CLI: bracketed column headers are mangled or crash the table renderer

[mocha06]

Problem

render_rich passes cell values to Rich without escaping, so any user-authored string containing square brackets is read as Rich markup. Bracket prefixes are a common naming convention for pipes and automation rules, so this hits real data.

Evidence

pipefy automation list on a pipe whose rules use bracketed names:

'[on hold] escalate'           printed 'escalate'      <-- prefix silently deleted
'[blue] team notify'           printed 'team notify'   <-- prefix silently deleted
'Notify [/marketing] team'     CRASH exit 1  MarkupError
'[HR] Performance Evaluation'  survives
'[SLA/2h] warn'                survives

rich.errors.MarkupError: closing tag '[/marketing]' at position 7 doesn't match any open tag.

Whether a name breaks depends on whether the bracketed text happens to parse as a Rich tag, so a smoke test with one sample name will not catch it.

• packages/cli/src/pipefy_cli/output/rich_renderer.py:49-57 — _render_list_of_dicts calls table.add_row(*(str(row.get(k, "")) for k in keys)).
• Any command that renders a list of dicts is affected, not only automation list.

Scope

• Build the table with markup=False, or run each cell through rich.markup.escape.
• One test with a name that deletes a tag and one with a name that raises.

Acceptance

• [on hold] escalate prints with its prefix intact.
• Notify [/marketing] team prints instead of raising.

[adriannoes]

This is fixed on the branch of #660, at 10537fd, which predates this issue.

_render_list_of_dicts and the primitives table both wrap cells in rich.text.Text, so values are never parsed as markup. That is in the shared renderer, so it covers every command that renders a list, matching your note that this is not only automation list. Rich 14 has no markup argument on Table, so the choice was Text or rich.markup.escape; Text avoids the escape round trip. Both acceptance cases are pinned by tests in test_output_renderers.py that fail with the change reverted:

'[on hold] escalate'        before: ' escalate'   after: '[on hold] escalate'
'Notify [/marketing] team'  before: MarkupError   after: 'Notify [/marketing] team'

One residual, which your write-up covers and the fix does not. Column headers are still passed as bare strings, so a header containing brackets is parsed as markup:

render_rich([{"[on hold] col": "v1"}])  ->  header prints as ' col'

Table.__init__ rejects a Text header (AttributeError: 'Text' object has no attribute '_index'), so closing it means rich.markup.escape on the header strings or a Column object. I left it out because no command builds rows with data-derived keys; every caller's keys are schema field names, so there is no reachable path today.

Suggest either closing this with #660 and opening a narrower note for the headers, or keeping it open scoped to the headers alone. Happy to do whichever.

[mocha06]

Cell values are fixed on #660 in 10537fd6, which predates this issue. _render_list_of_dicts wraps every cell in Text, so it covers every command that renders a list of dicts, not just automation list. Both cases in the description pass:

'[on hold] escalate'       -> '[on hold] escalate'
'Notify [/marketing] team' -> 'Notify [/marketing] team'

Narrowing this issue to the column headers. Table(*keys) still passes raw strings, so a header is still parsed as markup:

{'[on hold] col': 'v1'}   -> header prints ' col'
{'Notify [/x] col': 'v'}  -> MarkupError

Nothing can reach it today. Every command that renders a table either sends a nested payload, which takes the JSON branch, or gets its keys from GraphQL field names and aliases, and a GraphQL name cannot contain [. So this is latent, not live.

Remaining scope: wrap the header strings the same way cells are, at packages/cli/src/pipefy_cli/output/rich_renderer.py:60, and pin it with a test. One line and one test, worth doing so the next command that builds rows from data cannot reintroduce the crash.

Acceptance

• [on hold] escalate prints with its prefix intact.
• Notify [/marketing] team prints instead of raising.
• A column header containing brackets prints intact and does not raise.

[adriannoes]

#660 merged to dev as fda58356, which carries the cell half of the original report. Both Table sites in rich_renderer.py wrap values in rich.text.Text, so every command that renders a list prints its values literally:

'[on hold] escalate'       -> '[on hold] escalate'
'Notify [/marketing] team' -> 'Notify [/marketing] team'

Two tests in test_output_renderers.py pin both, and fail with the change reverted.

What remains is this issue as narrowed: column headers. Table(*keys) still parses them, so a header containing brackets is mangled or raises. Table.__init__ rejects a Text header (AttributeError: 'Text' object has no attribute '_index'), so closing it means rich.markup.escape on the header strings or a Column object.

Nothing can reach it today. Every table path either takes the JSON branch or draws its keys from GraphQL field names and aliases, which cannot contain [. That makes this defensive work rather than a live bug, which is worth knowing before anyone prioritizes it.