fix(agents): warn clearly on unresolved model ids (#39215, thanks @ademczuk)

Co-authored-by: ademczuk <andrew.demczuk@gmail.com>

src/terminal/ansi.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+import { sanitizeForLog, stripAnsi } from "./ansi.js";
+
+describe("terminal ansi helpers", () => {
+  it("strips ANSI and OSC8 sequences", () => {
+    expect(stripAnsi("\u001B[31mred\u001B[0m")).toBe("red");
+    expect(stripAnsi("\u001B]8;;https://openclaw.ai\u001B\\link\u001B]8;;\u001B\\")).toBe("link");
+  });
+
+  it("sanitizes control characters for log-safe interpolation", () => {
+    const input = "\u001B[31mwarn\u001B[0m\r\nnext\u0000line\u007f";
+    expect(sanitizeForLog(input)).toBe("warnnextline");
+  });
+});

src/terminal/ansi.ts

@@ -9,6 +9,19 @@ export function stripAnsi(input: string): string {
   return input.replace(OSC8_REGEX, "").replace(ANSI_REGEX, "");
 }
 
+/**
+ * Sanitize a value for safe interpolation into log messages.
+ * Strips ANSI escape sequences, C0 control characters (U+0000–U+001F),
+ * and DEL (U+007F) to prevent log forging / terminal escape injection (CWE-117).
+ */
+export function sanitizeForLog(v: string): string {
+  let out = stripAnsi(v);
+  for (let c = 0; c <= 0x1f; c++) {
+    out = out.replaceAll(String.fromCharCode(c), "");
+  }
+  return out.replaceAll(String.fromCharCode(0x7f), "");
+}
+
 export function visibleWidth(input: string): number {
   return Array.from(stripAnsi(input)).length;
 }