Module render 

Turns a CommandOutput into text: either a human-readable summary (used by default in fslite-cli) or pretty-printed JSON matching the wire codec exactly (--json). Every untrusted string field (node names, link targets, and paths — which fslite-core normalizes but does not strip control bytes from) is passed through one of three sanitizers before it reaches a human-readable line, since a malicious filename or path segment is attacker-controlled input reaching a real terminal.

Three sanitizers exist because \n/\t are not uniformly safe to keep: sanitize_name strips all control bytes (including \n/\t), Unicode bidirectional-override characters, and the Unicode line/paragraph separators, and is used for structured fields (node names, paths, link targets) where a newline is never legitimate and would otherwise let an attacker forge extra rows in table-shaped output (e.g. a node named a.txt\nfile 999 IMPORTANT.txt injecting a fake ls row), and where a bidi override could visually spoof the name (e.g. an extension made to display reversed). sanitize_for_terminal preserves \n/\t and the Unicode line/paragraph separators but strips other control bytes and bidi overrides (which are never legitimate in any context) — used for free-text fields where raw newlines can be legitimate content. sanitize_preview is a stricter tier: it wraps sanitize_for_terminal but further escapes \n/\t and the Unicode line/paragraph separators into visible escape sequences, for free-text content rendered inline within a single row (currently only search-match previews), keeping the content visible without letting it masquerade as a row boundary.

Functions

render_human

Renders a CommandOutput as human-readable text.

render_json

Renders a CommandOutput as pretty-printed JSON, exactly matching the serde wire codec (round-trippable back into a CommandOutput).

sanitize_for_terminal

Strips ASCII control bytes (except \n/\t) — including the ESC byte that begins every ANSI escape sequence — and Unicode bidirectional-override characters from untrusted text before it is written to a terminal. This removes the trigger byte outright rather than substituting a visible placeholder, since the goal is preventing the escape sequence (or a spoofed display order) from being interpreted at all. \n/\t and the Unicode line/paragraph separators (U+2028/U+2029) are preserved, since they can be legitimate content in free text; bidi overrides are never legitimate in any context, so they are always stripped.

sanitize_name

Stricter sibling of sanitize_for_terminal for structured fields (node names, paths, link targets) where a newline is never legitimate content. Strips every ASCII control byte (including \n/\t), every Unicode bidirectional-override character, and the Unicode line/paragraph separators, so a hostile name/path can neither inject extra lines that masquerade as separate output rows nor visually spoof its own content (e.g. a bidi override making an extension display reversed).

sanitize_preview

sanitize_for_terminal, with \n/\t and the Unicode line/paragraph separators (U+2028/U+2029) then escaped into visible escape sequences instead of passed through raw. Use this for free-text content rendered inline within a single table-shaped output row (currently only search-match previews): a real newline (ASCII or Unicode) in the underlying file content stays visible to the user, but can never be mistaken for a row boundary the way a raw line break could.