strip terminal control sequences from server-supplied text

Remove control, DEL, and bidi characters before display.
HTML escaping was the only filter, which leaves ANSI and OSC escape
sequences intact. A remote user could move the cursor, recolour the
screen, or reorder what was shown by putting escape codes in a
message, a nickname, or a channel name. Names rendered in the channel
tree go through the same filter now.

Keep the text box cursor and the prompt on rune boundaries.
Both indexed by byte, so editing a line containing multi-byte
characters could split one and render replacement characters.

Handle text view lines that carry no timestamp.
Toggling timestamps assumed every stored line had one and sliced past
the end of lines that did not.

Ignore key events on an empty tree.
The handlers indexed the item list before checking that it had any
items.

Remove the beep helpers.
They shelled out to an optional "beep" binary and panicked when it was
absent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ui.go

@@ -3,9 +3,9 @@ package main
 import (
 	"fmt"
 	"os"
-	"os/exec"
 	"strings"
 	"time"
+	"unicode"
 
 	"git.stormux.org/storm/barnard/gumble/gumble"
 	"git.stormux.org/storm/barnard/uiterm"
@@ -24,18 +24,17 @@ const (
 	uiViewAdmin       = "admin"
 )
 
-func Beep() {
-	cmd := exec.Command("beep")
-	cmdout, err := cmd.Output()
-	if err != nil {
-		panic(err)
-	}
-	if cmdout != nil {
-	}
-}
-
+// esc makes server-supplied text safe for a terminal as well as for HTML.
+// HTML escaping alone leaves ANSI, OSC, DEL, and bidi/control characters able
+// to alter terminal state or obscure the displayed text.
 func esc(str string) string {
-	return sanitize.HTML(str)
+	clean := strings.Map(func(r rune) rune {
+		if r == 0x7f || unicode.IsControl(r) || unicode.Is(unicode.Bidi_Control, r) {
+			return -1
+		}
+		return r
+	}, str)
+	return sanitize.HTML(clean)
 }
 
 func (b *Barnard) Notify(event string, who string, what string) {
@@ -47,10 +46,6 @@ func (b *Barnard) Notify(event string, who string, what string) {
 	}
 }
 
-func (b *Barnard) Beep() {
-	Beep()
-}
-
 func (b *Barnard) SetSelectedUser(user *gumble.User) {
 	b.selectedUser = user
 	if user == nil {
@@ -67,14 +62,21 @@ func (b *Barnard) GetInputStatus() string {
 }
 
 func (b *Barnard) UpdateInputStatus(status string) {
-	if len(status) > 20 {
-		status = status[:17] + "..." + "]"
-	}
+	status = truncateInputStatus(status)
 	b.UiInputStatus.Text = status
 	b.RebuildUserChannelTreePreservingSelection()
 	b.Ui.Refresh()
 }
 
+// truncateInputStatus shortens the prompt without splitting a multi-byte rune.
+func truncateInputStatus(status string) string {
+	chars := []rune(status)
+	if len(chars) > 20 {
+		return string(chars[:17]) + "..." + "]"
+	}
+	return status
+}
+
 func (b *Barnard) AddOutputLine(line string) {
 	now := time.Now()
 	b.UiOutput.AddLine(fmt.Sprintf("%s [%02d:%02d:%02d]", line, now.Hour(), now.Minute(), now.Second()))