Cloud routines: GitHub MCP comment posting injects U+00B7 middle dots into @mentions and command words, breaking Dependabot bot commands

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet (related but distinct from #62791)
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a Claude Code Routine posts a PR/issue comment via the GitHub MCP integration (mcp__github__add_issue_comment), a literal @dependabot rebase string in the comment body is altered before reaching GitHub: U+00B7 MIDDLE DOT characters are inserted into the mention token and into the command word.

Sent (tool call body param):

@dependabot rebase

Stored on GitHub (verified at byte level via the API — inserted bytes are c2 b7, i.e. U+00B7):

·@·d·ependabot r·ebase

Insertion points: before @, between @ and d, between d and e, and inside rebase (between r and e). Note the last one — the corruption is not limited to the @mention token; the command word itself is also broken, which suggests deliberate bot-command neutralization rather than a plain mention sanitizer.

The corruption is deterministic: 4 comments posted by the same routine within ~20 minutes, across 3 different repositories, all byte-for-byte identical in the mangled region. Live examples (public repos):

• https://github.com/paveg/hono-cf-access/pull/69 (posted twice, both mangled)
• https://github.com/paveg/hono-cf-access/pull/63
• https://github.com/paveg/hono-webhook-verify/pull/155
• https://github.com/paveg/hono-idempotency/pull/169

The corrupted body is what the GitHub REST API returns as the stored comment (GET /repos/{owner}/{repo}/issues/comments/{id}), so this is not a rendering-layer issue — the data at rest is corrupted. The routine's transcript additionally shows the mangled string echoed back in the MCP tool call's own success response, which points at the corruption happening before or during the API call.

This breaks the semantics of the message: Dependabot parses comment bodies for an exact @dependabot <command> token (documented comment commands). With both the mention and the command word corrupted, the command is not recognized.

What Should Happen?

Expected: A comment body containing @dependabot rebase is posted verbatim, so Dependabot's comment-command parser recognizes it and rebases the PR.

Actual: The mention and command word are corrupted with inserted U+00B7 characters every time. In most observed cases Dependabot did not react to the mangled comment.

Steps to Reproduce

1. In a Claude Code cloud Routine (scheduled task) with the GitHub MCP integration connected, call mcp__github__add_issue_comment with body: "@dependabot rebase" on any PR.
2. Fetch the posted comment back via the GitHub API (e.g. GET /repos/{owner}/{repo}/issues/{n}/comments) or view the PR on github.com.
3. Observe the stored body is ·@·d·ependabot r·ebase (hexdump shows c2 b7 insertions) instead of @dependabot rebase.
4. Repeat — the corruption is identical on every call.

Suspected Cause

Likely the same post-hoc injection layer responsible for #62791's attribution footer (the mangled comments carry that footer too) also passes the body through a sanitizer intended to neutralize @-mention pings and/or bot commands. Whatever its intent, it is too broad: it also corrupts mentions the model was explicitly instructed to send, breaking legitimate, documented Dependabot comment commands (@dependabot rebase, @dependabot recreate, …).

Use Case

Routines that manage Dependabot PRs (rebase stale branches, request re-runs) rely on posting these exact command strings. With the token corrupted, a routine cannot drive Dependabot's comment-command interface at all — and there's no workaround via the MCP tool short of bypassing it (shelling out to gh/curl), which loses the integration's auth handling.

Suggested Fix

If mention/command sanitization is intentional (anti-spam / anti-injection safety), it should distinguish between:

• mentions echoed from untrusted external content (real injection risk), vs.
• mentions the model authored itself as an explicit, human-instructed action (a routine's own prompt saying to comment @dependabot rebase).

At minimum, please track this as a correctness bug: a Claude Code Routine currently cannot post a functioning Dependabot bot-command.

Platform / Environment

Claude Code Routine (scheduled task), GitHub MCP integration, mcp__github__add_issue_comment. Same environment class as #62791.