Function sanitizeServerText

Make a string that originates in an attacker-controlled response — here the API error detail extracted from the response body — safe to print into an error message on stderr:

• Whole escape sequences (CSI, OSC and other control strings) are dropped first, then any remaining C0 and C1 controls and DEL. JSON.parse decodes a JSON-escaped ESC (a backslash-u-001b sequence) into a real ESC byte; printed raw, a hostile or MITM'd endpoint could drive ANSI/OSC sequences into the terminal (display spoofing, title changes).
• Unicode format characters (General Category Cf) are dropped: the bidi controls (isBidiControl), so server text cannot reorder the visible message, and the invisible ones — zero-width space/joiners, word joiner, soft hyphen, BOM — so two messages that look identical are identical.
• Every run of whitespace — newlines, tabs, U+2028/U+2029 included — becomes one space and the ends are trimmed, so the text stays on one line and a server cannot forge an Error: line of its own.

The CLI's JSON output is escaped separately (escapeControlChars in cli/shared.ts): JSON.stringify alone leaves DEL, C1 and bidi characters raw. Written as a char-code filter so no raw control byte appears in this source.