fix(tool-rendering): sanitize untrusted display text #14

2026-11-05T16:10:43Z

eleith-gitea-agent Bot commented

2026-11-05 16:10:43 +00:00

Summary

Sanitize untrusted tool-result bodies before applying renderer-owned theme styling, without modifying execution, stored data, or model-facing results.
Cover edit diff/patch metadata, legacy find/ls rendering details, and write-content previews as well as ordinary result text.
Use named intermediate values instead of nested function-call arguments throughout the new code and tests.
Add a patch changeset for @eleith-pi/tool-rendering.

Defensive implementation

Review reproduced two problems with Pi 1.5's terminal-sequence stripper on untrusted input: visible-text loss after cursor-visibility controls and quadratic scans for repeated unterminated sequences. The sanitizer therefore uses Node's VT helper plus a small forward-only OSC/APC pass and a binary-control filter, rather than private SDK APIs or the unsafe stripping path.

Validation

All 76 test files / 1,405 tests passed.
Typecheck, lint, repository formatting, staged whitespace checks, and builds for all nine extensions passed.
Focused sanitation tests passed on Node 22.20 and 26.5; exact minimum Node 22.19 and non-Linux platforms were not executed.
Regression coverage checks raw sequence removal, retained ANSI around styled body text, metadata bypasses, immutable model-facing data, cursor-control text preservation, and malformed-input handling in a subprocess with a hard deadline.

Reviews

Code, readability, and test reviews completed. Findings were fixed and re-reviewed with no remaining actionable issues.

Scope is intentionally limited to display bodies; timing, wrapping, header formatting, and other SDK-alignment recommendations remain separate batches.

## Summary - Sanitize untrusted tool-result bodies before applying renderer-owned theme styling, without modifying execution, stored data, or model-facing results. - Cover edit diff/patch metadata, legacy find/ls rendering details, and write-content previews as well as ordinary result text. - Use named intermediate values instead of nested function-call arguments throughout the new code and tests. - Add a patch changeset for `@eleith-pi/tool-rendering`. ## Defensive implementation Review reproduced two problems with Pi 1.5's terminal-sequence stripper on untrusted input: visible-text loss after cursor-visibility controls and quadratic scans for repeated unterminated sequences. The sanitizer therefore uses Node's VT helper plus a small forward-only OSC/APC pass and a binary-control filter, rather than private SDK APIs or the unsafe stripping path. ## Validation - All 76 test files / 1,405 tests passed. - Typecheck, lint, repository formatting, staged whitespace checks, and builds for all nine extensions passed. - Focused sanitation tests passed on Node 22.20 and 26.5; exact minimum Node 22.19 and non-Linux platforms were not executed. - Regression coverage checks raw sequence removal, retained ANSI around styled body text, metadata bypasses, immutable model-facing data, cursor-control text preservation, and malformed-input handling in a subprocess with a hard deadline. ## Reviews Code, readability, and test reviews completed. Findings were fixed and re-reviewed with no remaining actionable issues. Scope is intentionally limited to display bodies; timing, wrapping, header formatting, and other SDK-alignment recommendations remain separate batches.

eleith-gitea-agent Bot added 1 commit 2026-11-05 16:10:43 +00:00

fix(tool-rendering): sanitize untrusted display text

ci/woodpecker/pr/tool-rendering Pipeline was successful

Details

ci/woodpecker/push/tool-rendering Pipeline was successful

Details

0699dc99ba

eleith merged commit 0699dc99ba into main

2026-11-05 16:15:24 +00:00

eleith deleted branch fix/tool-rendering-display-sanitation

2026-11-05 16:15:24 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eleith/pi-extensions#14