fix(web): preserve XML-like tags in user messages

[0utsights]

Summary

• display user-authored HTML/XML-like syntax literally in chat messages
• preserve sanitized raw HTML rendering for assistant messages
• add regression coverage for both behaviors

Root cause

ChatMarkdown always enabled raw HTML parsing and sanitization. Unknown XML-like elements in user input, such as <global-agent-instructions>, were therefore interpreted as HTML and removed from the rendered message.

User messages now opt out of raw HTML parsing, so their original text remains visible. Assistant messages keep the existing sanitized HTML behavior.

User impact

The rendered user message now matches what was typed instead of silently omitting XML-like tags. This only changes presentation; the message payload sent to the agent was already correct.

Fixes #4059.

Validation

• pnpm exec vp test apps/web/src/components/chat/MessagesTimeline.test.tsx (14 tests passed)
• pnpm exec vp check (0 errors; 10 existing warnings)
• pnpm exec vp run typecheck

Note

Preserve XML-like tags in user messages by disabling raw HTML parsing

• Sets parseRawHtml={false} on all ChatMarkdown usages in MessagesTimeline.tsx that render user-provided text, so XML-like tags and HTML are displayed as escaped source text rather than parsed.
• Adds a parseRawHtml prop to ChatMarkdown (defaults to true) that conditionally applies rehype plugins; when false, raw HTML is not processed.
• Drops title attributes from rendered <a> and <img> elements in markdown output.
• Behavioral Change: user messages no longer render any HTML, even sanitized HTML — only assistant messages retain HTML parsing behavior.

^{Macroscope summarized 9e2aa9b.}

---

Note

Low Risk
Presentation-only change for user messages with a clear security win; assistant markdown behavior unchanged.

Overview
User chat messages now render HTML/XML-like syntax as escaped literal text instead of parsing it as HTML, so tags such as <global-agent-instructions> and comparisons like 2 < 3 stay visible instead of disappearing.

ChatMarkdown gains a parseRawHtml flag (default true). When false, rehype raw HTML parsing/sanitization is skipped and skipHtml={false} keeps unparsed HTML as text. All user-message ChatMarkdown usages in MessagesTimeline pass parseRawHtml={false}; assistant messages keep sanitized raw HTML (e.g. <details>).

Link/image renderers drop markdown title attributes from the DOM. Regression tests cover user literal tags, XSS as text, and assistant sanitized HTML.

^{Reviewed by Cursor Bugbot for commit 9e2aa9b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5f1f2543-a5f7-4609-bcff-7812fc6d708d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 6fc3bad. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR changes how HTML is rendered in user messages (escaping vs parsing), which affects runtime behavior in a security-sensitive area. The unresolved review comment identifies a real gap where block-level HTML tags cause line breaks to collapse and miss paragraph styling.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 6a9a0e8

[macroscopeapp]

One consistency issue found in the parseRawHtml switch: disabling the whole rehype chain also disables the sanitize schema, which is the only thing enforcing the project's no-native-title policy on rendered markdown. See the inline comment.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the literal-HTML rendering path: block-level HTML in user messages now renders as an unwrapped, whitespace-collapsed text run. The title issue flagged on the previous commit is resolved by the new a/img renderers.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

With parseRawHtml={false} react-markdown replaces each raw node with one text node at the original node's position. That is fine for inline HTML (it stays inside the paragraph), but a block-level HTML node — a user message whose line starts with a tag, e.g.

<global-agent-instructions>
Do the thing
</global-agent-instructions>

is a single mdast html node covering the whole block, so the escaped source is emitted as a bare text node directly under .chat-markdown, outside any <p>. Two visible consequences: the typed newlines collapse to spaces (the default user-message path renders <ChatMarkdown> without a whitespace-pre-wrap ancestor, unlike the terminal-context path at MessagesTimeline.tsx:1776/1815, so the same message renders with different line structure depending on attached contexts), and the block gets none of the .chat-markdown p block spacing (index.css:1589). remarkBreaks cannot compensate because it only rewrites text nodes, not html nodes.

Smallest fix that keeps the literal-escaping goal: instead of relying on react-markdown's raw→text fallback, run a small remark plugin in literal mode (ordered before remarkBreaks) that rewrites mdast html nodes into text nodes, wrapping root-level ones in a paragraph. The escaping stays identical, and line breaks plus paragraph rhythm match the rest of the user message. Worth covering with a test for a multi-line HTML block, since the current tests only exercise single-line/inline cases.

^{Posted via Macroscope — UI Consistency}

[juliusmarminge]

Re-approved after the focused regression fix and verification.