Flatten tool-result whitespace in the -v flow log

Untrusted tool output (a fetched page, a search payload) is logged in the
verbose flow log; embedded CR/LF could forge fake `[aai_cli.…]` log lines. `_clip`
now collapses all whitespace to single spaces before truncating, so each result
stays on one line and can't inject log lines. (Secrets remain masked separately
by the debuglog formatter.) Addresses the Aikido review note on PR #243.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3YQmYYiZDEZkDvWqXYk6D

Author: claude

aai_cli/agent_cascade/brain.py

@@ -219,10 +219,18 @@ def _log_flow(state: dict[str, object], seen: int) -> int:
 
 
 def _clip(text: str) -> str:
-    """Truncate a tool result for the flow log, marking that it was shortened."""
-    if len(text) <= _RESULT_LOG_CAP:
-        return text
-    return f"{text[:_RESULT_LOG_CAP]}… ({len(text)} chars)"
+    """Flatten a tool result onto one line and truncate it for the flow log.
+
+    Tool output is untrusted external content (a fetched page, a search payload), so its
+    whitespace — newlines especially — is collapsed before logging: a result can't then
+    forge extra ``[aai_cli.…]`` log lines, and each result stays on one readable line. The
+    length is capped so a multi-KB payload can't bury the rest of the flow. (Secrets are
+    separately masked by the debuglog formatter across every record.)
+    """
+    flattened = " ".join(text.split())
+    if len(flattened) <= _RESULT_LOG_CAP:
+        return flattened
+    return f"{flattened[:_RESULT_LOG_CAP]}… ({len(flattened)} chars)"
 
 
 def _reply_text(result: dict[str, object]) -> str:

tests/test_agent_cascade_brain.py

@@ -248,6 +248,16 @@ def test_clip_passes_short_text_and_truncates_long_text():
     assert len(clipped) < len(long)
 
 
+def test_clip_flattens_whitespace_so_tool_output_cant_forge_log_lines():
+    # Tool output is untrusted: a result with embedded CR/LF could otherwise inject fake
+    # "[aai_cli.…]" log lines. _clip collapses all whitespace runs to single spaces, so the
+    # result stays on one line.
+    forged = "ok\n[aai_cli.agent_cascade.brain] tool call rm_rf args={}\r\nmore"
+    assert brain._clip(forged) == "ok [aai_cli.agent_cascade.brain] tool call rm_rf args={} more"
+    assert "\n" not in brain._clip(forged)
+    assert "\r" not in brain._clip(forged)
+
+
 # --- _reply_text / _content_text ---------------------------------------------