fix(qa): escape tool coverage markdown cells

vincentkoc · vincentkoc · commit c85113e30e2a · 2026-06-21T14:46:38.000+02:00
diff --git a/extensions/qa-lab/src/tool-coverage-report.test.ts b/extensions/qa-lab/src/tool-coverage-report.test.ts
@@ -94,6 +94,35 @@ describe("qa tool coverage report", () => {
     );
   });
 
+  it("escapes freeform metadata in the markdown table", () => {
+    const report = buildQaToolCoverageReport({
+      scenarios: [
+        makeScenario("tool-read", "read|file", {
+          toolCoverage: {
+            bucket: "codex-native-workspace",
+            expectedLayer: "codex-native-workspace",
+            capabilityLayer: "codex-native-workspace",
+            required: true,
+            tracking: "#80236",
+            reason: "tracked | runtime drift",
+            codexDefaultImpact: "P2 | default",
+            qaImpact: "P1 | confidence",
+            action: "fix | backfill",
+          },
+        }),
+      ],
+      generatedAt: "2026-05-10T00:00:00.000Z",
+    });
+
+    const markdown = renderQaToolCoverageMarkdownReport(report);
+
+    expect(markdown).toContain("read\\|file");
+    expect(markdown).toContain("P2 \\| default");
+    expect(markdown).toContain("P1 \\| confidence");
+    expect(markdown).toContain("fix \\| backfill");
+    expect(markdown).toContain("#80236 tracked \\| runtime drift");
+  });
+
   it("uses runtime parity summary rows and allows tracked known-broken drift", () => {
     const report = buildQaToolCoverageReport({
       scenarios: [
diff --git a/extensions/qa-lab/src/tool-coverage-report.ts b/extensions/qa-lab/src/tool-coverage-report.ts
@@ -325,9 +325,22 @@ export function renderQaToolCoverageMarkdownReport(report: QaToolCoverageReport)
   ];
 
   for (const row of report.rows) {
-    lines.push(
-      `| ${row.tool} | ${row.bucket} | ${row.expectedLayer} | ${row.capabilityLayer} | ${row.required ? "yes" : "no"} | ${row.fixtureCount} | ${row.openclaw} | ${row.codex} | ${row.drift} | ${row.codexDefaultImpact ?? ""} | ${row.qaImpact ?? ""} | ${row.action ?? ""} | ${row.tracking ?? ""} |`,
-    );
+    const cells = [
+      row.tool,
+      row.bucket,
+      row.expectedLayer,
+      row.capabilityLayer,
+      row.required ? "yes" : "no",
+      row.fixtureCount.toString(),
+      row.openclaw,
+      row.codex,
+      row.drift,
+      row.codexDefaultImpact ?? "",
+      row.qaImpact ?? "",
+      row.action ?? "",
+      row.tracking ?? "",
+    ].map(escapeTableCell);
+    lines.push(`| ${cells.join(" | ")} |`);
   }
 
   if (report.failures.length > 0) {
@@ -344,3 +357,7 @@ export function renderQaToolCoverageMarkdownReport(report: QaToolCoverageReport)
 
   return `${lines.join("\n").trimEnd()}\n`;
 }
+
+function escapeTableCell(value: string): string {
+  return value.replace(/\|/gu, "\\|").replace(/\s+/gu, " ").trim();
+}
