agentlas 1.0.64 → 1.0.66

package/engine/browser/cdp.cjs

@@ -17,22 +17,83 @@
  * 안전: Agentlas 전용 프로필 Chrome 에만 붙는다(개인 크롬 아님). 되돌릴 수 없는
  * 행동은 호출자가 판단한다 — 이 모듈은 조종 primitive 만 제공한다.
  */
+const crypto = require("node:crypto");
+const fs = require("node:fs");
 const http = require("node:http");
+const path = require("node:path");
 
 const DEFAULT_PORT = Number(process.env.AGENTLAS_CDP_PORT || 9222);
+const DEFAULT_WS_OPEN_TIMEOUT_MS = 5_000;
+const CDP_HTTP_TIMEOUT_MS = 3_000;
+const CDP_HTTP_MAX_BYTES = 8 * 1024 * 1024;
+const CDP_PDF_MAX_BYTES = 64 * 1024 * 1024;
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
 
-function httpJson(port, path, { timeout = 3000, method = "GET" } = {}) {
+function httpJson(port, requestPath, { timeout = CDP_HTTP_TIMEOUT_MS, method = "GET" } = {}) {
+  const limit = Number.isFinite(Number(timeout)) && Number(timeout) > 0
+    ? Number(timeout)
+    : CDP_HTTP_TIMEOUT_MS;
   return new Promise((resolve, reject) => {
-    const req = http.request({ host: "127.0.0.1", port, path, timeout, method }, (res) => {
-      let body = "";
-      res.on("data", (d) => { body += d; });
-      res.on("end", () => {
-        try { resolve(JSON.parse(body)); } catch (e) { reject(e); }
+    let req = null;
+    let response = null;
+    let timer = null;
+    let settled = false;
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      if (error) {
+        try { response?.destroy(); } catch { /* already closed */ }
+        try { req?.destroy(); } catch { /* already closed */ }
+        reject(error);
+      } else {
+        resolve(value);
+      }
+    };
+    const timeoutError = () => {
+      const error = new Error(`CDP ${requestPath} timed out`);
+      error.code = "CDP_HTTP_TIMEOUT";
+      return error;
+    };
+    try {
+      req = http.request({ host: "127.0.0.1", port, path: requestPath, timeout: limit, method }, (res) => {
+        response = res;
+        const chunks = [];
+        let bodyBytes = 0;
+        res.on("data", (chunk) => {
+          if (settled) return;
+          const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+          bodyBytes += bytes.length;
+          if (bodyBytes > CDP_HTTP_MAX_BYTES) {
+            const error = new Error(`CDP ${requestPath} response exceeded ${CDP_HTTP_MAX_BYTES} bytes`);
+            error.code = "CDP_HTTP_BODY_LIMIT";
+            finish(error);
+            return;
+          }
+          chunks.push(bytes);
+        });
+        res.on("aborted", () => finish(new Error(`CDP ${requestPath} response aborted`)));
+        res.on("error", (error) => finish(error));
+        res.on("end", () => {
+          if (settled) return;
+          try {
+            finish(null, JSON.parse(Buffer.concat(chunks, bodyBytes).toString("utf8")));
+          } catch (error) {
+            finish(error);
+          }
+        });
       });
-    });
-    req.on("error", reject);
-    req.on("timeout", () => { req.destroy(); reject(new Error(`CDP ${path} timed out`)); });
-    req.end();
+      req.on("error", (error) => finish(error));
+      // Keep the inactivity timeout as a fast-path, but also enforce the
+      // absolute deadline below so a peer cannot keep this request alive by
+      // dripping one byte before every inactivity interval.
+      req.on("timeout", () => finish(timeoutError()));
+      timer = setTimeout(() => finish(timeoutError()), limit);
+      timer.unref?.();
+      req.end();
+    } catch (error) {
+      finish(error);
+    }
   });
 }
 
@@ -46,16 +107,184 @@ async function cdpReady(port = DEFAULT_PORT) {
   } catch { return false; }
 }
 
-/** 조종할 page 타겟 하나를 고른다(없으면 새로 연다). 반환: webSocketDebuggerUrl. */
-async function pickPageTarget(port = DEFAULT_PORT) {
-  const targets = await httpJson(port, "/json");
-  let page = (Array.isArray(targets) ? targets : []).find((t) => t.type === "page" && t.webSocketDebuggerUrl);
-  if (!page) {
-    // 새 탭을 연다(DevTools HTTP: PUT /json/new).
-    page = await httpJson(port, "/json/new?about:blank", { method: "PUT" });
+function verifiedPageTarget(target, port, ownsTarget = false) {
+  if (!target || target.type !== "page" || typeof target.id !== "string" || typeof target.webSocketDebuggerUrl !== "string") return null;
+  try {
+    const socket = new URL(target.webSocketDebuggerUrl);
+    if (socket.protocol !== "ws:" || !LOOPBACK_HOSTS.has(socket.hostname.toLowerCase()) || Number(socket.port) !== port) return null;
+  } catch {
+    return null;
   }
-  if (!page || !page.webSocketDebuggerUrl) throw new Error("no CDP page target available");
-  return page.webSocketDebuggerUrl;
+  return { id: target.id, webSocketDebuggerUrl: target.webSocketDebuggerUrl, ownsTarget };
+}
+
+async function resolvePageTarget(port, { selection = "new", targetId = null } = {}) {
+  if (selection !== "new" && selection !== "existing") {
+    throw new Error(`unsupported CDP target selection: ${selection}`);
+  }
+  const rawTargets = await httpJson(port, "/json");
+  const pages = (Array.isArray(rawTargets) ? rawTargets : [])
+    .map((target) => verifiedPageTarget(target, port))
+    .filter(Boolean);
+
+  if (selection === "existing") {
+    if (!targetId) throw new Error("existing CDP target selection requires an explicit targetId");
+    const exact = pages.find((target) => target.id === String(targetId));
+    if (!exact) throw new Error(`no CDP page target matches targetId ${targetId}`);
+    return exact;
+  }
+
+  // Never reuse an arbitrary first page. It may be a user's active tab, and
+  // browser/document/Telegram flows must not navigate it behind their back.
+  // Create a target we own, then return its socket identity to the caller.
+  const created = await httpJson(port, `/json/new?${encodeURIComponent("about:blank")}`, { method: "PUT" });
+  const exact = verifiedPageTarget(created, port, true);
+  if (!exact) throw new Error("CDP did not return a verified page target for the new tab");
+  return exact;
+}
+
+/**
+ * Pick a page target without guessing ownership.
+ *
+ * The safe default is a fresh target. Reusing a page requires selection:
+ * `pickPageTarget(port, { selection: "existing", targetId })`.
+ */
+async function pickPageTarget(port = DEFAULT_PORT, options = {}) {
+  return (await resolvePageTarget(port, options)).webSocketDebuggerUrl;
+}
+
+function closePageTarget(port, targetId) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let timer = null;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      resolve();
+    };
+    const req = http.request({
+      host: "127.0.0.1",
+      port,
+      path: `/json/close/${encodeURIComponent(String(targetId))}`,
+      timeout: CDP_HTTP_TIMEOUT_MS,
+    }, (res) => {
+      res.resume();
+      res.once("end", finish);
+      res.once("aborted", finish);
+      res.once("error", finish);
+    });
+    req.once("error", finish);
+    req.once("timeout", () => { req.destroy(); finish(); });
+    timer = setTimeout(() => { req.destroy(); finish(); }, CDP_HTTP_TIMEOUT_MS);
+    timer.unref?.();
+    req.end();
+  });
+}
+
+function sameFileIdentity(left, right) {
+  return left && right && String(left.dev) === String(right.dev) && String(left.ino) === String(right.ino);
+}
+
+function writeAtomicRegularFile(outPath, data) {
+  const target = path.resolve(String(outPath));
+  let original = null;
+  try {
+    original = fs.lstatSync(target);
+    if (!original.isFile() || original.nlink !== 1) {
+      const error = new Error(`CDP output path must be a regular file with one link: ${target}`);
+      error.code = "CDP_UNSAFE_OUTPUT_PATH";
+      throw error;
+    }
+  } catch (error) {
+    if (error && error.code !== "ENOENT") throw error;
+  }
+
+  const dir = path.dirname(target);
+  const base = path.basename(target);
+  const flags = fs.constants.O_WRONLY
+    | fs.constants.O_CREAT
+    | fs.constants.O_EXCL
+    | (fs.constants.O_NOFOLLOW || 0);
+  let temp = null;
+  let fd = null;
+  try {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      temp = path.join(dir, `.${base}.${process.pid}.${crypto.randomUUID()}.tmp`);
+      try {
+        fd = fs.openSync(temp, flags, 0o600);
+        break;
+      } catch (error) {
+        temp = null;
+        if (!error || error.code !== "EEXIST" || attempt === 2) throw error;
+      }
+    }
+    if (fd == null || !temp) throw new Error("could not create a temporary CDP output file");
+    let offset = 0;
+    while (offset < data.length) {
+      const written = fs.writeSync(fd, data, offset, data.length - offset);
+      if (!written) throw new Error("could not write the CDP output file");
+      offset += written;
+    }
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = null;
+
+    // Refuse a path that changed identity while the temporary file was being
+    // written. The final rename itself never follows a symlink or hardlink.
+    let current = null;
+    try { current = fs.lstatSync(target); } catch (error) {
+      if (!error || error.code !== "ENOENT") throw error;
+    }
+    if (original) {
+      if (!current || !current.isFile() || current.nlink !== 1 || !sameFileIdentity(original, current)) {
+        const error = new Error(`CDP output path changed while writing: ${target}`);
+        error.code = "CDP_OUTPUT_IDENTITY_CHANGED";
+        throw error;
+      }
+    } else if (current) {
+      // The caller observed an absent path. A file appearing before commit is
+      // a competing writer, even when it is otherwise a safe regular file.
+      // Never overwrite a file whose identity this operation did not capture.
+      const error = new Error(`CDP output path appeared while writing: ${target}`);
+      error.code = current.isFile() && current.nlink === 1
+        ? "CDP_OUTPUT_IDENTITY_CHANGED"
+        : "CDP_UNSAFE_OUTPUT_PATH";
+      throw error;
+    }
+    fs.renameSync(temp, target);
+    temp = null;
+  } finally {
+    if (fd != null) {
+      try { fs.closeSync(fd); } catch { /* already closed */ }
+    }
+    if (temp) {
+      try { fs.unlinkSync(temp); } catch { /* best-effort cleanup */ }
+    }
+  }
+}
+
+function waitForWebSocketOpen(ws, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let timer;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (error) reject(error);
+      else resolve();
+    };
+    timer = setTimeout(() => {
+      const error = new Error(`CDP websocket open timed out after ${timeoutMs}ms`);
+      error.code = "CDP_WEBSOCKET_OPEN_TIMEOUT";
+      try { ws.close(); } catch { /* already closed */ }
+      finish(error);
+    }, timeoutMs);
+    ws.addEventListener("open", () => finish(), { once: true });
+    ws.addEventListener("error", () => finish(new Error("CDP websocket failed to open")), { once: true });
+    ws.addEventListener("close", () => finish(new Error("CDP websocket closed before opening")), { once: true });
+  });
 }
 
 /**
@@ -65,16 +294,31 @@ async function pickPageTarget(port = DEFAULT_PORT) {
  *   evaluate(js, {awaitPromise})  Runtime.evaluate(returnByValue) — 값 반환
  *   waitFor(jsPredicate, {timeoutMs, pollMs})  predicate 가 truthy 될 때까지
  */
-async function attachPage({ port = DEFAULT_PORT, wsUrl } = {}) {
-  const url = wsUrl || (await pickPageTarget(port));
-  const ws = new WebSocket(url);
-  await new Promise((resolve, reject) => {
-    ws.addEventListener("open", resolve, { once: true });
-    ws.addEventListener("error", () => reject(new Error("CDP websocket failed to open")), { once: true });
-  });
+async function attachPage({ port = DEFAULT_PORT, wsUrl, selection = "new", targetId, connectTimeoutMs = DEFAULT_WS_OPEN_TIMEOUT_MS } = {}) {
+  const target = wsUrl
+    ? (() => {
+      try {
+        const socket = new URL(wsUrl);
+        if (socket.protocol !== "ws:" || !LOOPBACK_HOSTS.has(socket.hostname.toLowerCase()) || Number(socket.port) !== port) return null;
+      } catch { return null; }
+      return { id: null, webSocketDebuggerUrl: wsUrl, ownsTarget: false };
+    })()
+    : await resolvePageTarget(port, { selection, targetId });
+  if (!target) throw new Error(`invalid CDP websocket target for port ${port}`);
+
+  const url = target.webSocketDebuggerUrl;
+  let ws;
+  try {
+    ws = new WebSocket(url);
+    await waitForWebSocketOpen(ws, connectTimeoutMs);
+  } catch (error) {
+    if (target.ownsTarget) await closePageTarget(port, target.id);
+    throw error;
+  }
 
   let nextId = 0;
   const pending = new Map();
+  let closed = false;
   ws.addEventListener("message", (event) => {
     let msg;
     try { msg = JSON.parse(typeof event.data === "string" ? event.data : String(event.data)); } catch { return; }
@@ -85,8 +329,16 @@ async function attachPage({ port = DEFAULT_PORT, wsUrl } = {}) {
       else resolve(msg.result);
     }
   });
+  ws.addEventListener("close", () => {
+    for (const { reject, timer } of pending.values()) {
+      clearTimeout(timer);
+      reject(new Error("CDP websocket closed"));
+    }
+    pending.clear();
+  }, { once: true });
 
   function send(method, params = {}, { timeout = 30000 } = {}) {
+    if (closed) return Promise.reject(new Error("CDP page is closed"));
     const id = ++nextId;
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => { pending.delete(id); reject(new Error(`CDP ${method} timed out`)); }, timeout);
@@ -94,7 +346,8 @@ async function attachPage({ port = DEFAULT_PORT, wsUrl } = {}) {
         resolve: (r) => { clearTimeout(timer); resolve(r); },
         reject: (e) => { clearTimeout(timer); reject(e); },
       });
-      ws.send(JSON.stringify({ id, method, params }));
+      try { ws.send(JSON.stringify({ id, method, params })); }
+      catch (error) { pending.delete(id); clearTimeout(timer); reject(error); }
     });
   }
 
@@ -180,15 +433,45 @@ async function attachPage({ port = DEFAULT_PORT, wsUrl } = {}) {
   async function printPdf(outPath, { landscape = false, printBackground = true, scale = 1 } = {}) {
     const res = await send("Page.printToPDF", { landscape, printBackground, scale, transferMode: "ReturnAsBase64" }, { timeout: 60000 });
     const b64 = res && res.data;
-    if (!b64) throw new Error("Page.printToPDF returned no data");
+    if (typeof b64 !== "string" || !b64) throw new Error("Page.printToPDF returned no data");
+    if (b64.length > Math.ceil(CDP_PDF_MAX_BYTES / 3) * 4) {
+      const error = new Error(`Page.printToPDF response exceeded ${CDP_PDF_MAX_BYTES} bytes`);
+      error.code = "CDP_PDF_BODY_LIMIT";
+      throw error;
+    }
     const buf = Buffer.from(b64, "base64");
-    require("node:fs").writeFileSync(outPath, buf);
+    if (buf.length > CDP_PDF_MAX_BYTES) {
+      const error = new Error(`Page.printToPDF response exceeded ${CDP_PDF_MAX_BYTES} bytes`);
+      error.code = "CDP_PDF_BODY_LIMIT";
+      throw error;
+    }
+    writeAtomicRegularFile(outPath, buf);
     return { path: outPath, bytes: buf.length };
   }
 
-  function close() { try { ws.close(); } catch { /* already closed */ } }
+  async function close({ closeTarget = false } = {}) {
+    if (closed) return;
+    closed = true;
+    try { ws.close(); } catch { /* already closed */ }
+    if (closeTarget && target.ownsTarget && target.id) await closePageTarget(port, target.id);
+  }
 
-  return { navigate, evaluate, evalExpr, waitFor, focusSelector, typeInto, pressKey, clickSelector, printPdf, close, send };
+  return {
+    navigate, evaluate, evalExpr, waitFor, focusSelector, typeInto, pressKey,
+    clickSelector, printPdf, close, send,
+    targetId: target.id,
+    ownsTarget: target.ownsTarget,
+  };
 }
 
-module.exports = { cdpReady, pickPageTarget, attachPage, DEFAULT_PORT };
+module.exports = {
+  cdpReady,
+  pickPageTarget,
+  attachPage,
+  DEFAULT_PORT,
+  DEFAULT_WS_OPEN_TIMEOUT_MS,
+  CDP_HTTP_TIMEOUT_MS,
+  CDP_HTTP_MAX_BYTES,
+  CDP_PDF_MAX_BYTES,
+  writeAtomicRegularFile,
+};

package/engine/browser/vault.cjs

@@ -22,6 +22,7 @@ function normalizeSite(input) {
   if (!raw) return "";
   let u;
   try { u = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw : `https://${raw}`); } catch { return ""; }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return "";
   if (u.username || u.password) return ""; // 자격증명은 사이트 키에 절대 들이지 않는다
   const host = u.host.toLowerCase().replace(/^www\./, "");
   return host && !/\s/.test(host) ? host : "";

package/engine/cli-output.cjs

@@ -67,12 +67,23 @@ function textOf(value) {
   return JSON.stringify(value);
 }
 
+function terminalTextOf(value, maxLength = Number.POSITIVE_INFINITY) {
+  const text = textOf(value);
+  if (typeof text !== "string") return "";
+  return text
+    .replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "")
+    .replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "")
+    .replace(/\u001b[@-_]/g, "")
+    .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, " ")
+    .slice(0, maxLength);
+}
+
 /**
  * 표시 폭 — ANSI 를 벗기고, CJK 전각을 2칸으로 센다.
  * 한글 표가 어긋나던 이유가 이것이다(폭을 문자 수로 세면 열이 밀린다).
  */
 function displayWidth(value) {
-  const plain = String(value).replace(/\[[0-9;]*m/g, "");
+  const plain = terminalTextOf(value);
   let width = 0;
   for (const char of plain) {
     const code = char.codePointAt(0) ?? 0;
@@ -102,7 +113,7 @@ function padTo(value, width, align) {
 function renderQuiet(result) {
   const idField = result.schema.idField;
   return rowsOf(result)
-    .map((item) => textOf(readField(item, idField)))
+    .map((item) => terminalTextOf(readField(item, idField)))
     .filter((line) => line.length > 0)
     .join("\n");
 }
@@ -122,31 +133,65 @@ function renderYaml(result) {
     if (value === null || value === undefined) return "null";
     if (typeof value === "number" || typeof value === "boolean") return String(value);
     const text = textOf(value);
-    return /^[\w./:@-]+$/.test(text) ? text : JSON.stringify(text);
+    // YAML implicitly retypes unquoted strings such as yes/null/001/dates.
+    // Machine output must round-trip the command result without changing a
+    // string into a boolean, null, number, or timestamp. Conservatively leave
+    // only unambiguous word/path-like strings plain; JSON quoting is valid YAML.
+    const ambiguousWord = /^(?:~|null|true|false|yes|no|on|off|[-+]?\.?(?:inf|nan))$/i.test(text);
+    return /^[A-Za-z_./][\w./:@-]*$/.test(text) && !ambiguousWord ? text : JSON.stringify(text);
+  };
+  const isObject = (value) => value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+  const assertBoundedTree = (root) => {
+    let nodes = 0;
+    const visit = (value, ancestors, depth) => {
+      if ((!isObject(value) && !Array.isArray(value)) || value instanceof Date) return;
+      if (depth > 64) throw new TypeError("YAML output exceeds the maximum nesting depth");
+      if (ancestors.has(value)) throw new TypeError("YAML output contains a circular reference");
+      nodes += 1;
+      if (nodes > 100_000) throw new TypeError("YAML output contains too many nodes");
+      const next = new Set(ancestors);
+      next.add(value);
+      for (const child of Array.isArray(value) ? value : Object.values(value)) visit(child, next, depth + 1);
+    };
+    visit(root, new Set(), 0);
   };
   const objectLines = (object, indent) => {
     const pad = " ".repeat(indent);
-    return Object.entries(object).map(([key, value]) => {
-      if (value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date)) {
-        return `${pad}${key}:\n${objectLines(value, indent + 2).join("\n")}`;
-      }
-      if (Array.isArray(value)) {
-        if (value.length === 0) return `${pad}${key}: []`;
-        return `${pad}${key}:\n${value.map((entry) => `${pad}  - ${scalar(entry)}`).join("\n")}`;
+    const entries = Object.entries(object);
+    if (!entries.length) return [`${pad}{}`];
+    return entries.flatMap(([key, value]) => {
+      const renderedKey = scalar(key);
+      if (isObject(value) || Array.isArray(value)) {
+        const nested = value.length === 0 ? [`${pad}  ${Array.isArray(value) ? "[]" : "{}"}`] : valueLines(value, indent + 2);
+        if (nested.length === 1 && /^(?:\{\}|\[\])$/.test(nested[0].trim())) return [`${pad}${renderedKey}: ${nested[0].trim()}`];
+        return [`${pad}${renderedKey}:`, ...nested];
       }
-      return `${pad}${key}: ${scalar(value)}`;
+      return [`${pad}${renderedKey}: ${scalar(value)}`];
     });
   };
-  if (result.type === "list") {
-    if (result.data.length === 0) return "[]";
-    return result.data
-      .map((item) => {
-        const lines = objectLines(project(item), 2);
-        return `- ${lines.join("\n").trimStart()}`;
-      })
-      .join("\n");
-  }
-  return objectLines(project(result.data), 0).join("\n");
+  const valueLines = (value, indent) => {
+    const pad = " ".repeat(indent);
+    if (Array.isArray(value)) {
+      if (!value.length) return [`${pad}[]`];
+      return value.flatMap((entry) => {
+        if (isObject(entry)) {
+          const nested = objectLines(entry, indent + 2);
+          return [`${pad}- ${nested[0].trimStart()}`, ...nested.slice(1)];
+        }
+        if (Array.isArray(entry)) {
+          const nested = valueLines(entry, indent + 2);
+          return [`${pad}-`, ...nested];
+        }
+        return [`${pad}- ${scalar(entry)}`];
+      });
+    }
+    if (isObject(value)) return objectLines(value, indent);
+    return [`${pad}${scalar(value)}`];
+  };
+  const payload = result.type === "list" ? result.data.map(project) : project(result.data);
+  assertBoundedTree(payload);
+  if (result.type === "list" && result.data.length === 0) return "[]";
+  return valueLines(payload, 0).join("\n");
 }
 
 function renderTable(result, options) {
@@ -154,11 +199,11 @@ function renderTable(result, options) {
   const rows = rowsOf(result);
   if (rows.length === 0) return "";
   const cells = rows.map((item) =>
-    columns.map((column) => textOf(readField(item, column.field))),
+    columns.map((column) => terminalTextOf(readField(item, column.field))),
   );
   const widths = columns.map((column, index) =>
     Math.max(
-      options.noHeaders ? 0 : displayWidth(column.header),
+      options.noHeaders ? 0 : displayWidth(terminalTextOf(column.header)),
       ...cells.map((row) => displayWidth(row[index] ?? "")),
     ),
   );
@@ -166,7 +211,7 @@ function renderTable(result, options) {
   if (!options.noHeaders) {
     lines.push(
       columns
-        .map((column, index) => padTo(column.header.toUpperCase(), widths[index], column.align))
+        .map((column, index) => padTo(terminalTextOf(column.header).toUpperCase(), widths[index], column.align))
         .join("  ")
         .trimEnd(),
     );
@@ -212,12 +257,13 @@ function renderError(error, options = {}) {
   const commandError = toCommandError(error);
   if (opts.format === "json") return JSON.stringify({ error: commandError }, null, 2);
   if (opts.format === "yaml") {
-    return ["error:", `  code: ${commandError.code}`, `  message: ${JSON.stringify(commandError.message)}`].join("\n");
+    return ["error:", `  code: ${JSON.stringify(commandError.code)}`, `  message: ${JSON.stringify(commandError.message)}`].join("\n");
   }
   const prefix = opts.noColor ? "Error: " : "Error: ";
+  const safeMessage = terminalTextOf(commandError.message, 8192);
   return commandError.details && typeof commandError.details === "string" && opts.format === "table"
-    ? `${prefix}${commandError.message}`
-    : `${prefix}${commandError.message}`;
+    ? `${prefix}${safeMessage}`
+    : `${prefix}${safeMessage}`;
 }
 
 /**
@@ -230,7 +276,12 @@ function renderError(error, options = {}) {
 function parseOutputFlags(argv, env = process.env, isTty = Boolean(process.stdout.isTTY)) {
   const rest = [];
   const options = { ...DEFAULT_OPTIONS };
-  for (const token of argv) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--") {
+      rest.push(...argv.slice(index + 1));
+      break;
+    }
     if (token === "--json") options.format = "json";
     else if (token === "--yaml") options.format = "yaml";
     else if (token === "--quiet" || token === "-q") options.quiet = true;
@@ -259,4 +310,5 @@ module.exports = {
   parseOutputFlags,
   isRichUi,
   displayWidth,
+  terminalTextOf,
 };