fix: close server bypass edge cases

tools/thothctl/internal/output/sanitize.go

@@ -18,6 +18,8 @@ const maxSecretSourceFiles = 32
 
 const maxSecretSourceBytes = 256 * 1024
 
+const maxDiagnosticDetailBytes = 512
+
 // Sanitize redacts common credential fields and every supplied secret value.
 func Sanitize(text string, secretValues []string) string {
 	text = credentialField.ReplaceAllString(text, "${1}[REDACTED]")
@@ -31,6 +33,24 @@ func Sanitize(text string, secretValues []string) string {
 	return text
 }
 
+// SanitizeDetail redacts the complete subprocess detail before normalizing and bounding the text
+// that may be displayed at the CLI boundary.
+func SanitizeDetail(text string, secretValues []string) string {
+	detail := strings.Join(strings.Fields(Sanitize(text, secretValues)), " ")
+	if len(detail) <= maxDiagnosticDetailBytes {
+		return detail
+	}
+	var bounded strings.Builder
+	for _, character := range detail {
+		encoded := string(character)
+		if bounded.Len()+len(encoded) > maxDiagnosticDetailBytes {
+			break
+		}
+		bounded.WriteString(encoded)
+	}
+	return bounded.String()
+}
+
 // SecretValuesFromFiles reads non-empty secret-file contents without exposing them to callers.
 func SecretValuesFromFiles(paths []string) ([]string, error) {
 	if len(paths) > maxSecretSourceFiles {