Problem
Found in the #1026 review. The OpenCode permission modal now shows the command being approved, in full, inside a <pre>. The same applies to every surface that renders agent-proposed commands. Unicode bidi override and format characters (U+202A–U+202E, U+2066–U+2069, and zero-width characters) are reordered or hidden by the browser. This is the "Trojan Source" class, CVE-2021-42574: a prompt-injected model can make an executed command look different from what runs, for example making rm -rf appear commented out. Nothing in src/ neutralises these characters today.
Intended behaviour
Any approval surface renders these characters as visible escapes (e.g. ⟨U+202E⟩), so what the user sees is what runs. This covers the Claude and Codex permission and trust modals, the OpenCode modal, and composer previews. One shared helper should do it.
Acceptance
- A renderer test drives the OpenCode permission modal from the recorded ask, reshaped to include U+202E, and asserts the override renders as a visible marker, not as reordering.
- The same helper is used by every approval view.
OpenCode's own TUI has the same gap. It is still worth closing, because Agent Code's modal covers the feed where the tool call would otherwise be visible.
Problem
Found in the #1026 review. The OpenCode permission modal now shows the command being approved, in full, inside a
<pre>. The same applies to every surface that renders agent-proposed commands. Unicode bidi override and format characters (U+202A–U+202E, U+2066–U+2069, and zero-width characters) are reordered or hidden by the browser. This is the "Trojan Source" class, CVE-2021-42574: a prompt-injected model can make an executed command look different from what runs, for example makingrm -rfappear commented out. Nothing insrc/neutralises these characters today.Intended behaviour
Any approval surface renders these characters as visible escapes (e.g.
⟨U+202E⟩), so what the user sees is what runs. This covers the Claude and Codex permission and trust modals, the OpenCode modal, and composer previews. One shared helper should do it.Acceptance
OpenCode's own TUI has the same gap. It is still worth closing, because Agent Code's modal covers the feed where the tool call would otherwise be visible.