hyperfine

Closes #507 Summary The default ANSI palette is difficult to read in legacy Windows PowerShell/conhost sessions with the default dark-blue background. This centralizes Hyperfine's semantic colors and selects a readable palette only when reports that background. Other terminals keep the existing colors. The regression tests cover the palette selection and ensure that only a dark-blue background selects the legacy theme. Tests On Windows (Git Bash), all passed: — 45 unit tests, 19 execution-order tests, and 35 integration tests passed; 0 failed — passed; only existing repository warnings remain — passed; only the existing naming warning remains Baseline limitation The host is accessed through non-interactive SSH, so the blue-console contrast cannot be visually rendered here. The unmodified default branch was reproduced at the ANSI-output level: forced-color output emitted the low-contrast green (), blue (), and magenta () sequences described by the issue. The new behavior is selected from the actual Windows console buffer attributes and is covered by deterministic Windows tests. AI assistance This PR was authored with AI assistance for issue triage, repository navigation, implementation, test authoring, and validation. The change and test results are stated explicitly above.

So is like Roughly what I imagine would be best:

Problem When exporting benchmark results to CSV, hyperfine writes the command string and parameter values verbatim into CSV cells. Spreadsheet applications (Excel, LibreOffice Calc, Google Sheets) interpret cells beginning with , , , , tab, or carriage return as formulas, which can lead to formula injection (CWE-1236) when parameter values come from external input. For example, exported to CSV contains the literal, unescaped text , which is evaluated as a live formula when the file is opened in a spreadsheet. Fix Add a helper that prefixes values beginning with formula-triggering characters with a single quote (), forcing spreadsheet applications to display them as literal text. The helper is applied to both the field and all columns. This is the standard mitigation for CWE-1236 and does not affect values that don't begin with dangerous characters. Numeric fields (mean, stddev, etc.) are unaffected since they are serialized from values which cannot produce formula-interpretable strings. Testing Added two new tests: : Integration test that verifies a parameter value of is properly escaped in the CSV output as . : Unit test covering all six dangerous prefixes (, , , , , ) and several safe values that should pass through unchanged. All existing tests pass (3 unit + 39 integration).