fix: neutralize bidi and control chars in action logs

[EndBug]

Summary

• Sanitize strings logged through log() so Unicode bidi/isolate controls and C0/C1 characters render as visible \uXXXX escapes instead of spoofing CI log display.
• Apply the same neutralization to conflicted file paths in the pull conflict error.
• Add unit coverage and rebuild the bundled lib/ artifact.

Test plan

• npm test passes (includes new neutralizeLogString / neutralizeForLog cases)
• Confirm a path containing U+202E logs as \u202e rather than reversing surrounding text
• Confirm normal ASCII filenames are unchanged in logs

Made with Cursor

Summary by CodeRabbit

• Bug Fixes

  • Improved log safety by escaping control, bidirectional, and Unicode isolation characters.
  • Sanitized error messages, file paths, object data, and nested values before displaying logs.
  • Pull-conflict messages now display file paths safely without misleading formatting.
  • Circular references in logged data are handled safely.

• Tests

  • Added coverage for log sanitization of filenames, errors, control characters, nested data, and circular references.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fffd51af-4b38-4da6-ba1a-c4656a05a5b0

📥 Commits

Reviewing files that changed from the base of the PR and between ab6e718 and 51a7046.

📒 Files selected for processing (3)

• lib/index.js
• src/util.ts
• test/util.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• test/util.test.ts
• src/util.ts

---

📝 Walkthrough

Walkthrough

The change adds utilities that neutralize unsafe log characters, recursively sanitizes logged values and errors, and applies path sanitization to pull-conflict messages. Tests cover strings, objects, errors, circular references, and primitive values.

Changes

Log Safety

Layer / File(s)	Summary
Log sanitization utilities and coverage src/util.ts, test/util.test.ts	neutralizeLogString escapes control, bidirectional-format, and Unicode isolation characters. neutralizeForLog recursively sanitizes strings, object keys, arrays, objects, Error fields, and circular references. log now emits sanitized values. Tests cover the new behavior.
Conflict error path sanitization src/main.ts	Conflict file paths are sanitized before they are included in the thrown error message.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant log
  participant neutralizeForLog
  participant core_error
  Caller->>log: log(data or error)
  log->>neutralizeForLog: sanitize value
  neutralizeForLog-->>log: return sanitized value
  log->>core_error: write sanitized output

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: neutralizing bidi and control characters in action logs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/fix-log-bidi-spoofing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/util.ts`:
- Around line 75-85: Update neutralizeForLog to track visited arrays and objects
during recursive sanitization, using a WeakMap or equivalent context passed
through recursion. When a reference is encountered again, return a sanitized
circular-reference marker instead of recursing, while preserving existing array
and object sanitization for non-circular values so log() can complete.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6da7c15b-c91a-474a-9842-eccffa2df9dd

📥 Commits

Reviewing files that changed from the base of the PR and between 68ec86a and ab6e718.

📒 Files selected for processing (4)

• lib/index.js
• src/main.ts
• src/util.ts
• test/util.test.ts