@rulvar/cli 1.20.0 → 1.22.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { r as runCli, t as processIo } from "./io-74cSn0r8.js";
+import { r as runCli, t as processIo } from "./io-RtHEIn0r.js";
 import { inspect } from "node:util";
 //#region src/cli.ts
 /**

package/dist/index.d.ts

@@ -227,7 +227,12 @@ interface Worker {
 declare function createWorker(engine: Engine, options: CreateWorkerOptions): Worker;
 //#endregion
 //#region src/tui.d.ts
-/** Renders one event to a line, or undefined for silent event types. */
+/**
+* Renders one event to a line, or undefined for silent event types. The
+* composed line is sanitized so an untrusted provider/tool/log string
+* cannot inject a control sequence or a second physical line (v1.21.0
+* review P2-1).
+*/
 declare function renderEventLine(event: WorkflowEvent): string | undefined;
 /** Attaches the renderer to a handle's event stream; returns a detach. */
 declare function attachProgress(handle: RunHandle<unknown>, io: CliIo): () => void;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as resumeCommand, c as driveRun, d as renderEventLine, f as DEFAULT_STORE_DIR, g as looksLikeFile, h as loadWorkflowModule, i as inspectCommand, l as reportOutcome, m as loadCliConfig, n as HELP, o as runCommand, p as assembleEngine, r as runCli, s as runsLsCommand, t as processIo, u as attachProgress } from "./io-74cSn0r8.js";
+import { a as resumeCommand, c as driveRun, d as renderEventLine, f as DEFAULT_STORE_DIR, g as looksLikeFile, h as loadWorkflowModule, i as inspectCommand, l as reportOutcome, m as loadCliConfig, n as HELP, o as runCommand, p as assembleEngine, r as runCli, s as runsLsCommand, t as processIo, u as attachProgress } from "./io-RtHEIn0r.js";
 import { ConfigError, InvalidResolutionError, JournalCompatibilityError, LeaseHeldError, Replayer, RulvarError, buildDeriverRegistry, costReportFromJournal, maskSecrets, normalizeEntry, scanJournalCompatibility, validateSchemaSpec } from "@rulvar/core";
 //#region src/server.ts
 /**

package/dist/{io-74cSn0r8.js → io-RtHEIn0r.js}

@@ -1,4 +1,4 @@
-import { ConfigError, FileModelKnowledgeStore, INBOX_PROPOSAL_TTL_DAYS, JsonlFileStore, claimExpired, claimExpiry, compilePermissionPreset, costReportFromJournal, createEngine, parseModelRef, priceUsdOf, proposalStatement, remeasureQueue, resolvePricing, runProfile } from "@rulvar/core";
+import { ConfigError, FileModelKnowledgeStore, INBOX_PROPOSAL_TTL_DAYS, JsonlFileStore, claimExpired, claimExpiry, compilePermissionPreset, costReportFromJournal, createEngine, parseModelRef, priceUsdOf, proposalStatement, remeasureQueue, resolvePricing, runProfile, sanitizeTerminalText } from "@rulvar/core";
 import { join, resolve } from "node:path";
 import { existsSync, statSync } from "node:fs";
 import { pathToFileURL } from "node:url";
@@ -168,11 +168,27 @@ function applyRunProfile(profile, host) {
 }
 //#endregion
 //#region src/tui.ts
+/**
+* TUI progress renderer over the WorkflowEvent stream. Line-oriented: one compact line per
+* lifecycle event, replay-marked events dimmed with a prefix, a cost
+* and usage summary at run:end. TTY gets no special screen handling in
+* v1 beyond being the default sink; piped output stays byte-stable for
+* tests and logs.
+*/
 function money(usd) {
 	return `$${usd.toFixed(4)}`;
 }
-/** Renders one event to a line, or undefined for silent event types. */
+/**
+* Renders one event to a line, or undefined for silent event types. The
+* composed line is sanitized so an untrusted provider/tool/log string
+* cannot inject a control sequence or a second physical line (v1.21.0
+* review P2-1).
+*/
 function renderEventLine(event) {
+	const line = rawEventLine(event);
+	return line === void 0 ? void 0 : sanitizeTerminalText(line);
+}
+function rawEventLine(event) {
 	const replayMark = event.replayed === true ? "replay " : "";
 	switch (event.type) {
 		case "run:start": return `run ${event.runId} ${event.resumed ? "resumed" : "started"} (workflow ${event.workflow})`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/cli",
-  "version": "1.20.0",
+  "version": "1.22.0",
   "description": "Rulvar shell: run/resume/runs/inspect/plan/kb commands, TUI progress, createServer, createWorker, OTel exporter.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,17 +22,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@rulvar/core": "1.20.0"
+    "@rulvar/core": "1.22.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",
     "tsdown": "^0.22.3",
     "typescript": "~6.0.3",
-    "@rulvar/planner": "1.20.0",
-    "@rulvar/testing": "1.20.0",
-    "@rulvar/store-sqlite": "1.20.0",
-    "@rulvar/plan": "1.20.0",
-    "@rulvar/evals": "1.20.0"
+    "@rulvar/planner": "1.22.0",
+    "@rulvar/plan": "1.22.0",
+    "@rulvar/store-sqlite": "1.22.0",
+    "@rulvar/evals": "1.22.0",
+    "@rulvar/testing": "1.22.0"
   },
   "bin": {
     "rulvar": "./dist/cli.js"