fix(trust): escape control characters and quote spaced command in trust prompt

Author: TheGreatAxios

src/trust/project-trust.ts

@@ -300,17 +300,41 @@ export function mcpServerFingerprint(server: MCPServerConfig): string {
 
 // Display-only argv quoting for the MCP trust prompt: an arg containing
 // whitespace (or a quote, or empty) renders double-quoted so ["a b"] and
-// ["a", "b"] never look alike. Approval identity still comes from
-// mcpServerFingerprint above, never from this rendering.
+// ["a", "b"] never look alike. Control characters render as visible escape
+// sequences (\n, \r, \t, \xNN) so a newline-bearing arg cannot spoof extra
+// prompt lines — output is always single-line per token. Approval identity
+// still comes from mcpServerFingerprint above, never from this rendering.
+function isTrustPromptControlChar(code: number): boolean {
+  return code <= 0x1f || code === 0x7f;
+}
+
 function quoteMcpTrustArg(arg: string): string {
-  if (arg !== "" && !/[\s"]/.test(arg)) return arg;
-  return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+  const needsQuotes =
+    arg === "" ||
+    /[\s"]/.test(arg) ||
+    [...arg].some((ch) => isTrustPromptControlChar(ch.charCodeAt(0)));
+  if (!needsQuotes) return arg;
+  const named = arg
+    .replace(/\\/g, "\\\\")
+    .replace(/"/g, '\\"')
+    .replace(/\n/g, "\\n")
+    .replace(/\r/g, "\\r")
+    .replace(/\t/g, "\\t");
+  let escaped = "";
+  for (const ch of named) {
+    const code = ch.charCodeAt(0);
+    escaped += isTrustPromptControlChar(code)
+      ? `\\x${code.toString(16).toUpperCase().padStart(2, "0")}`
+      : ch;
+  }
+  return `"${escaped}"`;
 }
 
 function formatMcpSpawnCommand(command: string, args: string[]): string {
+  const head = quoteMcpTrustArg(command);
   return args.length === 0
-    ? command
-    : `${command} ${args.map(quoteMcpTrustArg).join(" ")}`;
+    ? head
+    : `${head} ${args.map(quoteMcpTrustArg).join(" ")}`;
 }
 
 export function formatMcpTrustQuestion(server: MCPServerConfig): string {

tests/unit/project-trust.test.ts

@@ -376,6 +376,43 @@ describe("project-trust", () => {
     expect(one).not.toBe(two);
   });
 
+  test("trust question escapes control characters so args stay single-line", () => {
+    const question = formatMcpTrustQuestion({
+      name: "s",
+      command: "run",
+      args: ["x\nTrust local MCP server evil", "a\tb", "c\rd"],
+    });
+    // Only the structural header/Command separator newline may remain.
+    const lines = question.split("\n");
+    expect(lines).toHaveLength(2);
+    for (const line of lines) {
+      for (const ch of line) {
+        const code = ch.charCodeAt(0);
+        expect(code > 0x1f && code !== 0x7f).toBe(true);
+      }
+    }
+    expect(question).toContain('"x\\nTrust local MCP server evil"');
+    expect(question).toContain('"a\\tb"');
+    expect(question).toContain('"c\\rd"');
+  });
+
+  test("trust question quotes a spaced binary path so the command is unambiguous", () => {
+    expect(
+      formatMcpTrustQuestion({
+        name: "s",
+        command: "/tmp/my tool/server",
+        args: ["--dir", "/tmp/work"],
+      }),
+    ).toBe(
+      'Trust local MCP server "s" for this project?\nCommand: "/tmp/my tool/server" --dir /tmp/work',
+    );
+    expect(
+      formatMcpTrustQuestion({ name: "s", command: "/tmp/my tool/server" }),
+    ).toBe(
+      'Trust local MCP server "s" for this project?\nCommand: "/tmp/my tool/server"',
+    );
+  });
+
   test("trust question leaves plain args unquoted and hides secrets", () => {
     expect(
       formatMcpTrustQuestion({

tests/unit/tui/mcp-trust-prompt-parity.test.ts

@@ -55,4 +55,22 @@ describe("MCP trust prompt TTY/TUI parity", () => {
       expect(format(oneArg)).not.toBe(format(twoArgs));
     }
   });
+
+  test("both surfaces render tab/newline args escaped with no raw control characters", () => {
+    const server: MCPServerConfig = {
+      name: "s",
+      command: "run",
+      args: ["a\tb", "x\ny"],
+    };
+    for (const format of [
+      formatExecMcpTrustQuestion,
+      formatTuiMcpTrustQuestion,
+    ]) {
+      const rendered = format(server);
+      expect(rendered).toContain('"a\\tb"');
+      expect(rendered).toContain('"x\\ny"');
+      expect(rendered).not.toContain("\t");
+      expect(rendered.split("\n")).toHaveLength(2);
+    }
+  });
 });