fix: sanitize streamed model output before terminal rendering

[Gautam Sharma (GautamSharma99)]

Summary

Fixes #540.

Interactive assistant Markdown was passed to Ink after lexing without removing terminal control protocols. Repository and connector content can influence model output, so OSC 52 clipboard writes, OSC 8 hyperlinks, CSI cursor/display controls, and related sequences could reach a user terminal.

Changes

• Added stripTerminalControlSequences, a boundary sanitizer that removes:
  • ESC-prefixed OSC, CSI, DCS, SOS, PM, and APC sequences;
  • their C1 equivalents, including BEL/ST-terminated and unterminated string controls;
  • unsafe C0/C1 controls, DEL, BEL, and carriage returns.
• Preserved newline and tab semantics needed for Markdown layout.
• Applied the sanitizer to the complete Markdown string before marked.lexer, covering paragraphs, headings, lists, blockquotes, inline/fenced code, tables, HTML, and fallback tokens without re-sanitizing Ink-generated styling.
• Added regression tests for OSC 52/OSC 8, CSI display/cursor controls, C1 controls, BEL, carriage return, whitespace preservation, and unterminated OSC/DCS payloads.
• Added a patch changeset.

Security rationale

The model output is untrusted terminal text. Sanitizing before Markdown parsing ensures no rendered token path can accidentally bypass the control-sequence policy, while Ink remains responsible for intentional application styling after the untrusted boundary.

Validation

• pnpm run lint:check
• pnpm run typecheck
• pnpm exec prettier --check (changed files)
• pnpm test — 67 files, 795 tests passed

[changeset-bot]

🦋 Changeset detected

Latest commit: ff2541e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
openwiki	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR