[nedtwigg]

Hardens what terminal output can do through query replies and links, and what invisible characters can hide.

• OSC 99 reply id. A capability reply reaches the PTY's input, so it now echoes an id only when it matches ^[A-Za-z0-9_+.-]{1,64}$. Any other id is dropped and the query is still answered. Every other reply, from Dormouse, xterm.js, or ImageAddon, carries only a parsed color, a number, or a constant. S124 now states this.
• Deceptive links. classifyDisplayMatch now compares the host the display text resolves to. It applies NFKC, reads separators as spaces, drops invisible characters, strips wrapping brackets and punctuation, and ignores a root dot or a port. Non-ASCII names go through the URL parser as punycode. Text that names no host (12.5%, v1.2.3) and a file: link whose text names its own path (README.md:42) stay plain.
• Terminal file: links. A click on a link whose text names its target now waits on the same dialog as a document link when the resolved target would run its own script. The check runs on the resolved target, so a symlink can't answer for its name and a user's inert handler skips the question. A declined question opens nothing further, and a double-click keeps one question. The click reaches the handler through a host-only dispatch option, not request params.
• Invisible characters. FORMAT_CHARACTERS now covers every Unicode format and default-ignorable code point, and every separator but U+0020. boundedPushText drops the same invisible characters, which also covers pairing and passkey labels.
• Docs. security.md now states that an upstream Tool grant reaches a dormouse.yml nested in a checkout, and that a confirmed terminal link can send a local page's contents off the machine. The dor-tool rationale no longer assumes output names its own host.

Behavior to review:

• A Tool's run can no longer spell an emoji that needs U+FE0F (U+200D was already refused); a script it calls still can. Paths and arguments are not refused, but consent dialogs and dor tool now show these characters, and spaces like U+202F in macOS screenshot names, as \u escapes.
• README.md:42 linking to a non-file: target, such as an https: permalink or vscode://file/..., is now deceptive, as README.md already was. It has a copy action but no open action.

Testing:

• New tests went red with their fixed lines removed.
• A real bash and zsh behind the owner stream showed nothing from an out-of-alphabet id stays staged at the prompt.
• tsc -b in lib and tsc --noEmit in standalone pass.
• The last root pnpm test, at load average about 90, had one failure: the 300-iteration group-drop test timed out at 5s. An earlier run at similar load also failed IframePanel and frame-client. All three files pass when run alone with --testTimeout=120000 --retry=3, and this branch does not touch them.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	9d18f57
Status:	🚫  Deploy failed.

View logs