fix: prevent DoS in sanitize_output ESC sequence handling

Found during self-review of commit 3b5ba98:

- CSI consumer (ESC [ / ESC ]) now capped at 256 iterations.
  An unterminated sequence like '\x1b[no-alpha-here' would
  previously consume all remaining output. Now it stops after
  256 chars, preserving the rest of the content.

- DCS/APC/PM/SOS consumer (ESC P/X/^+_) now capped at 4 KB.
  Same issue — unterminated DCS would eat all output.

- main.rs --loop validation: return the sanitized 'safe' string
  instead of the raw 'combined' to the transcript saver, so
  future reads from the transcript don't expose raw controls.

Author: Yogthos

src/main.rs

@@ -1060,7 +1060,7 @@ async fn run_headless_loop(
                     };
                     let safe = ansi::strip_controls(&combined, StripPolicy::KEEP_NEWLINE);
                     eprintln!("{safe}");
-                    Some(combined)
+                    Some(safe)
                 }
                 Err(e) => {
                     let msg = format!("error: {}", e);

src/ui/events.rs

@@ -225,22 +225,33 @@ pub fn sanitize_output(text: &str) -> CompactString {
             // Single-byte: ESC + any other char (reset, etc.)
             match chars.next() {
                 Some('[') | Some(']') => {
-                    // Consume until sequence terminator (alphabetic,
-                    // tilde, or BEL for OSC).
+                    // Consume until sequence terminator. Cap at 256
+                    // bytes to prevent DoS on unterminated sequences
+                    // (tool output containing "\x1b[no-alpha-here").
+                    let mut n = 0;
                     for next in &mut chars {
                         if next.is_ascii_alphabetic() || next == '~' || next == '\x07' {
                             break;
                         }
+                        n += 1;
+                        if n >= 256 {
+                            break;
+                        }
                     }
                 }
-                // DCS/APC/PM/SOS — consume until ST (ESC \).
+                // DCS/APC/PM/SOS — consume until ST (ESC \). Cap at 4 KB.
                 Some('P') | Some('X') | Some('^') | Some('_') => {
                     let mut prev = '\0';
+                    let mut n = 0;
                     for next in &mut chars {
                         if prev == '\x1b' && next == '\\' {
                             break;
                         }
                         prev = next;
+                        n += 1;
+                        if n >= 4096 {
+                            break;
+                        }
                     }
                 }
                 Some(_) => {} // Single-byte esc sequence — skip the second byte.