Strip incomplete markdown from Concierge streaming drafts

During Concierge streaming, partial markdown (e.g. unclosed bold,
links, code blocks) was being rendered as raw syntax by ExpensiMark.
Add stripIncompleteMarkdown() to sanitize the tail of bodyMarkdown
before parsing, removing unclosed constructs so they don't flash
briefly in the UI.

Co-authored-by: Issa Nimaga <inimaga@users.noreply.github.com>

Author: MelvinBot

src/pages/inbox/conciergeDraftState.ts

@@ -20,8 +20,82 @@ type BuildConciergeDraftReportActionParams = {
     reportID: string;
 };
 
+/**
+ * Count non-overlapping occurrences of `needle` in `haystack`.
+ */
+function countOccurrences(haystack: string, needle: string): number {
+    let count = 0;
+    let pos = 0;
+    while (true) {
+        const idx = haystack.indexOf(needle, pos);
+        if (idx === -1) {
+            break;
+        }
+        count++;
+        pos = idx + needle.length;
+    }
+    return count;
+}
+
+/**
+ * If the last line of `text` contains an odd number of `delimiter` occurrences,
+ * the final one opened a construct that was never closed. Strip from that
+ * opening delimiter to the end of the string.
+ */
+function stripUnpairedLastLineDelimiter(text: string, delimiter: string): string {
+    const lastNewline = text.lastIndexOf('\n');
+    const lastLine = text.substring(lastNewline + 1);
+    const count = countOccurrences(lastLine, delimiter);
+
+    if (count > 0 && count % 2 !== 0) {
+        return text.substring(0, text.lastIndexOf(delimiter));
+    }
+    return text;
+}
+
+/**
+ * Strips incomplete markdown constructs from the tail of a streaming markdown
+ * string so that ExpensiMark doesn't render raw syntax for half-finished
+ * links, bold, strikethrough, or code blocks.
+ */
+function stripIncompleteMarkdown(markdown: string): string {
+    if (!markdown) {
+        return markdown;
+    }
+
+    let result = markdown;
+
+    // 1. Incomplete link/image: find the last '[' and check whether a
+    //    complete [text](url) follows it. If not, strip from '[' (or '![').
+    const lastOpenBracket = result.lastIndexOf('[');
+    if (lastOpenBracket !== -1) {
+        const tail = result.substring(lastOpenBracket);
+        if (!/^\[[^\]]*\]\([^)]*\)/.test(tail)) {
+            const stripFrom = lastOpenBracket > 0 && result[lastOpenBracket - 1] === '!' ? lastOpenBracket - 1 : lastOpenBracket;
+            result = result.substring(0, stripFrom);
+        }
+    }
+
+    // 2. Unclosed bold (**) on the last line.
+    result = stripUnpairedLastLineDelimiter(result, '**');
+
+    // 3. Unclosed strikethrough (~~) on the last line.
+    result = stripUnpairedLastLineDelimiter(result, '~~');
+
+    // 4. Unclosed code block (``` spans multiple lines).
+    const codeBlockCount = countOccurrences(result, '```');
+    if (codeBlockCount % 2 !== 0) {
+        result = result.substring(0, result.lastIndexOf('```'));
+    }
+
+    // 5. Unclosed inline code (`) on the last line (after code-block handling).
+    result = stripUnpairedLastLineDelimiter(result, '`');
+
+    return result;
+}
+
 function buildConciergeDraftReportAction({bodyMarkdown, created, finalRenderedHTML, reportActionID, reportID}: BuildConciergeDraftReportActionParams): ReportAction | null {
-    const html = finalRenderedHTML ?? (bodyMarkdown ? getParsedComment(bodyMarkdown, {reportID}) : '');
+    const html = finalRenderedHTML ?? (bodyMarkdown ? getParsedComment(stripIncompleteMarkdown(bodyMarkdown), {reportID}) : '');
 
     if (!html) {
         return null;
@@ -101,5 +175,5 @@ function applyConciergeDraftEvent(currentDraft: ConciergeDraft | null, event: Co
     };
 }
 
-export {applyConciergeDraftEvent, buildConciergeDraftReportAction, getCachedDraft, setCachedDraft};
+export {applyConciergeDraftEvent, buildConciergeDraftReportAction, getCachedDraft, setCachedDraft, stripIncompleteMarkdown};
 export type {ConciergeDraft};

tests/unit/pages/inbox/conciergeDraftState.test.ts

@@ -1,4 +1,4 @@
-import {applyConciergeDraftEvent, getCachedDraft, setCachedDraft} from '@pages/inbox/conciergeDraftState';
+import {applyConciergeDraftEvent, getCachedDraft, setCachedDraft, stripIncompleteMarkdown} from '@pages/inbox/conciergeDraftState';
 import CONST from '@src/CONST';
 
 const REPORT_ID = '123';
@@ -132,6 +132,87 @@ describe('conciergeDraftState', () => {
         expect(otherReportDraft).toBe(initialDraft);
     });
 
+    describe('stripIncompleteMarkdown', () => {
+        it('returns empty/falsy values unchanged', () => {
+            expect(stripIncompleteMarkdown('')).toBe('');
+        });
+
+        it('does not alter complete markdown', () => {
+            const complete = 'Hello **bold** and [link](https://example.com) and `code`';
+            expect(stripIncompleteMarkdown(complete)).toBe(complete);
+        });
+
+        // --- Links / Images ---
+        it('strips an incomplete link with only opening bracket', () => {
+            expect(stripIncompleteMarkdown('Check out [')).toBe('Check out ');
+        });
+
+        it('strips an incomplete link with text but no closing bracket', () => {
+            expect(stripIncompleteMarkdown('Check out [this page')).toBe('Check out ');
+        });
+
+        it('strips an incomplete link with bracket closed but no URL', () => {
+            expect(stripIncompleteMarkdown('Check out [link](')).toBe('Check out ');
+        });
+
+        it('strips an incomplete link with partial URL', () => {
+            expect(stripIncompleteMarkdown('Check out [link](https://example')).toBe('Check out ');
+        });
+
+        it('preserves a complete link followed by an incomplete one', () => {
+            expect(stripIncompleteMarkdown('[done](https://a.com) and [broken')).toBe('[done](https://a.com) and ');
+        });
+
+        it('strips an incomplete image syntax', () => {
+            expect(stripIncompleteMarkdown('Here is ![alt')).toBe('Here is ');
+        });
+
+        // --- Bold (**) ---
+        it('strips trailing unclosed bold', () => {
+            expect(stripIncompleteMarkdown('Hello **world')).toBe('Hello ');
+        });
+
+        it('strips bare trailing ** delimiter', () => {
+            expect(stripIncompleteMarkdown('Hello **')).toBe('Hello ');
+        });
+
+        it('preserves complete bold and strips only the unclosed one', () => {
+            expect(stripIncompleteMarkdown('**done** and **broken')).toBe('**done** and ');
+        });
+
+        // --- Strikethrough (~~) ---
+        it('strips trailing unclosed strikethrough', () => {
+            expect(stripIncompleteMarkdown('Hello ~~strike')).toBe('Hello ');
+        });
+
+        // --- Code blocks (```) ---
+        it('strips an unclosed code block', () => {
+            expect(stripIncompleteMarkdown('Here:\n```\ncode')).toBe('Here:\n');
+        });
+
+        it('preserves a complete code block', () => {
+            const complete = 'Before\n```\ncode\n```\nAfter';
+            expect(stripIncompleteMarkdown(complete)).toBe(complete);
+        });
+
+        // --- Inline code (`) ---
+        it('strips trailing unclosed inline code', () => {
+            expect(stripIncompleteMarkdown('Run `command')).toBe('Run ');
+        });
+
+        it('preserves complete inline code', () => {
+            const complete = 'Run `command` now';
+            expect(stripIncompleteMarkdown(complete)).toBe(complete);
+        });
+
+        // --- Streaming integration ---
+        it('strips incomplete markdown during a streaming draft event', () => {
+            const draft = applyConciergeDraftEvent(null, createDraftEvent({bodyMarkdown: 'Check [this link'}), REPORT_ID);
+            // The raw '[this link' syntax should NOT appear in the rendered HTML
+            expect(getFirstMessageHTML(draft)).not.toContain('[this link');
+        });
+    });
+
     describe('draftCache', () => {
         // Always start clean so tests don't leak state into each other.
         beforeEach(() => {