Neutralise escape sequences in filenames and peer messages before printing

[op-q]

Receiver consent plan, phase 1. This fixes a bug in shipped releases and does not change the protocol. It is a behaviour change, so it waits for your review. Stacked on #67.

The bug

drop recv printed the sender's filename verbatim (Receiving <name>), before the receiver had agreed to anything. A filename can carry:

• escape sequences that clear the line, move the cursor, retitle the window or plant an OSC 8 hyperlink;
• a right-to-left override, so invoice_<U+202E>fdp.exe reads as invoice_exe.pdf.

Error messages from the peer or the relay reached the terminal unfiltered in the same way. The relay is untrusted in Drop's threat model, so its messages count as peer text too.

The fix

New cli/src/display.rs:

• for_terminal replaces control characters (C0, DEL, C1) and bidi/invisible formatting characters with U+FFFD. It replaces rather than deletes, so a doctored name looks doctored. It also collapses whitespace padding.
• name does the same, then shortens anything over 80 columns in the middle so the extension survives. Wide characters count as two columns.
• peer_message does the same, capped at 200 columns.

It is applied to: the receiver's Receiving, collision, Saved and extraction lines; archive warnings; every error frame's message (recv, send, relay transport); the relay's HTTP error body; the sender's own summary and warnings; and the interface's file browser rows.

Only what gets printed changes. The received file keeps the name its bytes arrived with.

Tests

• 12 unit tests: CSI, OSC 8, OSC title, C1, newlines and tabs, each bidi control, the RTL extension trick, padding, middle ellipsis, wide characters, and honest names (Łódź 東京 🎉.txt, Arabic, an emoji ZWJ sequence, 10:30 standup.md) left unchanged.
• One end-to-end test through the real binary over a real relay: a file named with ESC[2K ESC[1A U+202E crosses, and neither side's stderr contains ESC or U+202E. #[cfg(unix)] because Windows can't create that filename.
• Negative control: with the Receiving line reverted, the end-to-end test fails with "an escape sequence from the name reached the receiver's terminal".
• cargo fmt --check, clippy -D warnings, and cargo test --workspace --all-targets all pass: 193 tests, up from 180. check-secrets.sh passes.

unicode-width becomes a direct dependency. It was already in the tree through ratatui, so no new crate is built.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G7Fy45hUvna94cd79WKG8S

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.