view/log.js:101:Wn and view/list.js:95:cn feed commit subjects, author names and
filenames into hunk bytes verbatim, and neither render/ansi.js nor
render/wrap.js filters C0/ESC — a crafted subject repaints or spoofs the
terminal. The HTML sink is safe (render/html.js:241:BN-246 escapes). Related
sink bug: render/ansi.js:243:uy bannerColor pads the band by BYTES not
columns (a UTF-8 URI under-fills it) and emits the URI unsanitised, unlike
its plain/html twins. Found in the 2026-08-21 review.
One C0/ESC filter at the ANSI byte sink so every view is covered at once;
column-aware banner padding. Repro: a commit whose subject carries ESC
sequences renders inert in bee log.
The filter must not strip the renderer's own SGR — sanitise hunk text on the way in, not the finished stream.