Keep the line breaks in a stored FOS report, and escape it on the way out

[mastacontrola]

Follow-up to #1217. Widening MAX_TEXT to 8192 bytes bought less than it looked like: _sanitize() stripped every control character including the newline, so 8K of trace arrived as one unbroken line — barely more readable than the 500 characters it replaced.

Where the flattening belongs

It was there for a real reason, just not for the row. An embedded newline lets a caller forge a second entry — true of a chat notification, and of fosreports.log, whose entries are one timestamped line each and which gets read with tail. Not true of a database row rendered in a modal.

destination	line breaks
taskLog.logText	kept
Slack / ntfy / pushbullet Reason	flattened, then cut to MAX_REASON
fosreports.log	flattened

_sanitize() now keeps \n and strips everything else. Two details that are easy to get wrong and are pinned by tests:

• \r\n and lone \r are normalised to \n first. Without that the CR is merely replaced by a space, so every line of a DOS-ended report — which is most of them — stores with trailing whitespace.
• The invalid-UTF-8 fallback is an explicit byte range, not [[:cntrl:]]. That class includes the newline, so a machine with the wrong locale would silently lose the shape of its report while every other machine kept it.

_flatten() is flattening applied before the MAX_REASON cut, so the 500 characters are spent on text rather than on indentation.

Two display fixes fall out of it

The logs grid's Message column had no render at all. DataTables writes cell content with innerHTML, so a column without one is an HTML sink — and this is the single column fed by taskerror.class.php, an endpoint FOS reaches without authenticating. Every other column in that grid already escaped; this one was missed. It now escapes, and flattens for the one-line preview.

The modal was <pre class="mb-0 text-wrap">. Bootstrap defines .text-wrap as white-space: normal !important, which overrides the <pre> and collapses exactly the line breaks now being stored. Replaced with pre-wrap, which keeps them and still wraps long lines.

FOG_BCACHE_VER 287 → 288 for the JS change.

Verification

Against a copy of the live database — a CRLF report carrying terminal escapes and a NUL:

stored:    3 line breaks, no CR, no NUL, no ESC byte
flattened: 0 line breaks

Eight mutations across both gates, all killed. Three survived the first pass, all the same way — an assertion looking at more than its subject. The escaping check searched the whole file for targets: 5, which occurs in four grids here, and had been reporting on a different pane's column entirely; it is now scoped to buildLogs() and bounded by the neighbouring columnDef. The other two simply had no test case carrying a newline through the path they guarded.

Full suite: 71 passed, 0 failed.

On dev-branch

The PHP half is ported in the companion PR. The grid and the modal are not: 1.5 has no logs tab, no js/fog/task/, and no taskLog viewer at all, so there is nothing there to escape or to wrap. The row is stored faithfully either way.

🤖 Generated with Claude Code

https://claude.ai/code/session_013mJVe4CpK3rRbi9H5GubXd