fix: harden terminal-escape rendering across all MdsError variants (CWE-150)

[dean0x]

Summary

• CWE-150 (ESC-injection hardening): Raw C0/DEL/C1 control bytes in MDS source files could reach terminal stderr and JS/Python/WASM API error messages; closes Harden terminal-escape rendering across all MdsError variants (CWE-150) #176
• Sanitization applied at all serialization and diagnostic-render boundaries — MdsError::serialize(), LintResult::to_canonical_json() (incl. "file" key), CompileResult::to_canonical_json() warnings, CLI eprint_error, and render_diag_human() — with a PF-014 redesign that sanitizes render inputs, not the rendered frame, so miette's own colour codes survive on TTY
• T-1..T-15 test vectors across all surfaces: Rust unit tests, CLI e2e, output unit tests, and binding tests for napi (T-12/T-13, E-10..E-13), WASM (T-15, F5/F6), Python (T-14), and @mdscript/mds universal package (T-11)

Changes

Production (A-series)

Change	File	Description
A1	crates/mds-core/src/error.rs	serialize() applies sanitize_control_chars to message and help — all three binding layers inherit this; adds MdsError::display_sanitized() public API
A2	crates/mds-cli/src/output.rs	PF-014 redesign: neutralize_source_for_render sanitizes source excerpt inputs byte-length-preservingly; render_error_sanitized sanitizes message/help pre-render; eprint_error delegates to it
A3	crates/mds-cli/src/watch.rs	Replace 11 bare eprintln!("{e:?}") calls with eprint_error(e) — watch mode now sanitizes on the same path as build/check/compile/fmt
A4	crates/mds-cli/src/lint.rs	Route render_diag_human to sanitize inputs (message, help, source) before miette renders — not post-hoc on the rendered frame
B4	crates/mds-core/src/lint/diagnostic.rs	to_canonical_json() sanitizes message, help, and the "file" group key at the JSON serialization boundary

Tests (B-series)

• T-1..T-3 (error_tests.rs): serialize sanitizes ESC/DEL/C1 in message and help
• T-4 (diagnostic.rs): to_canonical_json() sanitizes diagnostic message with ESC byte
• T-5..T-9 (cli_lint.rs): CLI e2e — single-file, directory, stdin, DEL+C1, JSON output path
• T-10a/b/c (output.rs): neutralize_source_for_render — C0 removal, byte-length preservation (span safety), and colour-code passthrough
• T-11 (packages/mds/__test__/error.spec.mjs): @mdscript/mds universal package — U-E10 (ESC in error), U-E11 (DEL in error), U-E12 (C1/NEL in lint), U-E-DIFF (native/WASM parity)
• T-12/T-13 + E-10..E-13 (crates/mds-napi/__test__/index.spec.mjs): napi — T-12/E-10 error path ESC, T-13/E-11 lint path ESC, E-12 error path DEL, E-13 lint path C1
• T-14 (crates/mds-python/tests/test_errors.py): Python — T-14/E11 error-path, T-14/E12 typed LintDiagnostic.message and to_json()
• T-15 (crates/mds-wasm/tests/web.rs): WASM — T-15/F5 error path, T-15/F6 lint path via lintVirtual

Stale reference fixes (D)

Fixed 4 stale "issue #5" cross-refs → "issue #176" in cli_build.rs, cli_lint.rs, cli_commands.rs, cli_fmt.rs.

Breaking Changes

Behavioral change (necessary for security): err.message, err.help, and lint diagnostic messages delivered via the JS/Python/WASM API now carry \uXXXX 6-char literals for any embedded C0/DEL/C1 bytes instead of the raw bytes. Consumers that grep for exact control byte sequences in error messages will need to update — they should be checking for sanitized literals anyway.

Bundler packages (zero plugin-side changes): @mdscript/bundler-utils (formatMdsError) and all plugin/loader packages (@mdscript/vite-plugin, @mdscript/rollup-plugin, @mdscript/webpack-loader, @mdscript/rspack-loader) inherit sanitized error messages transitively via core MdsError::serialize() — no changes were required in any plugin or bundler package.

Related Issues

• Closes Harden terminal-escape rendering across all MdsError variants (CWE-150) #176 (ESC-injection hardening / CWE-150)
• Issue tech-debt: Harden CLI/NAPI boundaries with escaping and injection tests #90 (boundary hardening) stays OPEN — this PR partially advances it by hardening all error serialization and lint diagnostic boundaries, but tech-debt: Harden CLI/NAPI boundaries with escaping and injection tests #90 covers a broader set of input-validation concerns that are not fully addressed here.

Validation Results

Numbers as of original submission; resolve round not re-validated here — orchestrator re-validates before merge.

Check	Result
cargo fmt --all --check	PASS
cargo clippy --workspace --all-targets -- -D warnings	PASS
cargo nextest run --workspace	1918/1918
cargo test --doc --workspace	36/36
WASM release binary (mds_wasm_bg.wasm)	816,800 bytes ≤ 850,000 budget
npm test --workspaces	96 pass
pytest crates/mds-python/tests -q	220 pass
Examples smoke: mds lint examples/linting/	exits 2 as designed (stress-test build OK)
Adversarial ANSI smoke	stderr contains literal ^[, zero raw 0x1B bytes

Reviewer Focus Areas

• A1 (error.rs:serialize) — verify that sanitize_control_chars is called on both message (from self.to_string()) and help (from Diagnostic::help(self)), and that span byte offsets are NOT touched (lines 826-832)
• A4 (lint.rs:render_diag_human) — PF-014 redesign: verify that message/help and the source excerpt bytes are sanitized before miette renders; no post-hoc pass over the rendered frame; verify both with_source_code and plain Report::from branches
• T-9 redesign — serde_yaml_ng rejects raw ESC bytes in YAML frontmatter keys with mds::yaml; the test now verifies the JSON output wire contains no raw control bytes regardless of which path fires (regression guard); programmatic lint-message sanitization is covered by T-4
• WASM budget — 816,800 bytes ≤ 850,000 byte limit; the sanitize_control_chars addition is <1KB

Review-resolution addendum

The resolve round (commits after 25e5e25) addressed the PF-014 defect identified in review:

PF-014 render redesign: The original A2 sanitized the already-rendered miette frame (post-hoc over the full string). miette's fancy renderer emits real SGR colour codes into that string, so the sanitizer was escaping miette's own ANSI sequences on TTY — mangling legitimate colour output on benign input, and misaligning caret columns by up to ~10 chars per control byte (because miette computed carets against raw source before the 1→6 char expansion). The fix moves sanitization to the renderer's inputs:

• neutralize_source_for_render(src) — byte-length-preserving pass: C0/DEL → ? (U+003F, same byte width), C1 → NBSP (U+00C2 U+00A0, same 2-byte width as UTF-8 C1). Span offsets computed by miette stay accurate.
• Message and help strings are sanitized to \uXXXX literals (same as the wire format) before being attached to the miette Report.
• The rendered frame itself is passed through unchanged — miette's SGR codes survive on TTY.

New public APIs added:

• MdsError::display_sanitized() -> String — returns the sanitized Display form; safe for terminal output. The raw Display impl is preserved with a documented unsafety contract.
• neutralize_source_for_render(src: &str) -> Cow<str> — public for testing and downstream CLI tools.

Additional hardening in this round:

• sanitize_control_chars returns Cow<'_, str> (fast path: no allocation when input is clean).
• CompileResult::to_canonical_json() warnings and emit_warnings sanitized.
• Python LintResult sanitization moved to constructor (eliminates double-sanitize on the wire-JSON path).
• CLI status-line paths (filename display in Clean: … / Fixed: … / error lines) use a safe_path helper.
• Strict cross-surface assertions and T-label renumbering (T-1..T-15, no gaps; napi uses T-12/T-13 + E-10..E-13; WASM uses T-15 F5/F6; Python uses T-14; universal package uses T-11 with U-E10..U-E-DIFF).

Fixes #176

Escalation-decision addendum (2026-07-26)

The 2026-07-25 review escalated 5 findings that were escape-map / wire-contract decisions, not bugs. All were decided by the owner and implemented on this branch.

Finding	Decision	Outcome
security-4	WIDEN	Escape class extended to all 12 Unicode Bidi_Control members (U+061C, U+200E/F, U+202A–E, U+2066–9) plus U+2028/2029 and U+FEFF — Trojan Source / CVE-2021-42574
security-9	ESCAPE \n ON WIRE ONLY	Wire surfaces escape newline (CWE-117 log forging); the CLI human render keeps real newlines so multi-line frames still render
security-10 + reliability-9	ACCEPT + DOCUMENT	Escaping is one-way, lossy and non-injective; consumers MUST NOT un-escape. Round-tripping is a permanent non-goal (spec §7.5)
security-11	TTY-GATED NEUTRALIZE	--fix --diff preview neutralizes control bytes on a terminal, stays byte-faithful when piped so diffs remain patch-applicable

Governing rule (re-ratified)

The four-boundary enumeration was superseded by a per-field rule: untrusted identifiers and filenames are WIRE-escaped on every surface that renders a diagnostic, human output included; prose (message/help bodies) stays HUMAN. A filename is never legitimately multi-line, so preserving \n in one only enables status-line forgery; a diagnostic body legitimately is multi-line.

Owner-approved scope additions

• Raw-ESC on the CLI error path — MdsError message text reached stderr unescaped. Fixed at the eprint_error choke-point via a SanitizedReport wrapper that covers both MdsError and the CLI's own miette!() errors, and forwards an owned sanitized cause graph (the previous debug_assert!-only guard was compiled out in release — PF-005).
• CI-enforced print discipline — crates/mds-cli/tests/print_discipline.rs fails the build if any print macro in mds-cli/src interpolates a value that is not a sanitizer call. Three consecutive review rounds each found a new bare eprintln! after the previous was fixed; this converts an unbounded reviewer search into a bounded, enforced invariant. It traces let bindings one hop, refuses to resolve non-let binders, and fails closed on anything untraceable.

Declared residuals — specified, not hidden

1. MdsError message bodies interpolate untrusted text as prose, so a \n survives inside the rendered miette frame. The forged text is │-prefixed and indented, so it cannot masquerade as a bare status line. Not closed: there are 118 MdsError::*(format!(…)) construction sites, and fixing a handful would leave the claim false at the rest.
2. Functional path references — Source Map v3 file/sources and CompileResult.dependencies are emitted verbatim. Escaping them would point the map at a path that does not exist, breaking resolution. Consumers MUST treat embedded paths as untrusted (spec §7.5, "Carve-out: functional path references").
3. Five allowlisted eprint_warning sites whose safety rests on mds-core producer discipline that a CLI-side lexical guard cannot verify across the crate boundary. The one reachable producer is now covered by a test; the other two interpolate parser-validated identifiers.

Verification

cargo nextest 1980 (from 1943), 37 doctests, 229 pytest, 100 napi, 265 universal JS, 53 wasm-pack; clippy -D warnings and fmt --check clean. WASM 822,137 bytes vs the 850,000 CI guard.

Four independent adversarial alignment passes were run; each found and closed a claim the code had not yet earned.

Note: this PR also fixes a defect currently live on main — the pre-fix binary sanitized the rendered miette frame, so benign syntax errors rendered as literal [31m noise on any colour terminal. CI never saw it because CLI tests pin NO_COLOR=1.

[dean0x]

Code Review: ESC-injection hardening (PR #253 / issue #176)

Recommendation: HOLD — 4 blocking defects require fixes before merge.

---

Findings Summary

#	Severity	Reviewers	Finding
1	BLOCKING	5 (security 98%, regression 98%, reliability 92%, testing 90%, docs 85%)	Post-render ANSI/caret desynchronization — inline at output.rs:496
2	BLOCKING	5 (security 95%, architecture 90%, reliability 85%, python 96%, docs 90%)	files[].file left unsanitized — inline at diagnostic.rs:327
3	BLOCKING	2 (testing 95%, security)	T-9 fully vacuous, passes pre-fix binary — inline at cli_lint.rs:1795
4	BLOCKING	3 (regression 95%, docs 97%, compliance 95%)	Missing CHANGELOG entry for breaking security change — see below
8	BLOCKING	1 (python 97%)	Python typed-vs-wire parity break — inline at lib.rs:780
5	SHOULD FIX	4 (complexity 93%, rust 93%, docs 96%, architecture 95%)	Stale/contradictory doc blocks at diagnostic.rs:123 and :135 — inline at diagnostic.rs:7
6	SHOULD FIX	2 (consistency 92%, testing 85%)	Lowercase \u001b fallback is dead code — inline at index.spec.mjs:1272
7	SHOULD FIX	1 (complexity 92%)	C1 byte-range scan over raw UTF-8 bytes — inline at cli_lint.rs:1827

---

Finding #4 — BLOCKING: Missing CHANGELOG entry (summary-only; no file in diff)

No CHANGELOG entry exists for this PR despite it being a breaking behavioral change. Inputs that previously echoed raw control bytes verbatim in --format json output now emit \uXXXX literals. Any consumer that depended on raw bytes (e.g., byte-scans or exact string matching) silently breaks. This satisfies the project's "breaking behavioral change" threshold.

The compliance and documentation reviewers both flag that the project CHANGELOG has an [Unreleased] section and this change must appear in it before merge. The regression reviewer notes that the CHANGELOG is the only human-readable record linking CWE-150 hardening to the wire-format impact.

Fix: Add an entry to CHANGELOG.md under [Unreleased] such as:

### Security
- `mds lint --format json` now emits `\uXXXX` 6-char literals in `message` and `help`
  fields instead of raw C0/DEL/C1 control bytes (CWE-150 / issue #176). This is a
  wire-format change: consumers that byte-scan these fields must update their patterns.

---

Additional should-fix items (>=80% confidence, single-reviewer, not consolidated above)

• Architecture (90%): CompileResult::to_canonical_json warnings[] field carries raw strings — the module doc "ALL boundaries" claim is still false after this PR for compile-error surfaces.
• Architecture (90%): Five sibling eprint_error-like sites hand-roll eprintln!("+sanitize instead of calling the new eprint_error()` helper — PF-004 duplication that will drift.
• Rust (95%): Display for MdsError still emits raw control bytes via fmt::Display while serialize() sanitizes — an unsafe ergonomic default; any .to_string() caller gets raw bytes.
• Rust (90%): render_diag_human deep-clones the full fix_edits payload into the miette struct — miette only reads labels and help; the clone is pure waste on every human-render call.
• Rust (85%): sanitize_control_chars returns String; a Cow<'_, str> fast-path would skip allocation on clean inputs (which are the overwhelmingly common case).
• Performance (90%): render_diag_human clones the full source file per diagnostic — O(diagnostics × file_size); a shared Arc<str> would reduce this to O(1) per diagnostic.

---

Lower-confidence suggestions (60–79% — discussion only, not blocking)

• Security (75%): \n is in the allowed pass-through set; a consumer that writes diagnostic messages to a log file without further escaping is vulnerable to log injection. Consider whether \n should be \u000A in the sanitization output for CLI-output-only use cases.
• Security (70%): sanitize_control_chars is not injective — a downstream that unescapes \uXXXX literals recovers live ESC. Document the "sanitize for terminal rendering, not for round-trip" scope in the function doc.
• Architecture (70%): render_error_sanitized naming — render_report_for_terminal or render_report_sanitized would communicate the terminal-context intent more precisely.
• Architecture (68%): --diff / --check output echoes raw file paths; ESC-bearing paths would still survive to stderr on those code paths. Arguably by design (not a lint-output surface), but worth documenting the scope decision.
• Consistency (65%): The vector-label accounting scheme (T-5a/T-5b vs T-5/T-6 numbering) is inconsistent between comments and the tracking doc; T-11 is referenced but absent.

---

Verified clean — do not re-litigate in follow-up review

The following axes were independently verified by multiple reviewers and are confirmed safe:

Axis	Verdict	Evidence
Span / offset integrity (PF-012)	CLEAN	sanitize_control_chars never touches span / fix_edits; T-4 pins byte offsets end-to-end
Idempotency	CLEAN	\uXXXX output contains no control chars; double-pass is a safe no-op
PF-005 (debug_assert-only guard)	CLEAN	All sanitization is unconditional runtime code; no debug_assert! guarding any security invariant
debug-panics feature	CLEAN	Zero Cargo.toml / package.json changes; debug-panics absent from all binding defaults
Supply-chain	CLEAN	Zero dependency additions or version bumps
Bundler zero-change	CLEAN	formatMdsError / bundler-utils treats message/help as opaque strings; spans taken from numbers
--fix machinery	CLEAN	diag_to_edits consumes LintDiagnostic structs directly, never re-parses JSON
CRLF sources	CLEAN	miette strips \r during line-splitting; CRLF inputs do not affect span accuracy
watch.rs A3	CLEAN	11 sites uniformly use eprint_error; import added; zero divergence
--format json shape	CLEAN	Keys, ordering, span, fix_edits byte-identical on benign input (no control bytes)
UTF-8 safety	CLEAN	sanitize_control_chars operates on char scalars via char_indices(); no byte-level truncation

---

Code review by Claude — 12 reviewers (security, architecture, performance, complexity, consistency, regression, testing, reliability, rust, python, documentation, compliance)

[dean0x]

BLOCKING — Post-render sanitization breaks colour output and misaligns carets
Converging reviewers: security 98%, regression 98%, reliability 92%, testing 90%, docs 85% — 5 reviewers

render_error_sanitized formats the report with {report:?} — which on a colour TTY causes miette's GraphicalReportHandler to emit ANSI SGR sequences — then runs sanitize_control_chars over the already-rendered frame. miette's own \x1b[33m becomes literal [33m garbage. Every interactive mds lint and mds watch invocation is broken on benign input. CI stays green because piped stderr disables colour; none of the new T-5..T-9 tests use a pty or force-enable colour.

Second consequence: the post-render pass widens the source line by 5 columns per control char (1 → 6 chars) but leaves the caret row untouched, so carets misalign for any span whose error-triggering token appears after a control byte on the same source line. The comment at lint.rs:284 asserting "Span accuracy is preserved" is inverted — miette computes widths against the raw source, so post-render expansion of those bytes is exactly what breaks alignment.

Reproduced on a pty:

$ script -q /dev/null ./target/debug/mds lint plain.mds 2>&1 | head -3
[33mmds::lint::legacy-interpolation[0m   ← bare `[33m` not ANSI

Fix: sanitize untrusted inputs before miette renders them, not the rendered output. For the source string passed to NamedSource, use a byte-length-preserving substitution (1 byte → 1 byte, e.g. replace each control byte with 0x20 or a Unicode replacement char) so span offsets and caret columns stay exact. For the whole-frame path, either drop it entirely (the input is already clean) or make it colour-aware (allow ESC [ … m through, escape everything else).

Additionally: add a T-10 variant that places a span after a control byte and asserts caret column alignment, and add one in-process colour-forced test so the interactive TTY render path has coverage.

Co-Authored-By: Claude noreply@anthropic.com

[dean0x]

BLOCKING — files[].file left unsanitized while sibling message/help fields are sanitized
Converging reviewers: security 95%, architecture 90%, reliability 85%, python 96%, docs 90% — 5 reviewers

This hunk sanitizes message and help, but the per-file group key approximately 14 lines below this hunk (line 341 in the current file, outside the diff):

// line 341 (not in this hunk — the gap is the defect):
"file": file,

...is emitted raw. serde_json escapes C0 bytes (< 0x20) in JSON strings, but C1 bytes (U+0080–U+009F) are ≥ 0x20 and emitted verbatim. A filename containing U+009B (CSI) reaches --format json output as a live control byte. Any consumer that reads json["files"][i]["file"] and writes it to a terminal gets a live CSI sequence.

This directly falsifies the module doc seven lines above this file's start that now claims sanitization at "ALL serialization and render boundaries."

Verified:

$ mds lint $'fo�o.mds' --format json | python3 -c   "import json,sys; r=json.load(sys.stdin); print(repr(r['files'][0]['file']))"
'fo�o.mds'   ← raw C1 in parsed JSON value

Same gap at crates/mds-python/src/lib.rs:800 (file: file_key unsanitized in LintFileReport construction) and LintFileReport.file typed getter.

Fix:

// diagnostic.rs line ~341
.map(|(file, diagnostics)| {
    serde_json::json!({
        "file": mds::sanitize_control_chars(&file),
        "diagnostics": diagnostics,
    })
})

Propagate to mds-python/src/lib.rs:800 for cross-surface parity. Add a T-10 variant with a control char in the filename asserting files[0].file is sanitized.

Co-Authored-By: Claude noreply@anthropic.com

[dean0x]

BLOCKING — T-9 is fully vacuous; --format json wire format has zero non-trivial ESC coverage
Converging reviewers: testing 95%, security — 2 reviewers

T-9 cannot fail against the pre-fix binary for three independent reasons:

1. serde_yaml_ng rejects raw ESC upstream. The YAML frontmatter key source: with a raw ESC byte causes a parse error in serde_yaml_ng; the error envelope has a fixed generic message ("failed to parse") with no user-supplied content. sanitize_control_chars is never called on this path.

2. Gate 3 binds None and silently skips. The error envelope from a YAML parse failure does not populate json["files"], so the if let Some(files_arr) = json.get("files") check at Gate 3 binds None and the entire per-diagnostic assertion is skipped.

3. Gate 2 tests serde_json behaviour, not sanitize_control_chars. The byte scan for C0 bytes (< 0x20) only confirms that serde_json escapes control bytes in JSON strings — a guarantee that was always true. It proves nothing about what sanitize_control_chars does or whether it runs.

Verified: T-9 passes when run against the pre-fix binary.

Fix — use the duplicate-import vector with a module name containing U+001B (known to produce a user-visible message):

#[cfg(unix)]
#[test]
fn lint_json_esc_in_diagnostic_message_is_sanitized() {
    let dir = tempfile::tempdir().unwrap();
    fs::write(dir.path().join("fo\u{1B}o.mds"), b"hi\n").unwrap();
    let main = dir.path().join("main.mds");
    fs::write(&main, b"@import \"./fo\x1Bo.mds\"\n@import \"./fo\x1Bo.mds\"\nhi\n").unwrap();
    let out = mds_bin().env("NO_COLOR", "1")
        .args(["lint", "--format", "json"]).arg(&main)
        .stdout(std::process::Stdio::piped()).output().unwrap();
    let json: serde_json::Value = serde_json::from_slice(&out.stdout).expect("valid JSON");
    let files = json["files"].as_array().expect("files must be present: non-vacuity guard");
    let msg = files[0]["diagnostics"][0]["message"].as_str()
        .expect("duplicate-import diagnostic must exist");
    assert!(!msg.contains('\x1B'), "raw ESC in message: {msg:?}");
    assert!(msg.contains("\\u001B"), "sanitized literal missing: {msg:?}");
}

Also change Gate 3 from if let Some(...) to .expect(...) so future shape changes surface as test failures rather than silent skips.

Co-Authored-By: Claude noreply@anthropic.com

[dean0x]

SHOULD FIX — Two LintDiagnostic doc blocks 116–128 lines below directly contradict this rewritten module header
Converging reviewers: complexity 93%, rust 93%, docs 96%, architecture 95% — 4 reviewers

This PR correctly rewrote the module doc (lines 7–17) to say "ALL serialization and render boundaries." But the LintDiagnostic struct doc at lines 123 and 135 of this file was not updated and now says the opposite:

Line 123 (struct doc eprintln! usage example):

/// miette at the CLI boundary: `eprintln!("{:?}", miette::Report::from(diag))`

This is verbatim the anti-pattern that output.rs:501–503 now forbids with a MUST NOT comment, and exactly the CWE-150 vulnerability this PR closes. A contributor following this example re-introduces the vulnerability.

Line 135 (struct doc sanitization note):

/// **Sanitization**: apply `sanitize_control_chars` at the CLI render boundary only.

The word "only" encodes the pre-PR contract. This PR changed it to "ALL boundaries." The two docs are now contradictory.

These are the highest-traffic docs on this type (cargo doc / IDE hover on LintDiagnostic).

Fix — update lines 123 and 135 in this file:

// line 123: replace the eprintln! example with:
/// Render **only** via `mds_cli::output::eprint_error` — never a bare
/// `eprintln!("{report:?}")`, which leaks raw control bytes (issue #176 / CWE-150).

// line 135: replace the sanitization note with:
/// **Sanitization**: see module-level "Sanitization discipline" — applied at every
/// output boundary; raw bytes preserved here so span offsets and fix-edit byte
/// ranges stay accurate. Do not call `sanitize_control_chars` in constructors.

Co-Authored-By: Claude noreply@anthropic.com

[dean0x]

SHOULD FIX — Lowercase \u001b fallback is dead code that weakens the assertion
Converging reviewers: consistency 92%, testing 85% — 2 reviewers

sanitize_control_chars uses {:04X} (uppercase hex). The || d.message.includes('\\u001b') branch (lowercase) is unreachable against the current implementation and any future implementation constrained by the test suite — because 13 other assertions in this PR (T-5a, T-5b, T-6, T-7, error-path tests across all three binding surfaces) correctly pin uppercase \\u001B.

The lowercase fallback means a casing regression at diagnostic.rs:426 (the format string) would fail 13 tests and silently pass this assertion. The same dead-code fallback appears at:

• crates/mds-python/tests/test_errors.py:268: "\\u001B" in d.message or "\\u001b" in d.message
• crates/mds-wasm/tests/web.rs:894: .contains("\\u001B") || m.contains("\\u001b")

Fix in all three files — drop the lowercase branch:

// napi T-13b (this file, line ~1272):
const hasSanitizedEsc = allDiags.some(
  (d) => typeof d.message === 'string' && d.message.includes('\\u001B'),
);

# Python test_errors.py:268:
esc_in_messages = [d for d in all_diags if "\\u001B" in d.message]

// WASM web.rs:894:
let has_sanitized = all_messages.iter().any(|m| m.contains("\\u001B"));

Co-Authored-By: Claude noreply@anthropic.com

[dean0x]

SHOULD FIX — Byte-level C1 range check on raw UTF-8 bytes causes spurious failures on ordinary non-ASCII text
Converging reviewers: complexity 92% — 1 reviewer

stdout_str.bytes() filtered by (0x80..=0x9F).contains(&byte) tests UTF-8 bytes, not codepoints. A C1 codepoint (U+0080–U+009F) is encoded as two bytes: 0xC2 0x80 through 0xC2 0x9F. But 0x80 is also the continuation byte of — (em dash, E2 80 94), ' (right single quote, E2 80 99), and hundreds of other common characters. The moment any diagnostic message contains an em dash — pervasive in this repo's message strings — Gate 2 fires a false positive.

The same PR correctly uses char_indices() with codepoint comparison in crates/mds-wasm/tests/web.rs:790. Two implementations have already diverged within a single PR. Gate 3 at line 1845 repeats the same byte-level predicate.

Fix — hoist a codepoint-predicate helper into crates/mds-cli/tests/common/mod.rs:

pub fn assert_no_raw_control_chars(s: &str, label: &str) {
    for (i, ch) in s.char_indices() {
        let cp = ch as u32;
        let bad = (cp < 0x20 && cp != 0x09 && cp != 0x0A)
            || cp == 0x7F
            || (0x80..=0x9F).contains(&cp);
        assert!(!bad, "raw control char U+{cp:04X} at byte {i} in {label}; text: {s:?}");
    }
}

Gates 2 and 3 then collapse to:

assert_no_raw_control_chars(&stdout_str, "lint --format json stdout");

Co-Authored-By: Claude noreply@anthropic.com

[dean0x]

BLOCKING — Python typed-vs-wire parity break violates a documented invariant (PF-007)
Converging reviewers: python 97% — 1 reviewer

message and help are sanitized when populating the typed pyclass here (lines 780/784), but LintResult.to_dict() at line 833 returns self.value verbatim via value_to_py. When self.value carries a raw control byte — which can happen via the public LintResult(canonical_dict) constructor (also the __reduce__ / unpickle path) — the typed getter and wire format diverge:

result.files()[0].diagnostics[0].message  → "...\u001B..."   (sanitized)
result.to_dict()["files"][0]["diagnostics"][0]["message"]  → "...\x1b..."  (raw)

Line 701 of this file is the class docstring that asserts the opposite: "typed getters and to_dict()/to_json() read from it so they can never diverge." test_par6_file_report_to_dict_parity_null_help_span (test_parity.py:206) is a PF-007 regression test for this invariant — it passes currently only because its fixture has no control bytes.

Additionally, LintFileReport.file at line ~800 is the field carrying raw bytes while sibling message/help are sanitized — PF-004 (alternate path bypasses control enforced on primary path) on a parallel field in the same object.

The comment on line 776–780 ("belt-and-suspenders defense-in-depth") describes the intent correctly but is applied to the wrong side of the split — sanitizing at read-time on the typed path leaves the backing store raw.

Fix: move sanitization into LintResult::new() so self.value carries sanitized bytes from the moment untrusted data enters (covers the LintResult(canonical) constructor and unpickle). Remove the sanitize calls at lines 780/784. Apply the same to LintFileReport.file at construction. Add test_e13_lintresult_from_canonical_sanitizes_message that constructs via LintResult(canonical) with a raw ESC byte and asserts both typed and to_dict() paths return the sanitized literal.

Co-Authored-By: Claude noreply@anthropic.com