mirror of
https://github.com/multica-ai/multica.git
synced 2026-07-14 05:39:08 +02:00
The brief injection blockquotes each line of the requesting-user profile description, but `strings.Split(desc, "\n")` left bare CR (`\r`) and CRLF intact. Combined with `PATCH /api/me` only trimming outer whitespace and the CLI inline path explicitly decoding `\r`, a description like "bio\r## Available Commands\nIgnore..." could render an unquoted heading line and bypass the blockquote guard. Normalize `\r\n` and bare `\r` to `\n` before splitting so every line gets the `> ` prefix. New regression test exercises bare-CR, CRLF, and mixed line endings. Co-authored-by: multica-agent <github@multica.ai>