SLTerm Paste-Guard Lab Tauri 2 + Go + xterm.js

Interactive client-side sandbox for SLTerm's clipboard paste sanitizer and VT100 visual-deception simulator (frontend/app/view/term/paste-guard.ts). Inspect bracketed-paste breakouts, OSC 52 clipboard hijacking, CSI/CR/BS prompt overwrites, Trojan Source BiDi controls, zero-width tag smuggling, and secret exposure without uploading a single byte.

View SLTerm Repository → Download Desktop Builds → Companion: mcp-slim →

Clipboard Payload & Escape-Sequence Inspector

100% Local Browser Execution - Zero Network Calls
Verdict
-
-
Envelope Sanitization
-
-
VT100 Visual Deception
-
-
Warnings Triggered
0
None
What Terminal Visually Renders (simulateTerminalDisplay) VT100 Line Buffer 

        

        

          

            Annotated Raw Codepoint & Escape Stream
            Control & Hidden Spans
          

          

        

      


      

        

          Sanitized Payload Passed to xterm.paste()
          
        

        

      


      

    


    

      

        
Defense-in-Depth Architecture in SLTerm

      

      

        SLTerm combines a native Tauri 2 Rust host, a concurrent Go backend (wavesrv,
        pkg/agentteams, pkg/aitools, and pkg/secretstore XChaCha20-Poly1305 credential sealing),
        and an audited xterm.js frontend pipeline. Every clipboard paste passes through sanitizeAndAnalyzePaste
        before reaching the PTY, stripping 7-bit and 8-bit bracketed-paste breakouts, OSC 52 clipboard exfiltration sequences, and DCS/APC
        control strings while surfacing secret-redacted warnings.