@@ -4,6 +4,8 @@
  * Container-based component with keyboard navigation.
  */
 
+import { stripVTControlCharacters } from 'node:util';
+
 import {
   Container,
   Input,
@@ -192,6 +194,18 @@ function renderDisplayBlock(
  */
 const MAX_PREVIEW_ITEMS = 10;
 
+/**
+ * The plan is the thing being approved, and every field in it came from the
+ * model. Escape sequences would let that text repaint the panel it is being
+ * judged in — hide a line, redraw the buttons, or reverse the reading order —
+ * so they are removed rather than styled. `stripVTControlCharacters` takes the
+ * CSI and OSC sequences; the class escape then takes the bare control and
+ * format characters it leaves behind, which include the bidi overrides.
+ */
+function sanitizePlanText(text: string): string {
+  return stripVTControlCharacters(text).replaceAll(/[\p{Cc}\p{Cf}]/gu, ' ');
+}
+
 function renderWorkflowPlanDisplayBlock(
   block: WorkflowPlanDisplayBlock,
   s: BlockStyles,
@@ -202,16 +216,20 @@ function renderWorkflowPlanDisplayBlock(
     `~${String(block.prompt_tokens)} prompt tokens`,
   ];
   if (block.model !== undefined && block.model.length > 0) {
-    summary.push(`model: ${block.model}`);
+    summary.push(`model: ${sanitizePlanText(block.model)}`);
   }
   const lines = [s.strong(summary.join('  '))];
 
   if (block.prompt_template !== undefined && block.prompt_template.length > 0) {
-    lines.push(`${s.accent('prompt')} ${s.dim(truncateOneLine(block.prompt_template, 200))}`);
+    lines.push(
+      `${s.accent('prompt')} ${s.dim(truncateOneLine(sanitizePlanText(block.prompt_template), 200))}`,
+    );
   }
 
   for (const [index, item] of block.items.slice(0, MAX_PREVIEW_ITEMS).entries()) {
-    lines.push(s.dim(`${String(index + 1).padStart(3)}. ${truncateOneLine(item, 120)}`));
+    lines.push(
+      s.dim(`${String(index + 1).padStart(3)}. ${truncateOneLine(sanitizePlanText(item), 120)}`),
+    );
   }
   const hidden = block.items.length - MAX_PREVIEW_ITEMS;
   if (hidden > 0) {
 
@@ -124,6 +124,52 @@ describe('ApprovalPanelComponent', () => {
     expect(out).toContain('src/c.ts');
   });
 
+  // The plan is what the operator is judging, and every field in it came from
+  // the model. Escape sequences left intact could repaint the panel deciding
+  // their fate — blank a line, redraw the buttons, or reverse the text order.
+  it('strips terminal control sequences from the plan before painting it', () => {
+    const esc = String.fromCodePoint(0x1B);
+    const rtlOverride = String.fromCodePoint(0x202E);
+    const pending: PendingApproval = {
+      data: {
+        id: 'approval_workflow_ansi',
+        tool_call_id: 'tool_workflow_ansi',
+        tool_name: 'DynamicWorkflow',
+        action: 'run',
+        description: 'Sweep',
+        display: [
+          {
+            type: 'workflow_plan',
+            agent_count: 2,
+            items: [
+              `${esc}[2Kharmless-item`,
+              // OSC 8 hyperlink, and a right-to-left override.
+              `${esc}]8;;http://evil.example${esc}\\second-item${rtlOverride}`,
+            ],
+            prompt_tokens: 12,
+            prompt_template: `${esc}[31mReview {{item}}`,
+            model: `${esc}[1msonnet`,
+          },
+        ],
+        choices: [{ label: 'Approve once', response: 'approved' }],
+      },
+    };
+
+    const raw = new ApprovalPanelComponent(pending, () => {}).render(80).join('\n');
+    const out = strip(raw);
+
+    expect(out).toContain('harmless-item');
+    expect(out).toContain('second-item');
+    expect(out).toContain('Review {{item}}');
+    expect(out).toContain('model: sonnet');
+    // `strip` only removes SGR colour codes, so anything else the model smuggled
+    // in would still be sitting in `out`.
+    expect(out).not.toContain(`${esc}[2K`);
+    expect(out).not.toContain(']8;;');
+    expect(out).not.toContain('http://evil.example');
+    expect(out).not.toContain(rtlOverride);
+  });
+
   it('caps the plan item list and says how many it held back', () => {
     const pending: PendingApproval = {
       data: {
 
@@ -1,7 +1,8 @@
-import { promises as fs } from 'node:fs';
+import { constants, promises as fs } from 'node:fs';
 
 import path from 'pathe';
 
+import { resolveSafePath } from '../../services/fs/fsPathSafety';
 import { normalizeSkillName } from '../../skill/types';
 
 /**
@@ -123,24 +124,73 @@ export function renderSavedWorkflowSkill(workflow: SavedWorkflow): string {
  * Lives here rather than in the slash command so every surface that can run a
  * workflow can also keep one. The name is validated before any directory is
  * created, so a rejected name leaves nothing behind.
+ *
+ * A validated name is not enough on its own. Agents work in repositories they
+ * did not write, and a checked-out tree can already contain
+ * `.pythinker-code/skills/<name>/SKILL.md` as a symlink pointing anywhere on
+ * the machine — saving a workflow would then write through it. The resolved
+ * path is checked against the scope root before the write, and the write
+ * itself refuses to follow a final symlink, so neither a planted link nor one
+ * swapped in afterwards is followed.
  */
 export async function writeSavedWorkflowSkill(input: {
   readonly scope: SavedWorkflowScope;
   readonly workflow: SavedWorkflow;
   readonly projectRoot: string;
   readonly brandHomeDir: string;
 }): Promise<string> {
+  const name = savedWorkflowSkillName(input.workflow.name);
+  const root = input.scope === 'project' ? input.projectRoot : input.brandHomeDir;
   const dir = savedWorkflowSkillDir({
     scope: input.scope,
     name: input.workflow.name,
     projectRoot: input.projectRoot,
     brandHomeDir: input.brandHomeDir,
   });
-  const content = renderSavedWorkflowSkill({
-    ...input.workflow,
-    name: savedWorkflowSkillName(input.workflow.name),
-  });
+  const content = renderSavedWorkflowSkill({ ...input.workflow, name });
+  const skillMdPath = path.join(dir, 'SKILL.md');
+
+  // Before `mkdir`, not after: a symlinked `skills/` would otherwise have a
+  // directory created through it and left behind outside the project even
+  // though the write was refused.
+  await assertResolvesInsideRoot(root, dir);
   await fs.mkdir(dir, { recursive: true });
-  await fs.writeFile(path.join(dir, 'SKILL.md'), content, 'utf8');
+  // Again once the directory exists, so a `SKILL.md` symlink planted inside it
+  // is resolved rather than treated as the not-yet-existing tail.
+  await assertResolvesInsideRoot(root, skillMdPath);
+  await writeFileNoFollow(skillMdPath, content);
   return dir;
 }
+
+/** Throws when `target` resolves outside `root` once every symlink is followed. */
+async function assertResolvesInsideRoot(root: string, target: string): Promise<void> {
+  // `target` was built from `root` verbatim, so take the relative path against
+  // that same un-resolved root. Measuring it against the realpath instead makes
+  // every `/var` -> `/private/var` style link look like a `..` escape.
+  const relative = path.relative(root, target);
+  // `resolveSafePath` rejects an absolute or `..`-bearing input outright, and
+  // otherwise resolves the longest existing prefix through its symlinks before
+  // checking containment — which is exactly the planted-link case.
+  await resolveSafePath(await fs.realpath(root), relative);
+}
+
+/**
+ * Write without following a symlink at the final path component.
+ *
+ * `O_NOFOLLOW` is POSIX; on a platform without it the constant is undefined and
+ * the containment check above is the guard, so the flag is added only when the
+ * runtime offers it rather than failing the save outright.
+ */
+async function writeFileNoFollow(target: string, content: string): Promise<void> {
+  const noFollow = constants.O_NOFOLLOW ?? 0;
+  const handle = await fs.open(
+    target,
+    constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | noFollow,
+    0o600,
+  );
+  try {
+    await handle.writeFile(content, 'utf8');
+  } finally {
+    await handle.close();
+  }
+}
@@ -373,8 +373,17 @@ function dynamicWorkflowPreview(args: DynamicWorkflowToolInput): {
   return {
     agent_count: prompts.length,
     // Resumed subagents carry an id rather than an item, so label them to keep
-    // the list the same length as the count it sits under.
-    items: [...resumeIds.map((agentId) => `resume ${agentId}`), ...items],
+    // the list the same length as the count it sits under. The prompt goes in
+    // too: it is the instruction that subagent will actually receive, and the
+    // approval digest is built from this list — an id alone would let a second
+    // call keep the same ids, change what it tells them to do, and match the
+    // earlier grant.
+    items: [
+      ...resumeIds.map(
+        (agentId) => `resume ${agentId}: ${(args.resume_agent_ids ?? {})[agentId] ?? ''}`,
+      ),
+      ...items,
+    ],
     prompt_tokens: prompts.reduce((total, prompt) => total + estimateTokens(prompt), 0),
     prompt_template: promptTemplate,
     model: normalizeOptionalString(args.model),
 
@@ -8,6 +8,7 @@ import { describe, expect, it } from 'vitest';
 import {
   renderSavedWorkflowSkill,
   savedWorkflowSkillDir,
+  writeSavedWorkflowSkill,
 } from '../../src/agent/dynamic-workflow/save-as-skill';
 import { parseSkillFromFile } from '../../src/skill/parser';
 
@@ -175,6 +176,78 @@ describe('renderSavedWorkflowSkill', () => {
   });
 });
 
+// Agents work in repositories they did not write. A checked-out tree can
+// already contain the saved-skill path as a symlink pointing anywhere on the
+// machine, and a validated name does nothing about that — the write would
+// simply follow it.
+describe('writeSavedWorkflowSkill refuses to write through a symlink', () => {
+  const workflow = { name: 'audit', description: 'Audit routes' };
+
+  it('refuses when SKILL.md is a symlink pointing outside the project', async () => {
+    const root = await fs.mkdtemp(path.join(tmpdir(), 'workflow-symlink-'));
+    try {
+      const outside = path.join(root, 'outside.txt');
+      await fs.writeFile(outside, 'original', 'utf8');
+      const skillDir = path.join(root, 'project', '.pythinker-code', 'skills', 'audit');
+      await fs.mkdir(skillDir, { recursive: true });
+      await fs.symlink(outside, path.join(skillDir, 'SKILL.md'));
+
+      await expect(
+        writeSavedWorkflowSkill({
+          scope: 'project',
+          workflow,
+          projectRoot: path.join(root, 'project'),
+          brandHomeDir: path.join(root, 'home'),
+        }),
+      ).rejects.toThrow(/rejected \(symlink_outside_cwd\)/u);
+
+      // The planted target must be untouched, not merely "an error was thrown".
+      expect(await fs.readFile(outside, 'utf8')).toBe('original');
+    } finally {
+      await fs.rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('refuses when a parent directory is a symlink pointing outside the project', async () => {
+    const root = await fs.mkdtemp(path.join(tmpdir(), 'workflow-symlink-dir-'));
+    try {
+      const projectRoot = path.join(root, 'project');
+      const escape = path.join(root, 'escape');
+      await fs.mkdir(escape, { recursive: true });
+      await fs.mkdir(path.join(projectRoot, '.pythinker-code'), { recursive: true });
+      await fs.symlink(escape, path.join(projectRoot, '.pythinker-code', 'skills'));
+
+      await expect(
+        writeSavedWorkflowSkill({
+          scope: 'project',
+          workflow,
+          projectRoot,
+          brandHomeDir: path.join(root, 'home'),
+        }),
+      ).rejects.toThrow(/rejected \(symlink_outside_cwd\)/u);
+
+      expect(await fs.readdir(escape)).toEqual([]);
+    } finally {
+      await fs.rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('still writes a normal saved workflow', async () => {
+    const root = await fs.mkdtemp(path.join(tmpdir(), 'workflow-ok-'));
+    try {
+      const dir = await writeSavedWorkflowSkill({
+        scope: 'project',
+        workflow,
+        projectRoot: root,
+        brandHomeDir: path.join(root, 'home'),
+      });
+      expect(await fs.readFile(path.join(dir, 'SKILL.md'), 'utf8')).toContain('name: "audit"');
+    } finally {
+      await fs.rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
 // Rendering valid-looking Markdown is not the contract — being loadable as a
 // skill is. This drives the real parser the discovery path uses, so a saved
 // workflow that cannot be read back fails here rather than at the next launch.