@node9/proxy 2.14.1 → 2.14.2

package/dist/cli.js

@@ -2934,6 +2934,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
 function isIgnoredTool(toolName, config) {
   return matchesPattern(toolName, config.policy.ignoredTools);
 }
+function stripTerminalEscapes(s) {
+  return s.replace(TERMINAL_ESCAPE_RE, "");
+}
+function stripControlChars(s) {
+  return s.replace(CONTROL_CHAR_RE, "");
+}
+function safeMessage(value, max = 300) {
+  const raw = typeof value === "string" ? value : value instanceof Error ? value.message : String(value ?? "");
+  const s = stripTerminalEscapes(raw).replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -3151,7 +3162,10 @@ function computeSecurityScore(opts) {
 }
 function truncateBlastPath(full) {
   if (!full) return "";
-  const cleaned = full.replace(/[/\\]+$/, "");
+  if (full.length > MAX_BLAST_PATH) full = full.slice(-MAX_BLAST_PATH);
+  let end = full.length;
+  while (end > 0 && (full[end - 1] === "/" || full[end - 1] === "\\")) end--;
+  const cleaned = full.slice(0, end);
   const parts = cleaned.split(/[/\\]+/).filter((p) => p.length > 0);
   if (parts.length <= 2) {
     return cleaned.startsWith("~") && !cleaned.startsWith("~/") ? cleaned : cleaned.startsWith("~/") ? cleaned : parts.join("/");
@@ -3647,7 +3661,7 @@ function toScanFinding(c) {
 }
 function previewArgs(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
-  const s = String(cmd).replace(TERMINAL_ESCAPE_RE, "").replace(/\s+/g, " ").trim();
+  const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
   return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
 }
 function makeFinding(args) {
@@ -3687,7 +3701,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -5321,6 +5335,8 @@ var init_dist = __esm({
       block: 2
     };
     SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
+    TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+    CONTROL_CHAR_RE = /[\x00-\x1F\x7F]/g;
     aws_default = {
       name: "aws",
       description: "Protects AWS infrastructure from destructive AI operations",
@@ -6098,6 +6114,7 @@ var init_dist = __esm({
       longOutputRedactions: 1
     };
     LOOP_THRESHOLD_FOR_WASTE = 3;
+    MAX_BLAST_PATH = 4096;
     DESTRUCTIVE_OP_RE = /\brm\s+-[rRf]+\b|\bDROP\s+(TABLE|DATABASE|COLLECTION|SCHEMA)\b|\bTRUNCATE\s+TABLE\b|\bgit\s+push\s+(--force|-f)\b|\bFLUSHALL\b|\bFLUSHDB\b|\bkubectl\s+delete\b|\bhelm\s+uninstall\b/i;
     SENSITIVE_PATH_RE = /[\\/]\.aws(?:[\\/]|$)|^\.aws[\\/]|[\\/]\.ssh(?:[\\/]|$)|^\.ssh[\\/]|(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
     FILE_TOOLS = /* @__PURE__ */ new Set([
@@ -6178,8 +6195,6 @@ var init_dist = __esm({
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
     CANONICAL_EXTRACTOR_VERSION = "canonical-v15";
     DEDUPE_PREVIEW_LEN = 120;
-    TERMINAL_ESCAPE_RE = // eslint-disable-next-line no-control-regex
-    /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     ENGINE_VERSION = "1.4.0";
   }
 });
@@ -8728,6 +8743,14 @@ var init_context_sniper = __esm({
   }
 });
 
+// src/utils/safe-text.ts
+var init_safe_text = __esm({
+  "src/utils/safe-text.ts"() {
+    "use strict";
+    init_dist();
+  }
+});
+
 // src/ui/native.ts
 function resolveNativeDecision(opts) {
   const { code, output, elapsedMs, locked } = opts;
@@ -8837,7 +8860,7 @@ function escapePango(text) {
 function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1, ruleDescription) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
-  const safeAgent = (agent ?? "AI Agent").replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "").slice(0, 80);
+  const safeAgent = safeMessage(agent ?? "AI Agent", 80);
   lines.push(`\u{1F916} ${safeAgent}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   if (ruleDescription) lines.push(`\u2139  ${ruleDescription}`);
@@ -8974,6 +8997,7 @@ var init_native = __esm({
     import_child_process = require("child_process");
     import_path11 = __toESM(require("path"));
     init_context_sniper();
+    init_safe_text();
     isTestEnv = () => {
       return process.env.NODE_ENV === "test" || process.env.VITEST === "true" || !!process.env.VITEST || process.env.CI === "true" || !!process.env.CI || process.env.NODE9_TESTING === "1";
     };
@@ -9360,14 +9384,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     if (!res.ok) {
       import_fs12.default.appendFileSync(
         HOOK_DEBUG_LOG,
-        `[resolve-cloud] PATCH ${resolveUrl} \u2192 HTTP ${res.status}
+        `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err2) {
     import_fs12.default.appendFileSync(
       HOOK_DEBUG_LOG,
-      `[resolve-cloud] PATCH failed for ${requestId}: ${err2.message}
+      `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err2)}
 `
     );
   }
@@ -9380,6 +9404,7 @@ var init_cloud = __esm({
     import_os11 = __toESM(require("os"));
     import_path14 = __toESM(require("path"));
     init_audit();
+    init_safe_text();
     DLP_SAMPLE_MAX_LEN = 200;
     DLP_PATTERN_MAX_LEN = 100;
     KNOWN_CHECKED_BY = /* @__PURE__ */ new Set([
@@ -9512,9 +9537,8 @@ async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = (0, import_crypto7.randomUUID)();
     const actTs = Date.now();
-    const stripAnsi2 = (s) => s.replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "");
-    const sanitizedAgent = meta?.agent ? stripAnsi2(meta.agent).slice(0, 80) : void 0;
-    const sanitizedMcpServer = meta?.mcpServer ? stripAnsi2(meta.mcpServer).slice(0, 40) : void 0;
+    const sanitizedAgent = meta?.agent ? safeMessage(meta.agent, 80) : void 0;
+    const sanitizedMcpServer = meta?.mcpServer ? safeMessage(meta.mcpServer, 40) : void 0;
     const socketOk = await notifyActivity({
       id: actId,
       ts: actTs,
@@ -10390,6 +10414,7 @@ var init_orchestrator = __esm({
     init_loop_detector();
     init_shields();
     init_jail();
+    init_safe_text();
     WRITE_TOOLS = /* @__PURE__ */ new Set([
       "write",
       "write_file",
@@ -14995,7 +15020,7 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         }
       }
     } catch (err2) {
-      import_fs24.default.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${err2.message}
+      import_fs24.default.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${safeMessage(err2)}
 `);
     }
   }
@@ -15037,6 +15062,7 @@ var init_costSync = __esm({
     init_cost_gemini();
     init_cost_copilot();
     init_session_files();
+    init_safe_text();
     SYNC_INTERVAL_MS = 10 * 60 * 1e3;
     claudeSource = {
       id: "claude",
@@ -15867,9 +15893,6 @@ function fmtTs(ts) {
     return ts.slice(0, 10);
   }
 }
-function stripTerminalEscapes(s) {
-  return s.replace(TERMINAL_ESCAPE_RE2, "");
-}
 function preview(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
   const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
@@ -18584,7 +18607,7 @@ function registerScanCommand(program2) {
     }
   );
 }
-var import_chalk6, import_fs27, import_path29, import_os26, import_string_width2, toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, TERMINAL_ESCAPE_RE2, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS, STUCK_TOOLS_MIN_WASTE, STUCK_TOOLS_LIMIT, RECURRING_SESSION_THRESHOLD, STALE_AGE_DAYS, classifyRuleSeverity2, narrativeRuleLabel2;
+var import_chalk6, import_fs27, import_path29, import_os26, import_string_width2, toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS, STUCK_TOOLS_MIN_WASTE, STUCK_TOOLS_LIMIT, RECURRING_SESSION_THRESHOLD, STALE_AGE_DAYS, classifyRuleSeverity2, narrativeRuleLabel2;
 var init_scan = __esm({
   "src/cli/commands/scan.ts"() {
     "use strict";
@@ -18615,6 +18638,7 @@ var init_scan = __esm({
     init_scan_json();
     init_session_files();
     init_scan_history();
+    init_safe_text();
     toolInspectionMap = DEFAULT_CONFIG.policy.toolInspection;
     CODE_EXTENSIONS = /* @__PURE__ */ new Set([
       ".ts",
@@ -18649,7 +18673,6 @@ var init_scan = __esm({
       /\bseverity:\s*['"](?:block|review|allow)['"]/,
       /NODE9 SECURITY ALERT/
     ];
-    TERMINAL_ESCAPE_RE2 = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     LOOP_TOOLS = /* @__PURE__ */ new Set([
       "bash",
       "execute_bash",
@@ -19135,7 +19158,7 @@ function atomicWriteSync2(filePath, data, options) {
 function redactArgs(value) {
   if (!value || typeof value !== "object") return value;
   if (Array.isArray(value)) return value.map(redactArgs);
-  const result = {};
+  const result = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(value)) {
     result[k] = SECRET_KEY_RE.test(k) ? "[REDACTED]" : redactArgs(v);
   }
@@ -23491,7 +23514,7 @@ data: ${JSON.stringify(item.data)}
     if (req.method === "GET" && pathname === "/state/check") {
       const predicatesParam = reqUrl.searchParams.get("predicates") ?? "";
       const predicates = predicatesParam.split(",").filter(Boolean);
-      const results = {};
+      const results = /* @__PURE__ */ Object.create(null);
       for (const p of predicates) {
         results[p] = sessionHistory.checkPredicate(p);
       }
@@ -51227,7 +51250,7 @@ async function startTail(options = {}) {
   req.on("error", (err2) => {
     const msg = err2.code === "ECONNREFUSED" ? "Daemon is not running. Start it with: node9 daemon start" : err2.message;
     console.error(import_chalk44.default.red(`
-\u274C ${msg}`));
+\u274C ${safeMessage(msg)}`));
     process.exit(1);
   });
 }
@@ -51245,6 +51268,7 @@ var init_tail = __esm({
     init_startup_log();
     init_daemon2();
     init_daemon();
+    init_safe_text();
     PID_FILE = import_path70.default.join(import_os62.default.homedir(), ".node9", "daemon.pid");
     ICONS = {
       bash: "\u{1F4BB}",
@@ -51891,9 +51915,7 @@ function shellInvocation(command) {
 }
 
 // src/proxy/index.ts
-function sanitize(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
+init_safe_text();
 async function runProxy(targetCommand) {
   const commandParts = (0, import_execa2.parseCommandString)(targetCommand);
   const cmd = commandParts[0];
@@ -51929,7 +51951,7 @@ async function runProxy(targetCommand) {
       try {
         const name = message.params?.name || message.params?.tool_name || "unknown";
         const toolArgs = message.params?.arguments || message.params?.tool_input || {};
-        const result = await authorizeHeadless(sanitize(name), toolArgs, {
+        const result = await authorizeHeadless(stripControlChars(name), toolArgs, {
           agent: "Proxy/MCP"
         });
         if (!result.approved) {
@@ -52177,17 +52199,27 @@ init_machine_id();
 
 // src/utils/open-browser.ts
 var import_child_process6 = require("child_process");
+function isOpenableUrl(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:") return false;
+  return !/[\x00-\x20\x7F"'`]/.test(url);
+}
 function openBrowser(url) {
+  if (!isOpenableUrl(url)) return false;
   if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return false;
   if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
     return false;
   }
-  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
   try {
-    const child = (0, import_child_process6.spawn)(opener, [url], {
+    const child = (0, import_child_process6.spawn)(cmd, args, {
       stdio: "ignore",
-      detached: true,
-      shell: process.platform === "win32"
+      detached: true
     });
     child.on("error", () => {
     });
@@ -52248,6 +52280,7 @@ function postJson2(url, body, bearer) {
 }
 
 // src/auth/device-login.ts
+init_safe_text();
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function runDeviceLogin(opts = {}) {
   const startUrl = resolveCloudEndpoint("/device/start", opts.apiUrl);
@@ -52263,14 +52296,16 @@ async function runDeviceLogin(opts = {}) {
   } catch (e) {
     return {
       ok: false,
-      reason: `Could not reach the node9 cloud: ${e instanceof Error ? e.message : String(e)}`
+      reason: `Could not reach the node9 cloud: ${safeMessage(e)}`
     };
   }
   console.log("");
   console.log(`  Open this link to approve the connection:`);
-  console.log(`  ${import_chalk11.default.cyan.underline(start.verificationUrl)}`);
+  console.log(`  ${import_chalk11.default.cyan.underline(safeMessage(start.verificationUrl, 200))}`);
   console.log("");
-  console.log(`  Code: ${import_chalk11.default.bold(start.userCode)} ${import_chalk11.default.gray("(match it in the browser)")}`);
+  console.log(
+    `  Code: ${import_chalk11.default.bold(safeMessage(start.userCode, 40))} ${import_chalk11.default.gray("(match it in the browser)")}`
+  );
   console.log("");
   const opened = opts.noBrowser ? false : openBrowser(start.verificationUrl);
   console.log(
@@ -52316,6 +52351,7 @@ var fs50 = __toESM(require("fs"));
 var os45 = __toESM(require("os"));
 var path48 = __toESM(require("path"));
 var import_chalk12 = __toESM(require("chalk"));
+init_safe_text();
 async function revokeSelf(creds) {
   const url = creds.apiUrl.replace(/\/$/, "") + "/machines/self/disconnect";
   try {
@@ -52356,7 +52392,7 @@ function registerLogoutCommand(program2) {
     } else if (res.outcome === "already") {
       console.log(import_chalk12.default.gray("\u2713 Cloud: this machine was already disconnected."));
     } else {
-      console.log(import_chalk12.default.yellow(`\u26A0 Could not reach the cloud (${res.detail}).`));
+      console.log(import_chalk12.default.yellow(`\u26A0 Could not reach the cloud (${safeMessage(res.detail)}).`));
       console.log(
         import_chalk12.default.yellow("  The key was removed locally, but is still listed in the dashboard \u2014")
       );
@@ -52663,9 +52699,7 @@ function discardPendingReview(key, now = Date.now()) {
 
 // src/cli/commands/check.ts
 init_hook_payload();
-function sanitize2(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
+init_safe_text();
 function detectAiAgent(payload) {
   const meta = payload.meta;
   if (meta && typeof meta === "object") {
@@ -52911,10 +52945,13 @@ RAW: ${raw}
           const logPath = import_path47.default.join(import_os44.default.homedir(), ".node9", "hook-debug.log");
           if (!import_fs49.default.existsSync(import_path47.default.dirname(logPath)))
             import_fs49.default.mkdirSync(import_path47.default.dirname(logPath), { recursive: true });
-          import_fs49.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
-`);
+          import_fs49.default.appendFileSync(
+            logPath,
+            `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${JSON.stringify(raw)}
+`
+          );
         }
-        const rawToolName = sanitize2(extractToolName(payload));
+        const rawToolName = stripControlChars(extractToolName(payload));
         const toolName = canonicalToolName(rawToolName);
         const toolInput = canonicalToolInput(rawToolName, extractToolInput(payload));
         const agent = agentOverride ?? detectAiAgent(payload);
@@ -53304,6 +53341,7 @@ function containsShellMetachar(token) {
 
 // src/cli/commands/log.ts
 init_hook_payload();
+init_safe_text();
 var TEST_COMMAND_RE2 = /(?:^|\s)(npm\s+(?:run\s+)?test|npx\s+(?:vitest|jest|mocha)|yarn\s+(?:run\s+)?test|pnpm\s+(?:run\s+)?test|vitest|jest|mocha|pytest|py\.test|cargo\s+test|go\s+test|bundle\s+exec\s+rspec|rspec|phpunit|dotnet\s+test)\b/i;
 function detectTestResult(command, output) {
   if (!TEST_COMMAND_RE2.test(command)) return null;
@@ -53322,9 +53360,6 @@ var CONFIDENCE_RANK = { low: 0, medium: 1, high: 2 };
 function atLeastConfidence(c, min) {
   return CONFIDENCE_RANK[c] >= CONFIDENCE_RANK[min];
 }
-function sanitize3(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
 function scanCoveredEverything(value, depth = 0) {
   if (value === null || value === void 0) return true;
   if (typeof value === "string") return value.length <= DLP_SCAN_LIMITS.maxStringBytes;
@@ -53363,7 +53398,7 @@ function registerLogCommand(program2) {
         if (!raw || raw.trim() === "") process.exit(0);
         const payload = JSON.parse(raw);
         if (payload.toolCall === null) process.exit(0);
-        const rawToolName = sanitize3(extractToolName(payload, "unknown"));
+        const rawToolName = stripControlChars(extractToolName(payload, "unknown"));
         const tool = canonicalToolName(rawToolName);
         const rawInput = canonicalToolInput(rawToolName, extractToolInput(payload));
         const metaTag = (() => {
@@ -56195,6 +56230,7 @@ var import_http4 = __toESM(require("http"));
 var import_https7 = __toESM(require("https"));
 var import_url4 = require("url");
 var import_chalk22 = __toESM(require("chalk"));
+init_safe_text();
 function resolveConnectUrl(apiUrl) {
   return resolveCloudEndpoint("/cli/connect", apiUrl);
 }
@@ -56253,7 +56289,7 @@ function registerConnectCommand(program2) {
     try {
       resp = await postConnect(resolveConnectUrl(options.apiUrl), token);
     } catch (e) {
-      console.error(import_chalk22.default.red(`\u2717 ${e instanceof Error ? e.message : "Connect failed."}`));
+      console.error(import_chalk22.default.red(`\u2717 ${safeMessage(e) || "Connect failed."}`));
       process.exitCode = 1;
       return;
     }
@@ -56340,9 +56376,7 @@ init_mcp_pin();
 init_mcp_cmd();
 init_mcp_tools();
 init_daemon();
-function sanitize4(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
+init_safe_text();
 var RPC_INVALID_REQUEST = -32600;
 var RPC_SERVER_ERROR = -32e3;
 function isValidId(id) {
@@ -56366,7 +56400,7 @@ function normalizeClientName(name) {
   if (lower.includes("gemini")) return "Gemini";
   if (lower.includes("cline")) return "Cline";
   if (lower.includes("continue")) return "Continue";
-  const sanitized = sanitize4(name).slice(0, 40);
+  const sanitized = stripControlChars(name).slice(0, 40);
   return sanitized.length > 0 ? sanitized : void 0;
 }
 function reportPinMismatchToCloud(serverKey, serverLabel, agent) {
@@ -56546,7 +56580,7 @@ async function runMcpGateway(upstreamCommand, configName) {
       if (!deferredStdinEnd) agentIn.pause();
       authPending = true;
       try {
-        const toolName = sanitize4(
+        const toolName = stripControlChars(
           String(message.params?.name ?? message.params?.tool_name ?? "unknown")
         );
         const toolArgs = message.params?.arguments ?? message.params?.tool_input ?? {};
@@ -61990,12 +62024,9 @@ var import_chalk42 = __toESM(require("chalk"));
 var import_fs73 = __toESM(require("fs"));
 var import_path68 = __toESM(require("path"));
 var import_os60 = __toESM(require("os"));
+init_safe_text();
 var AUDIT_LOG = import_path68.default.join(import_os60.default.homedir(), ".node9", "audit.log");
 var RESOLVED_FILE = import_path68.default.join(import_os60.default.homedir(), ".node9", "dlp-resolved.json");
-var ANSI_RE = /\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g;
-function stripAnsi(s) {
-  return s.replace(ANSI_RE, "");
-}
 function loadResolved() {
   try {
     const raw = JSON.parse(import_fs73.default.readFileSync(RESOLVED_FILE, "utf-8"));
@@ -62089,10 +62120,10 @@ function registerDlpCommand(program2) {
         "  " + import_chalk42.default.red("\u25CF") + "  " + import_chalk42.default.white(e.dlpPattern ?? "Secret") + import_chalk42.default.dim("  " + fmtDate3(e.ts))
       );
       if (e.dlpSample) {
-        console.log("     " + import_chalk42.default.dim("Sample: ") + import_chalk42.default.yellow(stripAnsi(e.dlpSample)));
+        console.log("     " + import_chalk42.default.dim("Sample: ") + import_chalk42.default.yellow(safeMessage(e.dlpSample)));
       }
       if (e.project) {
-        console.log("     " + import_chalk42.default.dim("Project: ") + import_chalk42.default.dim(stripAnsi(e.project)));
+        console.log("     " + import_chalk42.default.dim("Project: ") + import_chalk42.default.dim(safeMessage(e.project)));
       }
       console.log("");
     }
@@ -62295,6 +62326,7 @@ function registerMaskCommand(program2) {
 
 // src/cli.ts
 init_blast();
+init_safe_text();
 var { version } = JSON.parse(
   import_fs77.default.readFileSync(import_path72.default.join(__dirname, "../package.json"), "utf-8")
 );
@@ -62327,7 +62359,7 @@ program.command("login").argument("[apiKey]", "Service/legacy key. Omit to log i
         cliVersion: version
       });
       if (!res.ok) {
-        console.error(import_chalk45.default.red(`\u2717 ${res.reason}`));
+        console.error(import_chalk45.default.red(`\u2717 ${safeMessage(res.reason)}`));
         process.exitCode = 1;
         return;
       }

package/dist/cli.mjs

@@ -2945,6 +2945,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
 function isIgnoredTool(toolName, config) {
   return matchesPattern(toolName, config.policy.ignoredTools);
 }
+function stripTerminalEscapes(s) {
+  return s.replace(TERMINAL_ESCAPE_RE, "");
+}
+function stripControlChars(s) {
+  return s.replace(CONTROL_CHAR_RE, "");
+}
+function safeMessage(value, max = 300) {
+  const raw = typeof value === "string" ? value : value instanceof Error ? value.message : String(value ?? "");
+  const s = stripTerminalEscapes(raw).replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -3162,7 +3173,10 @@ function computeSecurityScore(opts) {
 }
 function truncateBlastPath(full) {
   if (!full) return "";
-  const cleaned = full.replace(/[/\\]+$/, "");
+  if (full.length > MAX_BLAST_PATH) full = full.slice(-MAX_BLAST_PATH);
+  let end = full.length;
+  while (end > 0 && (full[end - 1] === "/" || full[end - 1] === "\\")) end--;
+  const cleaned = full.slice(0, end);
   const parts = cleaned.split(/[/\\]+/).filter((p) => p.length > 0);
   if (parts.length <= 2) {
     return cleaned.startsWith("~") && !cleaned.startsWith("~/") ? cleaned : cleaned.startsWith("~/") ? cleaned : parts.join("/");
@@ -3658,7 +3672,7 @@ function toScanFinding(c) {
 }
 function previewArgs(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
-  const s = String(cmd).replace(TERMINAL_ESCAPE_RE, "").replace(/\s+/g, " ").trim();
+  const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
   return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
 }
 function makeFinding(args) {
@@ -3698,7 +3712,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -5325,6 +5339,8 @@ var init_dist = __esm({
       block: 2
     };
     SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
+    TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+    CONTROL_CHAR_RE = /[\x00-\x1F\x7F]/g;
     aws_default = {
       name: "aws",
       description: "Protects AWS infrastructure from destructive AI operations",
@@ -6102,6 +6118,7 @@ var init_dist = __esm({
       longOutputRedactions: 1
     };
     LOOP_THRESHOLD_FOR_WASTE = 3;
+    MAX_BLAST_PATH = 4096;
     DESTRUCTIVE_OP_RE = /\brm\s+-[rRf]+\b|\bDROP\s+(TABLE|DATABASE|COLLECTION|SCHEMA)\b|\bTRUNCATE\s+TABLE\b|\bgit\s+push\s+(--force|-f)\b|\bFLUSHALL\b|\bFLUSHDB\b|\bkubectl\s+delete\b|\bhelm\s+uninstall\b/i;
     SENSITIVE_PATH_RE = /[\\/]\.aws(?:[\\/]|$)|^\.aws[\\/]|[\\/]\.ssh(?:[\\/]|$)|^\.ssh[\\/]|(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
     FILE_TOOLS = /* @__PURE__ */ new Set([
@@ -6182,8 +6199,6 @@ var init_dist = __esm({
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
     CANONICAL_EXTRACTOR_VERSION = "canonical-v15";
     DEDUPE_PREVIEW_LEN = 120;
-    TERMINAL_ESCAPE_RE = // eslint-disable-next-line no-control-regex
-    /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     ENGINE_VERSION = "1.4.0";
   }
 });
@@ -8731,6 +8746,14 @@ var init_context_sniper = __esm({
   }
 });
 
+// src/utils/safe-text.ts
+var init_safe_text = __esm({
+  "src/utils/safe-text.ts"() {
+    "use strict";
+    init_dist();
+  }
+});
+
 // src/ui/native.ts
 import { spawn } from "child_process";
 import path11 from "path";
@@ -8842,7 +8865,7 @@ function escapePango(text) {
 function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1, ruleDescription) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
-  const safeAgent = (agent ?? "AI Agent").replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "").slice(0, 80);
+  const safeAgent = safeMessage(agent ?? "AI Agent", 80);
   lines.push(`\u{1F916} ${safeAgent}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   if (ruleDescription) lines.push(`\u2139  ${ruleDescription}`);
@@ -8977,6 +9000,7 @@ var init_native = __esm({
   "src/ui/native.ts"() {
     "use strict";
     init_context_sniper();
+    init_safe_text();
     isTestEnv = () => {
       return process.env.NODE_ENV === "test" || process.env.VITEST === "true" || !!process.env.VITEST || process.env.CI === "true" || !!process.env.CI || process.env.NODE9_TESTING === "1";
     };
@@ -9366,14 +9390,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     if (!res.ok) {
       fs12.appendFileSync(
         HOOK_DEBUG_LOG,
-        `[resolve-cloud] PATCH ${resolveUrl} \u2192 HTTP ${res.status}
+        `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err2) {
     fs12.appendFileSync(
       HOOK_DEBUG_LOG,
-      `[resolve-cloud] PATCH failed for ${requestId}: ${err2.message}
+      `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err2)}
 `
     );
   }
@@ -9383,6 +9407,7 @@ var init_cloud = __esm({
   "src/auth/cloud.ts"() {
     "use strict";
     init_audit();
+    init_safe_text();
     DLP_SAMPLE_MAX_LEN = 200;
     DLP_PATTERN_MAX_LEN = 100;
     KNOWN_CHECKED_BY = /* @__PURE__ */ new Set([
@@ -9515,9 +9540,8 @@ async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = randomUUID2();
     const actTs = Date.now();
-    const stripAnsi2 = (s) => s.replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "");
-    const sanitizedAgent = meta?.agent ? stripAnsi2(meta.agent).slice(0, 80) : void 0;
-    const sanitizedMcpServer = meta?.mcpServer ? stripAnsi2(meta.mcpServer).slice(0, 40) : void 0;
+    const sanitizedAgent = meta?.agent ? safeMessage(meta.agent, 80) : void 0;
+    const sanitizedMcpServer = meta?.mcpServer ? safeMessage(meta.mcpServer, 40) : void 0;
     const socketOk = await notifyActivity({
       id: actId,
       ts: actTs,
@@ -10392,6 +10416,7 @@ var init_orchestrator = __esm({
     init_loop_detector();
     init_shields();
     init_jail();
+    init_safe_text();
     WRITE_TOOLS = /* @__PURE__ */ new Set([
       "write",
       "write_file",
@@ -14997,7 +15022,7 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         }
       }
     } catch (err2) {
-      fs26.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${err2.message}
+      fs26.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${safeMessage(err2)}
 `);
     }
   }
@@ -15036,6 +15061,7 @@ var init_costSync = __esm({
     init_cost_gemini();
     init_cost_copilot();
     init_session_files();
+    init_safe_text();
     SYNC_INTERVAL_MS = 10 * 60 * 1e3;
     claudeSource = {
       id: "claude",
@@ -15871,9 +15897,6 @@ function fmtTs(ts) {
     return ts.slice(0, 10);
   }
 }
-function stripTerminalEscapes(s) {
-  return s.replace(TERMINAL_ESCAPE_RE2, "");
-}
 function preview(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
   const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
@@ -18588,7 +18611,7 @@ function registerScanCommand(program2) {
     }
   );
 }
-var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, TERMINAL_ESCAPE_RE2, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS, STUCK_TOOLS_MIN_WASTE, STUCK_TOOLS_LIMIT, RECURRING_SESSION_THRESHOLD, STALE_AGE_DAYS, classifyRuleSeverity2, narrativeRuleLabel2;
+var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS, STUCK_TOOLS_MIN_WASTE, STUCK_TOOLS_LIMIT, RECURRING_SESSION_THRESHOLD, STALE_AGE_DAYS, classifyRuleSeverity2, narrativeRuleLabel2;
 var init_scan = __esm({
   "src/cli/commands/scan.ts"() {
     "use strict";
@@ -18614,6 +18637,7 @@ var init_scan = __esm({
     init_scan_json();
     init_session_files();
     init_scan_history();
+    init_safe_text();
     toolInspectionMap = DEFAULT_CONFIG.policy.toolInspection;
     CODE_EXTENSIONS = /* @__PURE__ */ new Set([
       ".ts",
@@ -18648,7 +18672,6 @@ var init_scan = __esm({
       /\bseverity:\s*['"](?:block|review|allow)['"]/,
       /NODE9 SECURITY ALERT/
     ];
-    TERMINAL_ESCAPE_RE2 = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     LOOP_TOOLS = /* @__PURE__ */ new Set([
       "bash",
       "execute_bash",
@@ -19139,7 +19162,7 @@ function atomicWriteSync2(filePath, data, options) {
 function redactArgs(value) {
   if (!value || typeof value !== "object") return value;
   if (Array.isArray(value)) return value.map(redactArgs);
-  const result = {};
+  const result = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(value)) {
     result[k] = SECRET_KEY_RE.test(k) ? "[REDACTED]" : redactArgs(v);
   }
@@ -23491,7 +23514,7 @@ data: ${JSON.stringify(item.data)}
     if (req.method === "GET" && pathname === "/state/check") {
       const predicatesParam = reqUrl.searchParams.get("predicates") ?? "";
       const predicates = predicatesParam.split(",").filter(Boolean);
-      const results = {};
+      const results = /* @__PURE__ */ Object.create(null);
       for (const p of predicates) {
         results[p] = sessionHistory.checkPredicate(p);
       }
@@ -51226,7 +51249,7 @@ async function startTail(options = {}) {
   req.on("error", (err2) => {
     const msg = err2.code === "ECONNREFUSED" ? "Daemon is not running. Start it with: node9 daemon start" : err2.message;
     console.error(chalk44.red(`
-\u274C ${msg}`));
+\u274C ${safeMessage(msg)}`));
     process.exit(1);
   });
 }
@@ -51237,6 +51260,7 @@ var init_tail = __esm({
     init_startup_log();
     init_daemon2();
     init_daemon();
+    init_safe_text();
     PID_FILE = path74.join(os66.homedir(), ".node9", "daemon.pid");
     ICONS = {
       bash: "\u{1F4BB}",
@@ -51883,9 +51907,7 @@ function shellInvocation(command) {
 }
 
 // src/proxy/index.ts
-function sanitize(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
+init_safe_text();
 async function runProxy(targetCommand) {
   const commandParts = parseCommandString(targetCommand);
   const cmd = commandParts[0];
@@ -51921,7 +51943,7 @@ async function runProxy(targetCommand) {
       try {
         const name = message.params?.name || message.params?.tool_name || "unknown";
         const toolArgs = message.params?.arguments || message.params?.tool_input || {};
-        const result = await authorizeHeadless(sanitize(name), toolArgs, {
+        const result = await authorizeHeadless(stripControlChars(name), toolArgs, {
           agent: "Proxy/MCP"
         });
         if (!result.approved) {
@@ -52169,17 +52191,27 @@ init_machine_id();
 
 // src/utils/open-browser.ts
 import { spawn as spawn4 } from "child_process";
+function isOpenableUrl(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:") return false;
+  return !/[\x00-\x20\x7F"'`]/.test(url);
+}
 function openBrowser(url) {
+  if (!isOpenableUrl(url)) return false;
   if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return false;
   if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
     return false;
   }
-  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
   try {
-    const child = spawn4(opener, [url], {
+    const child = spawn4(cmd, args, {
       stdio: "ignore",
-      detached: true,
-      shell: process.platform === "win32"
+      detached: true
     });
     child.on("error", () => {
     });
@@ -52240,6 +52272,7 @@ function postJson2(url, body, bearer) {
 }
 
 // src/auth/device-login.ts
+init_safe_text();
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function runDeviceLogin(opts = {}) {
   const startUrl = resolveCloudEndpoint("/device/start", opts.apiUrl);
@@ -52255,14 +52288,16 @@ async function runDeviceLogin(opts = {}) {
   } catch (e) {
     return {
       ok: false,
-      reason: `Could not reach the node9 cloud: ${e instanceof Error ? e.message : String(e)}`
+      reason: `Could not reach the node9 cloud: ${safeMessage(e)}`
     };
   }
   console.log("");
   console.log(`  Open this link to approve the connection:`);
-  console.log(`  ${chalk11.cyan.underline(start.verificationUrl)}`);
+  console.log(`  ${chalk11.cyan.underline(safeMessage(start.verificationUrl, 200))}`);
   console.log("");
-  console.log(`  Code: ${chalk11.bold(start.userCode)} ${chalk11.gray("(match it in the browser)")}`);
+  console.log(
+    `  Code: ${chalk11.bold(safeMessage(start.userCode, 40))} ${chalk11.gray("(match it in the browser)")}`
+  );
   console.log("");
   const opened = opts.noBrowser ? false : openBrowser(start.verificationUrl);
   console.log(
@@ -52308,6 +52343,7 @@ import * as fs50 from "fs";
 import * as os45 from "os";
 import * as path48 from "path";
 import chalk12 from "chalk";
+init_safe_text();
 async function revokeSelf(creds) {
   const url = creds.apiUrl.replace(/\/$/, "") + "/machines/self/disconnect";
   try {
@@ -52348,7 +52384,7 @@ function registerLogoutCommand(program2) {
     } else if (res.outcome === "already") {
       console.log(chalk12.gray("\u2713 Cloud: this machine was already disconnected."));
     } else {
-      console.log(chalk12.yellow(`\u26A0 Could not reach the cloud (${res.detail}).`));
+      console.log(chalk12.yellow(`\u26A0 Could not reach the cloud (${safeMessage(res.detail)}).`));
       console.log(
         chalk12.yellow("  The key was removed locally, but is still listed in the dashboard \u2014")
       );
@@ -52655,9 +52691,7 @@ function discardPendingReview(key, now = Date.now()) {
 
 // src/cli/commands/check.ts
 init_hook_payload();
-function sanitize2(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
+init_safe_text();
 function detectAiAgent(payload) {
   const meta = payload.meta;
   if (meta && typeof meta === "object") {
@@ -52903,10 +52937,13 @@ RAW: ${raw}
           const logPath = path51.join(os48.homedir(), ".node9", "hook-debug.log");
           if (!fs53.existsSync(path51.dirname(logPath)))
             fs53.mkdirSync(path51.dirname(logPath), { recursive: true });
-          fs53.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
-`);
+          fs53.appendFileSync(
+            logPath,
+            `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${JSON.stringify(raw)}
+`
+          );
         }
-        const rawToolName = sanitize2(extractToolName(payload));
+        const rawToolName = stripControlChars(extractToolName(payload));
         const toolName = canonicalToolName(rawToolName);
         const toolInput = canonicalToolInput(rawToolName, extractToolInput(payload));
         const agent = agentOverride ?? detectAiAgent(payload);
@@ -53296,6 +53333,7 @@ function containsShellMetachar(token) {
 
 // src/cli/commands/log.ts
 init_hook_payload();
+init_safe_text();
 var TEST_COMMAND_RE2 = /(?:^|\s)(npm\s+(?:run\s+)?test|npx\s+(?:vitest|jest|mocha)|yarn\s+(?:run\s+)?test|pnpm\s+(?:run\s+)?test|vitest|jest|mocha|pytest|py\.test|cargo\s+test|go\s+test|bundle\s+exec\s+rspec|rspec|phpunit|dotnet\s+test)\b/i;
 function detectTestResult(command, output) {
   if (!TEST_COMMAND_RE2.test(command)) return null;
@@ -53314,9 +53352,6 @@ var CONFIDENCE_RANK = { low: 0, medium: 1, high: 2 };
 function atLeastConfidence(c, min) {
   return CONFIDENCE_RANK[c] >= CONFIDENCE_RANK[min];
 }
-function sanitize3(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
 function scanCoveredEverything(value, depth = 0) {
   if (value === null || value === void 0) return true;
   if (typeof value === "string") return value.length <= DLP_SCAN_LIMITS.maxStringBytes;
@@ -53355,7 +53390,7 @@ function registerLogCommand(program2) {
         if (!raw || raw.trim() === "") process.exit(0);
         const payload = JSON.parse(raw);
         if (payload.toolCall === null) process.exit(0);
-        const rawToolName = sanitize3(extractToolName(payload, "unknown"));
+        const rawToolName = stripControlChars(extractToolName(payload, "unknown"));
         const tool = canonicalToolName(rawToolName);
         const rawInput = canonicalToolInput(rawToolName, extractToolInput(payload));
         const metaTag = (() => {
@@ -56187,6 +56222,7 @@ import http5 from "http";
 import https8 from "https";
 import { URL as URL5 } from "url";
 import chalk22 from "chalk";
+init_safe_text();
 function resolveConnectUrl(apiUrl) {
   return resolveCloudEndpoint("/cli/connect", apiUrl);
 }
@@ -56245,7 +56281,7 @@ function registerConnectCommand(program2) {
     try {
       resp = await postConnect(resolveConnectUrl(options.apiUrl), token);
     } catch (e) {
-      console.error(chalk22.red(`\u2717 ${e instanceof Error ? e.message : "Connect failed."}`));
+      console.error(chalk22.red(`\u2717 ${safeMessage(e) || "Connect failed."}`));
       process.exitCode = 1;
       return;
     }
@@ -56332,9 +56368,7 @@ init_mcp_pin();
 init_mcp_cmd();
 init_mcp_tools();
 init_daemon();
-function sanitize4(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
+init_safe_text();
 var RPC_INVALID_REQUEST = -32600;
 var RPC_SERVER_ERROR = -32e3;
 function isValidId(id) {
@@ -56358,7 +56392,7 @@ function normalizeClientName(name) {
   if (lower.includes("gemini")) return "Gemini";
   if (lower.includes("cline")) return "Cline";
   if (lower.includes("continue")) return "Continue";
-  const sanitized = sanitize4(name).slice(0, 40);
+  const sanitized = stripControlChars(name).slice(0, 40);
   return sanitized.length > 0 ? sanitized : void 0;
 }
 function reportPinMismatchToCloud(serverKey, serverLabel, agent) {
@@ -56538,7 +56572,7 @@ async function runMcpGateway(upstreamCommand, configName) {
       if (!deferredStdinEnd) agentIn.pause();
       authPending = true;
       try {
-        const toolName = sanitize4(
+        const toolName = stripControlChars(
           String(message.params?.name ?? message.params?.tool_name ?? "unknown")
         );
         const toolArgs = message.params?.arguments ?? message.params?.tool_input ?? {};
@@ -61978,16 +62012,13 @@ Persistent decisions  (${entries.length})
 }
 
 // src/cli/commands/dlp.ts
+init_safe_text();
 import chalk42 from "chalk";
 import fs77 from "fs";
 import path72 from "path";
 import os64 from "os";
 var AUDIT_LOG = path72.join(os64.homedir(), ".node9", "audit.log");
 var RESOLVED_FILE = path72.join(os64.homedir(), ".node9", "dlp-resolved.json");
-var ANSI_RE = /\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g;
-function stripAnsi(s) {
-  return s.replace(ANSI_RE, "");
-}
 function loadResolved() {
   try {
     const raw = JSON.parse(fs77.readFileSync(RESOLVED_FILE, "utf-8"));
@@ -62081,10 +62112,10 @@ function registerDlpCommand(program2) {
         "  " + chalk42.red("\u25CF") + "  " + chalk42.white(e.dlpPattern ?? "Secret") + chalk42.dim("  " + fmtDate3(e.ts))
       );
       if (e.dlpSample) {
-        console.log("     " + chalk42.dim("Sample: ") + chalk42.yellow(stripAnsi(e.dlpSample)));
+        console.log("     " + chalk42.dim("Sample: ") + chalk42.yellow(safeMessage(e.dlpSample)));
       }
       if (e.project) {
-        console.log("     " + chalk42.dim("Project: ") + chalk42.dim(stripAnsi(e.project)));
+        console.log("     " + chalk42.dim("Project: ") + chalk42.dim(safeMessage(e.project)));
       }
       console.log("");
     }
@@ -62287,6 +62318,7 @@ function registerMaskCommand(program2) {
 
 // src/cli.ts
 init_blast();
+init_safe_text();
 var { version } = JSON.parse(
   fs81.readFileSync(path76.join(__dirname, "../package.json"), "utf-8")
 );
@@ -62319,7 +62351,7 @@ program.command("login").argument("[apiKey]", "Service/legacy key. Omit to log i
         cliVersion: version
       });
       if (!res.ok) {
-        console.error(chalk45.red(`\u2717 ${res.reason}`));
+        console.error(chalk45.red(`\u2717 ${safeMessage(res.reason)}`));
         process.exitCode = 1;
         return;
       }

package/dist/dashboard.mjs

@@ -1775,6 +1775,9 @@ function classifySsrf(host) {
     return null;
   }
 }
+function stripTerminalEscapes(s) {
+  return s.replace(TERMINAL_ESCAPE_RE, "");
+}
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -1936,7 +1939,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var B58, B58_INDEX, XPRV_VERSIONS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SOURCE_COMMANDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var B58, B58_INDEX, XPRV_VERSIONS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SOURCE_COMMANDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, TERMINAL_ESCAPE_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3150,6 +3153,7 @@ var init_dist = __esm({
       const p = a.split(".");
       return p.length === 4 ? p.map(Number) : null;
     };
+    TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     aws_default = {
       name: "aws",
       description: "Protects AWS infrastructure from destructive AI operations",
@@ -5678,6 +5682,14 @@ var init_session_files = __esm({
   }
 });
 
+// src/utils/safe-text.ts
+var init_safe_text = __esm({
+  "src/utils/safe-text.ts"() {
+    "use strict";
+    init_dist();
+  }
+});
+
 // src/costSync.ts
 function decodeProjectDirName(dirName) {
   return dirName.replace(/-/g, "/");
@@ -5693,6 +5705,7 @@ var init_costSync = __esm({
     init_cost_gemini();
     init_cost_copilot();
     init_session_files();
+    init_safe_text();
     SYNC_INTERVAL_MS = 10 * 60 * 1e3;
   }
 });
@@ -6666,9 +6679,6 @@ function isNode9SelfOutput(text) {
   }
   return false;
 }
-function stripTerminalEscapes(s) {
-  return s.replace(TERMINAL_ESCAPE_RE, "");
-}
 function preview(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
   const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
@@ -7644,7 +7654,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
   }
   return result;
 }
-var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, TERMINAL_ESCAPE_RE, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
+var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
 var init_scan = __esm({
   "src/cli/commands/scan.ts"() {
     "use strict";
@@ -7670,6 +7680,7 @@ var init_scan = __esm({
     init_scan_json();
     init_session_files();
     init_scan_history();
+    init_safe_text();
     toolInspectionMap = DEFAULT_CONFIG.policy.toolInspection;
     CODE_EXTENSIONS = /* @__PURE__ */ new Set([
       ".ts",
@@ -7704,7 +7715,6 @@ var init_scan = __esm({
       /\bseverity:\s*['"](?:block|review|allow)['"]/,
       /NODE9 SECURITY ALERT/
     ];
-    TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     LOOP_TOOLS = /* @__PURE__ */ new Set([
       "bash",
       "execute_bash",

package/dist/index.js

@@ -4484,6 +4484,15 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
 function isIgnoredTool(toolName, config) {
   return matchesPattern(toolName, config.policy.ignoredTools);
 }
+var TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+function stripTerminalEscapes(s) {
+  return s.replace(TERMINAL_ESCAPE_RE, "");
+}
+function safeMessage(value, max = 300) {
+  const raw = typeof value === "string" ? value : value instanceof Error ? value.message : String(value ?? "");
+  const s = stripTerminalEscapes(raw).replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
 var aws_default = {
   name: "aws",
   description: "Protects AWS infrastructure from destructive AI operations",
@@ -7483,7 +7492,7 @@ function escapePango(text) {
 function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1, ruleDescription) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
-  const safeAgent = (agent ?? "AI Agent").replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "").slice(0, 80);
+  const safeAgent = safeMessage(agent ?? "AI Agent", 80);
   lines.push(`\u{1F916} ${safeAgent}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   if (ruleDescription) lines.push(`\u2139  ${ruleDescription}`);
@@ -7811,14 +7820,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     if (!res.ok) {
       import_fs11.default.appendFileSync(
         HOOK_DEBUG_LOG,
-        `[resolve-cloud] PATCH ${resolveUrl} \u2192 HTTP ${res.status}
+        `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
     import_fs11.default.appendFileSync(
       HOOK_DEBUG_LOG,
-      `[resolve-cloud] PATCH failed for ${requestId}: ${err.message}
+      `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err)}
 `
     );
   }
@@ -7919,9 +7928,8 @@ async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = (0, import_crypto5.randomUUID)();
     const actTs = Date.now();
-    const stripAnsi = (s) => s.replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "");
-    const sanitizedAgent = meta?.agent ? stripAnsi(meta.agent).slice(0, 80) : void 0;
-    const sanitizedMcpServer = meta?.mcpServer ? stripAnsi(meta.mcpServer).slice(0, 40) : void 0;
+    const sanitizedAgent = meta?.agent ? safeMessage(meta.agent, 80) : void 0;
+    const sanitizedMcpServer = meta?.mcpServer ? safeMessage(meta.mcpServer, 40) : void 0;
     const socketOk = await notifyActivity({
       id: actId,
       ts: actTs,

package/dist/index.mjs

@@ -4454,6 +4454,15 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
 function isIgnoredTool(toolName, config) {
   return matchesPattern(toolName, config.policy.ignoredTools);
 }
+var TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+function stripTerminalEscapes(s) {
+  return s.replace(TERMINAL_ESCAPE_RE, "");
+}
+function safeMessage(value, max = 300) {
+  const raw = typeof value === "string" ? value : value instanceof Error ? value.message : String(value ?? "");
+  const s = stripTerminalEscapes(raw).replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
 var aws_default = {
   name: "aws",
   description: "Protects AWS infrastructure from destructive AI operations",
@@ -7453,7 +7462,7 @@ function escapePango(text) {
 function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1, ruleDescription) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
-  const safeAgent = (agent ?? "AI Agent").replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "").slice(0, 80);
+  const safeAgent = safeMessage(agent ?? "AI Agent", 80);
   lines.push(`\u{1F916} ${safeAgent}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   if (ruleDescription) lines.push(`\u2139  ${ruleDescription}`);
@@ -7781,14 +7790,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     if (!res.ok) {
       fs11.appendFileSync(
         HOOK_DEBUG_LOG,
-        `[resolve-cloud] PATCH ${resolveUrl} \u2192 HTTP ${res.status}
+        `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
     fs11.appendFileSync(
       HOOK_DEBUG_LOG,
-      `[resolve-cloud] PATCH failed for ${requestId}: ${err.message}
+      `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err)}
 `
     );
   }
@@ -7889,9 +7898,8 @@ async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = randomUUID();
     const actTs = Date.now();
-    const stripAnsi = (s) => s.replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "");
-    const sanitizedAgent = meta?.agent ? stripAnsi(meta.agent).slice(0, 80) : void 0;
-    const sanitizedMcpServer = meta?.mcpServer ? stripAnsi(meta.mcpServer).slice(0, 40) : void 0;
+    const sanitizedAgent = meta?.agent ? safeMessage(meta.agent, 80) : void 0;
+    const sanitizedMcpServer = meta?.mcpServer ? safeMessage(meta.mcpServer, 40) : void 0;
     const socketOk = await notifyActivity({
       id: actId,
       ts: actTs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.14.1",
+  "version": "2.14.2",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",