v0.85.1

Security

• Text from outside the runtime reaches the terminal inert
  (ADR-0093). The model's reply, its thoughts, a tool call's detail and
  purpose, the approval and ask dialogs, ! output and every other
  string a TUI message carries reached the terminal with its escape
  sequences intact. Measured on tmux, 58 of 80 hostile deliveries acted:
  on every channel probed the window title was set, the clipboard buffer
  written (OSC 52) and the screen erased; image, hyperlink and DCS
  sequences were parsed; the cursor moved; and a CR hid the start of a
  line and an unterminated OSC the rest of it — in the approval dialog,
  the command being approved. C0 controls other than tab and newline,
  DEL, C1 and the bidi embeddings, overrides and isolates are now removed
  once, where text enters the TUI; the text of a sequence stays visible
  (]0;…), so nothing the operator could have read is hidden. The
  Markdown renderer's output is held to the colour codes it writes
  itself — none in the plain theme — and closed at the reply's end,
  because it decodes character references such as  into real
  controls. The plain REPL and -p do the same when their stream
  is a terminal and stay byte-for-byte to a pipe or a file (ADR-0042 §4
  amended). The transcript is unchanged. make escprobe re-runs the
  measurement: 0 of 95 after the change.