[fas89]

Description

fluid test and fluid contract-validation passed the contract's own text to Rich as
markup. In fluid test a JSON Schema pattern lost its character classes
(^[a-z0-9][a-z0-9-]*[a-z0-9]$ printed as ^*$) and exposes[orders] lost its id. In
both commands an id or expose id holding [/] raised MarkupError. That error then hit
main()'s generic handler, which wrapped it in [red]...[/red] and raised again, and
finally the last-resort console_error(...), which did the same. So both commands died
with a traceback. #734 had already made the "Environment overlay" row and the
contract-validation issue table literal; this PR covers the rest. It was found by the
defect scan on #734.

What changed:

• Two helpers in fluid_build/_console.py, re-exported from cli/console.py.
  • literal_text() returns a rich Text, so the value is never parsed as markup or
    :emoji: codes, and it spells control characters as \xNN.
  • cprint_literal() is its str counterpart for cprint. It passes markup=False
    and emoji=False, spells control characters, and still redacts.
  • Tab and line feed are kept, and a CRLF reads as a line feed.
• fluid test: the header panel and every results-table row go through
  literal_text. The _detail() helper (rich.markup.escape) is gone. The soda
  engine's failed check names and Soda's stderr go through cprint_literal.
• fluid contract-validation: the summary panel, each issue's message and path, and
  a severity outside the three styled ones go through literal_text.
• Both commands, without Rich: the plain reports go through cprint_literal. The
  console's plain fallback otherwise strips anything shaped like [word].
• _console.error prints its message through the same spelling, redacting the raw
  text before and after. An AST scan of its 130 call sites found none that passes
  intended markup. fluid validate stops escaping six messages before calling it; if it
  kept escaping, they would now print a stray backslash.
• main(): the Provider error and Unexpected error lines and the --debug
  traceback go through literal_text and are now redacted. Before, the MarkupError
  kept a secret sitting next to a [/] off the screen; now that the text prints, it has
  to be redacted.

Why Text, not rich.markup.escape, for a whole value: escape appends a backslash to
a trailing one so the value can sit before a tag (rich#2987, fixed in rich PR #3063). When
no tag follows, C:\work\ prints as C:\work\\. The CLIError branch of main() already
made the same choice.

Why control characters are spelled out: the security review of this branch found that
a top-level str used to pass through Rich's highlighter, which happened to break up
ESC[2J or an OSC-8 link by styling the [. A Text is not highlighted. Without the
spelling, the ❌ lines would have let a contract value or an exception message clear
the screen or plant a link. Report panels and table cells passed those sequences raw
before this change too; they are spelled now as well.

Visible changes besides the fix: the changed lines lose Rich's automatic highlighting
(numbers, URLs) and :emoji: codes. fe80::a:b:c used to print with a 🅱. The report
panels and tables render byte-identical ANSI for content without brackets or control
characters. JSON, JUnit and the plain --output-file report were already literal and are
unchanged.

Out of scope, listed for follow-ups:

• the typed-error renderers (main()'s CLIError branch and FluidCLIError.format_for_user)
  do not spell control characters;
• 34 console.print(f"[red]❌ ...") sites in the forge, ide, init and template modes still
  parse their data as markup;
• operator-typed values (--output-file, the contract path, --datasource) echoed
  through success() or cprint still parse as markup.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would break existing functionality)
• Documentation update
• Refactor / code cleanup
• New provider or provider enhancement

Documentation

• Docs PR linked:
• No docs needed — this change does not affect user-facing behaviour
  • Justification: terminal-output bug fix. The commands now print the text the docs
    already describe; the only sample, the fluid test panel in docs/cli/test.md, has
    no brackets and reads the same. No flag, exit code or output format changes.
• Docs TODO

Checklist

• I have read the Contributing Guide
• My code follows the project's coding standards
• I have added tests that prove my fix/feature works
• All new and existing tests pass (pytest)
• I have run ruff check and black with no errors
• New maintained Python files include license headers (python scripts/add_license_headers.py; examples/** exempt)

Testing

• New regression tests in tests/cli/test_cli_output_keeps_brackets.py,
  tests/test_console.py and tests/test_soda_engine_exit_codes.py. They cover:

  • both commands end to end through main();
  • every fluid test row and the contract-validation table, trailing backslashes
    included;
  • the Rich-less plain reports and the soda text output and stderr lines;
  • each fluid validate error branch;
  • main()'s Provider, Unexpected, --debug and last-resort handlers, and their
    redaction;
  • console_error: literal, redacted next to a control character, and without Rich;
  • cprint_literal;
  • control characters on a terminal (FORCE_COLOR=1).

  Each test fails on main or when its fix is reverted, and passes here.

• Affected test files: every file touching a changed module, 64 in all. Result: 2309
  passed. The 5 failures and 2 errors also happen on main. All of them are
  AttributeError: type object 'TokenType' has no attribute 'LLRR_ARROW', from sqlglot
  version skew in the local venv.

• Gates:

  • ruff check fluid_build/ tests/ and the dead-code gate;
  • black==24.10.0 --check;
  • scripts/check_license_headers.py;
  • lint-imports (6 contracts kept);
  • scripts/mypy_strict.py;
  • tools/product_guardrail/check.py;
  • tests/perf serially: only wall-clock budgets fail, identically on main, at load
    average ~200. fluid --help loads 1020 modules before and after.

• Live runs:

  • Contract with id: "tutorial.[/]hello", exposeId: "hello[/]message" and a tag that
    fails ^[a-z0-9][a-z0-9-]*[a-z0-9]$, through fluid test and
    fluid contract-validation with --no-data --no-cache.
    • Before: a traceback ending in rich.errors.MarkupError: closing tag '[/bold]' at position 47 doesn't match any open tag.
    • After: exit 1 on the schema errors, with every value shown as written.
    • --output json, --output junit and --output-file stay raw.
  • The same contract with an id carrying ESC[2J and an OSC-8 link, on a forced
    terminal: 0 raw sequences reach the output; the spelled form is shown.
  • fluid test --engine soda with an unmappable rule whose id holds [/],
    fe80::a:b:c and ESC[2J: printed as written, with no emoji and no traceback.

• Reviews: a security review and an adversarial defect hunt of the branch. Their
  findings (redaction order, emoji and control characters on the soda and --debug
  lines, CHANGELOG accuracy, test gaps) are fixed in 044a92c, which a second round
  reviewed; 28f0bfe adds the tests that round asked for.

Screenshots / Output

╭──────────────────────────── fluid test ────────────────────────────╮
│ ❌ Data Contract Test: tutorial.[/]hello                            │
...
│ 1 │ ❌ │ Schema syntax │ exposes[0].exposeId: 'hello[/]message' does not match
...   tags[1]: 'Bad Tag!' does not match '^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$'