@triflare/fx 2.1.0-beta.4 → 2.1.0-beta.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@triflare/fx",
-  "version": "2.1.0-beta.4",
+  "version": "2.1.0-beta.5",
   "description": "Code PenguinMod projects with text.",
   "type": "module",
   "license": "Apache-2.0",

package/product.yml

@@ -1,7 +1,7 @@
 # Identity
 name: "Triflare Fx"
 command: "fx"
-version: "2.1.0-beta.4"
+version: "2.1.0-beta.5"
 tagline: "Code PenguinMod projects with text."
 author: "Triflare"
 homepage: "https://github.com/triflare/fx"

package/src/cli/commands/vendor/outdated.js

@@ -34,7 +34,7 @@ export const vendorOutdatedCommand = {
           : result.status === "error"
             ? "danger"
             : "success";
-      reporter.item(result.name, reporter.tone(tone, label), { width: 24 });
+      reporter.item(result.name, label, { width: 24, tone });
       if (result.error) reporter.warn(result.error);
     }
     if (outdated > 0)

package/src/cli/reporter.js

@@ -8,6 +8,7 @@
 
 import { styleText } from "node:util";
 import { brandText } from "../brand.js";
+import { sanitizeTerminalText } from "../terminal.js";
 import { formatColumns } from "./format.js";
 import { createTheme } from "./theme.js";
 
@@ -60,7 +61,7 @@ export function createReporter({
     const glyph = mark(symbol);
     const stream = type === "success" ? stdout : stderr;
     const theme = themeFor(stream);
-    const text = String(message);
+    const text = sanitizeTerminalText(message);
     const output = text
       .split("\n")
       .map((line, index) => {
@@ -102,48 +103,54 @@ export function createReporter({
 
     info(message) {
       if (!human) return;
-      stdout.write(`${message}\n`);
+      stdout.write(`${sanitizeTerminalText(message)}\n`);
     },
 
     bullet(message) {
       if (!human) return;
       const theme = themeFor(stdout);
       const glyph = mark("bullet");
-      stdout.write(`  ${glyph ? `${theme.accent(glyph)} ` : ""}${message}\n`);
+      const text = sanitizeTerminalText(message);
+      stdout.write(`  ${glyph ? `${theme.accent(glyph)} ` : ""}${text}\n`);
     },
 
     step(message) {
       if (!human) return;
       const theme = themeFor(stdout);
       const glyph = mark("progress");
-      stdout.write(`${glyph ? `${theme.accent(glyph)} ` : ""}${message}\n`);
+      const text = sanitizeTerminalText(message);
+      stdout.write(`${glyph ? `${theme.accent(glyph)} ` : ""}${text}\n`);
     },
 
     heading(message) {
       if (!human) return;
-      stdout.write(`${themeFor(stdout).heading(String(message))}\n`);
+      stdout.write(
+        `${themeFor(stdout).heading(sanitizeTerminalText(message))}\n`,
+      );
     },
 
     /** Aligned `label  value` row used by command summaries. */
     detail(label, value, { width = 13 } = {}) {
       if (!human) return;
       const theme = themeFor(stdout);
-      const text = String(value);
+      const text = sanitizeTerminalText(value);
       const rendered = text === "(none)" ? theme.muted(text) : theme.bold(text);
-      stdout.write(
-        `  ${theme.muted(String(label).padEnd(width))} ${rendered}\n`,
-      );
+      const name = sanitizeTerminalText(label);
+      stdout.write(`  ${theme.muted(name.padEnd(width))} ${rendered}\n`);
     },
 
     /** Aligned name + description row used by listings. */
-    item(label, value = "", { width = 24, suffix = "" } = {}) {
+    item(label, value = "", { width = 24, suffix = "", tone } = {}) {
       if (!human) return;
       const theme = themeFor(stdout);
-      const text = String(label);
+      const text = sanitizeTerminalText(label);
       const padded = text.padEnd(Math.max(width, text.length));
-      const detail = value ? ` ${value}` : "";
-      const note = suffix ? ` ${theme.muted(suffix)}` : "";
-      stdout.write(`  ${theme.accent(padded)}${detail}${note}\n`);
+      const detail = value ? ` ${sanitizeTerminalText(value)}` : "";
+      const note = suffix
+        ? ` ${theme.muted(sanitizeTerminalText(suffix))}`
+        : "";
+      const rendered = tone ? theme.tone(tone, detail) : detail;
+      stdout.write(`  ${theme.accent(padded)}${rendered}${note}\n`);
     },
 
     /** Compact multi-column rows for long block and file listings. */
@@ -171,7 +178,9 @@ export function createReporter({
     /** Quiet, de-emphasized line for incidental notes. */
     note(message) {
       if (!human) return;
-      stdout.write(`${themeFor(stdout).muted(message)}\n`);
+      stdout.write(
+        `${themeFor(stdout).muted(sanitizeTerminalText(message))}\n`,
+      );
     },
 
     warn(message) {
@@ -191,9 +200,8 @@ export function createReporter({
     hint(message) {
       if (!human) return;
       const theme = themeFor(stdout);
-      stdout.write(
-        `  ${theme.accent("↳")} ${theme.muted(`hint: ${message}`)}\n`,
-      );
+      const text = sanitizeTerminalText(message);
+      stdout.write(`  ${theme.accent("↳")} ${theme.muted(`hint: ${text}`)}\n`);
     },
 
     /** One JSON document, used for the command result envelope. */

package/src/terminal.js

@@ -0,0 +1,27 @@
+/**
+ * Terminal output safety.
+ *
+ * Names, paths and source text can come from a repository the user did not
+ * write, so untrusted text is rendered with visible `\xNN` escapes instead of
+ * letting the terminal interpret control characters and escape sequences.
+ */
+
+/**
+ * Replace terminal control characters with visible `\xNN` escapes.
+ *
+ * Tabs and newlines are kept because callers print multi-line blocks.
+ * @param {unknown} value
+ */
+export function sanitizeTerminalText(value) {
+  let clean = "";
+  for (const char of String(value)) {
+    const code = char.codePointAt(0);
+    const printable =
+      code === 0x09 ||
+      code === 0x0a ||
+      (code >= 0x20 && code <= 0x7e) ||
+      code >= 0xa0;
+    clean += printable ? char : `\\x${code.toString(16).padStart(2, "0")}`;
+  }
+  return clean;
+}

package/src/vendor.js

@@ -23,6 +23,7 @@ import {
   readExtensionDataUri,
   resolveSource,
 } from "./extensions.js";
+import { sanitizeTerminalText } from "./terminal.js";
 
 export const LOCK_FILENAME = "fx.lock";
 export const LOCK_VERSION = 1;
@@ -1146,13 +1147,14 @@ export async function loadVendorExtensions({
 
 /** A compact line diff, enough to review an extension or config change. */
 export function formatDiff(before, after, filename = "") {
+  const header = sanitizeTerminalText(filename);
   const a = String(before).split(/\r?\n/);
   const b = String(after).split(/\r?\n/);
   const rows = a.length;
   const columns = b.length;
   // Keep very large extensions from allocating an enormous matrix.
   if (rows * columns > 4_000_000) {
-    return `--- ${filename}\n+++ ${filename}\n@@ source changed @@\n`;
+    return `--- ${header}\n+++ ${header}\n@@ source changed @@\n`;
   }
   const table = Array.from(
     { length: rows + 1 },
@@ -1166,24 +1168,24 @@ export function formatDiff(before, after, filename = "") {
           : Math.max(table[i + 1][j], table[i][j + 1]);
     }
   }
-  const lines = [`--- ${filename}`, `+++ ${filename}`];
+  const lines = [`--- ${header}`, `+++ ${header}`];
   let i = 0;
   let j = 0;
   while (i < rows && j < columns) {
     if (a[i] === b[j]) {
-      lines.push(` ${a[i]}`);
+      lines.push(` ${sanitizeTerminalText(a[i])}`);
       i += 1;
       j += 1;
     } else if (table[i + 1][j] >= table[i][j + 1]) {
-      lines.push(`-${a[i]}`);
+      lines.push(`-${sanitizeTerminalText(a[i])}`);
       i += 1;
     } else {
-      lines.push(`+${b[j]}`);
+      lines.push(`+${sanitizeTerminalText(b[j])}`);
       j += 1;
     }
   }
-  while (i < rows) lines.push(`-${a[i++]}`);
-  while (j < columns) lines.push(`+${b[j++]}`);
+  while (i < rows) lines.push(`-${sanitizeTerminalText(a[i++])}`);
+  while (j < columns) lines.push(`+${sanitizeTerminalText(b[j++])}`);
   return `${lines.join("\n")}\n`;
 }