fix(security): escape rejected names in CLI validation diagnostics

The CLI name validators echoed rejected input verbatim, so a name carrying
ANSI escape or control bytes reached the terminal and CI logs unchanged. Reuse
the canonical bounded ASCII preview already applied to blueprint names.

Signed-off-by: Tinson Lai <tinsonl@nvidia.com>

Author: laitingsheng

docs/reference/troubleshooting.mdx

@@ -663,6 +663,9 @@ Sandbox names must be lowercase, start with a letter, contain only letters, numb
 The CLI rejects names that do not match these rules.
 It prints a `Try: <suggested-slug>` recovery line whenever it can derive a valid lowercase, hyphen-separated form from the input, so passing `--name MyAssistant` reports `Try: myassistant` and you can rerun with the suggested slug.
 
+The error repeats the rejected value as a quoted preview rather than the raw input.
+Characters outside printable ASCII appear as `\uXXXX` escapes and the preview stops after 80 characters, so a name that carries control or escape sequences cannot change your terminal or a CI log.
+
 Names that collide with global CLI commands are also rejected.
 Reserved names include `onboard`, `list`, `deploy`, `setup`, `start`, `stop`, `status`, `debug`, `uninstall`, `credentials`, and `help`.
 Using a reserved name would cause the CLI to route to the global command instead of the sandbox.

nemoclaw/src/shared/sandbox-name.cts

@@ -44,7 +44,7 @@ const INVALID_NAME_PREVIEW_MAX_LENGTH = 80;
  * terminal or CI log. Escaping every non-ASCII UTF-16 code unit also covers
  * C1 controls, line separators, bidi formatting, and unpaired surrogates.
  */
-function diagnosticPreview(value: unknown): string {
+export function diagnosticPreview(value: unknown): string {
   const raw = String(value);
   const prefix = raw.slice(0, INVALID_NAME_PREVIEW_MAX_LENGTH);
   let escaped = '"';

src/lib/actions/sandbox/mcp-bridge-name-diagnostics.test.ts

@@ -0,0 +1,51 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+
+import {
+  validateMcpServerName,
+  validatePersistedMcpCredentialEnvName,
+  validateSandboxName,
+} from "./mcp-bridge-validation";
+
+const ESC = String.fromCharCode(27);
+
+function messageFrom(reject: () => void): string {
+  try {
+    reject();
+  } catch (error) {
+    return (error as Error).message;
+  }
+  throw new Error("expected the validator to reject the name");
+}
+
+describe("MCP bridge name diagnostics", () => {
+  it("escapes control characters in a rejected sandbox name (#7796)", () => {
+    const message = messageFrom(() => validateSandboxName(`bad${ESC}[31mX`));
+
+    expect(message).toContain(String.raw`Invalid sandbox name "bad\u001b[31mX"`);
+    expect(message).not.toContain(ESC);
+  });
+
+  it("escapes control characters in a rejected MCP server name (#7796)", () => {
+    const message = messageFrom(() => validateMcpServerName(`srv${ESC}]0;title`));
+
+    expect(message).toContain(String.raw`Invalid MCP server name "srv\u001b]0;title"`);
+    expect(message).not.toContain(ESC);
+  });
+
+  it("escapes control characters in a rejected credential environment name (#7796)", () => {
+    const message = messageFrom(() => validatePersistedMcpCredentialEnvName(`TOKEN${ESC}[2J`));
+
+    expect(message).toContain(String.raw`Invalid environment variable name "TOKEN\u001b[2J"`);
+    expect(message).not.toContain(ESC);
+  });
+
+  it("bounds an over-length rejected name to a truncated preview (#7796)", () => {
+    const message = messageFrom(() => validateSandboxName(`Bad${"x".repeat(200)}`));
+
+    expect(message).toContain(`"Bad${"x".repeat(77)}..."`);
+    expect(message.length).toBeLessThan(200);
+  });
+});

src/lib/actions/sandbox/mcp-bridge-status-state.test.ts

@@ -219,7 +219,7 @@ registry.registerSandbox({ name: "openclaw-sandbox", agent: "openclaw" });
       }>;
     };
     expect(payload.invalid.exitCode).toBe(2);
-    expect(payload.invalid.message).toContain("Invalid MCP server name '__proto__'");
+    expect(payload.invalid.message).toContain('Invalid MCP server name "__proto__"');
     expect(payload.inherited).toHaveLength(1);
     expect(payload.inherited[0]).toMatchObject({
       server: "constructor",

src/lib/actions/sandbox/mcp-bridge-validation.ts

@@ -5,6 +5,7 @@ import { type SpawnSyncReturns, spawnSync } from "node:child_process";
 import crypto from "node:crypto";
 
 import { resolveOpenshell } from "../../adapters/openshell/resolve";
+import { diagnosticPreview } from "../../name-validation";
 import type { McpBridgeEntry } from "../../state/registry";
 import { buildSubprocessEnv, isSubprocessEnvNameAllowed } from "../../subprocess-env";
 import {
@@ -162,7 +163,7 @@ const MCP_PROVIDER_HASH_BYTES = 8;
 export function validateSandboxName(name: string): void {
   if (!name || name.length > 63 || !VALID_SANDBOX_RE.test(name)) {
     throw new McpBridgeError(
-      `Invalid sandbox name '${name}'. Names must be 1-63 lowercase alphanumeric characters with optional internal hyphens.`,
+      `Invalid sandbox name ${diagnosticPreview(name)}. Names must be 1-63 lowercase alphanumeric characters with optional internal hyphens.`,
       2,
     );
   }
@@ -171,7 +172,7 @@ export function validateSandboxName(name: string): void {
 export function validateMcpServerName(name: string): void {
   if (!VALID_SERVER_RE.test(name)) {
     throw new McpBridgeError(
-      `Invalid MCP server name '${name}'. Names must start with a letter and contain only letters, digits, hyphens, and underscores.`,
+      `Invalid MCP server name ${diagnosticPreview(name)}. Names must start with a letter and contain only letters, digits, hyphens, and underscores.`,
       2,
     );
   }
@@ -218,7 +219,7 @@ export function validateMcpCredentialEnvName(name: string): void {
 export function validatePersistedMcpCredentialEnvName(name: string): void {
   if (!VALID_ENV_RE.test(name)) {
     throw new McpBridgeError(
-      `Invalid environment variable name '${name}'. Names must match [A-Za-z_][A-Za-z0-9_]*.`,
+      `Invalid environment variable name ${diagnosticPreview(name)}. Names must match [A-Za-z_][A-Za-z0-9_]*.`,
       2,
     );
   }

src/lib/deploy/index.test.ts

@@ -272,7 +272,7 @@ describe("executeDeploy", () => {
     await expect(executeDeploy(fixture.options)).rejects.toThrow("exit:1");
 
     const errorText = fixture.errors.join("\n");
-    expect(errorText).toContain("Invalid sandbox name: 'bad name'");
+    expect(errorText).toContain('Invalid sandbox name: "bad name"');
     expect(errorText).toContain("Sandbox names cannot contain spaces.");
     expect(errorText).toContain(
       "Allowed format: 1-63 characters, lowercase, starts with a letter, letters/numbers/internal hyphens only, ends with letter/number.",

src/lib/name-validation.ts

@@ -5,6 +5,7 @@ import {
   NAME_ALLOWED_FORMAT as CANONICAL_NAME_ALLOWED_FORMAT,
   NAME_MAX_LENGTH as CANONICAL_NAME_MAX_LENGTH,
   NAME_VALID_PATTERN as CANONICAL_NAME_VALID_PATTERN,
+  diagnosticPreview as canonicalDiagnosticPreview,
 } from "../../nemoclaw/dist/shared/sandbox-name.cjs";
 
 // sourceOfTruth: nemoclaw/src/shared/sandbox-name.cts
@@ -15,6 +16,7 @@ import {
 export const NAME_MAX_LENGTH = CANONICAL_NAME_MAX_LENGTH;
 export const NAME_ALLOWED_FORMAT = CANONICAL_NAME_ALLOWED_FORMAT;
 export const NAME_VALID_PATTERN = CANONICAL_NAME_VALID_PATTERN;
+export const diagnosticPreview = canonicalDiagnosticPreview;
 
 function validationSubject(label: string): string {
   const normalized = label.trim().toLowerCase();

src/lib/runner.ts

@@ -11,7 +11,12 @@ import path from "node:path";
 
 import { redirectInheritedChildStdoutToStderr } from "./cli/stdout-guard";
 import { shellQuote } from "./core/shell-quote";
-import { NAME_ALLOWED_FORMAT, NAME_MAX_LENGTH, NAME_VALID_PATTERN } from "./name-validation";
+import {
+  diagnosticPreview,
+  NAME_ALLOWED_FORMAT,
+  NAME_MAX_LENGTH,
+  NAME_VALID_PATTERN,
+} from "./name-validation";
 import { detectDockerHost } from "./platform";
 import { redact, redactError, writeRedactedResult } from "./security/redact";
 import { buildSubprocessEnv } from "./subprocess-env";
@@ -380,11 +385,13 @@ function validateName(name: string, label = "name"): string {
   }
   if (name.length > NAME_MAX_LENGTH) {
     throw new Error(
-      `${label} too long (max ${NAME_MAX_LENGTH} chars): '${name.slice(0, 20)}...'. Allowed format: ${NAME_ALLOWED_FORMAT}.`,
+      `${label} too long (max ${NAME_MAX_LENGTH} chars): ${diagnosticPreview(name)}. Allowed format: ${NAME_ALLOWED_FORMAT}.`,
     );
   }
   if (!NAME_VALID_PATTERN.test(name)) {
-    throw new Error(`Invalid ${label}: '${name}'. Allowed format: ${NAME_ALLOWED_FORMAT}.`);
+    throw new Error(
+      `Invalid ${label}: ${diagnosticPreview(name)}. Allowed format: ${NAME_ALLOWED_FORMAT}.`,
+    );
   }
   return name;
 }

src/lib/shields/transition-lock.test.ts

@@ -106,6 +106,20 @@ describe("host shields transition lock", () => {
     fs.writeFileSync(guardPath, JSON.stringify(value), { mode: 0o600 });
   }
 
+  it("escapes control characters in a rejected sandbox name (#7796)", () => {
+    const hostileName = `bad${String.fromCharCode(27)}[31mX`;
+
+    let message = "";
+    try {
+      shieldsTransitionLockPath(hostileName, stateDir);
+    } catch (error) {
+      message = (error as Error).message;
+    }
+
+    expect(message).toContain(String.raw`Invalid sandbox name: "bad\u001b[31mX".`);
+    expect(message).not.toContain(String.fromCharCode(27));
+  });
+
   it("atomically creates a regular owner file and removes it after the callback", () => {
     const locker = manager();
     const lockPath = shieldsTransitionLockPath("alpha", stateDir);

src/lib/shields/transition-lock.ts

@@ -6,7 +6,12 @@ import { randomBytes } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 
-import { NAME_ALLOWED_FORMAT, NAME_MAX_LENGTH, NAME_VALID_PATTERN } from "../name-validation";
+import {
+  diagnosticPreview,
+  NAME_ALLOWED_FORMAT,
+  NAME_MAX_LENGTH,
+  NAME_VALID_PATTERN,
+} from "../name-validation";
 import { resolveNemoclawStateDir } from "../state/paths";
 import { isProcessAlive, readProcessStartIdentity } from "./timer-control";
 
@@ -171,7 +176,9 @@ function validateSandboxName(name: string): string {
     );
   }
   if (!NAME_VALID_PATTERN.test(name)) {
-    throw new Error(`Invalid sandbox name: '${name}'. Allowed format: ${NAME_ALLOWED_FORMAT}.`);
+    throw new Error(
+      `Invalid sandbox name: ${diagnosticPreview(name)}. Allowed format: ${NAME_ALLOWED_FORMAT}.`,
+    );
   }
   return name;
 }