fix(output): unify sanitize/budget layer across Discord, TUI, CLI, and agents (salvage #758+#775+#782)

[unohee]

Salvage of draft PRs #758, #775, #782 into one coherent sanitize/budget layer.

All three drafts were abandoned by the broken autonomous loop (172–247 commits
behind, bodies saying "failed 4 times"). They overlap on discordHandlers.ts,
tui/sanitize.ts, and cliRunner.ts, so they are reconciled here into a single
layer instead of three competing ones.

Kept

src/support/outputBudget.ts (new) — from #782. Destination-specific
field/message/aggregate limits (Discord embed per-field + 6000 aggregate +
1900 message, Linear, prompt, audit, TUI, CLI, pipeline) and the helpers
truncate / truncateWithSuffix / capArray / codeList /
boundedFieldValue / boundedDescription / boundedMessageContent /
boundedLinearText / flattenToSingleLine / sanitizeException /
genericUserError / paginateEmbedFields. Wired into 9 consumers:
pipelineFormat, discordHandlers, cliRunner, tester, workerAuditLog,
workflowLinear, AuditBoard, DataTable, plus reviewer / skillDocumenter.

src/discord/embedUtils.ts (new) — from #758. EMBED_LIMITS plus
safeAddField / safeSetTitle / safeSetDescription / safeSetFooter /
enforceAggregateBudget / truncateField. The limits are re-exported from
outputBudget.ts rather than restated, so the embed layer and the
destination-agnostic helpers cannot drift apart.

src/tui/sanitize.ts — #758 and #775 reconciled. Adds
sanitizeAndBoundTerminalText + MAX_RENDERED_LINE_LENGTH /
MAX_TOTAL_RENDERED_CONTENT (#758), escapeHtml / formatMonitorError
(#758), and sanitizeAndNeutralize / clampAndSanitize (#775).
sanitizeAndNeutralize now delegates its control-character pass to
sanitizeTerminalText instead of a second control-character regex.

src/adapters/codexResponses.ts — #775's createResponsesReducer, a
bounded incremental reducer that replaces events.push(ev) +
reduceResponsesEvents(events) on the live stream path, so the full parsed
event history is never retained. reduceResponsesEvents remains as a thin
wrapper for the batch/test path. Folds in #762's MAX_FRAME_LENGTH and
MAX_REASONING_BUF frame bounds from the streaming-bounds group.

src/discord/discordCore.ts — #775's withDisabledMentions /
allowedMentions: { parse: [] } applied to every reply/send/thread.send, so
externally derived content cannot trigger mention parsing.

#758 render-path wiring — discordHandlers, discordPair, cliRunner,
ChatLog, MonitorPanel, and the en/ko prompt catalogs (evidence bounding,
aggregate feedback cap, MAX_FEEDBACK_ITEMS).

Dropped

• fix(external-integrations): bound and sanitize streamed and rendered provider content — prevent memory growth and untrusted-output exposure #775's discordHandlers.ts rewrite — as its triage warned, it rewrote the
  file from 996 to 611 lines, deleting handleLimits / handleAuto /
  handleApprove / handleReject while its own discordCore.ts still imports
  and calls them. That does not compile and removes the human-approval
  (!approve / !reject) gate. Kept the current handlers and applied only the
  sanitize/mention/reducer hunks.
• fix(external-integrations): bound and sanitize streamed and rendered provider content — prevent memory growth and untrusted-output exposure #775's handleDevProgress.test.ts rewrite — it asserted bounded generic
  replies for the handler it deleted. The gate survives here, so main's
  expectations stay.
• fix(output): sanitize and budget rendered content — prevent prompt injection, invalid embeds, terminal corruption, and HTML injection #758's dashboardHtml.ts change — it added a second exported escapeHtml
  with a different escaping table than main's existing in-template
  escapeHtml/escapeAttr pair, and nothing imported it. Main's fix(support-output): safely render dashboard values and decode Git streams — prevent injection and corrupted repository state #770 merge
  already hardened dashboard rendering; kept main's version.
• Junk/scratch: .copy-verify-sizes.mjs, .line-lens-cliRunner.txt,
  .size-calc-cliRunner.txt, .size-measure-cliRunner-copy.ts, ls,
  ls-run-verify.sh, ls-verify-agt3465, scripts/agt3465-verify-once.sh,
  src/.agt3465-probe.txt, src/agt3465-run-once.cjs.
• package.json / package-lock.json churn: fix(output): sanitize and budget rendered content — prevent prompt injection, invalid embeds, terminal corruption, and HTML injection #758 and fix(output): enforce aggregate output budgets across agents, Discord, runners, and TUI — prevent payload rejection and rendering abuse #782 each re-pinned
  vitest (^4.0.18 → ^4.1.8 / ^4.1.11) and fix(output): enforce aggregate output budgets across agents, Discord, runners, and TUI — prevent payload rejection and rendering abuse #782 re-added @vitest/* devDeps.
  No dependency is needed by this change, so no lock regeneration was required.

Conflicts resolved

• tui/sanitize.ts — fix(output): sanitize and budget rendered content — prevent prompt injection, invalid embeds, terminal corruption, and HTML injection #758 and fix(external-integrations): bound and sanitize streamed and rendered provider content — prevent memory growth and untrusted-output exposure #775 both append to the same file. Merged into one
  module with a single control-character implementation.
• discordHandlers.ts — fix(output): sanitize and budget rendered content — prevent prompt injection, invalid embeds, terminal corruption, and HTML injection #758's embed-utils rewrite is the base; fix(output): enforce aggregate output budgets across agents, Discord, runners, and TUI — prevent payload rejection and rendering abuse #782's
  budget pagination (paginateEmbedFields replaces fixed 10-per-page paging,
  which sized pages by item count and could still blow the 6000-char ceiling)
  and genericUserError error paths were layered on top. All four handlers
  including handleApprove/handleReject are intact.
• cliRunner.ts — fix(output): sanitize and budget rendered content — prevent prompt injection, invalid embeds, terminal corruption, and HTML injection #758's line/total bounds and fix(output): enforce aggregate output budgets across agents, Discord, runners, and TUI — prevent payload rejection and rendering abuse #782's sanitizeException /
  flattenToSingleLine / truncate budgets combined with fix(streaming): bound event and subprocess output retention — unbounded clients and frames can exhaust process memory #762's raw-input
  MAX_LINE_CHARS ceiling so bounding precedes the sanitizer scan.
• codexResponses.ts — fix(external-integrations): bound and sanitize streamed and rendered provider content — prevent memory growth and untrusted-output exposure #775's incremental reducer kept while main's newer
  response.incomplete / response.failed terminal-error propagation
  (added after the draft's merge-base) is preserved inside the same handle
  callback. Both intents apply, so both sides were combined.

Verification

• npx tsc --noEmit → clean.
• npx oxlint on the touched files → 0 warnings, 0 errors.
• npx vitest run src/discord/ src/tui/ src/support/outputBudget.test.ts src/support/workflowLinear*.test.ts src/runners/ src/adapters/codexResponses.test.ts src/agents/{pipelineFormat,tester,reviewer,skillDocumenter} src/automation/workerAuditLog src/locale/
  → 47 files passed, 512 passed | 1 skipped.
• outputBudget.test.ts is new (13 cases); sanitize.test.ts gains 18 cases
  covering the merged surface.

Two tests from the drafts were rewritten rather than carried over: one asserted
a behaviour the drafts' own code did not have (sanitizeTerminalText on
a\x00b\x01c\x07d\ne\tf yields abcd\ne\tf, not ab\nd\ne\tf), and the
codexResponses "bounded memory" case compared two ~800 KB heap deltas, which
measures GC timing rather than retention; it now asserts the streaming and batch
paths agree on a 10k-event stream.

Original drafts

Supersedes #758, #775, #782. Close them once this lands.