…ites (BE-4794)

Stripping the escape *bytes* was only half the boundary: Rich manufactures new
ones from markup it finds in the string, so the sanitizer was bypassable.

- Add `sanitize_markup` (sanitize_value + `rich.markup.escape`) and use it
  wherever text reaches a markup-parsing sink: `Renderer.info/warn/success`
  (+ their hints) and the `details` rows `error_panel` hands to
  `Table.add_row`. Verified: a server-supplied
  `[link=https://attacker.example]x[/link]` rendered as a live OSC 8 hyperlink
  (`\x1b]8;...`), and an unbalanced `[/]` raised `rich.errors.MarkupError`,
  crashing the CLI while it was merely printing an info line.
  Values passed to `rich.text.Text` (code/message/hint) keep plain `sanitize_*`
  — `Text` never parses markup, so escaping there would show the backslashes.
- Drop the now-redundant `rich.markup.escape` in `outdated.execute`:
  double-escaping renders a visible stray backslash. Escaping at the boundary
  rather than per call site is the point of having a boundary; callers that
  genuinely want markup still have `renderer.print()`, the documented
  passthrough. No call site passed markup to these helpers.
- `_ESCAPE_SEQUENCE_RE`: add SOS (`\x98`) to the 8-bit C1 string-introducer
  class, so `\x98payload\x9c` is consumed as a unit instead of leaving
  `payload` as visible garbage — matching the 7-bit `\x1bX` form.
- `error_panel` code/message use `sanitize_value`, and `sanitize_optional`
  coerces non-strings, so a caller ignoring the `str` annotation gets `str()`
  coercion rather than a `TypeError` from `re.sub`.

Tests: 15 new cases, all verified to fail without the source fix. Realistic
messages (`list[0]`, `[2/5] downloading`, Windows paths, URLs) render
byte-identically. Full suite green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

These assert on an un-wrapped substring, and `rich.print` gives no way to pass
`width` through, so the result otherwise depends on the runner's default
console width. The error-panel case fit in 80 columns with only ~10 to spare.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…(BE-4794)

The renderer boundary only covers text routed through `Renderer`. Command
modules print under their own `is_pretty()` gates, and those strings never
reach it — so the headline attack from the ticket (`comfy run --host/--port`
against a hostile server) still cleared the screen and set the window title,
as @bigcat88 proved on this branch.

Two defects at each of those sites, both pre-existing on `main`:
raw ANSI in the payload reaches the terminal, and Rich manufactures new
escapes from markup it finds — with an unbalanced `[/]` raising
`MarkupError` and hard-crashing the CLI from a remote string.

Route the server-supplied values through the PR's own `sanitize_markup`
across the `comfy run` and `comfy models` surfaces: the HTTP error body and
`execution_error` payload, the submit `URLError` reason, `--verbose` node
logs, preflight validation warnings, cloud/local output paths and warnings,
the watcher's output URLs, and the asset-catalog rows (`Table.add_row`
parses markup in `str` cells, same sink as the error panel's `_kv_table`).

The two `json.dumps` sites are *not* already safe as the review suggested:
`json.dumps` escapes `\x1b` but not `[`, so a node-error message containing
`[/red]` still crashed the CLI. Verified, and they are sanitized too — the
rendered blob is byte-identical to the original JSON.

Also reword the module docstring, which claimed to be "the single sanitizing
boundary": automatic coverage stops at `Renderer`, and a bare `rich.print`
of remote text must sanitize explicitly. Saying otherwise is the "false
sense of coverage" the PR body itself warns about.

15 regression tests drive the real call sites in pretty mode with a
force-terminal console; each was verified to fail without its fix.

…BE-4794)

Self-review turned up a third surface reachable by the identical attack.
`comfy nodes ls/show/search/types/categories/path` take the same
`--host/--port` pair as `comfy run` and render `object_info` straight from
that host into markup sinks: node ids, categories, descriptions, display
names, output/input types.

Verified against a hostile `object_info`: `comfy nodes show --host <evil>`
cleared the screen and set the window title, and a description of
`boom [/] x` raised an unhandled `MarkupError`.

Leaving this open would have closed BE-4794 with the same threat still
working one command over — the exact objection raised on the run path.

The intentional markup stays intentional: the `[dim]—[/dim]` empty-outputs
fallback and the `[bold]`/`[cyan]` wrappers are ours, so only the joined
server values inside them are escaped. Search/description cells truncate
before escaping so the escapes stay balanced.

5 more regression tests drive the real commands against a hostile
`object_info`; each verified to fail without the fix.

Textual conflict in `command/run/__init__.py` only. Main refactored the
local `--wait` path: `jobs_state.write` became `_write_state`, and the
pretty "Outputs:" block moved out of the `try` to after the `finally`,
iterating `completed_payload["outputs"]` instead of `execution.outputs`.

Took main's structure wholesale and re-applied the sanitize at the block's
new home, so both intents survive: main's state-file semantics (report a
`state_file` only when the terminal write landed) and this branch's
escaping of server-chosen output filenames. Same for the `ws_disconnected`
path — main's new `server_died` state-file block kept, with
`sanitize_markup(e)` retained on the pretty line.

Merged-tree verification: 3039 passed, 37 skipped; ruff clean on the
touched files.

…h markup

`comfy model download` rendered download failures with `rich.markup.escape()`,
which neutralizes the Rich-markup half of the hazard (its inline comment said
so — it was added to stop `MarkupError`) but leaves raw ANSI/control bytes
intact. Server-chosen text therefore still reached the terminal live and could
clear the screen, rewrite the window title, or repaint earlier lines to spoof
CLI output.

The remote text arrives via `guess_status_code_reason()`. Every branch but 401
returns a canned per-status string; the 401 branch interpolates the server's own
JSON `message`, which flows into `DownloadException` and out through the two
print sites.

Fixed at both layers:

- `guess_status_code_reason` sanitizes the server-supplied `message` at the
  boundary, so every consumer of the reason string benefits (the download error
  line, the persisted background-download state, `comfy node install`) instead
  of each print site having to remember. Markup escaping is deliberately not
  applied there — not every consumer renders through a markup-interpreting sink.
- The two `comfy model download` print sites use `sanitize_markup()` instead of
  `escape()`. It is a strict superset: same `MarkupError` protection, plus
  ANSI/control-byte stripping, plus the `str()` coercion the old `str(e)` calls
  did. It still covers reasons this change does not sanitize at source, such as
  the message aria2 relays.

Regression tests drive a hostile 401 body through the real chain — real
`guess_status_code_reason`, real `DownloadException`, real print sites — and
assert nothing executable survives. Verified failing before the fix.