[hetaoBackend]

Change

Sanitize untrusted model content before terminal rendering, including streaming and completed replies, thinking details, the transcript inspector, and headless text output. Preserve renderer-owned styling, Unicode text, stored content, and structured output.

Require approval for private runtime-data reads instead of granting access to the entire data directory. Preserve designated skill assets, agent workspaces, and explicit path approvals. Check resolved paths and recursive search scope, and resolve omitted directory-tool paths to the working directory rather than treating a search pattern as a path.

Validation

• PASS: pnpm verify full profile, all 14 gates on d429ea1d5b931db58ac95fb8413f8b3a25de09ac, with a clean tracked worktree (macOS arm64, Node.js 26.4.0).
• PASS: 283 focused tests covering terminal rendering, status-line compatibility, transcript inspection, and permission boundaries.
• PASS: source-built CLI checks with an isolated local mock provider and synthetic data, covering TUI/headless output and approval-required/explicitly-approved reads.
• NOT RUN: Linux/Windows execution, live external providers, terminal-emulator clipboard behavior, or separately downloaded npm artifacts. No product release is included.

Publication and contribution checks

• Changes are contributed under the existing applicable licenses; no imported source or changed notices.
• No credentials, account data, real user content, internal source history, or private review material is included. Tests use synthetic inputs.
• No source files were added or removed. Regression tests extend existing declared suites, so inventory regeneration is not needed.
• No shared README workflow changes. Offline fixture checks are identified above and are not live-service acceptance.

Maintainer handoff

Publication scope and licenses are unchanged. Shared-source port: pending.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}