From 12c01348be31817dde45c3bfff78411f1435386d Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Sun, 9 Aug 2026 15:10:44 +0800
Subject: [PATCH 01/10] test(core): give shell-registry fixtures their own
 output paths
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The retention-cap tests time out at 15s on shared CI runners while passing
everywhere else, and it is not load. Every settle writes a status sidecar
next to the entry's outputPath, and the fixture's default pointed all of
them at one fixed path: `/tmp/s1.output`, so `/tmp/s1.status` on every
machine that ever ran this suite. On a sticky-bit /tmp the file can already
belong to another user, and then the atomic write's rename answers EPERM
and retries with a blocking exponential backoff — 50, 100, 200ms — before
giving up. That is ~350ms per settle, measured at 362ms; the cap tests
settle 34 entries each, which is 12.3s of a 15s budget before the
assertions even run.

A/B on one machine with that exact shape (an unrenameable file planted at
the shared path): the old fixture reports `Test timed out in 15000ms`
three times over, the new one passes 57/57 in 778ms.

The fix is the fixture, not the retry policy: the backoff protects real
writes against transient EPERM and should stay. Entries now get output
paths under a per-test temp directory keyed by shellId, which the existing
afterEach already cleans, so no two entries — and no two jobs — share a
sidecar. The two tests that hand-wrote `/tmp` paths to exercise `&` and
control characters in a basename keep exactly that subject and move their
directory too.

Seen on feat/daemon-git-worktree-guard and feat/review-capture-tui, four
tests apiece, same describe block, with the file taking 120s.
---
 .../services/backgroundShellRegistry.test.ts  | 41 ++++++++++++++++---
 1 file changed, 35 insertions(+), 6 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index ba07b80f640..3c6f169ac18 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -35,6 +35,8 @@ afterEach(() => {
     rmSync(dir, { recursive: true, force: true });
   }
   tmpDirs = [];
+  // The per-test entry directory goes with them.
+  entryDir = undefined;
 });
 
 function makeOutputFile(content: string): string {
@@ -51,16 +53,34 @@ function makeTempDir(): string {
   return dir;
 }
 
+// Every settle writes a status sidecar next to the entry's outputPath, so
+// the fixture must not point them all at one SHARED path. With the old
+// fixed `/tmp/s1.output`, every entry in a test wrote `/tmp/s1.status` — a
+// path a sticky-bit /tmp shares with every other job on the machine. When
+// that file already belongs to another user, the atomic write's rename
+// answers EPERM and retries with a blocking exponential backoff (50, 100,
+// 200ms), so ONE settle costs ~350ms: measured, 34 of them take 12.3s of a
+// 15s test budget, which is what turned the retention-cap tests into
+// timeouts on shared CI runners while passing everywhere else. A per-run
+// directory keyed by shellId cannot collide with anything.
+let entryDir: string | undefined;
+
+function entryOutputPath(shellId: string): string {
+  entryDir ??= makeTempDir();
+  return join(entryDir, `${shellId}.output`);
+}
+
 function makeEntry(
   overrides: Partial<ShellTaskRegistration> = {},
 ): ShellTaskRegistration {
+  const shellId = overrides.shellId ?? 's1';
   return {
-    shellId: 's1',
+    shellId,
     command: 'sleep 60',
     cwd: '/tmp',
     status: 'running',
     startTime: 1000,
-    outputPath: '/tmp/s1.output',
+    outputPath: entryOutputPath(shellId),
     abortController: new AbortController(),
     ...overrides,
   };
@@ -318,12 +338,16 @@ describe('BackgroundShellRegistry', () => {
       const reg = new BackgroundShellRegistry();
       const callback = vi.fn();
       reg.setNotificationCallback(callback);
+      // The `&` in the BASENAME is what this test is about; the directory
+      // is the run's own so the settle below writes its status sidecar
+      // somewhere no other job shares.
+      const outputPath = join(makeTempDir(), 'out&err.log');
       reg.register(
         makeEntry({
           shellId: 'a&b',
           command: 'echo "<script>"',
           cwd: '/repo&work',
-          outputPath: '/tmp/out&err.log',
+          outputPath,
         }),
       );
 
@@ -338,7 +362,7 @@ describe('BackgroundShellRegistry', () => {
       expect(modelText).toContain('<cwd>/repo&amp;work</cwd>');
       expect(modelText).toContain('<result>bad &lt;thing&gt;[31m</result>');
       expect(modelText).toContain(
-        '<output-file>/tmp/out&amp;err.log</output-file>',
+        `<output-file>${outputPath.replace('&', '&amp;')}</output-file>`,
       );
     });
 
@@ -391,11 +415,14 @@ describe('BackgroundShellRegistry', () => {
       const reg = new BackgroundShellRegistry();
       const callback = vi.fn();
       reg.setNotificationCallback(callback);
+      // The control character in the BASENAME is the subject; the run's own
+      // directory keeps the status sidecar out of a shared path.
+      const outputPath = join(makeTempDir(), 'out\x03.log');
       reg.register(
         makeEntry({
           shellId: 'a',
           cwd: '/repo\x01\x02/work',
-          outputPath: '/tmp/out\x03.log',
+          outputPath,
         }),
       );
 
@@ -403,7 +430,9 @@ describe('BackgroundShellRegistry', () => {
 
       const [, modelText] = callback.mock.calls[0];
       expect(modelText).toContain('<cwd>/repo/work</cwd>');
-      expect(modelText).toContain('<output-file>/tmp/out.log</output-file>');
+      expect(modelText).toContain(
+        `<output-file>${outputPath.replace('\x03', '')}</output-file>`,
+      );
       expect(modelText).not.toContain('\x01');
       expect(modelText).not.toContain('\x02');
       expect(modelText).not.toContain('\x03');

From ededcef1629e71fb80d5aa53a0592bca512e961d Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Sun, 9 Aug 2026 17:11:25 +0800
Subject: [PATCH 02/10] test(core): expect the notification path through
 production's own escape
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The rebuilt <output-file> expectations computed their value by hand — a
single-occurrence String.replace, and none at all in the control-character
test — while production emits escapeXml(stripDisplayControlChars(path)),
which escapes all five XML metacharacters globally. So the expectations
were only correct while os.tmpdir() itself contained none of & < > " '.

That is the same "passes here, fails there" dependence this PR exists to
remove, in a new form and introduced by its own first commit. Probe: under
TMPDIR=/tmp/qcprobe/o&brien and .../o'brien, three tests fail with
production behaving correctly. Routing every expectation through escapeXml
makes all three environments agree — 57/57 under a plain TMPDIR and under
both poisoned ones.

Includes the pre-existing assertion in 'emits one task-notification when a
shell completes', which carried the same latent dependence and now goes
through the same pipeline.
---
 .../src/services/backgroundShellRegistry.test.ts | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index 3c6f169ac18..8cd7af1ea09 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -27,6 +27,7 @@ import {
   type ShellTaskRegistration,
 } from './backgroundShellRegistry.js';
 import { todoWorkChainContext } from '../utils/promptIdContext.js';
+import { escapeXml } from '../utils/xml.js';
 
 let tmpDirs: string[] = [];
 
@@ -302,7 +303,9 @@ describe('BackgroundShellRegistry', () => {
       expect(modelText).toContain(
         '<output-tail truncated="false">first line\nfinal result</output-tail>',
       );
-      expect(modelText).toContain(`<output-file>${outputPath}</output-file>`);
+      expect(modelText).toContain(
+        `<output-file>${escapeXml(outputPath)}</output-file>`,
+      );
       expect(meta).toEqual({
         shellId: 'a',
         status: 'completed',
@@ -361,8 +364,15 @@ describe('BackgroundShellRegistry', () => {
       );
       expect(modelText).toContain('<cwd>/repo&amp;work</cwd>');
       expect(modelText).toContain('<result>bad &lt;thing&gt;[31m</result>');
+      // Through the SAME pipeline production uses: escapeXml handles all
+      // five metacharacters globally, and a hand-rolled `replace` only
+      // matched the first one — so the expectation was correct only while
+      // os.tmpdir() itself held none of & < > " '. A TMPDIR under an
+      // `o&brien` or `o'brien` directory failed this test with production
+      // behaving correctly (probe-verified), which is the same
+      // "passes here, fails there" dependence this PR exists to remove.
       expect(modelText).toContain(
-        `<output-file>${outputPath.replace('&', '&amp;')}</output-file>`,
+        `<output-file>${escapeXml(outputPath)}</output-file>`,
       );
     });
 
@@ -431,7 +441,7 @@ describe('BackgroundShellRegistry', () => {
       const [, modelText] = callback.mock.calls[0];
       expect(modelText).toContain('<cwd>/repo/work</cwd>');
       expect(modelText).toContain(
-        `<output-file>${outputPath.replace('\x03', '')}</output-file>`,
+        `<output-file>${escapeXml(outputPath.replace('\x03', ''))}</output-file>`,
       );
       expect(modelText).not.toContain('\x01');
       expect(modelText).not.toContain('\x02');

From 1d832ba54eeba47534998e71d9de69909dc34d4f Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Sun, 9 Aug 2026 19:56:12 +0800
Subject: [PATCH 03/10] test(core): compose the notification path instead of
 re-deriving it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Third time on the same class, so this fixes the class rather than the case.
Production renders <output-file> as escapeXml(stripDisplayControlChars(p)).
My first pass hand-wrote the escape (single-occurrence, so only the first
`&`), the second added escapeXml but not the strip, and each was correct
only while os.tmpdir() happened to hold nothing the pipeline transforms — a
TMPDIR under a control character, a C1 byte, or a second \x03 failed the
assertion with production behaving correctly.

The expectations now call the real functions in the real order through one
helper, so they cannot drift from production at all. Verified 57/57 under a
clean TMPDIR, one containing \x01, and one containing `&`; dropping either
half of the composition turns three tests red under the matching hostile
TMPDIR.

(Noted while here, not changed: the registry keeps a private copy of
stripDisplayControlChars byte-identical to the exported one in
terminalSafe.ts. Out of scope for a deflake, but worth a look.)
---
 .../services/backgroundShellRegistry.test.ts   | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index 8cd7af1ea09..c6805748d08 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -28,6 +28,18 @@ import {
 } from './backgroundShellRegistry.js';
 import { todoWorkChainContext } from '../utils/promptIdContext.js';
 import { escapeXml } from '../utils/xml.js';
+import { stripDisplayControlChars } from '../utils/terminalSafe.js';
+
+// EXACTLY what production composes for <output-file>
+// (backgroundShellRegistry.ts renders escapeXml(stripDisplayControlChars(…))).
+// Hand-rolling either half is how this went wrong twice: a
+// single-occurrence `replace` for the `&`, then a single-occurrence one for
+// the control character — each correct only while os.tmpdir() happened to
+// hold nothing the pipeline transforms. Composing the real functions cannot
+// drift from production at all.
+function renderedPath(outputFile: string): string {
+  return escapeXml(stripDisplayControlChars(outputFile));
+}
 
 let tmpDirs: string[] = [];
 
@@ -304,7 +316,7 @@ describe('BackgroundShellRegistry', () => {
         '<output-tail truncated="false">first line\nfinal result</output-tail>',
       );
       expect(modelText).toContain(
-        `<output-file>${escapeXml(outputPath)}</output-file>`,
+        `<output-file>${renderedPath(outputPath)}</output-file>`,
       );
       expect(meta).toEqual({
         shellId: 'a',
@@ -372,7 +384,7 @@ describe('BackgroundShellRegistry', () => {
       // behaving correctly (probe-verified), which is the same
       // "passes here, fails there" dependence this PR exists to remove.
       expect(modelText).toContain(
-        `<output-file>${escapeXml(outputPath)}</output-file>`,
+        `<output-file>${renderedPath(outputPath)}</output-file>`,
       );
     });
 
@@ -441,7 +453,7 @@ describe('BackgroundShellRegistry', () => {
       const [, modelText] = callback.mock.calls[0];
       expect(modelText).toContain('<cwd>/repo/work</cwd>');
       expect(modelText).toContain(
-        `<output-file>${escapeXml(outputPath.replace('\x03', ''))}</output-file>`,
+        `<output-file>${renderedPath(outputPath)}</output-file>`,
       );
       expect(modelText).not.toContain('\x01');
       expect(modelText).not.toContain('\x02');

From 7ec241a535e8c1d0b25cdbc793d7a509616b6535 Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Sun, 9 Aug 2026 13:40:54 +0000
Subject: [PATCH 04/10] fix(core): use the shared stripDisplayControlChars in
 the shell registry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The registry kept a private stripDisplayControlChars that predates #4358:
that change added the bidi override/isolate ranges (U+202A-U+202E,
U+2066-U+2069) to the shared terminalSafe version and migrated
monitorRegistry onto it, but left this copy behind. The copies have
diverged ever since, even though terminalSafe's contract says both
background notification surfaces must apply the same defense.

The divergence bit this PR: the deflake's rebuilt <output-file>
expectations compose escapeXml(stripDisplayControlChars(...)) from the
shared utils — "exactly what production composes" was true for every
input except bidi codepoints, one more pass-here-fail-there dependence
in the class this PR exists to remove (and the earlier "byte-identical
copies" note was wrong: the shared one strips two more ranges).

Import the shared function and delete the stale copy. Notification
rendering (cwd, command label, result, output-file) now strips bidi
override/isolate characters — the documented Trojan-Source defense the
shared function exists for — and the test's composition can no longer
drift from production on any input. Net -20 lines.
---
 .../src/services/backgroundShellRegistry.ts   | 22 +------------------
 1 file changed, 1 insertion(+), 21 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.ts b/packages/core/src/services/backgroundShellRegistry.ts
index 094f647c70c..fb2fc31335c 100644
--- a/packages/core/src/services/backgroundShellRegistry.ts
+++ b/packages/core/src/services/backgroundShellRegistry.ts
@@ -24,6 +24,7 @@ import type { TaskBase, TaskRegistration } from '../agents/tasks/types.js';
 import { atomicWriteFileSync } from '../utils/atomicFileWrite.js';
 import { createDebugLogger } from '../utils/debugLogger.js';
 import { todoWorkChainContext } from '../utils/promptIdContext.js';
+import { stripDisplayControlChars } from '../utils/terminalSafe.js';
 import { escapeXml } from '../utils/xml.js';
 
 const debugLogger = createDebugLogger('BACKGROUND_SHELLS');
@@ -31,27 +32,6 @@ const MAX_NOTIFICATION_COMMAND_LENGTH = 80;
 const MAX_NOTIFICATION_MODEL_COMMAND_LENGTH = 500;
 export const MAX_NOTIFICATION_OUTPUT_TAIL_BYTES = 8192;
 
-/**
- * Strip C0 control characters (except tab) and C1 control characters from
- * terminal/UI display strings. Shell commands and errors are usually
- * user-authored, but this keeps escape sequences out of the visible
- * notification surface if a caller passes unsanitized text.
- */
-function stripDisplayControlChars(text: string): string {
-  let out = '';
-  for (let i = 0; i < text.length; i++) {
-    const code = text.charCodeAt(i);
-    if (code === 0x09) {
-      out += text[i];
-      continue;
-    }
-    if (code < 0x20) continue;
-    if (code >= 0x80 && code <= 0x9f) continue;
-    out += text[i];
-  }
-  return out;
-}
-
 function stripOutputControlChars(text: string): string {
   let out = '';
   for (let i = 0; i < text.length; i++) {

From 787fbf6256a2f7c3daac9bcbcc7d89b18b8f6e4b Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Mon, 10 Aug 2026 00:04:41 +0800
Subject: [PATCH 05/10] test(core): pin escapeXml's GLOBAL replace, not just
 its five characters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The composed oracle this PR introduced cannot discriminate a mutation in
escapeXml — it computes the expectation with the same function under test,
so both sides move together by construction. The literal case in
xml.test.ts is where that property has to live, and it carried exactly one
`&`: the other four metacharacters appeared twice and were pinned globally,
`&` was not.

Measured: mutating `.replace(/&/g, '&amp;')` to `.replace('&', '&amp;')`
ships green across the whole package — 19,546 tests passed. A real path
with two of them (a TMPDIR under `o&brien` with a basename like
`out&err.log`, the very case this PR's own history is about) would then
render a raw `&` into a model-facing XML envelope with nothing failing.

The case now carries two `&`, and the mutant turns it red.
---
 packages/core/src/utils/xml.test.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/packages/core/src/utils/xml.test.ts b/packages/core/src/utils/xml.test.ts
index 457d6539a44..ba56df2f655 100644
--- a/packages/core/src/utils/xml.test.ts
+++ b/packages/core/src/utils/xml.test.ts
@@ -10,8 +10,14 @@ import { escapeSystemReminderTags, escapeXml } from './xml.js';
 describe('xml utils', () => {
   describe('escapeXml', () => {
     it('escapes XML metacharacters for element and attribute contexts', () => {
-      expect(escapeXml(`a&b <tag attr="x">'y'</tag>`)).toBe(
-        'a&amp;b &lt;tag attr=&quot;x&quot;&gt;&apos;y&apos;&lt;/tag&gt;',
+      // TWO of each metacharacter: with a single `&`, a
+      // `.replace(/&/g, …)` → `.replace('&', …)` mutation shipped green
+      // across the whole package (measured: 19,546 tests passed), and a
+      // path holding two — a TMPDIR under `o&brien` with a basename like
+      // `out&err.log` — would then put a raw `&` into a model-facing XML
+      // envelope. The other four were already pinned globally; `&` was not.
+      expect(escapeXml(`a&b&c <tag attr="x">'y'</tag>`)).toBe(
+        'a&amp;b&amp;c &lt;tag attr=&quot;x&quot;&gt;&apos;y&apos;&lt;/tag&gt;',
       );
     });
   });

From 882568626772aeaf7efceb3fea4bbfadb4990198 Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Mon, 10 Aug 2026 00:26:02 +0800
Subject: [PATCH 06/10] test(core): pin the bidi stripping the shared helper
 brought with it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The swap to the shared stripDisplayControlChars is NOT behaviour-preserving,
and I said it was. The shared helper carries two lines the registry's own
copy did not — U+202A-202E and U+2066-2069 — so it strips bidi overrides as
well as C0/C1, and that changes what five notification paths render. My
"byte-identical" claim came from comparing the first dozen lines and
stopping where they matched.

Measured: `/tmp/a<RLO>evil<PDI>/out.log` renders unchanged through the old
copy and as `/tmp/aevil/out.log` through the shared one. Those characters
reorder how a path DISPLAYS without changing its bytes, so leaving them in
a model-facing envelope is a spoofing surface; the stronger behaviour is
the one to keep.

Kept, then, but no longer undocumented: a registry-level test pins the bidi
stripping in the notification, and reverting to a C0/C1-only helper turns it
red. The PR title and body say what actually changes.
---
 .../services/backgroundShellRegistry.test.ts  | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index c6805748d08..376f48bfdfd 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -349,6 +349,29 @@ describe('BackgroundShellRegistry', () => {
       expect(modelText).not.toContain(command);
     });
 
+    it('strips BIDI OVERRIDES from the notification, not just C0/C1', () => {
+      // The shared helper this renders through removes U+202A-202E and
+      // U+2066-2069 as well as C0/C1 — the registry's own former copy did
+      // not. Those characters reorder how a path DISPLAYS without changing
+      // its bytes, so `/tmp/a<RLO>evil<PDI>/out.log` can render as
+      // something else entirely in a model-facing envelope. This pins the
+      // stronger behaviour that came with the shared helper.
+      const reg = new BackgroundShellRegistry();
+      const callback = vi.fn();
+      reg.setNotificationCallback(callback);
+      const outputPath = join(makeTempDir(), 'a\u202Eevil\u2069.log');
+      reg.register(makeEntry({ shellId: 'bidi', outputPath }));
+
+      reg.complete('bidi', 0, 2000);
+
+      const [, modelText] = callback.mock.calls[0];
+      expect(modelText).toContain(
+        `<output-file>${renderedPath(outputPath)}</output-file>`,
+      );
+      expect(modelText).not.toContain('\u202E');
+      expect(modelText).not.toContain('\u2069');
+    });
+
     it('escapes XML and strips display control characters on failure', () => {
       const reg = new BackgroundShellRegistry();
       const callback = vi.fn();

From 9e0f67ea014bc16122028554b7ee34b5cc799f16 Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Mon, 10 Aug 2026 02:16:24 +0800
Subject: [PATCH 07/10] fix(core): strip bidi overrides from the output tail
 too
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The consolidation stopped one surface short, and my own test hid it: it
asserts modelText-wide absence of U+202E, which reads as whole-envelope
coverage, but its fixture shell has no output file — so <output-tail>
renders the canned unreadable form and was never exercised. The tail is the
LARGEST attacker-controllable field in the envelope, up to 8 KiB of a
background shell's own output, and it renders through a different helper
that stripped C0/C1 and passed bidi through verbatim. Probe-verified before
the fix: a shell whose output contains U+202E and U+2069 puts both into
<output-tail> unchanged.

Fixed in that helper rather than by swapping in the shared one, because the
tail must preserve newlines and carriage returns that the display helper
strips. Pinned by a test whose shell actually writes an output file — the
gap the previous pin had — asserting both that the overrides are gone and
that the line structure survives. Reverting the two ranges turns it red.

This is the Trojan-Source class (CVE-2021-42574): the characters reorder
how surrounding text reads without changing a byte, which in a model-facing
envelope means the model can be shown something other than what ran.
---
 .../services/backgroundShellRegistry.test.ts  | 27 +++++++++++++++++++
 .../src/services/backgroundShellRegistry.ts   |  9 +++++++
 2 files changed, 36 insertions(+)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index 376f48bfdfd..a199ff1d74c 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -349,6 +349,33 @@ describe('BackgroundShellRegistry', () => {
       expect(modelText).not.toContain(command);
     });
 
+    it('strips BIDI OVERRIDES from the OUTPUT TAIL — the biggest field', () => {
+      // The sibling test below asserts modelText-wide absence, which reads
+      // as whole-envelope coverage but is not: its fixture shell has no
+      // output file, so <output-tail> renders the canned unreadable form
+      // and is never exercised. The tail is the LARGEST
+      // attacker-controllable field — up to 8 KiB of a background shell's
+      // own output — and it renders through a different helper, which
+      // stripped C0/C1 but passed bidi overrides through verbatim
+      // (probe-verified). Newlines must survive the fix.
+      const reg = new BackgroundShellRegistry();
+      const callback = vi.fn();
+      reg.setNotificationCallback(callback);
+      const outputPath = makeOutputFile(
+        'line one\nharmless\u202Eevil\u2069 two\n',
+      );
+      reg.register(makeEntry({ shellId: 'tail-bidi', outputPath }));
+
+      reg.complete('tail-bidi', 0, 2000);
+
+      const [, modelText] = callback.mock.calls[0];
+      expect(modelText).toContain('<output-tail');
+      expect(modelText).not.toContain('\u202E');
+      expect(modelText).not.toContain('\u2069');
+      // The tail keeps its line structure — the strip must not eat \n.
+      expect(modelText).toContain('line one\nharmless');
+    });
+
     it('strips BIDI OVERRIDES from the notification, not just C0/C1', () => {
       // The shared helper this renders through removes U+202A-202E and
       // U+2066-2069 as well as C0/C1 — the registry's own former copy did
diff --git a/packages/core/src/services/backgroundShellRegistry.ts b/packages/core/src/services/backgroundShellRegistry.ts
index fb2fc31335c..98fdce4ab16 100644
--- a/packages/core/src/services/backgroundShellRegistry.ts
+++ b/packages/core/src/services/backgroundShellRegistry.ts
@@ -42,6 +42,15 @@ function stripOutputControlChars(text: string): string {
     }
     if (code < 0x20) continue;
     if (code >= 0x80 && code <= 0x9f) continue;
+    // The bidi overrides the shared display helper removes, removed here
+    // too — this is the LARGEST attacker-controllable field in the envelope
+    // (up to 8 KiB of a background shell's own output), and these
+    // characters reorder how the text around them reads without changing a
+    // byte: the Trojan-Source class. Kept as its own loop rather than
+    // swapped for the shared helper because the tail must preserve
+    // newlines and carriage returns, which that helper strips.
+    if (code >= 0x202a && code <= 0x202e) continue;
+    if (code >= 0x2066 && code <= 0x2069) continue;
     out += text[i];
   }
   return out;

From 42e1665f1798b7c35cb8dc04c92a08c5bd1ac532 Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Sun, 9 Aug 2026 22:11:16 +0000
Subject: [PATCH 08/10] refactor(core): give the bidi range set one home and
 pin all nine codepoints

---
 .../services/backgroundShellRegistry.test.ts  | 28 +++++++++++++++----
 .../src/services/backgroundShellRegistry.ts   | 17 +++++------
 packages/core/src/utils/terminalSafe.ts       | 17 +++++++++--
 3 files changed, 44 insertions(+), 18 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index a199ff1d74c..7732f7866ce 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -361,8 +361,11 @@ describe('BackgroundShellRegistry', () => {
       const reg = new BackgroundShellRegistry();
       const callback = vi.fn();
       reg.setNotificationCallback(callback);
+      // ALL NINE codepoints of both stripped ranges: pinning one per
+      // range let a one-character bound typo (0x202a→0x202b,
+      // 0x2066→0x2067) ship green (probe-verified).
       const outputPath = makeOutputFile(
-        'line one\nharmless\u202Eevil\u2069 two\n',
+        'line one\nharmless\u202A\u202B\u202C\u202D\u202Eevil\u2066\u2067\u2068\u2069 two\n',
       );
       reg.register(makeEntry({ shellId: 'tail-bidi', outputPath }));
 
@@ -370,10 +373,14 @@ describe('BackgroundShellRegistry', () => {
 
       const [, modelText] = callback.mock.calls[0];
       expect(modelText).toContain('<output-tail');
-      expect(modelText).not.toContain('\u202E');
-      expect(modelText).not.toContain('\u2069');
-      // The tail keeps its line structure — the strip must not eat \n.
-      expect(modelText).toContain('line one\nharmless');
+      const bidi = '\u202A\u202B\u202C\u202D\u202E\u2066\u2067\u2068\u2069';
+      for (const ch of bidi) {
+        expect(modelText).not.toContain(ch);
+      }
+      // The tail keeps its line structure AND the text after the stripped
+      // characters survives — the strip must not eat \n or truncate at
+      // the first bidi marker.
+      expect(modelText).toContain('line one\nharmlessevil two</output-tail>');
     });
 
     it('strips BIDI OVERRIDES from the notification, not just C0/C1', () => {
@@ -387,7 +394,16 @@ describe('BackgroundShellRegistry', () => {
       const callback = vi.fn();
       reg.setNotificationCallback(callback);
       const outputPath = join(makeTempDir(), 'a\u202Eevil\u2069.log');
-      reg.register(makeEntry({ shellId: 'bidi', outputPath }));
+      reg.register(
+        makeEntry({
+          shellId: 'bidi',
+          // command and cwd render through the same shared helper — pin
+          // them too, so a field-local bidi-blind sanitizer fails here.
+          command: 'cat \u202Efd\u2069.txt',
+          cwd: '/repo/\u202Efd\u2069',
+          outputPath,
+        }),
+      );
 
       reg.complete('bidi', 0, 2000);
 
diff --git a/packages/core/src/services/backgroundShellRegistry.ts b/packages/core/src/services/backgroundShellRegistry.ts
index 98fdce4ab16..58ed52f3c62 100644
--- a/packages/core/src/services/backgroundShellRegistry.ts
+++ b/packages/core/src/services/backgroundShellRegistry.ts
@@ -24,7 +24,10 @@ import type { TaskBase, TaskRegistration } from '../agents/tasks/types.js';
 import { atomicWriteFileSync } from '../utils/atomicFileWrite.js';
 import { createDebugLogger } from '../utils/debugLogger.js';
 import { todoWorkChainContext } from '../utils/promptIdContext.js';
-import { stripDisplayControlChars } from '../utils/terminalSafe.js';
+import {
+  isBidiControlChar,
+  stripDisplayControlChars,
+} from '../utils/terminalSafe.js';
 import { escapeXml } from '../utils/xml.js';
 
 const debugLogger = createDebugLogger('BACKGROUND_SHELLS');
@@ -42,15 +45,9 @@ function stripOutputControlChars(text: string): string {
     }
     if (code < 0x20) continue;
     if (code >= 0x80 && code <= 0x9f) continue;
-    // The bidi overrides the shared display helper removes, removed here
-    // too — this is the LARGEST attacker-controllable field in the envelope
-    // (up to 8 KiB of a background shell's own output), and these
-    // characters reorder how the text around them reads without changing a
-    // byte: the Trojan-Source class. Kept as its own loop rather than
-    // swapped for the shared helper because the tail must preserve
-    // newlines and carriage returns, which that helper strips.
-    if (code >= 0x202a && code <= 0x202e) continue;
-    if (code >= 0x2066 && code <= 0x2069) continue;
+    // Same bidi set as the shared display helper, in its own loop only
+    // because the tail must keep \n and \r, which that helper strips.
+    if (isBidiControlChar(code)) continue;
     out += text[i];
   }
   return out;
diff --git a/packages/core/src/utils/terminalSafe.ts b/packages/core/src/utils/terminalSafe.ts
index 64fb89fa334..14ec01fca3b 100644
--- a/packages/core/src/utils/terminalSafe.ts
+++ b/packages/core/src/utils/terminalSafe.ts
@@ -52,6 +52,20 @@ export function stripTerminalControlSequences(s: string): string {
   );
 }
 
+/**
+ * Whether a UTF-16 code unit is a Unicode bidirectional override /
+ * isolate codepoint: `\u202a-\u202e` (LRE / RLE / PDF / LRO / RLO) or
+ * `\u2066-\u2069` (LRI / RLI / FSI / PDI). These reorder how adjacent
+ * text renders without changing a byte — the "Trojan Source" class
+ * (CVE-2021-42574). The range set lives here so every display sanitizer
+ * strips from one home.
+ */
+export function isBidiControlChar(code: number): boolean {
+  return (
+    (code >= 0x202a && code <= 0x202e) || (code >= 0x2066 && code <= 0x2069)
+  );
+}
+
 /**
  * Strip C0 control characters (except TAB), C1 control characters, and
  * Unicode bidirectional override / isolate characters from a string
@@ -90,8 +104,7 @@ export function stripDisplayControlChars(text: string): string {
     }
     if (code < 0x20) continue;
     if (code >= 0x80 && code <= 0x9f) continue;
-    if (code >= 0x202a && code <= 0x202e) continue;
-    if (code >= 0x2066 && code <= 0x2069) continue;
+    if (isBidiControlChar(code)) continue;
     out += text[i];
   }
   return out;

From 5e441d24e504ea2712b390881fba5b8ab4b561e9 Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Mon, 10 Aug 2026 00:25:16 +0000
Subject: [PATCH 09/10] test(core): pin bidi stripping at the failed shell's
 <result> site

---
 .../core/src/services/backgroundShellRegistry.test.ts  | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index 7732f7866ce..dc6642b0f15 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -432,7 +432,7 @@ describe('BackgroundShellRegistry', () => {
         }),
       );
 
-      reg.fail('a&b', 'bad <thing>\x1B[31m', 2000);
+      reg.fail('a&b', 'bad <thing>\x1B[31m \u202Eevil\u2069', 2000);
 
       const [displayText, modelText] = callback.mock.calls[0];
       expect(displayText).toBe('Background shell "echo "<script>"" failed.');
@@ -441,7 +441,13 @@ describe('BackgroundShellRegistry', () => {
         '<command>echo &quot;&lt;script&gt;&quot;</command>',
       );
       expect(modelText).toContain('<cwd>/repo&amp;work</cwd>');
-      expect(modelText).toContain('<result>bad &lt;thing&gt;[31m</result>');
+      expect(modelText).toContain(
+        '<result>bad &lt;thing&gt;[31m evil</result>',
+      );
+      // The bidi pair in the fixture pins the fourth render site: <result>
+      // is the failed shell's error string and renders only on this path.
+      expect(modelText).not.toContain('\u202E');
+      expect(modelText).not.toContain('\u2069');
       // Through the SAME pipeline production uses: escapeXml handles all
       // five metacharacters globally, and a hand-rolled `replace` only
       // matched the first one — so the expectation was correct only while

From ab245bbae818628abd719f7346a458a0455e4218 Mon Sep 17 00:00:00 2001
From: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
Date: Mon, 10 Aug 2026 04:40:15 +0000
Subject: [PATCH 10/10] fix(core): strip bidi overrides from the monitor's
 streaming <result> (#8795)

---
 .../core/src/services/monitorRegistry.test.ts | 24 +++++++++++++++++++
 packages/core/src/services/monitorRegistry.ts |  2 +-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/services/monitorRegistry.test.ts b/packages/core/src/services/monitorRegistry.test.ts
index 054eafa7ac7..f4aff1120d9 100644
--- a/packages/core/src/services/monitorRegistry.test.ts
+++ b/packages/core/src/services/monitorRegistry.test.ts
@@ -663,6 +663,30 @@ describe('MonitorRegistry', () => {
     expect(modelText).not.toContain('\u0085');
   });
 
+  it('strips BIDI overrides from the streaming event <result>, not just the display line', () => {
+    // The display line is built from `safeEventLine`, but the model-facing
+    // <result> used to render from the raw event line — the one path that
+    // carries live untrusted process output (server logs, third-party
+    // stdout) to the model. Pin all nine codepoints of both stripped
+    // ranges so a one-character bound typo ships red.
+    const callback = vi.fn();
+    registry.setNotificationCallback(callback);
+    registry.register(createEntry());
+
+    registry.emitEvent(
+      'mon-1',
+      '/tmp/a\u202A\u202B\u202C\u202D\u202Eevil\u2066\u2067\u2068\u2069/out.log',
+    );
+
+    const [displayText, modelText] = callback.mock.calls[0] as [string, string];
+    expect(modelText).toContain('<result>/tmp/aevil/out.log</result>');
+    const bidi = '\u202A\u202B\u202C\u202D\u202E\u2066\u2067\u2068\u2069';
+    for (const ch of bidi) {
+      expect(modelText).not.toContain(ch);
+      expect(displayText).not.toContain(ch);
+    }
+  });
+
   it('propagates toolUseId in notification XML and meta', () => {
     const callback = vi.fn();
     registry.setNotificationCallback(callback);
diff --git a/packages/core/src/services/monitorRegistry.ts b/packages/core/src/services/monitorRegistry.ts
index cde406fa6f4..c98de5da930 100644
--- a/packages/core/src/services/monitorRegistry.ts
+++ b/packages/core/src/services/monitorRegistry.ts
@@ -517,7 +517,7 @@ export class MonitorRegistry {
       '<status>running</status>',
       `<event-count>${entry.eventCount}</event-count>`,
       `<summary>Monitor "${escapeXml(desc)}" emitted event #${entry.eventCount}.</summary>`,
-      `<result>${escapeXml(eventLine)}</result>`,
+      `<result>${escapeXml(safeEventLine)}</result>`,
       '</task-notification>',
     );