fix(workflows): also strip LF and C1 controls from gate show_file display

The control-char class skipped LF (so an embedded newline in a show_file
path could break the boxed layout) and the C1 range (so \x9b CSI and other
8-bit controls survived). Widen the class to [\x00-\x08\x0a-\x1f\x7f-\x9f]
(still keeping tab).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: doquanghuy

src/specify_cli/workflows/steps/gate/__init__.py

@@ -10,11 +10,11 @@
 from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
 from specify_cli.workflows.expressions import evaluate_expression
 
-#: C0 control characters except tab. Stripped from anything derived from a
-#: ``show_file`` before it is printed — both the file's contents and the path
-#: itself — so a file (or a path) containing ANSI escapes (e.g. ``\x1b[2J``)
-#: cannot clear the screen or spoof the prompt/options at the terminal.
-_CONTROL_CHARS = re.compile(r"[\x00-\x08\x0b-\x1f\x7f]")
+#: Control characters except tab: C0 (incl. LF, so an embedded newline cannot
+#: break the boxed layout), DEL, and C1 (incl. ``\x9b`` CSI). Stripped from
+#: anything derived from a ``show_file`` before it is printed — the file's
+#: contents and the path itself — so neither can inject ANSI/terminal escapes.
+_CONTROL_CHARS = re.compile(r"[\x00-\x08\x0a-\x1f\x7f-\x9f]")
 
 
 class GateStep(StepBase):

tests/test_workflows.py

@@ -995,9 +995,10 @@ def test_compose_prompt_sanitizes_show_file_path(self):
 
         # The displayed path header (and the read-error notice it produces)
         # must not carry escapes even when the path string itself contains
-        # control characters; the file is still opened with the raw value.
-        out = GateStep._compose_prompt("Review.", "evil\x1b[2Jpath.md")
-        assert "\x1b" not in out
+        # control characters — ESC, LF, and C1 CSI (\x9b); the file is still
+        # opened with the raw value.
+        out = GateStep._compose_prompt("Review.", "ev\x1bil\x9b[2J\npath.md")
+        assert "\x1b" not in out and "\x9b" not in out
         assert "evil[2Jpath.md:" in out
 
     def test_interactive_non_string_message_renders(self, monkeypatch, capsys):