Address Copilot review: safe Markdown escaping, matchedText guard, edge-case tests

- Add mdInlineCode() helper using variable-length backtick fence (CommonMark
  §6.1) so regex patterns containing backticks produce valid inline code spans.
  Reuse for seg.text in match lines.
- buildQueryTitle: use mdInlineCode() for regex queries (fixes embedded
  backticks) and JSON.stringify() for plain queries (escapes embedded " and
  converts \n so the heading always stays on a single line).
- Fix JSDoc example: '# Results for \`useFlag/i\`' → '# Results for \`/useFlag/i\`'.
- buildJsonOutput: guard matchedText behind seg.text non-empty check, matching
  markdown behaviour and preventing '"matchedText": ""' in JSON output.
- Add edge-case tests: plain query with embedded quotes, plain query with
  newline, regex with embedded backtick, empty seg.text omitted from JSON.

Author: shouze

src/output.test.ts

@@ -299,6 +299,29 @@ describe("buildQueryTitle", () => {
       '# Results for "useFlag"',
     );
   });
+
+  it("handles a plain query with embedded double quotes without breaking the heading", () => {
+    const title = buildQueryTitle('from "axios"');
+    // JSON.stringify escapes the embedded quotes — heading stays on one line
+    expect(title.startsWith("# Results for ")).toBe(true);
+    expect(title).not.toContain("\n");
+    expect(title).toContain("axios");
+  });
+
+  it("handles a plain query with a newline without breaking the heading", () => {
+    const title = buildQueryTitle("line1\nline2");
+    // JSON.stringify converts \n to \\n — no actual newline in the heading
+    expect(title.startsWith("# Results for ")).toBe(true);
+    expect(title).not.toContain("\n");
+  });
+
+  it("handles a regex query with an embedded backtick without producing malformed inline code", () => {
+    const title = buildQueryTitle("/foo`bar/i");
+    expect(title.startsWith("# Results for ")).toBe(true);
+    expect(title).not.toContain("\n");
+    // Variable-length fence: at least two consecutive backticks used as delimiter
+    expect(title).toContain("``");
+  });
 });
 
 describe("buildMarkdownOutput", () => {
@@ -597,6 +620,34 @@ describe("buildJsonOutput — line/col fields", () => {
     const parsed = JSON.parse(buildJsonOutput(groups, QUERY, ORG, new Set(), new Set()));
     expect(parsed.results[0].matches[0].matchedText).toBeUndefined();
   });
+
+  it("omits matchedText when seg.text is an empty string", () => {
+    // api.ts normalizes missing segment text to "" — matchedText must not be emitted
+    const groups: RepoGroup[] = [
+      {
+        repoFullName: "myorg/repoA",
+        matches: [
+          {
+            path: "src/foo.ts",
+            repoFullName: "myorg/repoA",
+            htmlUrl: "https://github.com/myorg/repoA/blob/main/src/foo.ts",
+            archived: false,
+            textMatches: [
+              {
+                fragment: "some snippet",
+                matches: [{ text: "", indices: [0, 0], line: 1, col: 1 }],
+              },
+            ],
+          },
+        ],
+        folded: true,
+        repoSelected: true,
+        extractSelected: [true],
+      },
+    ];
+    const parsed = JSON.parse(buildJsonOutput(groups, QUERY, ORG, new Set(), new Set()));
+    expect(parsed.results[0].matches[0].matchedText).toBeUndefined();
+  });
 });
 
 // ─── buildOutput dispatcher ──────────────────────────────────────────────────

src/output.ts

@@ -151,6 +151,21 @@ export function buildReplayDetails(
   ].join("\n");
 }
 
+// ─── Markdown inline-code helper ────────────────────────────────────────────
+
+/**
+ * Wraps `s` in a Markdown inline-code span using a backtick fence long enough
+ * to safely contain any backticks already present in `s` (CommonMark §6.1).
+ * Adds surrounding spaces when `s` starts or ends with a backtick character.
+ */
+function mdInlineCode(s: string): string {
+  const runs = [...s.matchAll(/`+/g)].map((m) => m[0].length);
+  const maxRun = runs.length > 0 ? Math.max(...runs) : 0;
+  const fence = "`".repeat(maxRun + 1);
+  const padded = s.startsWith("`") || s.endsWith("`") ? ` ${s} ` : s;
+  return `${fence}${padded}${fence}`;
+}
+
 // ─── Query title ─────────────────────────────────────────────────────────────
 
 /**
@@ -159,11 +174,15 @@ export function buildReplayDetails(
  *
  * Examples:
  *   # Results for "useFlag"
- *   # Results for `useFlag/i`
+ *   # Results for `/useFlag/i`
  *   # Results for "axios" · including archived · excluding templates
  */
 export function buildQueryTitle(query: string, options: ReplayOptions = {}): string {
-  const queryDisplay = isRegexQuery(query) ? `\`${query}\`` : `"${query}"`;
+  // JSON.stringify handles embedded double quotes and converts newlines to \n
+  // so the heading always stays on a single line.
+  // mdInlineCode uses a variable-length backtick fence to safely display regex
+  // patterns that may themselves contain backtick characters.
+  const queryDisplay = isRegexQuery(query) ? mdInlineCode(query) : JSON.stringify(query);
   const qualifiers: string[] = [];
   if (options.includeArchived) qualifiers.push("including archived");
   if (options.excludeTemplates) qualifiers.push("excluding templates");
@@ -232,7 +251,7 @@ export function buildMarkdownOutput(
       // absolute line numbers).
       const seg = m.textMatches[0]?.matches[0];
       if (seg) {
-        const matchedText = seg.text ? `: \`${seg.text}\`` : "";
+        const matchedText = seg.text ? `: ${mdInlineCode(seg.text)}` : "";
         lines.push(
           `  - [ ] [${m.path}:${seg.line}:${seg.col}](${m.htmlUrl}#L${seg.line})${matchedText}`,
         );
@@ -269,7 +288,13 @@ export function buildJsonOutput(
         return {
           path: m.path,
           url: m.htmlUrl,
-          ...(seg !== undefined ? { line: seg.line, col: seg.col, matchedText: seg.text } : {}),
+          ...(seg !== undefined
+            ? {
+                line: seg.line,
+                col: seg.col,
+                ...(seg.text ? { matchedText: seg.text } : {}),
+              }
+            : {}),
         };
       });
       return { ...base, matches };