Fix HTML escapes in terminal commands

[topperge]

Fixes #1916

Implemented common fixes for HTML escapes that have appeared when commands are generated in the RooCode Extension and then executed in the terminal

---

For more details, open the Copilot Workspace session.

---

Important

Fixes HTML escape issues in terminal commands by sanitizing inputs using sanitizeHtmlEscapes() in multiple files.

• Behavior:
  • Fixes HTML escape issues in terminal commands by introducing sanitizeHtmlEscapes() in execute-command.ts, Terminal.ts, and TerminalProcess.ts.
  • Ensures commands and paths are sanitized before execution to prevent errors.
• Functions:
  • Adds sanitizeHtmlEscapes() to handle HTML escape sequences in execute-command.ts, Terminal.ts, and TerminalProcess.ts.
  • Updates getExecuteCommandDescription() in execute-command.ts to use sanitizeHtmlEscapes() for command and cwd parameters.
  • Updates runCommand() in Terminal.ts and run() in TerminalProcess.ts to sanitize commands.
• Misc:
  • Updates createTerminal() in TerminalRegistry.ts to sanitize cwd using sanitizeHtmlEscapes().

^{This description was created by for f5f230a. It will automatically update as commits are pushed.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: f5f230a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ellipsis-dev]

Calling TerminalProcess.sanitizeHtmlEscapes(cwdString) here is problematic because the sanitizeHtmlEscapes method in TerminalProcess is declared as a private instance method and not static. To reuse this functionality across modules (as needed here for HTML escape sanitization), consider extracting it to a shared utility module or making it a public static method. This follows our modular design and prevents cross-module private access.

[mrubens]

@KJ7LNW would you be able to give feedback on this one since it touches the terminal code? Thank you!

[KJ7LNW]

@KJ7LNW would you be able to give feedback on this one since it touches the terminal code? Thank you!

If I understand correctly, this is an HTML entity escaping problem before being passed to the command, in which case it is not the responsibility of the terminal handler to process escape sequences

However, if we are really getting & symbols into the XML requests from the model, then this really should be handled at the global xml parser because terminal is not the only place that this could be a problem.

@topperge, please

1. reproduce the issue in Roo
2. Click this button at the top of the task and download the conversation with the model
3. paste the conversation here:

```xml
... paste ...
```

[mrubens]

I think #2120 should cover most of this, but let me know if you're seeing anything sneak through!