escape user-controlled values in integration-options error messages

the malformed-quoting handler (and the unexpected/unknown option
branches) interpolate raw_options/token into console.print. a value
carrying an unbalanced rich tag like '--commands-dir "[/red]foo' first
trips the intended shlex ValueError, but the error print then raises
rich.errors.MarkupError and leaks a traceback anyway. escape all three
before printing so the clean typer.Exit survives.

added a regression covering both the shlex path and a bare markup token.

Author: Quratulain-bilal

src/specify_cli/integrations/_helpers.py

@@ -6,6 +6,7 @@
 from typing import Any, Callable
 
 import typer
+from rich.markup import escape
 
 from .._agent_config import SCRIPT_TYPE_CHOICES
 from .._console import console
@@ -196,10 +197,12 @@ def _parse_integration_options(integration: Any, raw_options: str) -> dict[str,
         # shlex raises on malformed input (e.g. an unbalanced quote in
         # --integration-options='--commands-dir "foo'). Surface the clean CLI
         # error every other bad-input path here produces instead of leaking a
-        # raw ValueError traceback.
+        # raw ValueError traceback. raw_options is user-controlled, so escape
+        # it before interpolating — an unbalanced Rich tag like '[/red]' would
+        # otherwise raise MarkupError inside console.print and leak a traceback.
         console.print(
             f"[red]Error:[/red] Could not parse integration options "
-            f"'{raw_options}': {error}."
+            f"'{escape(raw_options)}': {escape(str(error))}."
         )
         raise typer.Exit(1) from error
     declared_options = list(integration.options())
@@ -209,7 +212,7 @@ def _parse_integration_options(integration: Any, raw_options: str) -> dict[str,
     while i < len(tokens):
         token = tokens[i]
         if not token.startswith("-"):
-            console.print(f"[red]Error:[/red] Unexpected integration option value '{token}'.")
+            console.print(f"[red]Error:[/red] Unexpected integration option value '{escape(token)}'.")
             if allowed:
                 console.print(f"Allowed options: {allowed}")
             raise typer.Exit(1)
@@ -220,7 +223,7 @@ def _parse_integration_options(integration: Any, raw_options: str) -> dict[str,
             name, value = name.split("=", 1)
         opt = declared.get(name)
         if not opt:
-            console.print(f"[red]Error:[/red] Unknown integration option '{token}'.")
+            console.print(f"[red]Error:[/red] Unknown integration option '{escape(token)}'.")
             if allowed:
                 console.print(f"Allowed options: {allowed}")
             raise typer.Exit(1)

tests/integrations/test_integration_subcommand.py

@@ -2693,6 +2693,31 @@ def test_malformed_quoting_exits_cleanly(self):
         with pytest.raises(typer.Exit):
             _parse_integration_options(integration, '--commands-dir "foo')
 
+    def test_malformed_quoting_with_rich_markup_exits_cleanly(self):
+        """A malformed value carrying Rich markup must still exit cleanly.
+
+        raw_options is user-controlled. A value like '--commands-dir "[/red]foo'
+        first trips the shlex ValueError path, but the error message then
+        interpolates the raw value into console.print — an unbalanced Rich tag
+        such as '[/red]' would raise rich.errors.MarkupError there and leak a
+        traceback anyway. The value must be escaped so the clean typer.Exit
+        survives."""
+        import typer
+
+        from specify_cli.integrations._commands import _parse_integration_options
+        from specify_cli.integrations import get_integration
+
+        integration = get_integration("generic")
+        assert integration is not None
+
+        # Unbalanced quote (shlex path) + markup injection in one value.
+        with pytest.raises(typer.Exit):
+            _parse_integration_options(integration, '--commands-dir "[/red]foo')
+
+        # Markup injection in a token that parses but is unexpected/unknown.
+        with pytest.raises(typer.Exit):
+            _parse_integration_options(integration, "[/red]foo")
+
 
 class TestUninstallNoManifestClearsInitOptions:
     def test_init_options_cleared_on_no_manifest_uninstall(self, tmp_path):