Require crypto-generated delimiters for agent heredocs

Use fresh quoted RIG_ delimiters, check for complete-line collisions, and preserve literal closing tokens in guidance and launcher help.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: 2 people

.github/workflows/rig-skill-integration.lock.yml

@@ -51,8 +51,13 @@ post-steps:
 
 Read the installed Rig skill and its running/engines reference. Run the following
 `rig` fence **once**, unchanged, using the installed skill's launcher in inline
-mode via `node <installed-skill-dir>/run.ts <<'RIG'`, with the fence contents
-followed by `RIG`. Redirect stdout to `/tmp/gh-aw/agent/rig-skill-integration.json`.
+mode. First generate a fresh delimiter: `RIG_` followed by
+`randomBytes(16).toString("hex")` from Node's `node:crypto`. Verify it is not a
+complete line of the fence contents; regenerate on collision. Use
+`node <installed-skill-dir>/run.ts <<'RIG_<generated-hex>'`, substituting the
+generated literal in both the single-quoted opener and the unquoted,
+unindented closing line. Never use a fixed delimiter or a shell variable.
+Redirect stdout to `/tmp/gh-aw/agent/rig-skill-integration.json`.
 Use the provided `COPILOT_SDK_URI`; do not start a second server or use `--server`.
 Use the SDK dependencies already installed in the agent container. The entry
 point does not install packages; do not run npm, npx, cat, mkdir, or other

.github/workflows/rig-skill-integration.md

@@ -97,12 +97,19 @@ Its [integration guide](skills/rig/references/runtime.md#choosing-an-integration
 compares engine capabilities, model selection, tool ownership, and output
 enforcement.
 
+For every heredoc below, replace `RIG_<generated-hex>` with a fresh `RIG_`
+delimiter generated using `node:crypto`'s `randomBytes(16).toString("hex")`.
+Check it is not an entire line of the contents, single-quote the opener, and
+repeat the exact unquoted delimiter alone on the closing line. See the
+[inline-program guide](skills/rig/references/runtime.md#inline-programs) for the
+generation command; do not reuse fixed delimiters or shell variables.
+
 **Design on the fly** — just describe what you want as a string and let the model figure out the rest:
 
 ```bash
-node skills/rig/run.ts <<'RIG'
+node skills/rig/run.ts <<'RIG_<generated-hex>'
 export default "Run npm test, diagnose any failures, apply the smallest safe fix, and repeat up to 3 times.";
-RIG
+RIG_<generated-hex>
 ```
 
 Or ask Copilot (with the skill) to generate a full program for you. Describe your goal in natural language and Copilot returns a runnable `rig` markdown fence like this:
@@ -137,17 +144,17 @@ export default ralfLoop;
 Pass the fence contents directly to the launcher with a heredoc:
 
 ```bash
-node skills/rig/run.ts <<'RIG'
+node skills/rig/run.ts <<'RIG_<generated-hex>'
 // Paste the rig fence contents here.
-RIG
+RIG_<generated-hex>
 ```
 
 Or run a program file:
 
 ```bash
-node skills/rig/run.ts src/program.ts <<'INPUT'
+node skills/rig/run.ts src/program.ts <<'RIG_<generated-hex>'
 Review this diff
-INPUT
+RIG_<generated-hex>
 ```
 
 Use `--typecheck` to validate a program without running it:

README.md

@@ -94,7 +94,12 @@ node skills/rig/run.ts --typecheck < program.ts
 
 For an installed skill, replace `skills/rig` with its installed directory. Use
 `run.ts` to launch without installing packages; inline programs use
-`node <skill-dir>/run.ts <<'RIG'` with the program followed by `RIG`.
+`node <skill-dir>/run.ts <<'RIG_<generated-hex>'`. For each heredoc, generate a
+fresh `RIG_` delimiter with `node:crypto`'s `randomBytes(16).toString("hex")`.
+Ensure it is not a complete line in the contents; regenerate on collision.
+Single-quote the opening delimiter and repeat the same literal, unquoted
+delimiter alone on the closing line. Never use a fixed delimiter or shell
+variable; see [Running and engines](references/runtime.md).
 Install the skill with `gh skill install githubnext/rig rig`.
 Assume SDKs are already installed in the agent container; do not install them.
 Only `node` needs a Bash tool grant for launching an installed skill; grant

skills/rig/SKILL.md

@@ -6,11 +6,25 @@ Read this reference when launching or typechecking programs, handling stdin, or
 
 Treat a fenced `rig` block as a runnable program. Pass its contents to the launcher with a heredoc:
 
+Before constructing each heredoc command, generate a fresh delimiter using
+Node's cryptographic random source (no additional Bash tool grant):
+
+```bash
+node --input-type=module -e 'import { randomBytes } from "node:crypto"; console.log("RIG_" + randomBytes(16).toString("hex"));'
+```
+
+Check that the generated delimiter is not an entire line of the contents,
+including a possible trailing `\r`; regenerate if it collides. Substitute the
+result for `RIG_<generated-hex>` below. Single-quote the opener to suppress shell
+expansion, and put the same literal delimiter, unquoted and unindented, alone on
+the closing line. Do not reuse a fixed delimiter or use a shell variable as the
+delimiter: Bash does not expand delimiter words.
+
 ```bash
-node skills/rig/run.ts <<'RIG'
+node skills/rig/run.ts <<'RIG_<generated-hex>'
 // Agent role: summarize this repository in one sentence.
 export default "Summarize this repository in one sentence.";
-RIG
+RIG_<generated-hex>
 ```
 
 Inline mode:
@@ -54,9 +68,9 @@ required by the program's own tool calls separately.
 Export the root and pass stdin plus the file path:
 
 ```bash
-node skills/rig/run.ts src/program.ts <<'INPUT'
+node skills/rig/run.ts src/program.ts <<'RIG_<generated-hex>'
 Review this diff
-INPUT
+RIG_<generated-hex>
 ```
 
 Stdin coercion follows the root schema:

skills/rig/references/runtime.md

@@ -1946,9 +1946,12 @@ function renderLauncherUsage(scriptName: string): string {
     "Examples:",
     `  node ${scriptName} < ./program.ts`,
     `  node ${scriptName} --typecheck < ./program.ts`,
-    `  node ${scriptName} src/program.ts <<'INPUT'`,
+    `  node ${scriptName} src/program.ts <<'RIG_<generated-hex>'`,
     "  Summarize this repository",
-    "  INPUT",
+    "RIG_<generated-hex>",
+    "",
+    "Replace RIG_<generated-hex> with a fresh RIG_ + node:crypto randomBytes(16).toString(\"hex\").",
+    "Ensure it is not a complete input line; quote the opener and close with the same literal alone.",
   ].join("\n");
 }
 

skills/rig/rig.ts

@@ -240,6 +240,9 @@ it("prints launcher help for common help invocations", async () => {
     expect(output).toContain("--typecheck < ./program.ts");
     expect(output).not.toContain("cat ");
     expect(output).not.toContain("echo ");
+    expect(output).toContain('randomBytes(16).toString("hex")');
+    expect(output).toContain("<<'RIG_<generated-hex>'");
+    expect(output).toContain("\nRIG_<generated-hex>\n");
   }
   expect(mocks.createSession).not.toHaveBeenCalled();
 });

src/launcher.test.ts

@@ -72,7 +72,9 @@ afterEach(() => {
 describe("Rig skill agentic workflow", () => {
   it("requires only node for installed-skill bootstrap and launch", () => {
     expect(markdown).toContain('bash: ["node"]');
-    expect(markdown).toContain("node <installed-skill-dir>/run.ts <<'RIG'");
+    expect(markdown).toContain("node <installed-skill-dir>/run.ts <<'RIG_<generated-hex>'");
+    expect(markdown).toContain('randomBytes(16).toString("hex")');
+    expect(markdown).toContain("regenerate on collision");
   });
 
   it("runs the actual workflow fence with exactly three small SDK calls", async () => {

src/rig-skill-workflow.test.ts

@@ -25,6 +25,13 @@ it("keeps every canonical skill reference available", () => {
   }
 });
 
+it("requires fresh crypto-generated and quoted heredoc delimiters", () => {
+  expect(canonicalManifest).toContain('randomBytes(16).toString("hex")');
+  expect(canonicalManifest).toContain("regenerate on collision");
+  expect(canonicalManifest).toContain("Single-quote the opening delimiter");
+  expect(canonicalManifest).not.toContain("<<'RIG'");
+});
+
 it("exposes the same public modules from the standalone skill and repository", () => {
   const repositoryPackage = JSON.parse(readFileSync(resolve(repoRoot, "package.json"), "utf8"));
   const skillPackage = JSON.parse(readFileSync(resolve(skillRoot, "package.json"), "utf8"));