fix(extensions): escape the non-numeric downloads fallback for Rich markup

Address review feedback: the fallback interpolated the untrusted catalog value
straight into a Rich-rendered string, so guarding the ``:,`` ValueError just
traded it for a MarkupError -- a catalog entry with downloads "[/red]foo" still
aborted `extension search`/`info`, and balanced tags could restyle the output.

Wrap the fallback in _escape_markup(str(...)) at both sites, matching how every
other catalog field in these renderers is already escaped. Numeric values keep
the identical ``:,`` branch, so correct catalogs are unchanged.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jawwad-ali

src/specify_cli/extensions/_commands.py

@@ -794,11 +794,14 @@ def extension_search(
             if downloads is not None:
                 # Catalog fields are untrusted; a non-numeric ``downloads``
                 # (e.g. the JSON string "1500") would crash the ``:,`` format
-                # with "Cannot specify ',' with 's'". Only group-format numbers.
+                # with "Cannot specify ',' with 's'". Only group-format numbers,
+                # and escape the fallback: the joined stats are rendered as Rich
+                # markup, so a value like "[/red]foo" would raise MarkupError
+                # (matching how every other catalog field here is escaped).
                 stats.append(
                     f"Downloads: {downloads:,}"
                     if isinstance(downloads, (int, float))
-                    else f"Downloads: {downloads}"
+                    else f"Downloads: {_escape_markup(str(downloads))}"
                 )
             if ext.get('stars') is not None:
                 stats.append(f"Stars: {ext['stars']}")
@@ -983,11 +986,14 @@ def _print_extension_info(ext_info: dict, manager):
     if downloads is not None:
         # Catalog fields are untrusted; a non-numeric ``downloads`` (e.g. the
         # JSON string "1500") would crash the ``:,`` format with "Cannot
-        # specify ',' with 's'". Only group-format numbers.
+        # specify ',' with 's'". Only group-format numbers, and escape the
+        # fallback: the joined stats are rendered as Rich markup, so a value
+        # like "[/red]foo" would raise MarkupError (matching how every other
+        # catalog field here is escaped).
         stats.append(
             f"Downloads: {downloads:,}"
             if isinstance(downloads, (int, float))
-            else f"Downloads: {downloads}"
+            else f"Downloads: {_escape_markup(str(downloads))}"
         )
     if ext_info.get('stars') is not None:
         stats.append(f"Stars: {ext_info['stars']}")

tests/test_extensions.py

@@ -4034,24 +4034,35 @@ def test_search_all_extensions(self, temp_dir):
         results = catalog.search()
         assert len(results) == 2
 
-    def test_info_renders_non_numeric_downloads(self):
-        """A non-numeric ``downloads`` from an untrusted catalog must not crash
-        the info renderer with 'Cannot specify ',' with 's''; it renders as-is."""
+    @pytest.mark.parametrize(
+        "downloads",
+        [
+            "1500",          # plain string: crashed the ``:,`` format
+            "[/red]foo",      # unbalanced closing tag: raises MarkupError unescaped
+            "[bold]x[/bold]",  # balanced tags: would silently restyle the output
+        ],
+    )
+    def test_info_renders_non_numeric_downloads(self, downloads):
+        """A non-numeric ``downloads`` from an untrusted catalog must not crash the
+        info renderer — neither with 'Cannot specify ',' with 's'' (the ``:,``
+        format) nor with a Rich MarkupError (the joined stats are markup)."""
         from unittest.mock import MagicMock
         from specify_cli.extensions._commands import _print_extension_info
 
         manager = MagicMock()
         manager.registry.is_installed.return_value = False
         ext_info = {
             "name": "Jira", "id": "jira", "version": "1.0.0",
-            "description": "desc", "downloads": "1500",  # string from catalog JSON
+            "description": "desc", "downloads": downloads,  # from catalog JSON
         }
-        # Must not raise ValueError.
+        # Must not raise ValueError or rich.errors.MarkupError.
         _print_extension_info(ext_info, manager)
 
-    def test_search_survives_non_numeric_downloads(self, temp_dir):
-        """`specify extension search` must not abort with a raw ValueError when a
-        catalog entry's ``downloads`` is a non-numeric string."""
+    @pytest.mark.parametrize("downloads", ["1500", "[/red]foo"])
+    def test_search_survives_non_numeric_downloads(self, temp_dir, downloads):
+        """`specify extension search` must not abort when a catalog entry's
+        ``downloads`` is a non-numeric string — not with a raw ValueError from the
+        ``:,`` format, nor with a Rich MarkupError from unescaped markup."""
         import yaml as yaml_module
         from typer.testing import CliRunner
         from unittest.mock import patch
@@ -4077,7 +4088,7 @@ def test_search_survives_non_numeric_downloads(self, temp_dir):
                 "name": "Jira", "id": "jira", "version": "1.0.0",
                 "description": "Jira integration", "author": "x",
                 "tags": ["jira"], "verified": True,
-                "downloads": "1500",  # non-numeric, straight from catalog JSON
+                "downloads": downloads,  # non-numeric, straight from catalog JSON
             }},
         }
         catalog.cache_dir.mkdir(parents=True, exist_ok=True)
@@ -4091,7 +4102,8 @@ def test_search_survives_non_numeric_downloads(self, temp_dir):
         with patch.object(Path, "cwd", return_value=project_dir):
             result = runner.invoke(app, ["extension", "search"], catch_exceptions=True)
         assert result.exit_code == 0, result.output
-        assert "Downloads: 1500" in result.output
+        # Rendered literally (escaped), not interpreted as markup or dropped.
+        assert f"Downloads: {downloads}" in result.output
 
     def test_search_by_query(self, temp_dir):
         """Test searching by query text."""