fix(formatters): fix HTML entities and escaped underscores in table output (#313)

## Summary

Fixes two rendering bugs introduced in `efb59ba` (the markdown rendering
pipeline):

1. **`<unknown>` displays as `&lt;unknown&gt;`** —
`escapeMarkdownInline` used HTML entities to escape angle brackets, but
`marked` keeps them as-is in text tokens, so they showed up literally in
terminal output.
2. **`/_astro/` displays as `/\_astro/`** — escaped underscores in URLs
got captured by GFM autolink detection, which doesn't process backslash
escapes, leaving the backslash visible.

## Changes

- `escapeMarkdownInline` / `escapeMarkdownCell`: use CommonMark
backslash escapes (`\<`/`\>`) instead of HTML entities. `marked`
correctly parses these as `escape` tokens with the decoded character.
- `renderOneInline` link case: detect GFM autolinks via `link.raw`
(starts with URL scheme, not `[`) and strip backslash-escape artifacts
from both link text and href.
- Tests: added angle bracket escape tests for both functions, plus
round-trip tests verifying `<unknown>` and URLs with underscores render
correctly through the full pipeline.

## Test plan

- `bun test test/lib/formatters/markdown.test.ts` — 77 tests pass (3
new)
- Manual: `bun src/bin.ts issue list` against projects with `<unknown>`
titles and URL-containing titles

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: betegon

src/lib/formatters/markdown.ts

@@ -78,7 +78,7 @@ export function isPlainOutput(): boolean {
  * Escape a string for safe use inside a markdown table cell.
  *
  * Collapses newlines, escapes backslashes, pipes, and angle brackets.
- * Angle brackets must be escaped to `<`/`>` so that user-supplied
+ * Angle brackets are backslash-escaped (`\<`/`\>`) so that user-supplied
  * content (e.g. `Expected <string>`) is not parsed as an HTML tag by
  * `marked`, which would silently drop the content via `renderHtmlToken`.
  */
@@ -87,17 +87,17 @@ export function escapeMarkdownCell(value: string): string {
     .replace(/\n/g, " ")
     .replace(/\\/g, "\\\\")
     .replace(/\|/g, "\\|")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
+    .replace(/</g, "\\<")
+    .replace(/>/g, "\\>");
 }
 
 /**
  * Escape CommonMark inline emphasis characters.
  *
  * Prevents `_`, `*`, `` ` ``, `[`, `]`, `<`, and `>` from being consumed
- * by the parser. Angle brackets are HTML-escaped so that user-supplied
- * content (e.g. `Expected <string> got <number>`) is not silently dropped
- * when `marked` parses the text as HTML tokens.
+ * by the parser. Angle brackets are backslash-escaped (`\<`/`\>`) so that
+ * user-supplied content (e.g. `Expected <string> got <number>`) is not
+ * silently dropped when `marked` parses the text as HTML tokens.
  */
 export function escapeMarkdownInline(value: string): string {
   return value
@@ -107,8 +107,8 @@ export function escapeMarkdownInline(value: string): string {
     .replace(/`/g, "\\`")
     .replace(/\[/g, "\\[")
     .replace(/\]/g, "\\]")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
+    .replace(/</g, "\\<")
+    .replace(/>/g, "\\>");
 }
 
 /**
@@ -320,9 +320,19 @@ function renderOneInline(token: Token): string {
       return chalk.hex(COLORS.yellow)((token as Tokens.Codespan).text);
     case "link": {
       const link = token as Tokens.Link;
-      const linkText = renderInline(link.tokens);
+      let linkText = renderInline(link.tokens);
+      let href = link.href ?? "";
+      // GFM autolinks absorb backslash-escapes literally (\_astro → \_astro).
+      // Detect autolinks via link.raw (starts with URL, not "[") and strip artifacts.
+      const raw = link.raw ?? "";
+      if (raw.startsWith("http://") || raw.startsWith("https://")) {
+        const stripEscapes = (s: string) =>
+          s.replace(/\\([_*`[\]<>\\])/g, "$1");
+        linkText = stripEscapes(linkText);
+        href = stripEscapes(href);
+      }
       const styled = chalk.hex(COLORS.blue)(linkText);
-      return link.href ? terminalLink(styled, link.href) : styled;
+      return href ? terminalLink(styled, href) : styled;
     }
     case "del":
       return chalk.dim.gray.strikethrough(

test/lib/formatters/markdown.test.ts

@@ -313,6 +313,10 @@ describe("escapeMarkdownCell", () => {
     const result = escapeMarkdownCell("a|b|c");
     expect(result).toBe("a\\|b\\|c");
   });
+
+  test("escapes angle brackets with backslash", () => {
+    expect(escapeMarkdownCell("<html>")).toBe("\\<html\\>");
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -479,6 +483,29 @@ describe("escapeMarkdownInline", () => {
   test("returns unchanged string with no special chars", () => {
     expect(escapeMarkdownInline("hello world")).toBe("hello world");
   });
+
+  test("escapes angle brackets with backslash", () => {
+    expect(escapeMarkdownInline("<unknown>")).toBe("\\<unknown\\>");
+  });
+
+  test("angle brackets survive round-trip through renderInlineMarkdown", () => {
+    withEnv({ SENTRY_PLAIN_OUTPUT: "0", NO_COLOR: undefined }, false, () => {
+      const escaped = escapeMarkdownInline("<unknown>");
+      const result = stripAnsi(renderInlineMarkdown(escaped));
+      expect(result).toBe("<unknown>");
+    });
+  });
+
+  test("URLs with underscores render without backslashes", () => {
+    withEnv({ SENTRY_PLAIN_OUTPUT: "0", NO_COLOR: undefined }, false, () => {
+      const escaped = escapeMarkdownInline(
+        "https://spotlightjs.com/_astro/ui-core.js"
+      );
+      const result = stripAnsi(renderInlineMarkdown(escaped));
+      expect(result).not.toContain("\\_");
+      expect(result).toContain("_astro");
+    });
+  });
 });
 
 // ---------------------------------------------------------------------------