Harden verbose context logging against terminal control-character injection

src/Bbt/Infrastructure/ResolvedContextReporter.cs

@@ -11,8 +11,10 @@ public static void LogRepoContext(BbtNetworkSettings settings, ResolvedRepoConte
             return;
         }
 
-        var source = string.IsNullOrWhiteSpace(context.Source) ? "unknown" : context.Source;
-        Console.Error.WriteLine($"Context: workspace={context.Workspace} repo={context.Repo} source={source}");
+        var workspace = TerminalSanitizer.Sanitize(context.Workspace) ?? string.Empty;
+        var repo = TerminalSanitizer.Sanitize(context.Repo) ?? string.Empty;
+        var source = TerminalSanitizer.Sanitize(string.IsNullOrWhiteSpace(context.Source) ? "unknown" : context.Source) ?? "unknown";
+        Console.Error.WriteLine($"Context: workspace={workspace} repo={repo} source={source}");
     }
 
     public static void LogWorkspaceContext(BbtNetworkSettings settings, string workspace, string source)
@@ -22,7 +24,8 @@ public static void LogWorkspaceContext(BbtNetworkSettings settings, string works
             return;
         }
 
-        var resolvedSource = string.IsNullOrWhiteSpace(source) ? "unknown" : source;
-        Console.Error.WriteLine($"Context: workspace={workspace} source={resolvedSource}");
+        var resolvedWorkspace = TerminalSanitizer.Sanitize(workspace) ?? string.Empty;
+        var resolvedSource = TerminalSanitizer.Sanitize(string.IsNullOrWhiteSpace(source) ? "unknown" : source) ?? "unknown";
+        Console.Error.WriteLine($"Context: workspace={resolvedWorkspace} source={resolvedSource}");
     }
 }

tests/Bbt.Core.Tests/Infrastructure/ResolvedContextReporterTests.cs

@@ -0,0 +1,61 @@
+using Bbt.Core.Context;
+using Bbt.Infrastructure;
+using Xunit;
+
+namespace Bbt.Core.Tests.Infrastructure;
+
+[Collection("EnvironmentVariables")]
+public sealed class ResolvedContextReporterTests
+{
+    [Fact]
+    public void LogRepoContext_SanitizesControlCharacters()
+    {
+        var settings = new TestNetworkSettings { Verbose = true };
+        var context = new ResolvedRepoContext("ws\u001b[31m", "repo\u0007", "source\u001b[0m");
+
+        using var stderr = new StringWriter();
+        var original = Console.Error;
+        try
+        {
+            Console.SetError(stderr);
+            ResolvedContextReporter.LogRepoContext(settings, context);
+        }
+        finally
+        {
+            Console.SetError(original);
+        }
+
+        var output = stderr.ToString();
+        Assert.DoesNotContain('\u001b', output);
+        Assert.DoesNotContain('\u0007', output);
+        Assert.Contains("workspace=ws[31m", output);
+        Assert.Contains("repo=repo", output);
+        Assert.Contains("source=source[0m", output);
+    }
+
+    [Fact]
+    public void LogWorkspaceContext_SanitizesControlCharacters()
+    {
+        var settings = new TestNetworkSettings { Verbose = true };
+
+        using var stderr = new StringWriter();
+        var original = Console.Error;
+        try
+        {
+            Console.SetError(stderr);
+            ResolvedContextReporter.LogWorkspaceContext(settings, "ws\u001b[31m", "src\u0001");
+        }
+        finally
+        {
+            Console.SetError(original);
+        }
+
+        var output = stderr.ToString();
+        Assert.DoesNotContain('\u001b', output);
+        Assert.DoesNotContain('\u0001', output);
+        Assert.Contains("workspace=ws[31m", output);
+        Assert.Contains("source=src", output);
+    }
+
+    private sealed class TestNetworkSettings : BbtNetworkSettings;
+}