sanitizeForPromptLiteral (agents/sanitize-for-prompt.ts)

Sanitizes untrusted strings for safe inclusion in LLM prompts, removing control characters and wrapping data blocks.

// Source: https://github.com/beita6969/ScienceClaw | License: MIT | Copyright 2025 Peter Steinberger
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Sanitize untrusted strings before embedding them into an LLM prompt.
 *
 * Threat model (OC-19): attacker-controlled directory names (or other runtime strings)
 * that contain newline/control characters can break prompt structure and inject
 * arbitrary instructions.
 *
 * Strategy (Option 3 hardening):
 * - Strip Unicode "control" (Cc) + "format" (Cf) characters (includes CR/LF/NUL, bidi marks, zero-width chars).
 * - Strip explicit line/paragraph separators (Zl/Zp): U+2028/U+2029.
 *
 * Notes:
 * - This is intentionally lossy; it trades edge-case path fidelity for prompt integrity.
 * - If you need lossless represent

... (truncated -- full source via MCP)