Escape control characters in message sign preview.

[fnando]

What

Escape control characters in message sign preview.

Why

Close https://github.com/stellar/stellar-cli-internal/issues/8

Known limitations

N/A

[Copilot]

Pull request overview

This PR hardens the message sign UX by sanitizing the human-readable message preview so terminal control characters (e.g., ANSI escape sequences) aren’t emitted to the user’s terminal, addressing the linked issue.

Changes:

• Sanitize the Message: preview line in message sign output to escape control characters.
• Add an integration test ensuring the preview output does not contain raw ESC bytes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
cmd/soroban-cli/src/commands/message/sign.rs	Sanitizes the message preview before printing to stderr.
cmd/crates/soroban-test/tests/it/message.rs	Adds an integration test that verifies ESC bytes are not present in the preview output.

[leighmcculloch]

It's odd to call the soroban_spec_tools::sanitize fn from a package that provides contract spec utilities when the message sign command has nothing to do with contracts or contract specs. The sanitize function is just a light wrap around the escape_bytes crate, so I think we can just use that here?

Suggested change

	print.infoln(format!("Message: {}", sanitize(&message_display)));
	let escaped = escape_bytes::escape(s.as_bytes()).map(char::from).collect();
	print.infoln(format!("Message: {}", sanitize(&message_display)));

Given the byte <> str shuffling it'd be nice if the escape-bytes crate had a fn that took on the responsibility of guaranteeing that you can convert bytes or a string to a utf8 safe string:

• Accept &str and implement Display for ergonomic zero-alloc escaping escape-bytes#9

[mootz12]

I think this package might be too strict, as it obfuscates the output string when using chars that take up more than 1 byte.

For example:

$ stellar message sign '¡Hola Mundo!' --sign-with-key SAKICEVQLYWGSOJS4WW7HZJWAHZVEEBS527LHK5V4MLJALYKICQCJXMW
ℹ️  Signer: GBXFXNDLV4LSWA4VB7YIL5GBD7BVNR22SGBTDKMO2SBZZHDXSKZYCP7L
ℹ️  Message: \xc2\xa1Hola Mundo!
sH3cuFuzVmfgXuMsJEH+iTryYo1zeQdNbHUFBZry3MRSNgEP2kg2SYuChVmoWMjgJdGyKQKK3tIzGPk3ft9WDw==

[leighmcculloch]

Yeah the escape-bytes package outputs printable ASCII only, not printable UTF8. Maybe not what you want here.