The paste can't press keys

Your support agent pastes a customer's error text into vim on the customer's container to reproduce a bug. The text came from a web form. Anyone can type an escape sequence into a web form.

POST /api/v1/terminal/paste wraps the text in a bracketed-paste envelope when the running program has opted in, and replaces every ESC and C1 CSI codepoint inside the envelope with U+FFFD. The response counts them: esc_neutralized: 3. A string built to close the frame early and type a command arrives as three replacement characters and some text.

The response also reports bracketed_active. If the program didn't opt in, no envelope was applied, and the agent writes to a file instead.

Typed terminals trusted whoever typed. This one distinguishes text from keys and tells you which it delivered.