From 2c3568c375a0fe2c4970f4e774c1c0a28ba01431 Mon Sep 17 00:00:00 2001
From: ShuaixinHuang <1836656514@qq.com>
Date: Sat, 24 Oct 2026 16:11:00 +0800
Subject: [PATCH] fix(cli): preserve literal HTML text in Markdown tables
 (#6932)

---
 src/cli/cliOutputFormatter.ts                     |  3 +++
 tests/boundary/cli/cliOutput.test.ts              |  8 ++++++++
 tests/boundary/cli/evidenceBundleCommands.test.ts | 10 +++++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/cli/cliOutputFormatter.ts b/src/cli/cliOutputFormatter.ts
index ced0f34004..5e9afa58d5 100644
--- a/src/cli/cliOutputFormatter.ts
+++ b/src/cli/cliOutputFormatter.ts
@@ -44,6 +44,9 @@ const isObjectArray = (value: unknown): value is Record<string, unknown>[] =>
 
 const escapeTableCell = (value: string): string =>
   value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
     .replace(/\\/g, "\\\\")
     .replace(/\|/g, "\\|")
     .replace(/\r\n|\r|\n/g, "<br>");
diff --git a/tests/boundary/cli/cliOutput.test.ts b/tests/boundary/cli/cliOutput.test.ts
index 371581de67..4decca57fa 100644
--- a/tests/boundary/cli/cliOutput.test.ts
+++ b/tests/boundary/cli/cliOutput.test.ts
@@ -26,6 +26,14 @@ describe("CLI output argument boundary", () => {
     expect(JSON.parse(renderCliDocument(value, "json", false))).toEqual(value);
   });
 
+  it("preserves literal HTML and entity text in Markdown table headers and cells", () => {
+    const value = [{ "List<T>": "&copy; <br>\r\nnext" }];
+    const markdown = renderCliDocument(value, "md", false);
+    expect(markdown).toContain("List&lt;T&gt;");
+    expect(markdown).toContain("&amp;copy; &lt;br&gt;<br>next");
+    expect(JSON.parse(renderCliDocument(value, "json", false))).toEqual(value);
+  });
+
   it("rejects token windows that would corrupt structured output", () => {
     for (const format of ["json", "jsonl", "yaml"] as const) {
       const validation = parseCliOutputArguments([
diff --git a/tests/boundary/cli/evidenceBundleCommands.test.ts b/tests/boundary/cli/evidenceBundleCommands.test.ts
index 700e0b658c..7ae2760615 100644
--- a/tests/boundary/cli/evidenceBundleCommands.test.ts
+++ b/tests/boundary/cli/evidenceBundleCommands.test.ts
@@ -237,7 +237,11 @@ cliTest(
   async ({ cli }) => {
     const root = await createTestTempDirectory("rea-evidence-markdown-cells-");
     const path = join(root, "bundle.json");
-    const result = { text: "left|right\\tail\nnext" };
+    const result = {
+      text: "left|right\\tail\nnext",
+      type: "List<string>",
+      literal: "&copy; <br>",
+    };
     const record = createEvidence(
       undefined,
       { id: "fixture", name: "Fixture", version: "1" },
@@ -257,9 +261,13 @@ cliTest(
     const json = await cli.run({ arguments: [...base, "--json"] });
     expect(json.exitCode, json.stderr).toBe(0);
     expect(json.stdout).toContain(JSON.stringify(result.text));
+    expect(json.stdout).toContain(JSON.stringify(result.type));
+    expect(json.stdout).toContain(JSON.stringify(result.literal));
     const markdown = await cli.run({ arguments: [...base, "--format", "md"] });
     expect(markdown.exitCode, markdown.stderr).toBe(0);
     expect(markdown.stdout).toContain("left\\|right\\\\tail<br>next");
+    expect(markdown.stdout).toContain("List&lt;string&gt;");
+    expect(markdown.stdout).toContain("&amp;copy; &lt;br&gt;");
   },
 );