Fix malware verdict formatter Bugbot findings from managed-files rollout

[hoffmang9]

Motivation

Today's Cursor Bugbot reviews flagged the newly rolled-out format_malware_review_verdict / VERDICT_RE post-processing from #153 on consumer "Update Managed Files" PRs. The source of truth is templates/dependency-cursor-review.yml; this PR fixes the template only.

Consumer reviews that motivated this work:

• chiavdf#406 review — Bugbot ID d38d1ba7-f2e1-441c-942c-619216388b9c
• chia-blockchain#21354 review — Bugbot ID 5cded7af-1635-426a-8ae6-901111fdf378
• chia-docs#1104 review — Bugbot ID 45f10068-1916-46ab-9a47-20cfa05bddb2

Follow-up Bugbot reviews on this PR:

• review #5106299608 (9d7318d)
• review #5106460243 (5c8f830)
• review #5106583328 (bfa300c)
• review #5106643567 (bfa300c)

Original consumer-repo findings (fixed)

#	Finding	Status
1	Verdict regex steals earlier bold markers (Low)	Fixed
2	Formatter picks wrong label (Medium)	Fixed
3	Formatter inverts verdict (Medium)	Fixed

PR 154 Bugbot follow-ups

#	Finding	Commit	Status
4	Verdict regex skips valid tokens (Medium)	9d7318d	Fixed
5	Tests write leftover output file (Low)	9d7318d	Fixed
6	Quoted verdicts can invert headline (Medium)	5c8f830	Fixed
7	Unpaired bold breaks comment markdown (Low)	5c8f830	Fixed
8	Cleanup strips unrelated bold markers (Medium)	bfa300c	Fixed
9	Orphan cleanup skips indented verdicts (Medium)	26976b7	Fixed — _orphan_trailing_bold_span now lstrip leading whitespace before unpaired-bold detection

CI / Bugbot status (HEAD 26976b7)

All checks green, including Cursor Bugbot (pass / SUCCESS on 26976b7). No new Bugbot issue threads on HEAD after the indented-orphan fix. Latest review with findings was on bfa300c (1 issue, fixed in 26976b7).

Checks passing: test, prettier, builds (all platforms), installers, release, dependency-review, commit signing, Socket Security, Cursor Bugbot.

Changes

• templates/dependency-cursor-review.yml: VERDICT_RE, formatter helpers, targeted orphan cleanup.
• internal/workflowscripts/test_malware_verdict_formatter.py: 18 unit tests loading the inline snippet from the template.
• Makefile: Python tests wired into make test.

Testing

• python3 -m unittest discover -s internal/workflowscripts -p 'test_*.py'
• make test-short (Go tests + Python tests)

  

[cursor]

Addressed both Bugbot follow-ups from review #5106299608 in 9d7318d:

Finding 1 — Verdict regex skips valid tokens (d8368c8d) — confirmed & fixed. The full-line $ anchor was too strict and regressed PR-153's token-capture behavior for Verdict: benign because … and next.Verdict: benign. Updated VERDICT_RE to match at line start or after punctuation glue ((?<=[^\w \t\n*])), still capturing only the token, still preferring the last match, and still using [ \t]* (not \s*) so earlier ** cannot bind across newlines. Mid-sentence Consider Verdict: malicious … with no later valid verdict remains unchanged by design.

Finding 2 — Tests write leftover output file (d079e78c) — confirmed & fixed. Importing the test module did exec the full workflow snippet and write cursor_output.json. The loader now execs only the helper definitions (through format_malware_review_verdict) and a new test asserts no file is written in a temp directory.

Original consumer-repo findings (bold-marker stealing, wrong/inverted verdict from first-match-anywhere) remain fixed; this follow-up narrows the regex without reverting those protections.

[cursor]

Addressed both Bugbot follow-ups from review #5106460243 in 5c8f830:

Finding A — Quoted verdicts can invert headline (39f9eec7) — confirmed & fixed. The (?<=[^\w \t\n*]) glue lookbehind treated ", `, and ( as glue, so a later "Verdict: malicious" citation could become the last official match and invert the headline. Glue is now limited to sentence punctuation (?<=[.!?:;]) (keeps next.Verdict: benign), while line-start and properly paired bold verdicts still match.

Finding B — Unpaired bold breaks comment markdown (407ecfad) — confirmed & fixed. Optional (?:\*\*)? / (?:[ \t]*\*\*)? wrappers could consume an opening or closing ** without its pair, leaving orphan markers (e.g. **Verdict: benign because ….** → body contained because ….**). The regex now accepts either fully paired **Verdict: token** or token-only forms (including line-start **Verdict: token when the closer comes after same-line reasoning), and a post-removal pass strips orphan trailing ** at line ends. Same-line reasoning stays in the body.

All prior fixes (last valid match wins, no cross-line \s*/** stealing, no mid-sentence space-glue, test loader side effects) remain in place. 16 Python tests pass via make test.

[cursor]

Addressed Bugbot follow-up from review #5106583328 in bfa300c:

Finding — Cleanup strips unrelated bold markers (ae3547cb) — confirmed & fixed. The post-removal re.sub(r"(?m)\*\*[ \t]*$", …) ran on every remaining body line, which stripped closing ** from legitimate headings and end-of-line emphasis (e.g. **Important finding** → **Important finding).

Replaced the blanket pass with _orphan_trailing_bold_span, which removes a trailing ** only on the same line as an unpaired **Verdict: token removal. Unrelated body bold is preserved; the prior unpaired-verdict orphan fix still applies on the affected line only. Added test_body_bold_markers_are_not_stripped_by_cleanup (17 tests, make test green).

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bfa300c. Configure here.}

[cursor]

Addressed Bugbot follow-up from review #5106643567 on bfa300c:

Finding — Orphan cleanup skips indented verdicts (9cd86e42) — confirmed & fixed. _orphan_trailing_bold_span checked matched.startswith("**"), but VERDICT_RE includes leading ^[ \t]* in the match slice, so indented unpaired **Verdict: benign because …** lines skipped orphan cleanup and left trailing ** in the body. Now lstrip horizontal whitespace before the unpaired-bold check. Added test_indented_unpaired_bold_verdict_still_cleans_orphan_markers.

[cursor]

Babysitting complete on HEAD 26976b7. All GitHub checks are green, including Cursor Bugbot (pass/SUCCESS).

During babysitting, Bugbot on bfa300c reported one additional issue — Orphan cleanup skips indented verdicts (9cd86e42) — which was confirmed and fixed in 26976b7 by lstrip-ing horizontal whitespace before the unpaired-bold check in _orphan_trailing_bold_span. Re-pushed; CI and Bugbot re-ran clean with 0 new findings on HEAD.

Ready for human review. Not merging per instructions.