fix(security): sanitize untrusted terminal output; fix CI lint action

Verification-protocol finding (Axis 2.8 Adversarial Surface / 2.3 Security):
agent-influenced output — streamed tokens, tool args/results, reasoning,
engine notices, and resumed transcripts — was written to the terminal
without stripping ANSI/control escape sequences, a terminal-injection risk
(cursor/screen manipulation, OSC 52 clipboard exfiltration).

- add sanitize()/isControl(): strip C0 control bytes + DEL (incl. ESC),
  keeping newlines/tabs; applied to all untrusted display paths (collapse,
  streamed token + thinking ingestion, addNote, resumed transcripts)
- tests for the sanitizer and end-to-end defanging

CI: golangci-lint v2 requires golangci-lint-action v7+ (v6 rejects v2.x) —
bump the action so the Lint job runs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rWqu7pktbd2ejfNw3a7Vf

Author: jkyberneees

.github/workflows/ci.yml

@@ -52,6 +52,6 @@ jobs:
           cache: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
           version: v2.5.0

internal/tui/gaps_test.go

@@ -1,6 +1,7 @@
 package tui
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/BackendStack21/bodek/internal/client"
@@ -45,3 +46,39 @@ func TestArgPreviewURLKey(t *testing.T) {
 		t.Errorf("argPreview url = %q", got)
 	}
 }
+
+func TestSanitizeStripsControlSequences(t *testing.T) {
+	// ESC-based screen clear + OSC 52 clipboard write must be defanged.
+	evil := "ok\x1b[2Jclear\x1b]52;c;ZXZpbA==\x07 \x7f\x00 plain\ttab\nnl"
+	got := sanitize(evil)
+	for _, bad := range []rune{'\x1b', '\x07', '\x00', '\x7f'} {
+		if strings.ContainsRune(got, bad) {
+			t.Errorf("sanitize left control byte %q in %q", bad, got)
+		}
+	}
+	if !strings.Contains(got, "plain") || !strings.Contains(got, "\t") || !strings.Contains(got, "\n") {
+		t.Errorf("sanitize dropped legitimate text/whitespace: %q", got)
+	}
+	// Fast path: clean input is returned unchanged.
+	if sanitize("hello world") != "hello world" {
+		t.Error("sanitize altered clean input")
+	}
+}
+
+func TestUntrustedOutputDefanged(t *testing.T) {
+	m := wired(t)
+	m.msgs = append(m.msgs, message{role: roleAsst, streaming: true})
+	m.curIdx = 0
+	m.handleEvent(client.Event{Type: "tool_call", Name: "shell", Data: "{\"command\":\"x\x1b[2J\"}"})
+	m.handleEvent(client.Event{Type: "tool_result", Name: "shell", Data: "out\x1b]0;pwn"})
+	m.handleEvent(client.Event{Type: "token", Content: "hi\x1b[31m"})
+
+	if strings.ContainsRune(m.msgs[0].content, '\x1b') {
+		t.Error("streamed token escape not sanitized")
+	}
+	for _, s := range m.msgs[0].steps {
+		if strings.ContainsRune(s.arg, '\x1b') || strings.ContainsRune(s.result, '\x1b') {
+			t.Error("tool step escape not sanitized")
+		}
+	}
+}

internal/tui/model.go

@@ -351,12 +351,12 @@ func (m *Model) handleEvent(ev client.Event) (tea.Model, tea.Cmd) {
 		m.sandbox = ev.Sandbox
 
 	case "thinking":
-		m.thinking.WriteString(ev.Content)
+		m.thinking.WriteString(sanitize(ev.Content))
 		m.status = "thinking"
 
 	case "token":
 		if i := m.cur(); i >= 0 {
-			m.msgs[i].content += ev.Content
+			m.msgs[i].content += sanitize(ev.Content)
 			m.msgs[i].streaming = true
 		}
 		m.status = "responding"
@@ -509,7 +509,7 @@ func (m *Model) finalize() {
 }
 
 func (m *Model) addNote(s string) {
-	m.notices = append(m.notices, s)
+	m.notices = append(m.notices, sanitize(s))
 	if len(m.notices) > 6 {
 		m.notices = m.notices[len(m.notices)-6:]
 	}
@@ -695,7 +695,37 @@ func linePreview(data string) string {
 }
 
 func collapse(s string) string {
-	return strings.Join(strings.Fields(s), " ")
+	return strings.Join(strings.Fields(sanitize(s)), " ")
+}
+
+// sanitize strips terminal control sequences from untrusted content before it
+// is rendered. Agent output — streamed tokens, tool results, file contents,
+// resumed transcripts — is attacker-influenced; raw C0 control bytes (notably
+// ESC, 0x1b) could drive ANSI/OSC escapes that move the cursor, clear the
+// screen, or exfiltrate via OSC 52. We keep newlines and tabs and drop every
+// other control byte (and DEL), which defangs escape sequences by removing
+// their introducer while leaving readable text intact.
+func sanitize(s string) string {
+	if !strings.ContainsFunc(s, isControl) {
+		return s
+	}
+	var b strings.Builder
+	b.Grow(len(s))
+	for _, r := range s {
+		if !isControl(r) {
+			b.WriteRune(r)
+		}
+	}
+	return b.String()
+}
+
+// isControl reports whether r is a control character we strip from untrusted
+// text (C0 controls and DEL, except newline and tab).
+func isControl(r rune) bool {
+	if r == '\n' || r == '\t' {
+		return false
+	}
+	return r < 0x20 || r == 0x7f
 }
 
 // formatDuration renders a short, friendly elapsed time.

internal/tui/panels.go

@@ -228,14 +228,17 @@ func (m *Model) handleSessionDetail(msg sessionDetailMsg) {
 	m.sandbox = msg.sess.Sandbox
 	m.msgs = m.msgs[:0]
 	for _, mm := range msg.sess.Messages {
+		// Persisted transcripts are attacker-influenced (agent output, and the
+		// session file itself); strip terminal control sequences before display.
+		content := sanitize(mm.Content)
 		switch mm.Role {
 		case "user":
-			m.msgs = append(m.msgs, message{role: roleUser, content: mm.Content})
+			m.msgs = append(m.msgs, message{role: roleUser, content: content})
 		case "assistant":
-			if strings.TrimSpace(mm.Content) == "" {
+			if strings.TrimSpace(content) == "" {
 				continue
 			}
-			m.msgs = append(m.msgs, message{role: roleAsst, content: mm.Content, rendered: m.render(mm.Content)})
+			m.msgs = append(m.msgs, message{role: roleAsst, content: content, rendered: m.render(content)})
 		}
 	}
 	m.addNote("resumed session " + shortID(msg.sess.ID))