	fileErr  map[string]error // path -> error
-}
-
-func (m *mockGiteaClient) ListContents(ctx context.Context, owner, repo, path string) ([]ContentEntry, error) {
-	if m.listErr != nil {
-		return nil, m.listErr
-	}
-	entries, ok := m.contents[path]
-	if !ok {
-		return nil, errors.New("list contents .review-bot/personas: HTTP 404: not found")
-	}
-	return entries, nil
-}
-
-func (m *mockGiteaClient) GetFileContent(ctx context.Context, owner, repo, filepath string) (string, error) {
-	if m.fileErr != nil {
-		if err, ok := m.fileErr[filepath]; ok {
-			return "", err
-		}
-	}
-	content, ok := m.files[filepath]
-	if !ok {
-		return "", errors.New("HTTP 404: file not found")
-	}
-	return content, nil
-}
-
-func TestLoadRepoPersonas(t *testing.T) {
-	ctx := context.Background()
-
-	t.Run("directory not found returns empty map", func(t *testing.T) {
-		client := &mockGiteaClient{} // No contents configured -> 404
-		personas, err := LoadRepoPersonas(ctx, client, "owner", "repo")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if personas == nil {
-			t.Error("expected empty map, got nil")
-		}
-		if len(personas) != 0 {
-			t.Errorf("expected 0 personas, got %d", len(personas))
-		}
-	})
-
-	t.Run("empty directory returns empty map", func(t *testing.T) {
-		client := &mockGiteaClient{
-			contents: map[string][]ContentEntry{
-				RepoPersonaPath: {},
-			},
-		}
-		personas, err := LoadRepoPersonas(ctx, client, "owner", "repo")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if len(personas) != 0 {
-			t.Errorf("expected 0 personas, got %d", len(personas))
-		}
-	})
-
-	t.Run("loads valid personas", func(t *testing.T) {
-		client := &mockGiteaClient{
-			contents: map[string][]ContentEntry{
-				RepoPersonaPath: {
-					{Name: "trading.yaml", Path: ".review-bot/personas/trading.yaml", Type: "file"},
-					{Name: "crypto.yaml", Path: ".review-bot/personas/crypto.yaml", Type: "file"},
-				},
-			},
-			files: map[string]string{
-				".review-bot/personas/trading.yaml": `name: trading
-display_name: Trading Expert
-identity: You are a trading expert.
-focus:
-  - order handling
-  - risk management
-`,
-				".review-bot/personas/crypto.yaml": `name: crypto
-display_name: Crypto Expert
-identity: You are a cryptography expert.
-focus:
-  - key management
-  - encryption
-`,
-			},
-		}
-		personas, err := LoadRepoPersonas(ctx, client, "owner", "repo")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if len(personas) != 2 {
-			t.Fatalf("expected 2 personas, got %d", len(personas))
-		}
-		if personas["trading"] == nil {
-			t.Error("expected trading persona")
-		}
-		if personas["crypto"] == nil {
-			t.Error("expected crypto persona")
-		}
-		if personas["trading"].DisplayName != "Trading Expert" {
-			t.Errorf("trading display name = %q, want %q", personas["trading"].DisplayName, "Trading Expert")
-		}
-	})
-
-	t.Run("skips invalid persona files", func(t *testing.T) {
-		client := &mockGiteaClient{
-			contents: map[string][]ContentEntry{
-				RepoPersonaPath: {
-					{Name: "valid.yaml", Path: ".review-bot/personas/valid.yaml", Type: "file"},
-					{Name: "invalid.yaml", Path: ".review-bot/personas/invalid.yaml", Type: "file"},
-				},
-			},
-			files: map[string]string{
-				".review-bot/personas/valid.yaml": `name: valid
-identity: Valid persona
-`,
-				".review-bot/personas/invalid.yaml": "not valid yaml: [broken",
-			},
-		}
-		personas, err := LoadRepoPersonas(ctx, client, "owner", "repo")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		// Should have the valid one, skip the invalid
-		if len(personas) != 1 {
-			t.Fatalf("expected 1 persona (skipped invalid), got %d", len(personas))
-		}
-		if personas["valid"] == nil {
-			t.Error("expected valid persona")
-		}
-	})
-
-	t.Run("skips non-yaml files", func(t *testing.T) {
-		client := &mockGiteaClient{
-			contents: map[string][]ContentEntry{
-				RepoPersonaPath: {
-					{Name: "persona.yaml", Path: ".review-bot/personas/persona.yaml", Type: "file"},
-					{Name: "README.md", Path: ".review-bot/personas/README.md", Type: "file"},
-					{Name: "notes.txt", Path: ".review-bot/personas/notes.txt", Type: "file"},
-				},
-			},
-			files: map[string]string{
-				".review-bot/personas/persona.yaml": `name: test
-identity: Test persona
-`,
-				".review-bot/personas/README.md": "# Personas\n\nPut your personas here.",
-			},
-		}
-		personas, err := LoadRepoPersonas(ctx, client, "owner", "repo")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if len(personas) != 1 {
-			t.Fatalf("expected 1 persona (yaml only), got %d", len(personas))
-		}
-	})
-
-	t.Run("skips subdirectories", func(t *testing.T) {
-		client := &mockGiteaClient{
-			contents: map[string][]ContentEntry{
-				RepoPersonaPath: {
-					{Name: "persona.yaml", Path: ".review-bot/personas/persona.yaml", Type: "file"},
-					{Name: "subdir", Path: ".review-bot/personas/subdir", Type: "dir"},
-				},
-			},
-			files: map[string]string{
-				".review-bot/personas/persona.yaml": `name: test
-identity: Test persona
-`,
-			},
-		}
-		personas, err := LoadRepoPersonas(ctx, client, "owner", "repo")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if len(personas) != 1 {
-			t.Fatalf("expected 1 persona (files only), got %d", len(personas))
-		}
-	})
-
-	t.Run("propagates auth errors", func(t *testing.T) {
-		client := &mockGiteaClient{
-			listErr: errors.New("HTTP 401: unauthorized"),
-		}
-		_, err := LoadRepoPersonas(ctx, client, "owner", "repo")
-		if err == nil {
-			t.Fatal("expected error for auth failure")
-		}
-		if !strings.Contains(err.Error(), "401") {
-			t.Errorf("error = %q, want containing '401'", err.Error())
-		}
-	})
-
-	t.Run("skips files that fail to fetch", func(t *testing.T) {
-		client := &mockGiteaClient{
-			contents: map[string][]ContentEntry{
-				RepoPersonaPath: {
-					{Name: "good.yaml", Path: ".review-bot/personas/good.yaml", Type: "file"},
-					{Name: "bad.yaml", Path: ".review-bot/personas/bad.yaml", Type: "file"},
-				},
-			},
-			files: map[string]string{
-				".review-bot/personas/good.yaml": `name: good
-identity: Good persona
-`,
-			},
-			fileErr: map[string]error{
-				".review-bot/personas/bad.yaml": errors.New("HTTP 500: internal server error"),
-			},
-		}
-		personas, err := LoadRepoPersonas(ctx, client, "owner", "repo")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if len(personas) != 1 {
-			t.Fatalf("expected 1 persona (skipped failed fetch), got %d", len(personas))
-		}
-	})
-
-	t.Run("skips oversized files", func(t *testing.T) {
-		// Create a content string that exceeds MaxPersonaFileSize (64KB)
-		oversizedContent := strings.Repeat("a", MaxPersonaFileSize+1)
-		client := &mockGiteaClient{
-			contents: map[string][]ContentEntry{
-				RepoPersonaPath: {
-					{Name: "normal.yaml", Path: ".review-bot/personas/normal.yaml", Type: "file"},
-					{Name: "huge.yaml", Path: ".review-bot/personas/huge.yaml", Type: "file"},
-				},
-			},
-			files: map[string]string{
-				".review-bot/personas/normal.yaml": `name: normal
-identity: Normal sized persona
-`,
-				".review-bot/personas/huge.yaml": oversizedContent,
-			},
-		}
-		personas, err := LoadRepoPersonas(ctx, client, "owner", "repo")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		// Should have the normal one, skip the oversized
-		if len(personas) != 1 {
-			t.Fatalf("expected 1 persona (skipped oversized), got %d", len(personas))
-		}
-		if personas["normal"] == nil {
-			t.Error("expected normal persona")
-		}
-	})
-}
-
-func TestMergePersonas(t *testing.T) {
-	builtin := map[string]*Persona{
-		"security": {Name: "security", Identity: "Built-in security"},
-		"docs":     {Name: "docs", Identity: "Built-in docs"},
-	}
-	repo := map[string]*Persona{
-		"security": {Name: "security", Identity: "Repo security override"},
-		"trading":  {Name: "trading", Identity: "Repo trading"},
-	}
-
-	merged := MergePersonas(builtin, repo)
-
-	t.Run("repo overrides builtin on collision", func(t *testing.T) {
-		if merged["security"].Identity != "Repo security override" {
-			t.Errorf("security identity = %q, want repo override", merged["security"].Identity)
-		}
-	})
-
-	t.Run("builtin preserved when no collision", func(t *testing.T) {
-		if merged["docs"].Identity != "Built-in docs" {
-			t.Errorf("docs identity = %q, want built-in", merged["docs"].Identity)
-		}
-	})
-
-	t.Run("repo-only persona added", func(t *testing.T) {
-		if merged["trading"] == nil {
-			t.Error("expected trading persona from repo")
-		}
-		if merged["trading"].Identity != "Repo trading" {
-			t.Errorf("trading identity = %q, want repo", merged["trading"].Identity)
-		}
-	})
-
-	t.Run("original maps not modified", func(t *testing.T) {
-		if builtin["trading"] != nil {
-			t.Error("builtin map was modified")
-		}
-		if len(repo) != 2 {
-			t.Error("repo map was modified")
-		}
-	})
-}
-
-func TestGetBuiltinPersonasMap(t *testing.T) {
-	personas := GetBuiltinPersonasMap()
-
-	if len(personas) == 0 {
-		t.Fatal("expected at least one built-in persona")
-	}
-
-	// Verify expected personas exist
-	expected := []string{"security", "architect", "docs"}
-	for _, name := range expected {
-		if personas[name] == nil {
-			t.Errorf("expected built-in persona %q", name)
-		}
-	}
-
-	// Verify personas are valid
-	for name, p := range personas {
-		if p.Name != name {
-			t.Errorf("persona %q has mismatched name %q", name, p.Name)
-		}
-		if p.Identity == "" {
-			t.Errorf("persona %q has empty identity", name)
-		}
-	}
-}
-
-func TestIsYAMLFile(t *testing.T) {
-	tests := []struct {
-		name string
-		want bool
-	}{
-		{"test.yaml", true},
-		{"test.yml", true},
-		{"test.YAML", true},
-		{"test.YML", true},
-		{"test.json", false},
-		{"test.md", false},
-		{"test.txt", false},
-		{"yaml", false},
-		{"yaml.md", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := isYAMLFile(tt.name); got != tt.want {
-				t.Errorf("isYAMLFile(%q) = %v, want %v", tt.name, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestIsNotFoundError(t *testing.T) {
-	tests := []struct {
-		err  error
-		want bool
-	}{
-		{nil, false},
-		{errors.New("HTTP 404: not found"), true},
-		{errors.New("HTTP 404"), true},
-		// Intentionally false: generic "not found" could mask auth/transport errors.
-		// Only explicit HTTP 404 responses should be treated as "directory doesn't exist".
-		{errors.New("something not found"), false},
-		{errors.New("HTTP 401: unauthorized"), false},
-		{errors.New("connection refused"), false},
-	}
-
-	for _, tt := range tests {
-		name := "nil"
-		if tt.err != nil {
-			name = tt.err.Error()
-		}
-		t.Run(name, func(t *testing.T) {
-			if got := isNotFoundError(tt.err); got != tt.want {
-				t.Errorf("isNotFoundError(%v) = %v, want %v", tt.err, got, tt.want)
-			}
-		})
-	}
-}