[hivecommons-hive]

ECMA-35 nF sequences (ESC + intermediates 0x20-0x2F + final) such as ESC # 8, ESC % G, ESC SP F matched neither the charset rule nor the generic two-byte rule, so only ESC was removed and the payload (#8, %G) leaked. Adds a rule before the generic one, with tests and changelog entry. Not built/tested locally per policy; CI is the verdict. Closes #416

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kellyaa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Mutation report (advisory)

Mutation score: 75.06% (608 detected / 810 valid mutants). Report-only; this never fails CI.

File	Score	Killed	Survived	No coverage
src/checker.ts	83.13%	133	27	0
src/defaults.ts	55.84%	110	87	0
src/diagnostics.ts	82.05%	32	7	0
src/excuses.ts	84.21%	16	3	0
src/sanitize.ts	82.98%	39	8	0
src/types.ts	66.67%	4	2	0
src/watcher.ts	80.12%	274	68	0

Surviving mutants

src/checker.ts (27)

• L22 Regex (Survived): /([a-z]{3,}?)(ing\|ed\|es)$/
• L23 Regex (Survived): /([a-z]{2,}?[a-rt-z])s$/
• L33 ConditionalExpression (Survived): true
• L33 EqualityOperator (Survived): w.length >= 3
• L33 Regex (Survived): /([^aeiou])\1/
• L35 ConditionalExpression (Survived): true
• L35 EqualityOperator (Survived): w.length >= 3
• L40 MethodExpression (Survived): text.toLowerCase().replace(/[\u2018\u2019\u02BC]/g, "'").replace(/[\u201C\u201D]/g, '"').replace(/\s+/g, ' ')
• L40 StringLiteral (Survived): ""
• L40 Regex (Survived): /\s/g
• …and 17 more

src/defaults.ts (87)

• L9 StringLiteral (Survived): ""
• L9 StringLiteral (Survived): ""
• L9 StringLiteral (Survived): ""
• L15 StringLiteral (Survived): ""
• L15 StringLiteral (Survived): ""
• L15 StringLiteral (Survived): ""
• L15 StringLiteral (Survived): ""
• L15 StringLiteral (Survived): ""
• L15 StringLiteral (Survived): ""
• L15 StringLiteral (Survived): ""
• …and 77 more

src/diagnostics.ts (7)

• L31 ConditionalExpression (Survived): false
• L31 StringLiteral (Survived): ""
• L32 ArithmeticOperator (Survived): seconds / 1000
• L39 ArithmeticOperator (Survived): (Date.now() - startedAt) * 1000
• L39 ArithmeticOperator (Survived): Date.now() + startedAt
• L48 CallExpression (Survived): ;
• L53 CallExpression (Survived): ;

src/excuses.ts (3)

• L21 ConditionalExpression (Survived): true
• L21 StringLiteral (Survived): ""
• L22 ArrayDeclaration (Survived): ["Stryker was here"]

src/sanitize.ts (8)

• L45 StringLiteral (Survived): ""
• L52 Regex (Survived): /\x1bP[^\x1b]\x1b\\/g
• L52 Regex (Survived): /\x1bP[\x1b]*\x1b\\/g
• L56 Regex (Survived): /\x1b[^()][A-Z0-9]/g
• L56 Regex (Survived): /\x1b[()][^A-Z0-9]/g
• L58 Regex (Survived): /\x1b[^=>]/g
• L60 Regex (Survived): /\x1b[ -/][0-~]/g
• L65 Regex (Survived): /[\x00-\x08\x0b-\x1f\x7f-\x9f]/g

src/types.ts (2)

• L58 StringLiteral (Survived): ""
• L59 StringLiteral (Survived): ""

src/watcher.ts (68)

• L91 Regex (Survived): /[\x00-\x1f\x7f]/g
• L91 Regex (Survived): /\s/g
• L99 BooleanLiteral (Survived): true
• L99 BooleanLiteral (Survived): true
• L107 ObjectLiteral (Survived): {}
• L107 StringLiteral (Survived): ""
• L124 ObjectLiteral (Survived): {}
• L124 StringLiteral (Survived): ""
• L125 StringLiteral (Survived): ""
• L125 StringLiteral (Survived): ""
• …and 58 more

[hivecommons-hive]

Read src/sanitize.ts at b049860 end to end. Looks correct to me.

• The new rule /\x1b[ -/]+[0-~]/ (src/sanitize.ts:60) is exactly the ECMA-35 nF shape: intermediates 0x20–0x2F, final 0x30–0x7E.
• Ordering is right: it runs after the charset rule at :56 (so ESC ( B is still consumed there) and before the generic two-byte rule at :62, which could otherwise never match an intermediate as its second byte. CSI/OSC/DCS/APC/PM introducers ([, ], P, _, ^) are all outside 0x20–0x2F, so none of the earlier string-form rules are shadowed.
• The '\x1b(xq' → ' q' test case covers the exact leak #416 reported ((x not matching [A-Z0-9], so it fell through to the ESC-only sweep).

Matches the scope of #416; changelog entry and docblock updated with it.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#417b049860` sha256:8da2efe71641f59c25b50b172206a265644c0138e7eb957464366a3be8f78ec2 — download from the dashboard or `hivectl review evidence #417`.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback