fix(output): truncate progress item text on rune boundaries

lastItem was sliced by byte index, so a multibyte character straddling
the cutoff produced invalid UTF-8 in the progress line. truncate on
rune boundaries instead.

Author: TBX3D

internal/output/output.go

@@ -27,7 +27,7 @@ import (
 // rewrite the terminal title, move the cursor, or clear the screen when it
 // reaches the sink. \t and \n survive so tab/newline-structured output stays
 // intact, and SGR color sequences (ESC [ ... m, what lipgloss emits for
-// bold/color) survive so legitimate styling keeps working - every other C0
+// bold/color) survive so legitimate styling keeps working: every other C0
 // control byte, DEL (0x7f), C1 controls (U+0080-U+009F), OSC sequences
 // (ESC ] ... BEL/ST) and non-SGR CSI sequences (cursor moves, screen clears,
 // ...) are dropped.

internal/output/progress.go

@@ -16,6 +16,7 @@ import (
 	"fmt"
 	"sync"
 	"sync/atomic"
+	"unicode/utf8"
 )
 
 // Progress bar configuration
@@ -174,10 +175,12 @@ func (p *Progress) render() {
 		}
 	}
 
-	// Truncate item if too long
+	// rune-aware so a multibyte character straddling the cut point isn't
+	// split into invalid UTF-8.
 	maxItemLen := 30
-	if len(lastItem) > maxItemLen {
-		lastItem = lastItem[:maxItemLen-3] + "..."
+	if runeCount := utf8.RuneCountInString(lastItem); runeCount > maxItemLen {
+		runes := []rune(lastItem)
+		lastItem = string(runes[:maxItemLen-3]) + "..."
 	}
 
 	// Format: [========>          ] 45% (4500/10000) /admin

internal/output/sanitize_test.go

@@ -37,7 +37,7 @@ func TestInfoStripsRawANSI(t *testing.T) {
 	t.Logf("CONFIRMED: Info sanitizes control bytes before printing: %q", got)
 }
 
-// SGR color sequences (what lipgloss emits) must survive sanitization -
+// SGR color sequences (what lipgloss emits) must survive sanitization:
 // Sanitize is meant to strip attacker control bytes, not legitimate styling.
 func TestSanitizeKeepsSGRColor(t *testing.T) {
 	styled := "\x1b[1;38;5;231mhello\x1b[0m"

internal/scan/probe_ansi_test.go

@@ -12,7 +12,7 @@ import (
 	"github.com/vmfunc/sif/internal/output"
 )
 
-// extractTitle deliberately returns the raw <title> text unmodified - it's a
+// extractTitle deliberately returns the raw <title> text unmodified: it's a
 // data-extraction helper, and the JSON/log record of a probe result should be
 // byte-accurate. sanitization happens downstream, at the point the title is
 // printed to the terminal (see TestProbeTitleANSIStrippedFromTerminal below).