z-clean 0.3.1 → 0.3.3

package/src/config.js

@@ -3,6 +3,14 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const {
+  appendPrivateFile,
+  sanitizeHistoryEntry,
+  sanitizeHistoryFile,
+  secureDirectory,
+  secureFile,
+  writePrivateFile,
+} = require('./storage-security');
 
 const CONFIG_DIR_ENV = 'ZCLEAN_CONFIG_DIR';
 
@@ -32,6 +40,7 @@ const DEFAULT_CONFIG = {
   logRetention: '30d',
   maxKillBatch: 20,
   customAiDirs: [],
+  customPatterns: [],
 };
 
 /**
@@ -68,10 +77,7 @@ function parseMemory(str) {
  * Ensure the config directory exists.
  */
 function ensureConfigDir() {
-  const configDir = getConfigDir();
-  if (!fs.existsSync(configDir)) {
-    fs.mkdirSync(configDir, { recursive: true });
-  }
+  secureDirectory(getConfigDir());
 }
 
 /**
@@ -79,12 +85,16 @@ function ensureConfigDir() {
  */
 function loadConfig() {
   ensureConfigDir();
+  sanitizeHistoryFile(getLogFile());
   const configFile = getConfigFile();
   if (fs.existsSync(configFile)) {
+    secureFile(configFile);
     try {
       const raw = fs.readFileSync(configFile, 'utf-8');
       const userConfig = JSON.parse(raw);
-      return { ...DEFAULT_CONFIG, ...userConfig };
+      const config = { ...DEFAULT_CONFIG, ...userConfig };
+      if (!(parseDuration(config.maxAge) > 0)) config.maxAge = DEFAULT_CONFIG.maxAge;
+      return config;
     } catch {
       // Corrupted config — use defaults
       return { ...DEFAULT_CONFIG };
@@ -98,7 +108,7 @@ function loadConfig() {
  */
 function saveConfig(config) {
   ensureConfigDir();
-  fs.writeFileSync(getConfigFile(), JSON.stringify(config, null, 2) + '\n', 'utf-8');
+  writePrivateFile(getConfigFile(), JSON.stringify(config, null, 2) + '\n');
 }
 
 /**
@@ -107,8 +117,8 @@ function saveConfig(config) {
  */
 function appendLog(entry) {
   ensureConfigDir();
-  const line = JSON.stringify({ timestamp: new Date().toISOString(), ...entry }) + '\n';
-  fs.appendFileSync(getLogFile(), line, 'utf-8');
+  const sanitized = sanitizeHistoryEntry({ timestamp: new Date().toISOString(), ...entry });
+  appendPrivateFile(getLogFile(), JSON.stringify(sanitized) + '\n');
 }
 
 /**
@@ -122,7 +132,7 @@ function readLogs(limit = 50) {
     return lines
       .slice(-limit)
       .map((line) => {
-        try { return JSON.parse(line); } catch { return null; }
+        try { return sanitizeHistoryEntry(JSON.parse(line)); } catch { return null; }
       })
       .filter(Boolean);
   } catch {
@@ -140,15 +150,15 @@ function pruneLogs(config) {
 
   const cutoff = Date.now() - retentionMs;
   const lines = fs.readFileSync(logFile, 'utf-8').trim().split('\n').filter(Boolean);
-  const kept = lines.filter((line) => {
+  const kept = lines.flatMap((line) => {
     try {
-      const entry = JSON.parse(line);
-      return new Date(entry.timestamp).getTime() >= cutoff;
+      const entry = sanitizeHistoryEntry(JSON.parse(line));
+      return new Date(entry.timestamp).getTime() >= cutoff ? [JSON.stringify(entry)] : [];
     } catch {
-      return false;
+      return [];
     }
   });
-  fs.writeFileSync(logFile, kept.join('\n') + (kept.length ? '\n' : ''), 'utf-8');
+  writePrivateFile(logFile, kept.join('\n') + (kept.length ? '\n' : ''));
 }
 
 /**

package/src/detector/custom-patterns.js

@@ -0,0 +1,79 @@
+'use strict';
+
+const { parseDuration } = require('../config');
+
+const CUSTOM_PATTERN_MIN = 3;
+const CUSTOM_PATTERN_MAX = 80;
+const SAFE_CUSTOM_MAX_AGE = '24h';
+const GENERIC_CUSTOM_PATTERNS = new Set([
+  'bash', 'bun', 'bunx', 'cargo', 'chrome', 'chromium', 'cmd', 'corepack', 'cscript', 'deno', 'dotnet', 'esbuild', 'fish',
+  'go', 'java', 'javaw', 'node', 'nodejs', 'npm', 'npx', 'perl', 'php', 'pip', 'pip3', 'pipx', 'pnpm',
+  'powershell', 'powershell_ise', 'pwsh', 'py', 'pyw', 'python', 'python3', 'pythonw', 'ruby', 'server', 'sh', 'sleep', 'ts-node', 'tsx',
+  'uv', 'vite', 'worker', 'wscript', 'yarn', 'zsh',
+]);
+
+function getCustomPatternError(value) {
+  if (typeof value !== 'string') return '--pattern must be a literal between 3 and 80 characters.';
+  const literal = value.trim();
+  if (literal.length < CUSTOM_PATTERN_MIN || literal.length > CUSTOM_PATTERN_MAX) {
+    return '--pattern must be a literal between 3 and 80 characters.';
+  }
+  if (/[\p{Cc}\p{Cf}]/u.test(literal)) {
+    return '--pattern must contain printable characters only.';
+  }
+  const lower = literal.toLowerCase();
+  const genericFragment = [...GENERIC_CUSTOM_PATTERNS].some((name) => name.includes(lower));
+  const genericExecutable = lower.split(/[\s/\\'"`]+/).some(isGenericExecutableToken);
+  if (genericFragment || genericExecutable) {
+    return '--pattern must be specific; generic runtime names are not allowed.';
+  }
+  return null;
+}
+
+function isGenericExecutableToken(token) {
+  const basename = token
+    .replace(/^[^a-z0-9]+|[^a-z0-9.]+$/g, '')
+    .replace(/\.(?:exe|cmd|bat|com)$/i, '');
+  const executableName = basename
+    .replace(/\.(?:cjs|mjs|js)$/i, '')
+    .replace(/-cli$/i, '');
+  return GENERIC_CUSTOM_PATTERNS.has(executableName)
+    || isVersionedGenericRuntime(executableName);
+}
+
+function isVersionedGenericRuntime(value) {
+  const match = value.match(/^([a-z][a-z_-]*?)(?:\d[\d.]*(?:[a-z][a-z0-9]*)?)$/);
+  return Boolean(match && GENERIC_CUSTOM_PATTERNS.has(match[1]));
+}
+
+function normalizeCustomPattern(value) {
+  if (getCustomPatternError(value)) return null;
+  return value.trim();
+}
+
+function getCustomPatterns(config) {
+  if (!Array.isArray(config?.customPatterns)) return [];
+  return [...new Set(config.customPatterns.map(normalizeCustomPattern).filter(Boolean))];
+}
+
+function createCustomPattern(literal, config) {
+  const configuredAge = config?.maxAge;
+  const maxOrphanAge = parseDuration(configuredAge) > 0
+    ? configuredAge
+    : SAFE_CUSTOM_MAX_AGE;
+  return {
+    name: `custom:${literal}`,
+    literal,
+    minAge: 0,
+    maxOrphanAge,
+    orphanOnly: true,
+    strictOrphan: true,
+  };
+}
+
+module.exports = {
+  createCustomPattern,
+  getCustomPatternError,
+  getCustomPatterns,
+  normalizeCustomPattern,
+};

package/src/detector/patterns.js

@@ -1,5 +1,12 @@
 'use strict';
 
+const {
+  createCustomPattern,
+  getCustomPatternError,
+  getCustomPatterns,
+  normalizeCustomPattern,
+} = require('./custom-patterns');
+
 /**
  * Process patterns to detect AI tool zombies.
  *
@@ -211,7 +218,7 @@ const PATTERNS = [
  * @param {object} [config] — optional config with customAiDirs
  * @returns {object|null} matched pattern or null
  */
-function matchPattern(cmdline, config) {
+function matchPattern(cmdline, config, customPatterns = getCustomPatterns(config)) {
   const aiRegex = config && config.customAiDirs && config.customAiDirs.length > 0
     ? buildAiDirRegex(config.customAiDirs)
     : AI_DIR_REGEX;
@@ -225,7 +232,28 @@ function matchPattern(cmdline, config) {
       return pattern;
     }
   }
+
+  const command = String(cmdline).toLowerCase();
+  for (const literal of customPatterns) {
+    if (command.includes(literal.toLowerCase())) {
+      return createCustomPattern(literal, config);
+    }
+  }
   return null;
 }
 
-module.exports = { PATTERNS, AI_TOOL_DIRS, AI_DIR_REGEX, buildAiDirRegex, matchPattern };
+function createPatternMatcher(config) {
+  const customPatterns = getCustomPatterns(config);
+  return (cmdline) => matchPattern(cmdline, config, customPatterns);
+}
+
+module.exports = {
+  PATTERNS,
+  AI_TOOL_DIRS,
+  AI_DIR_REGEX,
+  buildAiDirRegex,
+  createPatternMatcher,
+  getCustomPatternError,
+  matchPattern,
+  normalizeCustomPattern,
+};

package/src/installer/launchd.js

@@ -3,7 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { execSync } = require('child_process');
+const { execFileSync, execSync } = require('child_process');
 const { LOCAL_BIN_HINT, resolveZcleanBin } = require('./bin-path');
 
 const PLIST_NAME = 'com.zclean.hourly';
@@ -136,12 +136,14 @@ function installLaunchd() {
   } catch (err) {
     return {
       installed: true,
+      active: false,
       message: `Plist written to ${PLIST_PATH} but launchctl load failed: ${err.message}. Try: launchctl bootstrap gui/$(id -u) ${PLIST_PATH}`,
     };
   }
 
   return {
     installed: true,
+    active: true,
     message: `Hourly launchd agent installed: ${PLIST_PATH}`,
   };
 }
@@ -151,32 +153,79 @@ function installLaunchd() {
  *
  * @returns {{ removed: boolean, message: string }}
  */
-function removeLaunchd() {
-  if (os.platform() !== 'darwin') {
-    return { removed: false, message: 'launchd is macOS only.' };
-  }
-
-  if (!fs.existsSync(PLIST_PATH)) {
-    return { removed: false, message: 'Plist not found. Already uninstalled.' };
+function removeLaunchd(options = {}) {
+  const platform = options.platform || os.platform();
+  const plistPath = options.plistPath || PLIST_PATH;
+  const uid = options.uid ?? process.getuid?.();
+  const run = options.execFileSync || execFileSync;
+
+  if (platform !== 'darwin') {
+    return { removed: false, failed: false, message: 'launchd is macOS only.' };
   }
 
+  const hasPlist = fs.existsSync(plistPath);
+  let unloaded = false;
+  let serviceRemoved = false;
+  let stateUnknown = false;
   try {
-    execSync(`launchctl bootout gui/${process.getuid()} ${PLIST_PATH}`, {
-      encoding: 'utf-8',
-      timeout: 5000,
-    });
+    run('launchctl', ['bootout', `gui/${uid}/${PLIST_NAME}`], launchctlOptions());
+    unloaded = true;
+    serviceRemoved = true;
   } catch {
-    // Might not be loaded
+    if (hasPlist) {
+      try {
+        run('launchctl', ['bootout', `gui/${uid}`, plistPath], launchctlOptions());
+        unloaded = true;
+        serviceRemoved = true;
+      } catch {}
+    }
+  }
+
+  if (!unloaded) {
+    try {
+      run('launchctl', ['print', `gui/${uid}/${PLIST_NAME}`], launchctlOptions());
+    } catch (err) {
+      if (isLaunchdServiceMissing(err)) {
+        unloaded = true;
+      } else {
+        stateUnknown = true;
+      }
+    }
+  }
+
+  if (!unloaded) {
+    return {
+      removed: false,
+      failed: true,
+      message: stateUnknown
+        ? 'Could not verify launchd service removal; plist preserved when present.'
+        : 'launchd agent is still loaded; plist preserved for a later retry.',
+    };
   }
 
-  fs.unlinkSync(PLIST_PATH);
+  if (hasPlist) fs.unlinkSync(plistPath);
+  if (!hasPlist && !serviceRemoved) {
+    return { removed: false, failed: false, message: 'Plist and launchd service not found. Already uninstalled.' };
+  }
 
   return {
     removed: true,
-    message: `launchd agent removed: ${PLIST_PATH}`,
+    failed: false,
+    message: hasPlist
+      ? `launchd agent removed: ${plistPath}`
+      : 'launchd service removed; plist was already absent.',
   };
 }
 
+function launchctlOptions() {
+  return { encoding: 'utf-8', timeout: 5000 };
+}
+
+function isLaunchdServiceMissing(err) {
+  const output = `${err?.message || ''}\n${String(err?.stdout || '')}\n${String(err?.stderr || '')}`;
+  return /could not find service|service not found|no such process/i.test(output);
+}
+
 function escapeXml(value) {
   return String(value)
     .replace(/&/g, '&')

package/src/installer/systemd.js

@@ -3,7 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { execSync } = require('child_process');
+const { execFileSync, execSync } = require('child_process');
 const { LOCAL_BIN_HINT, quoteSystemdArg, resolveZcleanBin } = require('./bin-path');
 
 const SYSTEMD_USER_DIR = path.join(os.homedir(), '.config', 'systemd', 'user');
@@ -72,6 +72,7 @@ function installSystemd() {
 
   // Reload and enable
   const messages = [];
+  let active = true;
   try {
     execSync('systemctl --user daemon-reload', { encoding: 'utf-8', timeout: 5000 });
     execSync(`systemctl --user enable --now ${SERVICE_NAME}.timer`, {
@@ -80,6 +81,7 @@ function installSystemd() {
     });
     messages.push(`Timer installed and enabled: ${TIMER_PATH}`);
   } catch (err) {
+    active = false;
     messages.push(`Files written but systemctl failed: ${err.message}`);
     messages.push(`Try manually: systemctl --user enable --now ${SERVICE_NAME}.timer`);
   }
@@ -96,6 +98,7 @@ function installSystemd() {
 
   return {
     installed: true,
+    active,
     message: messages.join('\n'),
   };
 }
@@ -105,41 +108,57 @@ function installSystemd() {
  *
  * @returns {{ removed: boolean, message: string }}
  */
-function removeSystemd() {
-  if (os.platform() !== 'linux') {
-    return { removed: false, message: 'systemd is Linux only.' };
+function removeSystemd(options = {}) {
+  const platform = options.platform || os.platform();
+  const servicePath = options.servicePath || SERVICE_PATH;
+  const timerPath = options.timerPath || TIMER_PATH;
+  const run = options.execFileSync || execFileSync;
+  if (platform !== 'linux') {
+    return { removed: false, failed: false, message: 'systemd is Linux only.' };
   }
 
-  // Disable timer
+  const hasFiles = fs.existsSync(servicePath) || fs.existsSync(timerPath);
   try {
-    execSync(`systemctl --user disable --now ${SERVICE_NAME}.timer`, {
-      encoding: 'utf-8',
-      timeout: 5000,
-    });
-  } catch {
-    // Might not be running
+    run('systemctl', ['--user', 'disable', '--now', `${SERVICE_NAME}.timer`], systemctlOptions());
+  } catch (err) {
+    if (!hasFiles && isSystemdUnitMissing(err)) {
+      return { removed: false, failed: false, message: 'Files and timer not found. Already uninstalled.' };
+    }
+    return {
+      removed: false,
+      failed: true,
+      message: 'Could not disable systemd timer; unit files preserved for a later retry.',
+    };
   }
 
-  // Remove files
-  let removed = false;
-  for (const filepath of [SERVICE_PATH, TIMER_PATH]) {
+  for (const filepath of [servicePath, timerPath]) {
     if (fs.existsSync(filepath)) {
       fs.unlinkSync(filepath);
-      removed = true;
     }
   }
 
-  // Reload daemon
   try {
-    execSync('systemctl --user daemon-reload', { encoding: 'utf-8', timeout: 5000 });
-  } catch { /* ignore */ }
+    run('systemctl', ['--user', 'daemon-reload'], systemctlOptions());
+  } catch {
+    return { removed: true, failed: true, message: 'Timer disabled, but systemd daemon-reload failed.' };
+  }
 
   return {
-    removed,
-    message: removed ? 'systemd timer and service removed.' : 'Files not found. Already uninstalled.',
+    removed: true,
+    failed: false,
+    message: 'systemd timer and service removed.',
   };
 }
 
+function systemctlOptions() {
+  return { encoding: 'utf-8', timeout: 5000 };
+}
+
+function isSystemdUnitMissing(err) {
+  const output = `${err?.message || ''}\n${String(err?.stdout || '')}\n${String(err?.stderr || '')}`;
+  return /unit .* (?:does not exist|not found|could not be found)/i.test(output);
+}
+
 module.exports = {
   installSystemd,
   removeSystemd,

package/src/installer/taskscheduler.js

@@ -45,11 +45,13 @@ function installTaskScheduler() {
     execFileSync('schtasks', args, { encoding: 'utf-8', timeout: 10000 });
     return {
       installed: true,
+      active: true,
       message: `Task Scheduler task created: ${TASK_NAME} (hourly)`,
     };
   } catch (err) {
     return {
       installed: false,
+      active: false,
       message: `Failed to create scheduled task: ${err.message}\nTry running as administrator.`,
     };
   }
@@ -60,31 +62,40 @@ function installTaskScheduler() {
  *
  * @returns {{ removed: boolean, message: string }}
  */
-function removeTaskScheduler() {
-  if (os.platform() !== 'win32') {
-    return { removed: false, message: 'Task Scheduler is Windows only.' };
+function removeTaskScheduler(options = {}) {
+  const platform = options.platform || os.platform();
+  const run = options.execFileSync || execFileSync;
+  if (platform !== 'win32') {
+    return { removed: false, failed: false, message: 'Task Scheduler is Windows only.' };
   }
 
   try {
-    execFileSync('schtasks', ['/delete', '/TN', TASK_NAME, '/F'], {
+    run('schtasks', ['/delete', '/TN', TASK_NAME, '/F'], {
       encoding: 'utf-8',
       timeout: 10000,
     });
     return {
       removed: true,
+      failed: false,
       message: `Task Scheduler task removed: ${TASK_NAME}`,
     };
   } catch (err) {
-    if (err.message.includes('does not exist') || err.message.includes('ERROR')) {
-      return { removed: false, message: 'Task not found. Already uninstalled.' };
+    if (isTaskMissing(err)) {
+      return { removed: false, failed: false, message: 'Task not found. Already uninstalled.' };
     }
     return {
       removed: false,
+      failed: true,
       message: `Failed to remove task: ${err.message}`,
     };
   }
 }
 
+function isTaskMissing(err) {
+  const output = `${err?.message || ''}\n${String(err?.stdout || '')}\n${String(err?.stderr || '')}`;
+  return /task name(?: .*?)? does not exist|cannot find the (?:file|task)|task .* not found/i.test(output);
+}
+
 module.exports = {
   installTaskScheduler,
   removeTaskScheduler,

package/src/killer.js

@@ -56,7 +56,6 @@ function killZombies(zombies, config) {
         action: 'kill',
         pid: proc.pid,
         name: proc.name,
-        cmd: proc.cmd,
         reason: proc.reason,
         memFreed: proc.mem,
       });
@@ -69,7 +68,6 @@ function killZombies(zombies, config) {
         action: 'kill-failed',
         pid: proc.pid,
         name: proc.name,
-        cmd: proc.cmd,
         error: killResult.error,
       });
     }
@@ -120,6 +118,9 @@ function verifyProcessUnix(proc, runtime = runtimeOptions()) {
     if (scanPrefix !== currentPrefix) {
       return { valid: false, reason: 'cmd-mismatch' };
     }
+    if (!matchesCustomLiteral(proc, cmd)) {
+      return { valid: false, reason: 'pattern-mismatch' };
+    }
 
     // Verify start time if available
     if (proc.startTime) {
@@ -156,6 +157,9 @@ function verifyProcessWindows(proc, runtime = runtimeOptions({ platform: 'win32'
   if (scanPrefix !== currentPrefix) {
     return { valid: false, reason: 'cmd-mismatch' };
   }
+  if (!matchesCustomLiteral(proc, currentCmd)) {
+    return { valid: false, reason: 'pattern-mismatch' };
+  }
 
   if (proc.startTime && current.startTime && current.startTime !== proc.startTime) {
     return { valid: false, reason: 'start-time-mismatch' };
@@ -168,6 +172,11 @@ function verifyProcessWindows(proc, runtime = runtimeOptions({ platform: 'win32'
   return { valid: true, reason: 'verified' };
 }
 
+function matchesCustomLiteral(proc, currentCmd) {
+  if (!proc.matchLiteral) return true;
+  return String(currentCmd).toLowerCase().includes(String(proc.matchLiteral).toLowerCase());
+}
+
 /**
  * Kill a process with graceful shutdown sequence.
  *

package/src/process-diagnostic.js

@@ -0,0 +1,17 @@
+'use strict';
+
+function providerDiagnostic(provider, code, error) {
+  return {
+    code,
+    provider,
+    message: diagnosticMessage(error),
+  };
+}
+
+function diagnosticMessage(error) {
+  const stderr = error && error.stderr ? String(error.stderr).trim() : '';
+  const fallback = error instanceof Error ? error.message : String(error || '');
+  return (stderr || fallback).replace(/\s+/g, ' ').slice(0, 500);
+}
+
+module.exports = { providerDiagnostic };

package/src/reporter.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { sanitizeTerminalText } = require('./terminal-text');
+
 /**
  * ANSI color codes — no external dependencies.
  */
@@ -78,7 +80,7 @@ function formatDiagnostic(item) {
   const providers = Array.isArray(item.providers) && item.providers.length > 0
     ? ` (providers: ${item.providers.join(', ')})`
     : '';
-  return `${code}${item.message || 'process scan diagnostic'}${providers}`;
+  return sanitizeTerminalText(`${code}${item.message || 'process scan diagnostic'}${providers}`);
 }
 
 function reportScanDiagnostics(result) {
@@ -123,8 +125,8 @@ function reportDryRun(zombies) {
   const totalMem = zombies.reduce((sum, z) => sum + z.mem, 0);
 
   for (const z of zombies) {
-    console.log(`  ${c('red', 'PID')} ${c('bold', String(z.pid).padStart(6))}  ${c('cyan', z.name.padEnd(16))}  ${c('yellow', formatBytes(z.mem).padStart(8))}  ${c('gray', formatDuration(z.age).padStart(6))}`);
-    console.log(`  ${c('gray', '  cmd:')} ${truncate(z.cmd, 72)}`);
+    console.log(`  ${c('red', 'PID')} ${c('bold', String(z.pid).padStart(6))}  ${c('cyan', truncate(z.name, 16).padEnd(16))}  ${c('yellow', formatBytes(z.mem).padStart(8))}  ${c('gray', formatDuration(z.age).padStart(6))}`);
+    console.log(`  ${c('gray', '  cmd:')} ${truncate(sanitizeTerminalText(z.cmd), 72)}`);
     console.log(`  ${c('gray', '  why:')} ${z.reason}`);
     console.log();
   }
@@ -155,7 +157,7 @@ function reportKill(results) {
     const totalMem = killed.reduce((sum, p) => sum + p.mem, 0);
     console.log(c('green', `  Killed ${killed.length} zombie process${killed.length === 1 ? '' : 'es'}:`));
     for (const p of killed) {
-      console.log(`    ${c('green', 'KILLED')} PID ${String(p.pid).padStart(6)}  ${p.name.padEnd(16)}  ${formatBytes(p.mem).padStart(8)}`);
+      console.log(`    ${c('green', 'KILLED')} PID ${String(p.pid).padStart(6)}  ${truncate(p.name, 16).padEnd(16)}  ${formatBytes(p.mem).padStart(8)}`);
     }
     console.log(c('green', `\n  Memory freed: ${formatBytes(totalMem)}`));
 
@@ -170,14 +172,14 @@ function reportKill(results) {
   if (skipped.length > 0) {
     console.log(c('yellow', `\n  Skipped ${skipped.length} (re-verification failed):`));
     for (const p of skipped) {
-      console.log(`    ${c('yellow', 'SKIP')}   PID ${String(p.pid).padStart(6)}  ${p.name.padEnd(16)}  reason: ${p.skipReason}`);
+      console.log(`    ${c('yellow', 'SKIP')}   PID ${String(p.pid).padStart(6)}  ${truncate(p.name, 16).padEnd(16)}  reason: ${sanitizeTerminalText(p.skipReason)}`);
     }
   }
 
   if (failed.length > 0) {
     console.log(c('red', `\n  Failed to kill ${failed.length}:`));
     for (const p of failed) {
-      console.log(`    ${c('red', 'FAIL')}   PID ${String(p.pid).padStart(6)}  ${p.name.padEnd(16)}  error: ${p.error}`);
+      console.log(`    ${c('red', 'FAIL')}   PID ${String(p.pid).padStart(6)}  ${truncate(p.name, 16).padEnd(16)}  error: ${sanitizeTerminalText(p.error)}`);
     }
   }
 
@@ -233,7 +235,7 @@ function reportLogs(logs) {
         console.log(`  ${time}  ${c('green', 'KILL')}  PID ${String(entry.pid).padStart(6)}  ${(entry.name || '').padEnd(16)}  ${formatBytes(entry.memFreed || 0)}`);
         break;
       case 'kill-failed':
-        console.log(`  ${time}  ${c('red', 'FAIL')}  PID ${String(entry.pid).padStart(6)}  ${(entry.name || '').padEnd(16)}  ${entry.error || ''}`);
+        console.log(`  ${time}  ${c('red', 'FAIL')}  PID ${String(entry.pid).padStart(6)}  ${(entry.name || '').padEnd(16)}  ${sanitizeTerminalText(entry.error || '')}`);
         break;
       case 'cleanup-summary':
         console.log(`  ${time}  ${c('cyan', 'DONE')}  killed:${entry.killed} failed:${entry.failed} skipped:${entry.skipped}  freed:${formatBytes(entry.totalMemFreed || 0)}`);
@@ -258,7 +260,7 @@ function reportConfig(config, configPath) {
     const displayValue = Array.isArray(value)
       ? (value.length === 0 ? '[]' : JSON.stringify(value))
       : String(value);
-    console.log(`  ${c('cyan', key.padEnd(20))} ${displayValue}`);
+    console.log(`  ${c('cyan', key.padEnd(20))} ${sanitizeTerminalText(displayValue)}`);
   }
 
   console.log();