fix(sdk): reject control characters in remote targets

[Hughhhhcoder]

Summary

The canonical contract validator accepts tab, line-feed, and carriage-return characters inside scan.target.remote. The WHATWG URL parser removes those characters before validation, while the original unsanitized value remains in the loaded manifest.

This can make a validated remote target contain embedded line or control characters and contradict the SDK contract that the value is sanitized.

Fixes #231.

Changes

• Move the existing model-unsafe control and line-separator character pattern into a shared internal module.
• Reuse that pattern for both output-directory and canonical remote validation.
• Reject control and line-separator characters in scan.target.remote before URL parsing.
• Add regression coverage for tab, line-feed, and carriage-return remote values.

Testing

• bun test --timeout 30000 ./tests-ts/contract.test.ts -t "rejects schema-valid but canonically invalid contract data": 1 passed, 40 skipped, 15 expect calls
• pnpm run check:plugin-source: passed
• pnpm run types: passed
• pnpm run lint: passed
• pnpm run format: passed
• git diff --check: passed

The local Node runtime is 25.4.0 and emits the repository engine warning; the package requires Node 22, 24, or 26.

Risk and rollout

Low and limited to invalid contract input. Valid URL handling, manifest schemas, output-directory behavior, and the public API shape remain unchanged. The shared pattern preserves the existing output-directory validation behavior.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T04:43:52.649838Z	3c36dd9	Manual request
🔒 Security Review	✅ Completed 2026-09-02T04:44:23.714078Z	3c36dd9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Hughhhhcoder]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 3c36dd920f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".