Terminal Output Sanitization for Untrusted Content

Todo2026-09-28Jean Mertz

type: tracking

KindFeature

Implements096

Tracking ticket for RFD 096.

Implementation plan

• Build ContentWriter allowlist filter: Add jp_term::sanitize::ContentWriter, the vte-based per-class SGR allowlist filter with span-closing reset and shared conceal removal, plus unit tests for sequence classes, chunk-split sequences, and finish() behavior. Standalone, no behavior change until wired.
• Close tool-output spans for #1201: Route tool-result bytes in jp_cli::render::tool (render_result, render_formatted_arguments) through ContentWriter under pass-through (off) policy, closing the span before the truncation note. Fixes the bleeding-color regression with a snapshot test.
• Harden OSC embedding: Escape control characters in the strings jp_term::osc splices into set_title and hyperlink sequences, unconditional and independent of the sanitize config knob.
• Add the style.sanitize config knob: Introduce style.sanitize in jp_config (strip / visualize / off), defaulting to strip.
• Wire sanitization into chat rendering: Apply ContentWriter to render_request (SGR kept, span-closed), render_content/render_reasoning (SGR dropped, no span), and add the decoded-text filter in jp_md::render, with snapshot tests covering escape-laden fixtures including entity-decoded escapes.
• Audit and sanitize remaining render paths: Wire sanitization into tool-result, history re-render, and table/list output (jp conversation ls titles, jp conversation grep hits), ensuring width-budgeted truncation always runs on escape-free text and JP-authored chrome stays unsanitized.
• Enforce plain-text tool prompts: Document and strip control characters from jp_tool::Question text, pre-amble, select options, and text-answer defaults in ToolPrompter, while preserving the original (unstripped) values returned to the tool. Independent of the config knob.
• Document sanitization behavior: Update docs/configuration.md, the README security section, and the ubiquitous-language glossary to describe the new style.sanitize knob and disambiguate display sanitization from storage sanitization and stream repair.