@rulvar/cli 1.21.0 → 1.23.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { r as runCli, t as processIo } from "./io-74cSn0r8.js";
+import { r as runCli, t as processIo } from "./io-Dh-Fa5Nf.js";
 import { inspect } from "node:util";
 //#region src/cli.ts
 /**

package/dist/index.d.ts

@@ -227,7 +227,12 @@ interface Worker {
 declare function createWorker(engine: Engine, options: CreateWorkerOptions): Worker;
 //#endregion
 //#region src/tui.d.ts
-/** Renders one event to a line, or undefined for silent event types. */
+/**
+* Renders one event to a line, or undefined for silent event types. The
+* composed line is sanitized so an untrusted provider/tool/log string
+* cannot inject a control sequence or a second physical line (v1.21.0
+* review P2-1).
+*/
 declare function renderEventLine(event: WorkflowEvent): string | undefined;
 /** Attaches the renderer to a handle's event stream; returns a detach. */
 declare function attachProgress(handle: RunHandle<unknown>, io: CliIo): () => void;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as resumeCommand, c as driveRun, d as renderEventLine, f as DEFAULT_STORE_DIR, g as looksLikeFile, h as loadWorkflowModule, i as inspectCommand, l as reportOutcome, m as loadCliConfig, n as HELP, o as runCommand, p as assembleEngine, r as runCli, s as runsLsCommand, t as processIo, u as attachProgress } from "./io-74cSn0r8.js";
+import { a as resumeCommand, c as driveRun, d as renderEventLine, f as DEFAULT_STORE_DIR, g as looksLikeFile, h as loadWorkflowModule, i as inspectCommand, l as reportOutcome, m as loadCliConfig, n as HELP, o as runCommand, p as assembleEngine, r as runCli, s as runsLsCommand, t as processIo, u as attachProgress } from "./io-Dh-Fa5Nf.js";
 import { ConfigError, InvalidResolutionError, JournalCompatibilityError, LeaseHeldError, Replayer, RulvarError, buildDeriverRegistry, costReportFromJournal, maskSecrets, normalizeEntry, scanJournalCompatibility, validateSchemaSpec } from "@rulvar/core";
 //#region src/server.ts
 /**

package/dist/{io-74cSn0r8.js → io-Dh-Fa5Nf.js}

@@ -1,4 +1,4 @@
-import { ConfigError, FileModelKnowledgeStore, INBOX_PROPOSAL_TTL_DAYS, JsonlFileStore, claimExpired, claimExpiry, compilePermissionPreset, costReportFromJournal, createEngine, parseModelRef, priceUsdOf, proposalStatement, remeasureQueue, resolvePricing, runProfile } from "@rulvar/core";
+import { ConfigError, FileModelKnowledgeStore, INBOX_PROPOSAL_TTL_DAYS, JsonlFileStore, claimExpired, claimExpiry, compilePermissionPreset, costReportFromJournal, createEngine, parseModelRef, priceUsdOf, proposalStatement, remeasureQueue, resolvePricing, runProfile, sanitizeTerminalText } from "@rulvar/core";
 import { join, resolve } from "node:path";
 import { existsSync, statSync } from "node:fs";
 import { pathToFileURL } from "node:url";
@@ -168,24 +168,43 @@ function applyRunProfile(profile, host) {
 }
 //#endregion
 //#region src/tui.ts
+/**
+* TUI progress renderer over the WorkflowEvent stream. Line-oriented: one compact line per
+* lifecycle event, replay-marked events dimmed with a prefix, a cost
+* and usage summary at run:end. TTY gets no special screen handling in
+* v1 beyond being the default sink; piped output stays byte-stable for
+* tests and logs.
+*/
 function money(usd) {
 	return `$${usd.toFixed(4)}`;
 }
-/** Renders one event to a line, or undefined for silent event types. */
+/**
+* Renders one event to a line, or undefined for silent event types. The
+* composed line is sanitized so an untrusted provider/tool/log string
+* cannot inject a control sequence or a second physical line (v1.21.0
+* review P2-1).
+*/
 function renderEventLine(event) {
+	const line = rawEventLine(event);
+	return line === void 0 ? void 0 : sanitizeTerminalText(line);
+}
+function rawEventLine(event) {
 	const replayMark = event.replayed === true ? "replay " : "";
+	const str = (value) => typeof value === "string" ? value : "";
+	const num = (value) => typeof value === "number" && Number.isFinite(value) ? value : 0;
+	const who = str(event.agentType) || "(anon)";
 	switch (event.type) {
-		case "run:start": return `run ${event.runId} ${event.resumed ? "resumed" : "started"} (workflow ${event.workflow})`;
-		case "phase:start": return `phase ${event.phase}`;
-		case "agent:start": return `${replayMark}agent ${event.agentType || "(anon)"}${event.label === void 0 ? "" : ` [${event.label}]`} ${event.role} on ${event.model}`;
-		case "agent:end": return `${replayMark}agent ${event.agentType || "(anon)"} ${event.status} (${money(event.costUsd)}, ${event.usage.inputTokens + event.usage.outputTokens} tok)`;
-		case "agent:error": return `agent ${event.agentType || "(anon)"} error: ${event.error.message}${event.willRetry ? " (will retry)" : ""}`;
-		case "agent:queued": return `agent ${event.agentType || "(anon)"} queued`;
-		case "tool:start": return `${replayMark}tool ${event.toolName}`;
-		case "tool:end": return `${replayMark}tool ${event.toolName} ${event.outcome} (${event.durationMs}ms)`;
-		case "approval:pending": return `approval pending: tool ${event.toolName} (entry ${event.entryRef})`;
-		case "log": return event.level === "debug" ? void 0 : `${event.level}: ${event.msg}`;
-		case "run:end": return `run ${event.runId} ${event.status}`;
+		case "run:start": return `run ${str(event.runId)} ${event.resumed === true ? "resumed" : "started"} (workflow ${str(event.workflow)})`;
+		case "phase:start": return `phase ${str(event.phase)}`;
+		case "agent:start": return `${replayMark}agent ${who}${str(event.label) === "" ? "" : ` [${str(event.label)}]`} ${str(event.role)} on ${str(event.model)}`;
+		case "agent:end": return `${replayMark}agent ${who} ${str(event.status)} (${money(num(event.costUsd))}, ${String(num(event.usage?.inputTokens) + num(event.usage?.outputTokens))} tok)`;
+		case "agent:error": return `agent ${who} error: ${str(event.error?.message)}${event.willRetry === true ? " (will retry)" : ""}`;
+		case "agent:queued": return `agent ${who} queued`;
+		case "tool:start": return `${replayMark}tool ${str(event.toolName)}`;
+		case "tool:end": return `${replayMark}tool ${str(event.toolName)} ${str(event.outcome)} (${String(num(event.durationMs))}ms)`;
+		case "approval:pending": return `approval pending: tool ${str(event.toolName)} (entry ${String(num(event.entryRef))})`;
+		case "log": return event.level === "debug" ? void 0 : `${str(event.level)}: ${str(event.msg)}`;
+		case "run:end": return `run ${str(event.runId)} ${str(event.status)}`;
 		default: return;
 	}
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/cli",
-  "version": "1.21.0",
+  "version": "1.23.0",
   "description": "Rulvar shell: run/resume/runs/inspect/plan/kb commands, TUI progress, createServer, createWorker, OTel exporter.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,17 +22,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@rulvar/core": "1.21.0"
+    "@rulvar/core": "1.23.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",
     "tsdown": "^0.22.3",
     "typescript": "~6.0.3",
-    "@rulvar/store-sqlite": "1.21.0",
-    "@rulvar/testing": "1.21.0",
-    "@rulvar/planner": "1.21.0",
-    "@rulvar/evals": "1.21.0",
-    "@rulvar/plan": "1.21.0"
+    "@rulvar/testing": "1.23.0",
+    "@rulvar/store-sqlite": "1.23.0",
+    "@rulvar/planner": "1.23.0",
+    "@rulvar/plan": "1.23.0",
+    "@rulvar/evals": "1.23.0"
   },
   "bin": {
     "rulvar": "./dist/cli.js"