fix: harden terminal output and config masking

Author: Finesssee

src/config.rs

@@ -224,11 +224,8 @@ pub fn config_get(key: &str, raw: bool) -> Result<()> {
             let api_key = get_api_key()?;
             if raw {
                 println!("{}", api_key);
-            } else if api_key.len() > 8 {
-                let masked = format!("{}***{}", &api_key[..4], &api_key[api_key.len() - 4..]);
-                println!("{}", masked);
             } else {
-                println!("lin_***");
+                println!("{}", mask_api_key_for_display(&api_key));
             }
         }
         "profile" => {
@@ -258,13 +255,7 @@ pub fn show_config() -> Result<()> {
     if let Some(current) = &config.current {
         println!("Current workspace: {}", current);
         if let Some(workspace) = config.workspaces.get(current) {
-            let key = &workspace.api_key;
-            if key.len() > 12 {
-                let masked = format!("{}...{}", &key[..8], &key[key.len() - 4..]);
-                println!("API Key: {}", masked);
-            } else {
-                println!("API Key: {}", key);
-            }
+            println!("API Key: {}", mask_api_key_for_display(&workspace.api_key));
         }
     } else {
         println!("No workspace configured. Run: linear workspace add <name>");
@@ -322,12 +313,7 @@ pub fn workspace_list() -> Result<()> {
     for (name, workspace) in &config.workspaces {
         let is_current = config.current.as_ref() == Some(name);
         let marker = if is_current { "*" } else { " " };
-        let key = &workspace.api_key;
-        let masked = if key.len() > 12 {
-            format!("{}...{}", &key[..8], &key[key.len() - 4..])
-        } else {
-            key.clone()
-        };
+        let masked = mask_api_key_for_display(&workspace.api_key);
         println!("{} {} ({})", marker, name, masked);
     }
 
@@ -360,13 +346,7 @@ pub fn workspace_current() -> Result<()> {
     if let Some(current) = &config.current {
         println!("Current workspace: {}", current);
         if let Some(workspace) = config.workspaces.get(current) {
-            let key = &workspace.api_key;
-            if key.len() > 12 {
-                let masked = format!("{}...{}", &key[..8], &key[key.len() - 4..]);
-                println!("API Key: {}", masked);
-            } else {
-                println!("API Key: {}", key);
-            }
+            println!("API Key: {}", mask_api_key_for_display(&workspace.api_key));
         }
     } else {
         println!("No workspace selected. Run: linear workspace add <name>");
@@ -422,7 +402,17 @@ fn oauth_config_has_secrets(oauth_config: &OAuthConfig) -> bool {
             .refresh_token
             .as_ref()
             .map(|token| !token.is_empty())
-            .unwrap_or(false)
+        .unwrap_or(false)
+}
+
+fn mask_api_key_for_display(api_key: &str) -> String {
+    if api_key.len() > 12 {
+        format!("{}***{}", &api_key[..4], &api_key[api_key.len() - 4..])
+    } else if api_key.starts_with("lin_") {
+        "lin_***".to_string()
+    } else {
+        "***".to_string()
+    }
 }
 
 #[cfg(feature = "secure-storage")]
@@ -793,4 +783,22 @@ mod tests {
         assert!(ws.oauth.is_some());
         assert_eq!(ws.oauth.as_ref().unwrap().access_token, "oauth_tok");
     }
+
+    #[test]
+    fn test_mask_api_key_for_display_masks_short_linear_keys() {
+        assert_eq!(mask_api_key_for_display("lin_short"), "lin_***");
+    }
+
+    #[test]
+    fn test_mask_api_key_for_display_shows_prefix_and_suffix_for_long_keys() {
+        assert_eq!(
+            mask_api_key_for_display("lin_api_prod123"),
+            "lin_***d123"
+        );
+    }
+
+    #[test]
+    fn test_mask_api_key_for_display_masks_non_linear_short_keys() {
+        assert_eq!(mask_api_key_for_display("secret"), "***");
+    }
 }

src/text.rs

@@ -1,22 +1,46 @@
+pub fn sanitize_terminal_text(input: &str) -> String {
+    use regex::Regex;
+    use std::sync::OnceLock;
+
+    static OSC_SEQUENCE: OnceLock<Regex> = OnceLock::new();
+    static CSI_SEQUENCE: OnceLock<Regex> = OnceLock::new();
+    static ESC_SEQUENCE: OnceLock<Regex> = OnceLock::new();
+
+    let osc_sequence =
+        OSC_SEQUENCE.get_or_init(|| Regex::new(r"\x1B\][^\x07\x1B]*(?:\x07|\x1B\\)").unwrap());
+    let csi_sequence = CSI_SEQUENCE.get_or_init(|| Regex::new(r"\x1B\[[0-?]*[ -/]*[@-~]").unwrap());
+    let esc_sequence = ESC_SEQUENCE.get_or_init(|| Regex::new(r"\x1B[@-Z\\-_]").unwrap());
+
+    let without_osc = osc_sequence.replace_all(input, "");
+    let without_csi = csi_sequence.replace_all(&without_osc, "");
+    let without_esc = esc_sequence.replace_all(&without_csi, "");
+
+    without_esc
+        .chars()
+        .filter(|ch| !ch.is_control() || matches!(ch, '\n' | '\t'))
+        .collect()
+}
+
 pub fn truncate(value: &str, max_len: Option<usize>) -> String {
+    let sanitized = sanitize_terminal_text(value);
     let Some(max_len) = max_len else {
-        return value.to_string();
+        return sanitized;
     };
     if max_len == 0 {
         return String::new();
     }
 
-    let char_count = value.chars().count();
+    let char_count = sanitized.chars().count();
     if char_count <= max_len {
-        return value.to_string();
+        return sanitized;
     }
 
     if max_len <= 3 {
-        return value.chars().take(max_len).collect();
+        return sanitized.chars().take(max_len).collect();
     }
 
     // Take (max_len - 3) chars and add ellipsis
-    let truncated: String = value.chars().take(max_len - 3).collect();
+    let truncated: String = sanitized.chars().take(max_len - 3).collect();
     format!("{}...", truncated)
 }
 
@@ -83,7 +107,7 @@ pub fn strip_markdown(input: &str) -> String {
     let multi_blank = MULTI_BLANK.get_or_init(|| Regex::new(r"\n{3,}").unwrap());
     result = multi_blank.replace_all(&result, "\n\n").to_string();
 
-    result.trim().to_string()
+    sanitize_terminal_text(result.trim())
 }
 
 #[cfg(test)]
@@ -203,4 +227,22 @@ mod tests {
     fn test_strip_markdown_collapses_blank_lines() {
         assert_eq!(strip_markdown("a\n\n\n\nb"), "a\n\nb");
     }
+
+    #[test]
+    fn test_truncate_strips_ansi_before_counting() {
+        assert_eq!(truncate("\u{1b}[31mhello\u{1b}[0m", Some(5)), "hello");
+    }
+
+    #[test]
+    fn test_strip_markdown_removes_terminal_control_sequences() {
+        assert_eq!(
+            strip_markdown("**hello** \u{1b}]52;c;ZXZpbA==\u{7} world"),
+            "hello  world"
+        );
+    }
+
+    #[test]
+    fn test_strip_markdown_removes_embedded_control_characters() {
+        assert_eq!(strip_markdown("ok\u{8}\u{0c}then"), "okthen");
+    }
 }