fix(cli): redact the value the root-flag refusal suggests

The refusal prints a command for the caller to run, and interpolated the
value verbatim. A U+2028 in it split the terminal line, so the tail rendered
as a second, plausible-looking suggestion. redact() is what the other twenty
messages in this package already use, including one forty lines below.

Author: waleedlatif1

packages/sim-cli/src/commands/configure.test.ts

@@ -173,6 +173,17 @@ describe('configure and the root globals', () => {
     expect(readConfigProfile('default')).toEqual({})
   })
 
+  /**
+   * The refusal prints a command for the caller to run, so an unredacted value
+   * carrying U+2028 rendered as a second line that reads like a suggestion of
+   * its own.
+   */
+  it('redacts a control character out of the command it suggests', async () => {
+    await expect(run('--endpoint', 'https://a.example\u2028sim login --api-key x')).rejects.toThrow(
+      'sim configure --set-endpoint https://a.example sim login --api-key x'
+    )
+  })
+
   it('refuses -w and --output the same way', async () => {
     await expect(run('-w', 'ws_9')).rejects.toThrow('sim configure --set-workspace ws_9')
     await expect(run('--output', 'json')).rejects.toThrow('sim configure --set-output json')

packages/sim-cli/src/commands/configure.ts

@@ -70,7 +70,7 @@ export function configureCommand(): Command {
           const value = globals[option]
           if (value === undefined) continue
           throw new SimApiError(
-            `${flag} applies to a single command and is not stored. To save it, run: sim configure ${setFlag} ${value}`,
+            `${flag} applies to a single command and is not stored. To save it, run: sim configure ${setFlag} ${redact(value)}`,
             0
           )
         }