Development record
cli.go scrubPaths — the error surface cli.Run prints for every verb — redacts the cwd, the home and the paths embedded in a PathError but applies no termsafe.Sanitize, so an error message that echoes an operand (acquireSource fetch failed for %s with the raw URL, and every other verb whose error text quotes user or repository content) can carry ESC, C1 and bidi runes to stderr raw. Repo-wide, all verbs; found while fixing GHSA-4fmm-95pf-32c6 and deliberately not fixed there. A fix would sanitise once at the print site and pin it with an ESC-bearing operand.
issueresolvedminoriss-2609012037438844
cli.go scrubPaths — the error surface cli.Run prints for every verb — redacts the cwd, the home and the paths embedded in a PathError but applies no termsafe.Sanitize, so an error message that echoes an operand (acquireSource fetch failed for %s with the raw URL, and every other verb whose error text quotes user or repository content) can carry ESC, C1 and bidi runes to stderr raw. Repo-wide, all verbs; found while fixing GHSA-4fmm-95pf-32c6 and deliberately not fixed there. A fix would sanitise once at the print site and pin it with an ESC-bearing operand.
Grounds
- pursued: no verb's refusal reaches the terminal with a raw attack rune; an echoed operand whose ESC, C1 or bidi rune survives on stderr or in the envelope would show it wrong
Frontmatter
| id | iss-2609012037438844 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609012037438844-cli-go-scrubpaths-the-error-surface-cli.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609260221565656The staging hooks and the guard hook print stderr diagnostics that bypass Run's masking: session-end (cli.go warn) and subagent-stop (hook_subagent.go warn) print msg raw while the --json reason is Sanitize'd, so a transcript_path carrying ESC or RLO reaches the terminal raw; guard hook failOpen and its dropped-repo-layer lines print %v and scrubPaths(err) unmasked, so a committed .abcd/guard.json whose entries map key carries ESC reaches stderr raw through the JSON type error. iss-2609012037438844 was resolved as masking at the print site, which is false until every stderr print in internal/surface/cli that bypasses Run masks too.