fix(tui): sanitize untrusted terminal text and allowlist hyperlink targets

packages/coding-agent/.changes/eng-5344-terminal-output-sanitize.md

@@ -0,0 +1 @@
+- Fixed assistant text, thinking, tool output and link targets being able to send terminal control sequences (clipboard writes, screen clears, title changes) to the terminal ([ENG-5344](https://linear.app/primeintellect/issue/ENG-5344)).

packages/coding-agent/src/core/tools/bash.ts

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import type { AgentTool } from "@earendil-works/pi-agent-core";
-import { Container, Text, truncateToWidth } from "@earendil-works/pi-tui";
+import { Container, sanitizeTerminalText, Text, truncateToWidth } from "@earendil-works/pi-tui";
 import { type Static, Type } from "typebox";
 import { expandCollapseHint } from "../../modes/interactive/components/keybinding-hints.js";
 import { truncateToVisualLines } from "../../modes/interactive/components/visual-truncate.js";
@@ -175,7 +175,8 @@ function formatDuration(ms: number): string {
 }
 
 function formatBashCall(args: { command?: string; timeout?: number } | undefined): string {
-	const command = str(args?.command);
+	const rawCommand = str(args?.command);
+	const command = rawCommand === null ? null : sanitizeTerminalText(rawCommand);
 	const timeout = args?.timeout as number | undefined;
 	const timeoutSuffix = timeout ? theme.fg("muted", ` (timeout ${timeout}s)`) : "";
 	let commandDisplay: string;

packages/coding-agent/src/core/tools/edit.ts

@@ -1,5 +1,13 @@
 import type { AgentTool } from "@earendil-works/pi-agent-core";
-import { Box, type Component, Container, Spacer, Text, wrapTextWithAnsi } from "@earendil-works/pi-tui";
+import {
+	Box,
+	type Component,
+	Container,
+	Spacer,
+	sanitizeTerminalText,
+	Text,
+	wrapTextWithAnsi,
+} from "@earendil-works/pi-tui";
 import { constants } from "fs";
 import { access as fsAccess, readFile as fsReadFile, writeFile as fsWriteFile } from "fs/promises";
 import { type Static, Type } from "typebox";
@@ -201,7 +209,7 @@ function formatEditCall(
 ): string {
 	const invalidArg = invalidArgText(theme);
 	const rawPath = str(args?.file_path ?? args?.path);
-	const path = rawPath !== null ? shortenPath(rawPath) : null;
+	const path = rawPath !== null ? sanitizeTerminalText(shortenPath(rawPath)) : null;
 	const pathDisplay = path === null ? invalidArg : path ? theme.fg("accent", path) : theme.fg("toolOutput", "...");
 	return `${theme.fg("toolTitle", theme.bold("edit"))} ${pathDisplay}`;
 }
@@ -224,7 +232,7 @@ function formatEditResult(
 		if (!errorText || errorText === previewError) {
 			return undefined;
 		}
-		return theme.fg("error", errorText);
+		return theme.fg("error", sanitizeTerminalText(errorText));
 	}
 
 	const resultDiff = result.details?.diff;

packages/coding-agent/src/core/tools/render-utils.ts

@@ -1,6 +1,6 @@
 import * as os from "node:os";
 import type { ImageContent, TextContent } from "@earendil-works/pi-ai";
-import { getImageDimensions, imageFallback } from "@earendil-works/pi-tui";
+import { getImageDimensions, imageFallback, sanitizeTerminalText } from "@earendil-works/pi-tui";
 import stripAnsi from "strip-ansi";
 import { sanitizeBinaryOutput } from "../../utils/shell.js";
 
@@ -38,7 +38,9 @@ export function getTextOutput(
 	const textBlocks = result.content.filter((c) => c.type === "text");
 	const imageBlocks = result.content.filter((c) => c.type === "image");
 
-	let output = textBlocks.map((c) => sanitizeBinaryOutput(stripAnsi(c.text || "")).replace(/\r/g, "")).join("\n");
+	let output = textBlocks
+		.map((c) => sanitizeTerminalText(sanitizeBinaryOutput(stripAnsi(c.text || "")).replace(/\r/g, "")))
+		.join("\n");
 
 	const includeImageDimensions = options.includeImageDimensions ?? true;
 	if (imageBlocks.length > 0 && !showImages) {

packages/coding-agent/src/modes/interactive/components/agent-message.ts

@@ -3,6 +3,7 @@ import {
 	Container,
 	type MarkdownTheme,
 	Spacer,
+	sanitizeTerminalText,
 	Text,
 	truncateToWidth,
 	visibleWidth,
@@ -13,7 +14,7 @@ import { getMarkdownTheme, theme } from "../theme/theme.js";
 import { expandCollapseHint } from "./keybinding-hints.js";
 
 function collapseText(text: string): string {
-	return text.replace(/\s+/g, " ").trim();
+	return sanitizeTerminalText(text).replace(/\s+/g, " ").trim();
 }
 
 /** `◆ <label> · <participant>[ · <preview>]` summary line shared by received and sent agent-message UI. */
@@ -34,10 +35,12 @@ export function agentMessagePreview(prefixWidth: number, message: string): strin
 export function agentMessageBodyLines(message: string, width: number): string[] {
 	const safeWidth = Math.max(1, width);
 	const textWidth = Math.max(1, safeWidth - 4);
-	const bodyLines = message.split("\n").flatMap((line) => {
-		const wrapped = wrapTextWithAnsi(line, textWidth);
-		return wrapped.length > 0 ? wrapped : [""];
-	});
+	const bodyLines = sanitizeTerminalText(message)
+		.split("\n")
+		.flatMap((line) => {
+			const wrapped = wrapTextWithAnsi(line, textWidth);
+			return wrapped.length > 0 ? wrapped : [""];
+		});
 	return bodyLines.map((line, index) => {
 		const prefix = index === 0 ? theme.fg("dim", "╰─ ") : "   ";
 		return truncateToWidth(` ${prefix}${theme.fg("customMessageText", line)}`, safeWidth, "");

packages/coding-agent/src/modes/interactive/components/assistant-message.ts

@@ -7,6 +7,7 @@ import {
 	Markdown,
 	type MarkdownTheme,
 	Spacer,
+	sanitizeTerminalText,
 	Text,
 	truncateToWidth,
 	visibleWidth,
@@ -79,7 +80,7 @@ class CollapsedThinkingRow implements Component {
  * non-empty line, stripped of markdown emphasis and truncated.
  */
 export function thinkingRecap(thinking: string, fallback: string, maxWidth = 120): string {
-	const lines = thinking
+	const lines = sanitizeTerminalText(thinking)
 		.split("\n")
 		.map((line) => line.trim())
 		.filter((line) => line.length > 0);
@@ -365,7 +366,8 @@ export class AssistantMessageComponent extends Container {
 		}
 	}
 
-	private createErrorComponent(message: string, prefix?: string): Component {
+	private createErrorComponent(rawMessage: string, prefix?: string): Component {
+		const message = sanitizeTerminalText(rawMessage);
 		const inlineLoginRecovery = formatInlineLoginRecoveryMessage(message);
 		if (inlineLoginRecovery) {
 			const text = prefix ? `${prefix}: ${inlineLoginRecovery}` : inlineLoginRecovery;

packages/coding-agent/src/modes/interactive/components/bash-execution.ts

@@ -1,4 +1,4 @@
-import { Container, Loader, Spacer, Text, type TUI } from "@earendil-works/pi-tui";
+import { Container, Loader, Spacer, sanitizeTerminalText, Text, type TUI } from "@earendil-works/pi-tui";
 import stripAnsi from "strip-ansi";
 import {
 	DEFAULT_MAX_BYTES,
@@ -70,7 +70,7 @@ export class BashExecutionComponent extends Container {
 
 	appendOutput(chunk: string): void {
 		// Note: binary data is already sanitized in tui-renderer.ts executeBashCommand
-		const clean = stripAnsi(chunk).replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+		const clean = sanitizeTerminalText(stripAnsi(chunk).replace(/\r\n/g, "\n").replace(/\r/g, "\n"));
 
 		const newLines = clean.split("\n");
 		if (this.outputLines.length > 0 && newLines.length > 0) {

packages/coding-agent/src/modes/interactive/components/collapsible-error.ts

@@ -1,4 +1,10 @@
-import { type Component, truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@earendil-works/pi-tui";
+import {
+	type Component,
+	sanitizeTerminalText,
+	truncateToWidth,
+	visibleWidth,
+	wrapTextWithAnsi,
+} from "@earendil-works/pi-tui";
 import stripAnsi from "strip-ansi";
 import { theme } from "../theme/theme.js";
 import { expandCollapseHint } from "./keybinding-hints.js";
@@ -12,7 +18,7 @@ export interface CollapsibleErrorOptions {
 }
 
 export function normalizeErrorDetails(text: string): string {
-	return stripAnsi(text).replace(/\r\n/g, "\n").replace(/\r/g, "\n").trimEnd();
+	return sanitizeTerminalText(stripAnsi(text).replace(/\r\n/g, "\n").replace(/\r/g, "\n")).trimEnd();
 }
 
 interface ErrorDetailLine {

packages/coding-agent/src/modes/interactive/components/diff.ts

@@ -1,4 +1,4 @@
-import { truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@earendil-works/pi-tui";
+import { sanitizeTerminalText, truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@earendil-works/pi-tui";
 import * as Diff from "diff";
 import { highlightCode, theme } from "../theme/theme.js";
 
@@ -78,7 +78,7 @@ export interface RenderDiffOptions {
  * - Added lines: green, with inverse on changed tokens
  */
 export function renderDiff(diffText: string, _options: RenderDiffOptions = {}): string {
-	const lines = diffText.split("\n");
+	const lines = sanitizeTerminalText(diffText).split("\n");
 	const result: string[] = [];
 
 	let i = 0;
@@ -233,7 +233,7 @@ export function renderRichDiff(diffText: string, contentWidth: number, options:
 	const useBlocks = theme.colorMode === "truecolor";
 	const rows: string[] = [];
 
-	for (const rawLine of diffText.split("\n")) {
+	for (const rawLine of sanitizeTerminalText(diffText).split("\n")) {
 		const parsed = parseDiffLine(rawLine);
 		if (!parsed) {
 			rows.push(

packages/coding-agent/src/modes/interactive/components/ipython-cell.ts

@@ -1,5 +1,6 @@
 import {
 	type Component,
+	sanitizeTerminalText,
 	truncateToWidth,
 	VersionedRenderCache,
 	visibleWidth,
@@ -132,7 +133,7 @@ export function getIpythonCodeFromArgs(args: unknown): string {
 		return "";
 	}
 	const code = (args as { code?: unknown }).code;
-	return typeof code === "string" ? code : "";
+	return typeof code === "string" ? sanitizeTerminalText(code) : "";
 }
 
 function readDetails(details: unknown): IpythonDetails {
@@ -211,7 +212,7 @@ function readDiffDisplays(value: unknown): DiffDisplay[] | undefined {
 		}
 		return [
 			{
-				path: record.path,
+				path: sanitizeTerminalText(record.path),
 				oldStr: record.oldStr,
 				newStr: record.newStr,
 				startLine: typeof record.startLine === "number" ? record.startLine : undefined,
@@ -268,10 +269,12 @@ function readErrorDetails(value: unknown): IpythonErrorDetails | undefined {
 		return undefined;
 	}
 	return {
-		ename: record.ename,
+		ename: sanitizeTerminalText(record.ename),
 		evalue: typeof record.evalue === "string" ? record.evalue : "",
 		traceback: Array.isArray(record.traceback)
-			? record.traceback.filter((line): line is string => typeof line === "string")
+			? record.traceback
+					.filter((line): line is string => typeof line === "string")
+					.map((line) => normalizeErrorDetails(line))
 			: [],
 	};
 }
@@ -333,17 +336,23 @@ function formatIpythonErrorSummary(error: IpythonErrorDetails): string {
 	return visibleWidth(value) <= 48 ? `${error.ename}: ${value}` : error.ename;
 }
 
+// Model-written code is untrusted; sanitize once per state update, not per render.
+function sanitizeState(state: IPythonCellState): IPythonCellState {
+	const code = sanitizeTerminalText(state.code);
+	return code === state.code ? state : { ...state, code };
+}
+
 export class IPythonCellComponent implements Component {
 	private readonly renderCache = new VersionedRenderCache();
 	private state: IPythonCellState;
 	private stateVersion = 0;
 
 	constructor(state: IPythonCellState) {
-		this.state = state;
+		this.state = sanitizeState(state);
 	}
 
 	update(state: IPythonCellState): void {
-		this.state = state;
+		this.state = sanitizeState(state);
 		this.stateVersion += 1;
 	}
 

packages/coding-agent/src/modes/interactive/components/tool-execution.ts

@@ -1,5 +1,5 @@
 import type { AgentToolResult } from "@earendil-works/pi-agent-core";
-import { type Component, Container, Image, Text, type TUI } from "@earendil-works/pi-tui";
+import { type Component, Container, Image, sanitizeTerminalText, Text, type TUI } from "@earendil-works/pi-tui";
 import type { ToolDefinition, ToolRenderContext, ToolRenderResultOptions } from "../../../core/extensions/types.js";
 import type { KernelSentAgentMessage } from "../../../core/kernel/index.js";
 import { createBashToolDefinition } from "../../../core/tools/bash.js";
@@ -507,7 +507,8 @@ export class ToolExecutionComponent extends Container {
 
 	private formatToolExecution(): string {
 		const parts: string[] = [];
-		const content = JSON.stringify(this.args, null, 2);
+		// JSON.stringify escapes C0 controls but leaves DEL and C1 controls intact.
+		const content = sanitizeTerminalText(JSON.stringify(this.args, null, 2) ?? "");
 		if (content) {
 			parts.push(content);
 		}

packages/coding-agent/test/suite/regressions/2108-assistant-message-links.test.ts

@@ -41,23 +41,20 @@ describe("assistant Markdown file links", () => {
 
 	test.each([
 		["audit-out/report.md", reportUrl],
-		["#overview", "#overview"],
 		["./audit-out/report.md", reportUrl],
 		["../report.md", pathToFileURL(resolve(cwd, "../report.md")).href],
 		["/tmp/report.md", pathToFileURL("/tmp/report.md").href],
 		["<audit-out/my report.md>", pathToFileURL(resolve(cwd, "audit-out/my report.md")).href],
 		["audit-out/my%20report.md", pathToFileURL(resolve(cwd, "audit-out/my report.md")).href],
 		["audit-out/report%23draft%25.md", pathToFileURL(resolve(cwd, "audit-out/report#draft%.md")).href],
 		["audit-out/report.md#findings", `${reportUrl}#findings`],
-		["file:///tmp/report.md", "file:///tmp/report.md"],
 		["C:/repo/report.md", "file:///C:/repo/report.md"],
 		[String.raw`C:\repo\report.md`, "file:///C:/repo/report.md"],
 		["<D:/repo/my report.md>", "file:///D:/repo/my%20report.md"],
 		["D:/repo/report%23draft.md#findings", "file:///D:/repo/report%23draft.md#findings"],
 		["https://example.com/report?q=1#findings", "https://example.com/report?q=1#findings"],
 		["http://example.com/report", "http://example.com/report"],
 		["mailto:reader@example.com", "mailto:reader@example.com"],
-		["https://[invalid", "https://[invalid"],
 	])("resolves %s without changing the label", (href, expected) => {
 		const component = new AssistantMessageComponent(
 			{ ...message, content: [{ type: "text", text: `[Audit report](${href})` }] },
@@ -71,6 +68,25 @@ describe("assistant Markdown file links", () => {
 		expect(stripAnsi(lines.join("\n")).trim()).toBe("Audit report");
 	});
 
+	// ENG-5344: OSC 8 targets are allowlisted (http, https, mailto, and file only
+	// when resolved from a local path via the session cwd). Anything else renders
+	// like a terminal without hyperlink support.
+	test.each(["#overview", "file:///tmp/report.md", "https://[invalid", "javascript:alert(1)"])(
+		"shows %s as text instead of an OSC 8 target",
+		(href) => {
+			const component = new AssistantMessageComponent(
+				{ ...message, content: [{ type: "text", text: `[Audit report](${href})` }] },
+				false,
+				undefined,
+				undefined,
+				{ cwd },
+			);
+			const lines = component.render(80);
+			expect(linkTargets(lines)).toEqual([]);
+			expect(stripAnsi(lines.join("\n")).trim()).toBe(`Audit report (${href})`);
+		},
+	);
+
 	test.each(["addMessageToChat", "startAssistantStreamingMessage"] as const)(
 		"%s uses the attached session cwd and produces an openable target",
 		(method) => {