CLI output: docs, review fixes, changelog !471

merged merged by cmc on 2026-09-24 15:08 UTC · krz/gitbay:cli-output-docs into main

24 files changed, +516 −278

Layout: unified · split

.gitbay/wiki/Admin.org +4

   sshd requires that binary to be root-owned and not group/world
   writable. Unknown keys fail authentication inside sshd, so system mode
   requires =registration.mode = "closed"= (check-config enforces this).
+  Under the forced command the CLI's leading =--term=<cols>[,color]=
+  argument works as is; a client that sets =GITBAY_TERM= instead needs
+  =AcceptEnv GITBAY_TERM= in =sshd_config=, since that env request is
+  handled by the host's sshd, not gitbayd.
 * Configuration reference

.gitbay/wiki/Users.org +45 −4

	@@ -727,10 +727,9 @@ terminal, and follows these rules so every noun reads the same way.
727		727
728	- A list command prints one row per item, tab-separated, no header.	728	- A list command prints one row per item, tab-separated, no header.
729	Columns run identifier, state, then description; a trailing column	729	Columns run identifier, state, then description; a trailing column
730	may carry a word (=due 2027-01-01=, =via team=). The =gitbay= CLI pads	730	may carry a word (=due 2027-01-01=, =via team=). Piped, a timestamp in
731	the tabs into aligned columns when stdout is a terminal and leaves	731	a row is RFC3339 to the second, UTC. Under =--json= nothing is
732	them as tabs when piped, so =cut -f= sees the same bytes stock ssh	732	touched.
733	prints. Under =--json= nothing is touched.
734	- An empty list prints nothing on stdout and =nothing to list= on	733	- An empty list prints nothing on stdout and =nothing to list= on
735	stderr.	734	stderr.
736	- A mutation prints one line: verb, object, identifier	735	- A mutation prints one line: verb, object, identifier
	@@ -748,6 +747,48 @@ terminal, and follows these rules so every noun reads the same way.
748	something to them (a key, a member, a label on an issue), =set= for	747	something to them (a key, a member, a label on an issue), =set= for
749	a value, =revoke= for a credential, =show= and =list= for reads.	748	a value, =revoke= for a credential, =show= and =list= for reads.
750		749
		750	** At a terminal
		751
		752	The =gitbay= CLI sends a leading =--term=<cols>[,color]= argument on
		753	the SSH command line when stdout is a terminal (OpenSSH's multiplexed
		754	sessions, which the CLI uses, do not forward a session's =SetEnv=).
		755	The argument goes first: the server reads =--term=<v>= only as the
		756	first argument, and ignores it over HTTP. The server then prints:
		757
		758	- lists under a header, padded, fitted to the width (the title or
		759	description column is cut with =…= first), states in colour, ages as
		760	=2h ago=, and the next page as a command on stderr (piped output
		761	keeps a =next\t<cursor>= row instead);
		762	- =show= views with a title line, aligned fields, the body rendered
		763	from markdown or org, one line per event, and comments under a rule;
		764	a sub-table (labels, revisions, and the like) carries a section label
		765	line in both terminal and piped output; timestamps as
		766	=2026-09-23 23:26 UTC=. =wiki show= piped prints the page source
		767	verbatim; the rendered page is terminal-only;
		768	- help with flag descriptions, defaults, and examples; =gitbay --help=
		769	groups commands under WORK, REPOSITORIES, YOU and INSTANCE;
		770	=help --json= adds =flags= and =examples=.
		771
		772	=NO_COLOR=, =TERM=dumb= and =--no-color= drop the colour. =show=,
		773	=diff= and =log= at a terminal go through =$GITBAY_PAGER=, else
		774	=$PAGER=, else =less= (with =LESS=FRX= when =LESS= is unset); an empty
		775	=GITBAY_PAGER= turns paging off. Paging never applies to =--follow=,
		776	=--json=, or piped output.
		777
		778	=GITBAY_TERM=off= stops the CLI sending =--term= at all, for an
		779	instance older than v1.36.0, which refuses the argument as an unknown
		780	command.
		781
		782	Stock ssh without the CLI's multiplexing gets the plain output unless
		783	it passes the same leading argument or sets the environment variable
		784	sshd is told to accept. OpenSSH parses options after the host, so the
		785	argument goes after =--=:
		786
		787	#+begin_src sh
		788	ssh git@gitbay.org -- --term=120,color issue list krz/gitbay
		789	ssh -o SetEnv=GITBAY_TERM=120,color git@gitbay.org issue list krz/gitbay
		790	#+end_src
		791
751	* Scripting	792	* Scripting
752		793
753	Every read command takes =--json= and emits one envelope:	794	Every read command takes =--json= and emits one envelope:

CHANGELOG.org +36

	@@ -4,6 +4,42 @@ Versioning follows semver from v0.1.0. Database migrations run
4	automatically on daemon start; upgrade notes appear per release when	4	automatically on daemon start; upgrade notes appear per release when
5	anything beyond "replace the binary and restart" is needed.	5	anything beyond "replace the binary and restart" is needed.
6		6
		7	* v1.36.0 — 2026-09-23
		8
		9	Terminal output for the CLI (#254).
		10
		11	Upgrade note. Upgrade the instance before the CLI: an older server
		12	refuses the CLI's leading =--term= argument as an unknown command.
		13	Against an older instance, set =GITBAY_TERM=off= and the CLI sends no
		14	terminal size.
		15
		16	- At a terminal, lists print under a header, fitted to the width, with
		17	states in colour and relative ages; the next page is a command on
		18	stderr. Piped output keeps the same tab-separated rows, with
		19	timestamps as RFC3339 to the second; =repo log= rows are
		20	tab-separated (were fixed-width) and =repo settings show= keys print
		21	as fields (=require mr=, not =require_mr:=).
		22	- =show= commands print a title line, aligned fields, the body
		23	rendered from markdown or org, events one per line and comments
		24	under a rule, through a pager when longer than the screen.
		25	- Help describes every flag, with defaults and examples, and
		26	=gitbay --help= groups the commands under WORK, REPOSITORIES, YOU
		27	and INSTANCE. =help --json= adds =flags= and =examples=.
		28	- =release list= takes =--limit= and =--cursor=, and leaves the title
		29	empty when it repeats the tag. =mr revisions='s one-revision note
		30	moved to stderr. =notifications device add= prints =registered
		31	device <n>=. =dashboard= prints =none= under an empty section.
		32
		33	The CLI sends =--term=<cols>[,color]= as the first argument on the
		34	SSH command line, since OpenSSH's multiplexed sessions do not forward
		35	a session's =SetEnv=; the server reads it only there, and ignores it
		36	over HTTP. Stock ssh opts in with =ssh git@gitbay.org -- --term=120,color
		37	issue list krz/gitbay= (the =--= keeps ssh from reading it as its own
		38	option) or =-o SetEnv=GITBAY_TERM=120,color=. Operators running
		39	the system-sshd forced command add =AcceptEnv GITBAY_TERM= to
		40	=sshd_config= for the =SetEnv= form; the =--term= argument needs no
		41	sshd configuration.
		42
7	* v1.35.1 — 2026-09-23	43	* v1.35.1 — 2026-09-23
8		44
9	The landing page's recording (#253).	45	The landing page's recording (#253).

cmd/gitbay/ssh.go +3 −2

 // termValue is GITBAY_TERM for this invocation: the terminal's width,
 // and whether colour is wanted. Empty when stdout is not a terminal,
-// so piped output stays the rows stock ssh prints.
+// so piped output stays the rows stock ssh prints, and when GITBAY_TERM
+// is "off", for an instance older than --term.
 func termValue(isTerminal bool, cols int, env func(string) string) string {
-	if !isTerminal || cols < 40 {
+	if !isTerminal || cols < 40 || env("GITBAY_TERM") == "off" {
 		return ""
 	}
 	v := strconv.Itoa(cols)

cmd/gitbay/summaries_gen.go +231 −231

cmd/gitbay/summaries_test.go +7 −2

 import (
 	"flag"
 	"fmt"
+	"go/format"
 	"os"
 	"slices"
 	"strings"
 	slices.Sort(lines)
 	b.WriteString(strings.Join(lines, ""))
 	b.WriteString("}\n")
+	want, err := format.Source([]byte(b.String()))
+	if err != nil {
+		t.Fatal(err)
+	}
 	if *updateSummaries {
-		os.WriteFile("summaries_gen.go", []byte(b.String()), 0o644)
+		os.WriteFile("summaries_gen.go", want, 0o644)
 	}
 	got, _ := os.ReadFile("summaries_gen.go")
-	if string(got) != b.String() {
+	if string(got) != string(want) {
 		t.Fatal("summaries_gen.go is stale: go test ./cmd/gitbay -run TestSummariesAreCurrent -update")
 	}
 }

cmd/gitbay/term_test.go +1

	@@ -22,6 +22,7 @@ func TestTermValue(t *testing.T) {
22	{true, 120, map[string]string{"NO_COLOR": "1"}, false, "120"},	22	{true, 120, map[string]string{"NO_COLOR": "1"}, false, "120"},
23	{true, 120, map[string]string{"TERM": "dumb"}, false, "120"},	23	{true, 120, map[string]string{"TERM": "dumb"}, false, "120"},
24	{true, 120, nil, true, "120"},	24	{true, 120, nil, true, "120"},
		25	{true, 120, map[string]string{"GITBAY_TERM": "off"}, false, ""},
25	}	26	}
26	for _, c := range cases {	27	for _, c := range cases {
27	noColor = c.noColor	28	noColor = c.noColor

e2e/readonly_test.go +3 −1

	@@ -232,8 +232,10 @@ func TestReadOnlyCommandsWriteNothing(t *testing.T) {
232	}	232	}
233	}	233	}
234		234
		235	var sgrRe = regexp.MustCompile("\x1b\\[[0-9;]*m")
		236
235	func stripSGRe2e(s string) string {	237	func stripSGRe2e(s string) string {
236	return regexp.MustCompile("\x1b\\[[0-9;]*m").ReplaceAllString(s, "")	238	return sgrRe.ReplaceAllString(s, "")
237	}	239	}
238		240
239	func displayCells(s string) int {	241	func displayCells(s string) int {

internal/control/adminhost.go +1 −1

	@@ -333,7 +333,7 @@ func runAdminStats(c *Ctx, args []string) int {
333	"lfs", humanBytes(d.LFSBytes),	333	"lfs", humanBytes(d.LFSBytes),
334	)	334	)
335	if len(d.Repos) > 0 {	335	if len(d.Repos) > 0 {
336	io.WriteString(w, "\n")	336	v.section("repos")
337	tb := c.table(w, "PATH", "BYTES")	337	tb := c.table(w, "PATH", "BYTES")
338	for _, r := range d.Repos {	338	for _, r := range d.Repos {
339	tb.row(cRef(r.Path), cText(humanBytes(r.Bytes)))	339	tb.row(cRef(r.Path), cText(humanBytes(r.Bytes)))

internal/control/control.go +8 −13

 	// A leading --term=<v> selects terminal output for this session, the
 	// same as GITBAY_TERM. It must come off before Lookup: Lookup matches
 	// argv against a command's Path, and a --term= in front would never
-	// match one.
+	// match one. Over HTTP it is dropped unread: the web and the API
-	for len(argv) > 0 {
+	// render no terminal.
-		v, ok := strings.CutPrefix(argv[0], "--term=")
+	if v, ok := strings.CutPrefix(argv[0], "--term="); ok {
-		if !ok {
+		if !c.ViaAPI {
-			break
+			c.Term = ParseTerm(v)
 		}
-		c.Term = ParseTerm(v)
 		argv = argv[1:]
-	}
+		if len(argv) == 0 {
-	if len(argv) == 0 {
+			return c.fail(protocol.ExitUsage, "no command given; try: ssh <host> help")
-		return c.fail(protocol.ExitUsage, "no command given; try: ssh <host> help")
+		}
 	}
 	cmd, rest, ok := Lookup(argv)
 	c.Cmd = cmd
 			c.JSON = true
 			continue
 		}
-		if v, ok := strings.CutPrefix(a, "--term="); ok {
-			c.Term = ParseTerm(v)
-			continue
-		}
 		args = append(args, a)
 	}
 	c.Argv = args

internal/control/control_test.go +26

	@@ -276,3 +276,29 @@ func TestArgumentRefusalsNameTheUsage(t *testing.T) {
276	}	276	}
277	}	277	}
278	}	278	}
		279
		280	// TestTermArgument: --term= is read only as the first argument, and
		281	// never over HTTP.
		282	func TestTermArgument(t *testing.T) {
		283	cases := []struct {
		284	name string
		285	viaAPI bool
		286	argv []string
		287	want Term
		288	wantArgv []string
		289	}{
		290	{"leading", false, []string{"--term=80,color", "issue", "list", "a/b"}, Term{Cols: 80, Color: true}, []string{"a/b"}},
		291	{"later", false, []string{"issue", "list", "a/b", "--term=x"}, Term{}, []string{"a/b", "--term=x"}},
		292	{"over HTTP", true, []string{"--term=80,color", "issue", "list", "a/b"}, Term{}, []string{"a/b"}},
		293	}
		294	for _, tc := range cases {
		295	c := &Ctx{Scope: "git", ViaAPI: tc.viaAPI, Stdout: io.Discard, Stderr: io.Discard}
		296	Dispatch(c, tc.argv)
		297	if c.Term != tc.want {
		298	t.Errorf("%s: Term %+v, want %+v", tc.name, c.Term, tc.want)
		299	}
		300	if !slices.Equal(c.Argv, tc.wantArgv) {
		301	t.Errorf("%s: Argv %q, want %q", tc.name, c.Argv, tc.wantArgv)
		302	}
		303	}
		304	}

internal/control/deps.go +1 −1

	@@ -122,7 +122,7 @@ func runDepsStatus(c *Ctx, args []string) int {
122	"tracked in", tracked,	122	"tracked in", tracked,
123	)	123	)
124	if len(out.Behind) > 0 {	124	if len(out.Behind) > 0 {
125	io.WriteString(w, "\n")	125	v.section("behind")
126	tb := c.table(w, "ECOSYSTEM", "NAME", "CURRENT", "LATEST")	126	tb := c.table(w, "ECOSYSTEM", "NAME", "CURRENT", "LATEST")
127	for _, b := range out.Behind {	127	for _, b := range out.Behind {
128	tb.row(cText(b.Ecosystem), cRef(b.Name), cText(b.Current), cText(b.Latest))	128	tb.row(cText(b.Ecosystem), cRef(b.Name), cText(b.Current), cText(b.Latest))

internal/control/help.go +2 −1

	@@ -112,7 +112,8 @@ func runHelp(c *Ctx, args []string) int {
112	}	112	}
113		113
114	// program is how help spells the command it documents: the CLI at a	114	// program is how help spells the command it documents: the CLI at a
115	// terminal (only the CLI sends GITBAY_TERM), ssh otherwise.	115	// terminal (only the CLI or a caller passing --term sets one), ssh
		116	// otherwise.
116	func (c *Ctx) program() string {	117	func (c *Ctx) program() string {
117	if c.Term.Cols > 0 {	118	if c.Term.Cols > 0 {
118	return "gitbay"	119	return "gitbay"

internal/control/mr.go +1 −1

	@@ -790,7 +790,7 @@ func runMRShow(c *Ctx, args []string) int {
790	v.body(d.Body, d.BodyFormat)	790	v.body(d.Body, d.BodyFormat)
791		791
792	if len(commits) > 1 {	792	if len(commits) > 1 {
793	io.WriteString(w, "\n")	793	v.section("commit")
794	tb := c.table(w, "SHA", "SUBJECT")	794	tb := c.table(w, "SHA", "SUBJECT")
795	for _, cm := range commits {	795	for _, cm := range commits {
796	tb.row(cRef(fmt.Sprintf("%.10s", cm.SHA)), cFlex(cm.Subject))	796	tb.row(cRef(fmt.Sprintf("%.10s", cm.SHA)), cFlex(cm.Subject))

internal/control/org.go +1 −1

	@@ -140,7 +140,7 @@ func runOrgShow(c *Ctx, args []string) int {
140	v := c.view(w)	140	v := c.view(w)
141	v.title(d.Org, "", "")	141	v.title(d.Org, "", "")
142	if len(ms) > 0 {	142	if len(ms) > 0 {
143	io.WriteString(w, "\n")	143	v.section("members")
144	tb := c.table(w, "USER", "ROLE")	144	tb := c.table(w, "USER", "ROLE")
145	for _, m := range ms {	145	for _, m := range ms {
146	tb.row(cRef(m.User), cState(m.Role))	146	tb.row(cRef(m.User), cState(m.Role))

internal/control/release.go +1 −1

	@@ -310,7 +310,7 @@ func runReleaseShow(c *Ctx, args []string) int {
310	)	310	)
311	v.body(d.Notes, d.NotesFormat)	311	v.body(d.Notes, d.NotesFormat)
312	if len(d.Assets) > 0 {	312	if len(d.Assets) > 0 {
313	io.WriteString(w, "\n")	313	v.section("assets")
314	tb := c.table(w, "NAME", "SIZE", "SHA256")	314	tb := c.table(w, "NAME", "SIZE", "SHA256")
315	for _, a := range d.Assets {	315	for _, a := range d.Assets {
316	tb.row(cRef(a.Name), cNum(a.Size), cFlex(a.SHA256))	316	tb.row(cRef(a.Name), cNum(a.Size), cFlex(a.SHA256))

internal/control/snippet.go +1 −1

	@@ -231,7 +231,7 @@ func runSnippetShow(c *Ctx, args []string) int {
231	"url", snippetURL(c, sn),	231	"url", snippetURL(c, sn),
232	)	232	)
233	if len(files) > 0 {	233	if len(files) > 0 {
234	io.WriteString(w, "\n")	234	v.section("files")
235	tb := c.table(w, "NAME", "SIZE")	235	tb := c.table(w, "NAME", "SIZE")
236	for _, f := range files {	236	for _, f := range files {
237	tb.row(cRef(f.Name), cText(fmt.Sprintf("%d bytes", f.Size)))	237	tb.row(cRef(f.Name), cText(fmt.Sprintf("%d bytes", f.Size)))

internal/control/table.go +1

	@@ -61,6 +61,7 @@ func (t *table) row(cs ...cell) {
61	}	61	}
62	now := termNow()	62	now := termNow()
63	for i := range cs {	63	for i := range cs {
		64	cs[i].s = termSafe(cs[i].s)
64	if cs[i].kind == kindAge {	65	if cs[i].kind == kindAge {
65	cs[i].s = relAge(cs[i].s, now)	66	cs[i].s = relAge(cs[i].s, now)
66	}	67	}

internal/control/teams.go +1 −1

	@@ -190,7 +190,7 @@ func runTeamShow(c *Ctx, args []string) int {
190	v.title(org.Name+"/"+team.Name, "", "")	190	v.title(org.Name+"/"+team.Name, "", "")
191	v.fields("members", strings.Join(members, ", "))	191	v.fields("members", strings.Join(members, ", "))
192	if len(grants) > 0 {	192	if len(grants) > 0 {
193	io.WriteString(w, "\n")	193	v.section("grants")
194	tb := c.table(w, "REPO", "ROLE")	194	tb := c.table(w, "REPO", "ROLE")
195	for _, g := range grants {	195	for _, g := range grants {
196	tb.row(cRef(g.RepoPath), cState(g.Role))	196	tb.row(cRef(g.RepoPath), cState(g.Role))

internal/control/term.go +38 −7

	@@ -37,15 +37,46 @@ func ParseTerm(v string) Term {
37	}	37	}
38		38
39	const (	39	const (
40	sgrReset = "\x1b[0m"	40	sgrReset = "\x1b[0m"
41	sgrBold = "\x1b[1m"	41	sgrBold = "\x1b[1m"
42	sgrDim = "\x1b[2m"	42	sgrDim = "\x1b[2m"
43	sgrUnderline = "\x1b[4m"	43	sgrRed = "\x1b[31m"
44	sgrRed = "\x1b[31m"	44	sgrGreen = "\x1b[32m"
45	sgrGreen = "\x1b[32m"	45	sgrMagenta = "\x1b[35m"
46	sgrMagenta = "\x1b[35m"
47	)	46	)
48		47
		48	// termSafe replaces the bytes a terminal would act on — ESC, the C0
		49	// controls but tab and newline, DEL, and the C1 controls — with U+FFFD,
		50	// so user text cannot move the cursor, set the clipboard (OSC 52) or
		51	// clear the screen. Carriage return is dropped rather than replaced:
		52	// web forms store CRLF line endings, and a lone CR would let text
		53	// overwrite its own line. Terminal output only: plain output is unchanged.
		54	func termSafe(s string) string {
		55	unsafe := func(r rune) bool {
		56	return (r < 0x20 && r != '\t' && r != '\n') \|\| (r >= 0x7f && r <= 0x9f)
		57	}
		58	if strings.IndexFunc(s, unsafe) < 0 {
		59	return s
		60	}
		61	return strings.Map(func(r rune) rune {
		62	switch {
		63	case r == '\r':
		64	return -1
		65	case unsafe(r):
		66	return '\uFFFD'
		67	}
		68	return r
		69	}, s)
		70	}
		71
		72	// safe is termSafe at a terminal and s unchanged in plain output.
		73	func (t Term) safe(s string) string {
		74	if t.Cols == 0 {
		75	return s
		76	}
		77	return termSafe(s)
		78	}
		79
49	// paint wraps s in an SGR sequence when colour is on.	80	// paint wraps s in an SGR sequence when colour is on.
50	func (t Term) paint(sgr, s string) string {	81	func (t Term) paint(sgr, s string) string {
51	if !t.Color \|\| sgr == "" \|\| s == "" {	82	if !t.Color \|\| sgr == "" \|\| s == "" {

internal/control/term_test.go +6 −6

	@@ -26,12 +26,12 @@ func TestParseTerm(t *testing.T) {
26		26
27	func TestCells(t *testing.T) {	27	func TestCells(t *testing.T) {
28	cases := map[string]int{	28	cases := map[string]int{
29	"abc": 3,	29	"abc": 3,
30	"日本": 4,	30	"日本": 4,
31	"é": 1,	31	"é": 1,
32	"é": 1,	32	"é": 1,
33	"\x1b[32mopen\x1b[0m": 4,	33	"\x1b[32mopen\x1b[0m": 4,
34	"": 0,	34	"": 0,
35	}	35	}
36	for in, want := range cases {	36	for in, want := range cases {
37	if got := cells(in); got != want {	37	if got := cells(in); got != want {

internal/control/termsafe_test.go added +89

@@ -0,0 +1,89 @@
	1	package control
	2
	3	import (
	4	"bytes"
	5	"strings"
	6	"testing"
	7
	8	"gitbay.org/gitbay/internal/protocol"
	9	"gitbay.org/gitbay/internal/store"
	10	)
	11
	12	const evil = "x\x1b]52;c;ZXZpbA==\x07y\x1b[2Jz"
	13
	14	func TestTermSafe(t *testing.T) {
	15	cases := map[string]string{
	16	"plain\ttext\n": "plain\ttext\n",
	17	"a\x1bb": "a�b",
	18	"a\x00c\x7fd": "a�c�d",
	19	"a\r\nb\r\n": "a\nb\n",
	20	"a\rb": "ab",
	21	"a\u0085b\u009bc": "a�b�c",
	22	"ümlaut": "ümlaut",
	23	}
	24	for in, want := range cases {
	25	if got := termSafe(in); got != want {
	26	t.Errorf("termSafe(%q) = %q, want %q", in, got, want)
	27	}
	28	}
	29	}
	30
	31	func noControls(t *testing.T, what, out string) {
	32	t.Helper()
	33	s := stripSGR(out)
	34	if strings.ContainsAny(s, "\x1b\x07") {
	35	t.Errorf("%s: control bytes reach the terminal: %q", what, s)
	36	}
	37	}
	38
	39	func TestTableRowControlBytes(t *testing.T) {
	40	var plain, term bytes.Buffer
	41	for _, c := range []struct {
	42	ctx *Ctx
	43	w *bytes.Buffer
	44	}{{&Ctx{}, &plain}, {&Ctx{Term: Term{Cols: 80, Color: true}}, &term}} {
	45	tb := c.ctx.table(c.w, "#", "STATE", "TITLE")
	46	tb.row(cRef("#1"), cState("open"), cFlex(evil))
	47	tb.flush()
	48	}
	49	noControls(t, "table", term.String())
	50	if want := "#1\topen\t" + evil + "\n"; plain.String() != want {
	51	t.Errorf("plain changed: %q", plain.String())
	52	}
	53	}
	54
	55	func TestIssueShowControlBytes(t *testing.T) {
	56	show := func(term Term) string {
	57	st, repo, uid := newQueueTestRepo(t)
	58	if _, err := st.CreateIssue(repo.ID, uid, evil, "body "+evil, "md"); err != nil {
	59	t.Fatal(err)
	60	}
	61	c, errOut := pruneCtx(st, t.TempDir(), store.User{ID: uid, Username: "alice"})
	62	c.Term = term
	63	if code := Dispatch(c, []string{"issue", "show", repo.Path(), "1"}); code != protocol.ExitOK {
	64	t.Fatalf("exit %d: %s", code, errOut)
	65	}
	66	return c.Stdout.(*bytes.Buffer).String()
	67	}
	68	noControls(t, "issue show", show(Term{Cols: 80, Color: true}))
	69	if out := show(Term{}); !strings.Contains(out, "#1 "+evil+" open\n") {
	70	t.Errorf("plain title changed:\n%q", out)
	71	}
	72	}
	73
	74	// A body written in a browser arrives with CRLF line endings.
	75	func TestIssueShowCRLFBody(t *testing.T) {
	76	st, repo, uid := newQueueTestRepo(t)
	77	if _, err := st.CreateIssue(repo.ID, uid, "t", "first line\r\nsecond line\r\n", "md"); err != nil {
	78	t.Fatal(err)
	79	}
	80	c, errOut := pruneCtx(st, t.TempDir(), store.User{ID: uid, Username: "alice"})
	81	c.Term = Term{Cols: 80}
	82	if code := Dispatch(c, []string{"issue", "show", repo.Path(), "1"}); code != protocol.ExitOK {
	83	t.Fatalf("exit %d: %s", code, errOut)
	84	}
	85	out := c.Stdout.(*bytes.Buffer).String()
	86	if strings.ContainsAny(out, "\r�") \|\| !strings.Contains(out, "first line second line") {
	87	t.Errorf("CRLF body at a terminal:\n%q", out)
	88	}
	89	}

internal/control/view.go +7 −4

 func (v *view) title(ref, title, state string) {
 	v.sep()
 	t := v.c.Term
+	ref, title, state = t.safe(ref), t.safe(title), t.safe(state)
 	if t.Cols == 0 {
 		switch {
 		case title == "" && state == "":
 	}
 	v.sep()
 	for i := 0; i+1 < len(kv); i += 2 {
-		key, val := kv[i], kv[i+1]
+		key, val := v.c.Term.safe(kv[i]), v.c.Term.safe(kv[i+1])
 		if val == "" {
 			continue
 		}
 		return
 	}
 	v.sep()
+	src = v.c.Term.safe(src)
 	for _, line := range strings.Split(strings.TrimRight(termtext.Render(src, format, v.opts()), "\n"), "\n") {
 		if line == "" {
 			io.WriteString(v.w, "\n")
 // event is one line for a system comment: its text without link
 // targets, the time at the right edge at a terminal.
 func (v *view) event(text, format, ts string) {
-	line := "· " + termtext.Inline(text, format)
+	line := "· " + termtext.Inline(v.c.Term.safe(text), format)
-	when := v.c.when(ts)
+	when := v.c.Term.safe(v.c.when(ts))
 	if cols := v.c.Term.Cols; cols > 0 {
 		room := cols - 2 - 2 - cells(when)
 		line = pad(clip(line, room), room)
 }
 func (v *view) comment(author, ts, body, format string) {
-	when := v.c.when(ts)
+	when := v.c.Term.safe(v.c.when(ts))
+	author = v.c.Term.safe(author)
 	cols := v.c.Term.Cols
 	if cols > 0 {
 		suffix := ", " + when + " "

internal/termtext/termtext.go +2

	@@ -20,6 +20,8 @@ type Options struct {
20	Base string	20	Base string
21	}	21	}
22		22
		23	// Render lays out markdown or org for a terminal. It passes control
		24	// bytes in src through: callers sanitise src first (control.termSafe).
23	func Render(src, format string, o Options) string {	25	func Render(src, format string, o Options) string {
24	if format == "org" {	26	if format == "org" {
25	return Org(src, o)	27	return Org(src, o)

	@@ -3,236 +3,236 @@
3	package main	3	package main
4		4
5	var summaries = map[string]string{	5	var summaries = map[string]string{
6	"account export": "write your account bundle (profile, repos, issues, MRs) as JSON",	6	"account export": "write your account bundle (profile, repos, issues, MRs) as JSON",
7	"account import-bundle": "replay an account bundle (see gitbay migrate)",	7	"account import-bundle": "replay an account bundle (see gitbay migrate)",
8	"admin email verify": "mark an address verified by admin assertion",	8	"admin email verify": "mark an address verified by admin assertion",
9	"admin invite": "issue a registration invite and mail its code",	9	"admin invite": "issue a registration invite and mail its code",
10	"admin mr prune": "drop merged or closed MRs' head refs and the objects only they kept, e.g. after a history rewrite (instance admins; audited)",	10	"admin mr prune": "drop merged or closed MRs' head refs and the objects only they kept, e.g. after a history rewrite (instance admins; audited)",
11	"admin repo archive": "archive any repository (instance admins; audited)",	11	"admin repo archive": "archive any repository (instance admins; audited)",
12	"admin repo delete": "delete any repository (instance admins; audited)",	12	"admin repo delete": "delete any repository (instance admins; audited)",
13	"admin repo list": "list every repository with size and last push (instance admins)",	13	"admin repo list": "list every repository with size and last push (instance admins)",
14	"admin repo unarchive": "unarchive any repository (instance admins; audited)",	14	"admin repo unarchive": "unarchive any repository (instance admins; audited)",
15	"admin repo visibility": "set any repository's visibility (instance admins; audited)",	15	"admin repo visibility": "set any repository's visibility (instance admins; audited)",
16	"admin runners forget": "alias of admin runners remove",	16	"admin runners forget": "alias of admin runners remove",
17	"admin runners remove": "drop a key's runner heartbeat row, e.g. one that polled once by mistake (instance admins)",	17	"admin runners remove": "drop a key's runner heartbeat row, e.g. one that polled once by mistake (instance admins)",
18	"admin runners": "the build queue and runner accounts: last poll, scope, the build each holds (instance admins)",	18	"admin runners": "the build queue and runner accounts: last poll, scope, the build each holds (instance admins)",
19	"admin stats": "instance statistics: counts and per-repository disk usage",	19	"admin stats": "instance statistics: counts and per-repository disk usage",
20	"admin user create": "create an account, optionally with a key and a verified address (instance admins)",	20	"admin user create": "create an account, optionally with a key and a verified address (instance admins)",
21	"admin user delete": "delete an account that anchors nothing (keys, emails and sessions go with it)",	21	"admin user delete": "delete an account that anchors nothing (keys, emails and sessions go with it)",
22	"admin user demote": "remove instance admin from an account (never the last one)",	22	"admin user demote": "remove instance admin from an account (never the last one)",
23	"admin user disable": "suspend an account: SSH, web sessions and API tokens refused until re-enabled",	23	"admin user disable": "suspend an account: SSH, web sessions and API tokens refused until re-enabled",
24	"admin user enable": "restore a suspended account",	24	"admin user enable": "restore a suspended account",
25	"admin user limits": "show or set an account's repository and storage caps (instance admins)",	25	"admin user limits": "show or set an account's repository and storage caps (instance admins)",
26	"admin user list": "list accounts (instance admins)",	26	"admin user list": "list accounts (instance admins)",
27	"admin user promote": "make an account an instance admin",	27	"admin user promote": "make an account an instance admin",
28	"admin user show": "show an account: keys, emails, orgs, tokens, sessions (instance admins)",	28	"admin user show": "show an account: keys, emails, orgs, tokens, sessions (instance admins)",
29	"audit": "instance audit log (admins)",	29	"audit": "instance audit log (admins)",
30	"build cancel": "withdraw a queued build before a runner claims it",	30	"build cancel": "withdraw a queued build before a runner claims it",
31	"build jobs": "list the jobs a trigger can name",	31	"build jobs": "list the jobs a trigger can name",
32	"build list": "list recent builds",	32	"build list": "list recent builds",
33	"build log": "print a build's log, or follow it until the build ends",	33	"build log": "print a build's log, or follow it until the build ends",
34	"build show": "show one build",	34	"build show": "show one build",
35	"build trigger": "queue a job now (scheduled or not)",	35	"build trigger": "queue a job now (scheduled or not)",
36	"dashboard": "one read for the account dashboard: review queue, assigned and open work, pins, activity, builds",	36	"dashboard": "one read for the account dashboard: review queue, assigned and open work, pins, activity, builds",
37	"email add": "add an address and mail a verification code",	37	"email add": "add an address and mail a verification code",
38	"email list": "list the addresses on your account",	38	"email list": "list the addresses on your account",
39	"email primary": "make a verified address the primary",	39	"email primary": "make a verified address the primary",
40	"email remove": "remove an address; not the primary, nor the last verified one",	40	"email remove": "remove an address; not the primary, nor the last verified one",
41	"email verify": "confirm a verification code",	41	"email verify": "confirm a verification code",