Sanitize command names and descriptions (#17228)

packages/cli/src/ui/components/Help.tsx

@@ -9,6 +9,7 @@ import { Box, Text } from 'ink';
 import { theme } from '../semantic-colors.js';
 import { type SlashCommand, CommandKind } from '../commands/types.js';
 import { KEYBOARD_SHORTCUTS_URL } from '../constants.js';
+import { sanitizeForListDisplay } from '../utils/textUtils.js';
 
 interface Help {
   commands: readonly SlashCommand[];
@@ -77,7 +78,8 @@ export const Help: React.FC<Help> = ({ commands }) => (
             {command.kind === CommandKind.MCP_PROMPT && (
               <Text color={theme.text.secondary}> [MCP]</Text>
             )}
-            {command.description && ' - ' + command.description}
+            {command.description &&
+              ' - ' + sanitizeForListDisplay(command.description, 100)}
           </Text>
           {command.subCommands &&
             command.subCommands
@@ -88,7 +90,8 @@ export const Help: React.FC<Help> = ({ commands }) => (
                     {'   '}
                     {subCommand.name}
                   </Text>
-                  {subCommand.description && ' - ' + subCommand.description}
+                  {subCommand.description &&
+                    ' - ' + sanitizeForListDisplay(subCommand.description, 100)}
                 </Text>
               ))}
         </Box>

packages/cli/src/ui/components/SuggestionsDisplay.tsx

@@ -9,6 +9,8 @@ import { theme } from '../semantic-colors.js';
 import { ExpandableText, MAX_WIDTH } from './shared/ExpandableText.js';
 import { CommandKind } from '../commands/types.js';
 import { Colors } from '../colors.js';
+import { sanitizeForListDisplay } from '../utils/textUtils.js';
+
 export interface Suggestion {
   label: string;
   value: string;
@@ -115,7 +117,7 @@ export function SuggestionsDisplay({
             {suggestion.description && (
               <Box flexGrow={1} paddingLeft={3}>
                 <Text color={textColor} wrap="truncate">
-                  {suggestion.description}
+                  {sanitizeForListDisplay(suggestion.description, 100)}
                 </Text>
               </Box>
             )}

packages/cli/src/ui/utils/textUtils.test.ts

@@ -13,9 +13,34 @@ import {
   escapeAnsiCtrlCodes,
   stripUnsafeCharacters,
   getCachedStringWidth,
+  sanitizeForListDisplay,
 } from './textUtils.js';
 
 describe('textUtils', () => {
+  describe('sanitizeForListDisplay', () => {
+    it('should strip ANSI codes and replace newlines/tabs with spaces', () => {
+      const input = '\u001b[31mLine 1\nLine 2\tTabbed\r\nEnd\u001b[0m';
+      expect(sanitizeForListDisplay(input)).toBe('Line 1 Line 2 Tabbed End');
+    });
+
+    it('should collapse multiple consecutive whitespace characters into a single space', () => {
+      const input = 'Multiple \n\n newlines and \t\t tabs';
+      expect(sanitizeForListDisplay(input)).toBe('Multiple newlines and tabs');
+    });
+
+    it('should truncate long strings', () => {
+      const longInput = 'a'.repeat(50);
+      expect(sanitizeForListDisplay(longInput, 20)).toBe(
+        'a'.repeat(17) + '...',
+      );
+    });
+
+    it('should handle empty or null input', () => {
+      expect(sanitizeForListDisplay('')).toBe('');
+      expect(sanitizeForListDisplay(null as unknown as string)).toBe('');
+    });
+  });
+
   describe('getCachedStringWidth', () => {
     it('should handle unicode characters that crash string-width', () => {
       // U+0602 caused string-width to crash (see #16418)

packages/cli/src/ui/utils/textUtils.ts

@@ -123,6 +123,27 @@ export function stripUnsafeCharacters(str: string): string {
     .join('');
 }
 
+/**
+ * Sanitize a string for display in list-like UI components (e.g. Help, Suggestions).
+ * Removes ANSI codes, collapses whitespace characters into a single space, and optionally truncates.
+ */
+export function sanitizeForListDisplay(
+  str: string,
+  maxLength?: number,
+): string {
+  if (!str) {
+    return '';
+  }
+
+  let sanitized = stripAnsi(str).replace(/\s+/g, ' ');
+
+  if (maxLength && sanitized.length > maxLength) {
+    sanitized = sanitized.substring(0, maxLength - 3) + '...';
+  }
+
+  return sanitized;
+}
+
 const stringWidthCache = new LRUCache<string, number>(
   LRU_BUFFER_PERF_CACHE_LIMIT,
 );