fix(web): preserve XML-like tags in user messages

[0utsights]

Summary

• display user-authored HTML/XML-like syntax literally in chat messages
• preserve sanitized raw HTML rendering for assistant messages
• add regression coverage for both behaviors

Root cause

ChatMarkdown always enabled raw HTML parsing and sanitization. Unknown XML-like elements in user input, such as <global-agent-instructions>, were therefore interpreted as HTML and removed from the rendered message.

User messages now opt out of raw HTML parsing, so their original text remains visible. Assistant messages keep the existing sanitized HTML behavior.

User impact

The rendered user message now matches what was typed instead of silently omitting XML-like tags. This only changes presentation; the message payload sent to the agent was already correct.

Fixes #4059.

Validation

• pnpm exec vp test apps/web/src/components/chat/MessagesTimeline.test.tsx (14 tests passed)
• pnpm exec vp check (0 errors; 10 existing warnings)
• pnpm exec vp run typecheck

Note

Preserve XML-like tags in user messages by disabling raw HTML parsing

• Adds a parseRawHtml prop to ChatMarkdown (default true) that controls whether the rehype plugin pipeline runs.
• Sets parseRawHtml={false} in UserMessageBody so HTML-like tags in user text render as literal text instead of being parsed.
• Assistant messages are unaffected and continue to render sanitized HTML as before.
• Behavioral Change: user messages that previously rendered HTML tags will now display them as escaped source text.

^{Macroscope summarized 6fc3bad.}

---

Note

Low Risk
Presentation-only change in chat markdown rendering with a narrow default-preserving API and targeted tests; no auth or data-path impact.

Overview
Fixes user chat bubbles silently dropping XML-like tags (e.g. <global-agent-instructions>) because markdown always ran raw HTML parsing via rehype-raw + sanitize.

ChatMarkdown gains a parseRawHtml flag (default true). When false, rehype raw-HTML plugins are skipped so angle-bracket text is shown as escaped literals instead of being stripped as unknown HTML.

User message rendering in MessagesTimeline sets parseRawHtml={false} on every ChatMarkdown path for user content. Assistant messages keep the default, so sanitized HTML such as <details> still renders.

Regression tests cover escaped tags in user messages and continued HTML rendering for assistants.

^{Reviewed by Cursor Bugbot for commit 6fc3bad. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 48eadef6-30e3-4d52-8366-1afd50039933

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 6fc3bad. Configure here.}

[cursor]

Raw HTML still dropped for users

High Severity

When parseRawHtml is false, XML-like tags (e.g., <global-agent-instructions>) disappear from rendered markdown. This happens because setting rehypePlugins to undefined removes the plugin needed to process these html nodes, causing them to be dropped from the output.

 

^{Reviewed by Cursor Bugbot for commit 6fc3bad. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

An unresolved high-severity review comment identifies a potential bug where XML-like tags may be dropped rather than preserved, contradicting the PR's stated intent. Human review needed to verify correctness.

^{You can customize Macroscope's approvability policy. Learn more.}