fix(security): close all open dependabot + codeql alerts

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/token-check.yml

@@ -7,6 +7,10 @@ on:
 env:
   NPM_TOKEN_EXPIRES: "2026-08-21"
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   check:
     runs-on: ubuntu-latest

packages/cli/src/lib/terminal-render.test.ts

@@ -55,6 +55,24 @@ describe('createTerminalRenderer', () => {
     expect(capture.writes.join('')).toBe('# Summary\n\n- item\n');
   });
 
+  it('strips markdown table separator rows and resists pathological inputs', () => {
+    const capture = createCapture(true);
+    const renderer = createTerminalRenderer(capture.output);
+
+    renderer.renderMarkdown(
+      ['| Name | Value |', '| :--- | ---: |', '| foo | 1 |'].join('\n'),
+    );
+    const rendered = capture.writes.join('');
+    expect(rendered).not.toContain(':---');
+    expect(rendered).not.toContain('---:');
+
+    const pathological = `| |${'  |'.repeat(26)}x|`;
+    const start = performance.now();
+    const capture2 = createCapture(true);
+    createTerminalRenderer(capture2.output).renderMarkdown(pathological);
+    expect(performance.now() - start).toBeLessThan(500);
+  });
+
   it('renders preview panels and tool activity lines', () => {
     const capture = createCapture(true);
     const renderer = createTerminalRenderer(capture.output);

packages/cli/src/lib/terminal-render.ts

@@ -109,7 +109,7 @@ function isTableLine(line: string): boolean {
 
 function formatTable(lines: string[]): string[] {
   const rows = lines
-    .filter((line) => !/^\|\s*[: -]+(\|\s*[: -]+)+\|$/.test(line))
+    .filter((line) => !/^\|[ \t:-]+(\|[ \t:-]+)+\|$/.test(line))
     .map((line) =>
       line
         .slice(1, -1)

pnpm-workspace.yaml

@@ -20,7 +20,7 @@ overrides:
   "postcss@<8.5.10": "8.5.15"
   "rollup@>=4.0.0 <4.59.0": "4.59.0"
   "smol-toml@<1.6.1": "1.6.1"
-  "undici@>=6.0.0 <6.24.0": "6.24.0"
+  "undici@<6.24.0": "6.24.0"
   "undici@>=7.0.0 <7.24.0": "7.24.0"
   "vite@>=7.0.0 <=7.3.1": "7.3.2"
   "ws@>=8.0.0 <8.20.1": "8.20.1"