fix: preserve angle bracket content that isn't valid HTML

Text like "<insert text here>" was being parsed as an unknown HTML
element, then stripped by DOMPurify leaving empty message bubbles.
Override marked's html renderer to escape unknown tags as literal
text while passing safe HTML tags through. Also fix chat list
previews which stripped all <tag> patterns indiscriminately.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: JSKitty

src/js/markdown.js

@@ -139,6 +139,24 @@ function initializeMarked() {
         </div>`;
     };
 
+    // Escape unknown HTML tags as literal text — prevents DOMPurify from stripping
+    // user content like "<insert text here>" which gets parsed as an unknown HTML element.
+    // Safe tags (b, em, strong, etc.) pass through for user HTML support.
+    const safeHtmlTags = new Set([
+        'a', 'abbr', 'b', 'blockquote', 'br', 'code', 'del', 'details', 'div', 'em',
+        'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 's',
+        'span', 'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'th', 'thead',
+        'tr', 'u', 'ul'
+    ]);
+    renderer.html = function(token) {
+        const html = typeof token === 'string' ? token : (token.text || token.raw || '');
+        const tagMatch = html.match(/^<\/?([a-zA-Z][a-zA-Z0-9]*)/);
+        if (tagMatch && safeHtmlTags.has(tagMatch[1].toLowerCase())) {
+            return html; // Known safe tag — pass through
+        }
+        return encodeAttr(html); // Unknown tag — escape as literal text
+    };
+
     // No-preview autolink extension: <https://url> renders as a link but suppresses OG preview
     const noPreviewAutolink = {
         name: 'noPreviewAutolink',

src/main.js

@@ -1447,8 +1447,8 @@ function contentToPreviewText(content) {
     let text = content;
     // Replace <br> / <br/> with space
     text = text.replace(/<br\s*\/?>/gi, ' ');
-    // Strip all remaining HTML tags (require letter, / or ! after < to avoid matching math like "3 < 5 > 2")
-    text = text.replace(/<\/?[a-zA-Z!][^>]*>/g, '');
+    // Strip known HTML tags only (preserve unknown angle bracket content like "<insert text here>")
+    text = text.replace(/<\/?(a|abbr|b|blockquote|br|code|del|details|div|em|h[1-6]|hr|i|li|ol|p|pre|s|span|strong|sub|summary|sup|table|tbody|td|th|thead|tr|u|ul)(?:\s[^>]*)?\/?>/gi, '');
     // Strip block-level markdown: headers, blockquotes, code fences, horizontal rules
     text = text.replace(/^#{1,6}\s+/gm, '');
     text = text.replace(/^>\s?/gm, '');