priv/rust/tui/src/render/sanitize.rs:153 slices mid-codepoint. escape_len_at returns Some(2) for the catch-all two-byte escape (util.rs:107); when the byte after ESC is a UTF-8 lead byte, rest = &rest[len..] splits a character.
Reproduced against the real crate through the bash-output render path:
panicked at src/render/sanitize.rs:153:
byte index 2 is not a char boundary; it is inside '✓' (bytes 1..4) of `✓ done`
Reachable from tools/bash.rs:90 → collapse::enhanced_output_lines → normalized_output_rows → scrub_terminal_output, i.e. raw unsanitized tool output. A printf '\033✓', a clipped ANSI sequence in a log, or a partially-read binary aborts the user's TUI session.
scrub_terminal_output is the first consumer of raw ESC bytes, which is why this is new. scrub_untrusted_document filters by chars() and is char-safe.
Fix: advance by whole chars — clamp len up to the next is_char_boundary, or drive the loop with char_indices.
Shipped knowingly in v1.0.177.
priv/rust/tui/src/render/sanitize.rs:153slices mid-codepoint.escape_len_atreturnsSome(2)for the catch-all two-byte escape (util.rs:107); when the byte after ESC is a UTF-8 lead byte,rest = &rest[len..]splits a character.Reproduced against the real crate through the bash-output render path:
Reachable from
tools/bash.rs:90→collapse::enhanced_output_lines→normalized_output_rows→scrub_terminal_output, i.e. raw unsanitized tool output. Aprintf '\033✓', a clipped ANSI sequence in a log, or a partially-read binary aborts the user's TUI session.scrub_terminal_outputis the first consumer of raw ESC bytes, which is why this is new.scrub_untrusted_documentfilters bychars()and is char-safe.Fix: advance by whole chars — clamp
lenup to the nextis_char_boundary, or drive the loop withchar_indices.Shipped knowingly in v1.0.177.