buildReferenceContext (src/core/work-topology.ts, mirrored into the hooks) collapses [\s\u0085\u001c-\u001e] runs and lengthens the fence past the longest backtick run, which stops a memory from breaking out of the block or forging a header. It does not strip \u001b, so a memory containing \u001b[31m…\u001b[0m reaches the agent's context — and any terminal that renders the hook output — with the escape intact.
Reproduced through the real pre-edit-recall hook. Not a breakout, but it is attacker-influenced bytes in a rendering path. Strip C0/C1 control characters other than the whitespace already handled (and consider bidi overrides) in the one place every injected block goes through.
buildReferenceContext(src/core/work-topology.ts, mirrored into the hooks) collapses[\s\u0085\u001c-\u001e]runs and lengthens the fence past the longest backtick run, which stops a memory from breaking out of the block or forging a header. It does not strip\u001b, so a memory containing\u001b[31m…\u001b[0mreaches the agent's context — and any terminal that renders the hook output — with the escape intact.Reproduced through the real
pre-edit-recallhook. Not a breakout, but it is attacker-influenced bytes in a rendering path. Strip C0/C1 control characters other than the whitespace already handled (and consider bidi overrides) in the one place every injected block goes through.