/** * Display hygiene for strings that go through MCP tool responses. * * `cleanDisplayChars` is **NOT** anti-injection. The framing wrapper in * `wrap.ts` is what isolates author content from operator instructions; * this helper only strips characters that would render badly or sneak * past visual inspection of the displayed text. Calling it on * author-controlled strings before wrapping keeps the user-visible * output free of zero-width unicode, ANSI escape sequences, and * unbounded newlines. * * Definition (single source of truth, repo-wide): * 1. Strip zero-width unicode: U+200B (ZWSP), U+200C (ZWNJ), * U+200D (ZWJ), U+FEFF (ZWNBSP / BOM). * 2. Strip ANSI CSI escape sequences (`\x1b[...m` and similar). * 3. Normalize newlines: convert `\r\n` and `\r` to `\n`. * * What this does NOT do: * - Collapse whitespace runs (would be a Phase-4c-specific extension * and produce divergent versions of the helper; explicitly avoided). * - Reject CR/LF (the `list_pinned` integrity gate validates that * on the **raw** value before this helper runs). * - Strip `<|im_start|>` or similar markup tokens (ineffective: the * LLM doesn't enforce them as protocol; the framing wrapper does). */ export declare function cleanDisplayChars(input: string): string; /** * Stricter helper for one-line display contexts where any whitespace * separator other than a single space would visually break the line — * e.g. statusline output, search result rows, the agent banner header. * Built on top of `cleanDisplayChars`; replaces every JS-regex `\s` * run (space, `\t`, `\v`, `\f`, `\n`, `\r`, U+00A0, U+2028, U+2029, * and other unicode whitespace) with a single space, then trims. * * `cleanDisplayChars` alone is not enough for one-line contexts: the * server's Zod schema accepts names/descriptions up to 100/280 chars * including embedded whitespace, and `cleanDisplayChars` normalizes * `\r` to `\n` (and leaves `\t`, `\v`, `\f`, ` `, ` ` * untouched). A name like `"evil\rOPERATOR"`, `"evil\fOPERATOR"`, or * `"evil OPERATOR"` would otherwise produce a second visual * line outside the wrapper. This helper closes that. */ export declare function cleanInlineString(input: string): string;