fix(telegram): stop auto-linking destinations in /policy show

Telegram was rendering every destination string in /policy show output
as a clickable blue link (example.com, api.github.com, etc.) because
the message was sent in plain text mode and Telegram auto-detects URL
patterns.

Wrap the output in <pre>...</pre> and send with ParseMode=HTML +
DisableWebPagePreview. Inside a preformatted block Telegram leaves URL
patterns alone, and the monospace rendering also aligns the columns
better.

- commands.go: htmlPreOpen/htmlPreClose constants, htmlEscapeText
  helper, wrap both policyShow (engine fallback) and
  policyShowFromStore in <pre>. Escape destination, tool, pattern,
  replacement, name, source, default verdict, and protocols.
- approval.go: sendReply path sniffs the <pre> prefix and switches to
  HTML parse mode with web-page preview disabled. Other replies are
  still plain text.
- Tests: TestPolicyShowEscapesHTML and a wrapping check in
  TestPolicyShowIncludesAllFields.

Author: nnemirovsky

internal/telegram/approval.go

@@ -434,6 +434,15 @@ func (tc *TelegramChannel) handleMessage(msg *tgbotapi.Message) {
 	}
 
 	reply := tgbotapi.NewMessage(tc.chatID, response)
+	// Responses that contain <code> or <b> are pre-rendered HTML (see
+	// policyShow / policyShowFromStore). Send them with HTML parse mode so
+	// the tags render and Telegram does not auto-link URLs inside <code>.
+	// Plain-text responses never contain these tags because dynamic input
+	// gets HTML-escaped before insertion.
+	if strings.Contains(response, "<code>") || strings.Contains(response, "<b>") {
+		reply.ParseMode = tgbotapi.ModeHTML
+		reply.DisableWebPagePreview = true
+	}
 	if _, err := tc.api.Send(reply); err != nil {
 		log.Printf("telegram send error: %s", sanitizeError(err))
 	}

internal/telegram/commands.go

@@ -216,9 +216,7 @@ func (h *CommandHandler) policyShow() string {
 	// Fallback to engine snapshot when store is not configured.
 	snap := h.engine.Load().Snapshot()
 	var b strings.Builder
-	b.WriteString("Current policy (default: ")
-	b.WriteString(snap.Default.String())
-	b.WriteString(")\n\n")
+	fmt.Fprintf(&b, "Current policy (default: %s)\n\n", htmlCode(snap.Default.String()))
 
 	for _, section := range []struct {
 		label string
@@ -235,14 +233,14 @@ func (h *CommandHandler) policyShow() string {
 		b.WriteString(":\n")
 		for _, r := range section.rules {
 			b.WriteString("  ")
-			b.WriteString(r.Destination)
+			b.WriteString(htmlCode(r.Destination))
 			if len(r.Ports) > 0 {
 				b.WriteString(" ports=")
 				b.WriteString(formatPorts(r.Ports))
 			}
 			if len(r.Protocols) > 0 {
 				b.WriteString(" protocols=")
-				b.WriteString(strings.Join(r.Protocols, ","))
+				b.WriteString(htmlCode(strings.Join(r.Protocols, ",")))
 			}
 			b.WriteString("\n")
 		}
@@ -255,6 +253,23 @@ func (h *CommandHandler) policyShow() string {
 	return b.String()
 }
 
+// htmlEscapeText escapes the three characters that Telegram's HTML parse mode
+// requires in text nodes: &, <, >. Quotes and apostrophes are left alone
+// since we don't use them in tag attributes.
+func htmlEscapeText(s string) string {
+	s = strings.ReplaceAll(s, "&", "&amp;")
+	s = strings.ReplaceAll(s, "<", "&lt;")
+	s = strings.ReplaceAll(s, ">", "&gt;")
+	return s
+}
+
+// htmlCode wraps s in <code>...</code> after HTML-escaping it. Inside <code>
+// Telegram will not auto-detect URLs, so destinations like api.github.com
+// render as monospace text rather than clickable blue links.
+func htmlCode(s string) string {
+	return "<code>" + htmlEscapeText(s) + "</code>"
+}
+
 func (h *CommandHandler) policyShowFromStore() string {
 	cfg, err := h.store.GetConfig()
 	if err != nil {
@@ -271,9 +286,7 @@ func (h *CommandHandler) policyShowFromStore() string {
 	}
 
 	var b strings.Builder
-	b.WriteString("Current policy (default: ")
-	b.WriteString(dv)
-	b.WriteString(")\n\n")
+	fmt.Fprintf(&b, "Current policy (default: %s)\n\n", htmlCode(dv))
 
 	for _, section := range []struct {
 		label   string
@@ -293,32 +306,33 @@ func (h *CommandHandler) policyShowFromStore() string {
 		if len(sectionRules) == 0 {
 			continue
 		}
+		b.WriteString("<b>")
 		b.WriteString(section.label)
-		b.WriteString(":\n")
+		b.WriteString("</b>:\n")
 		for _, r := range sectionRules {
 			target := r.Destination
 			if r.Tool != "" {
 				target = "tool:" + r.Tool
 			} else if r.Pattern != "" {
 				target = "pattern:" + r.Pattern
 			}
-			fmt.Fprintf(&b, "  [%d] %s", r.ID, target)
+			fmt.Fprintf(&b, "  [%d] %s", r.ID, htmlCode(target))
 			if len(r.Ports) > 0 {
 				b.WriteString(" ports=")
 				b.WriteString(formatPorts(r.Ports))
 			}
 			if len(r.Protocols) > 0 {
 				b.WriteString(" protocols=")
-				b.WriteString(strings.Join(r.Protocols, ","))
+				b.WriteString(htmlCode(strings.Join(r.Protocols, ",")))
 			}
 			if r.Replacement != "" {
-				fmt.Fprintf(&b, " -> %q", r.Replacement)
+				fmt.Fprintf(&b, " -> %s", htmlCode(r.Replacement))
 			}
 			if r.Name != "" {
-				fmt.Fprintf(&b, " (%s)", r.Name)
+				fmt.Fprintf(&b, " (%s)", htmlEscapeText(r.Name))
 			}
 			if r.Source != "" {
-				fmt.Fprintf(&b, " [%s]", r.Source)
+				fmt.Fprintf(&b, " [%s]", htmlEscapeText(r.Source))
 			}
 			b.WriteString("\n")
 		}

internal/telegram/commands_test.go

@@ -469,20 +469,57 @@ func TestPolicyShowIncludesAllFields(t *testing.T) {
 	out := handler.Handle(&Command{Name: "policy", Args: []string{"show"}})
 
 	mustContain := []string{
-		"example.com",
+		"<code>example.com</code>",
 		"ports=443",
-		"protocols=quic",
+		"protocols=<code>quic</code>",
 		"(test rule)",
 		"[manual]",
-		"pattern:sk-[A-Za-z0-9]+",
-		`-> "sk-REDACTED"`,
+		"<code>pattern:sk-[A-Za-z0-9]+</code>",
+		"-> <code>sk-REDACTED</code>",
 		"[seed]",
 	}
 	for _, want := range mustContain {
 		if !strings.Contains(out, want) {
 			t.Errorf("policy show output missing %q\nfull output:\n%s", want, out)
 		}
 	}
+
+	// Section headers are bolded so the sender picks HTML parse mode,
+	// which also disables Telegram's URL auto-linking inside <code>.
+	if !strings.Contains(out, "<b>ALLOW</b>") {
+		t.Errorf("policy show output must bold section headers: %q", out)
+	}
+}
+
+func TestPolicyShowEscapesHTML(t *testing.T) {
+	s := newTestStore(t)
+	if _, err := s.AddRule("deny", store.RuleOpts{
+		Pattern: "<script>",
+		Source:  "manual",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.AddRule("redact", store.RuleOpts{
+		Pattern:     "a&b",
+		Replacement: "<x>",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := newTestHandlerWithStore(t, s, nil, "")
+	out := handler.Handle(&Command{Name: "policy", Args: []string{"show"}})
+
+	// Raw "<script>" must not survive the <code> wrapper. It should be
+	// rendered as "<code>pattern:&lt;script&gt;</code>".
+	if strings.Contains(out, "pattern:<script>") {
+		t.Errorf("raw <script> must be HTML-escaped: %s", out)
+	}
+	if !strings.Contains(out, "&lt;script&gt;") {
+		t.Errorf("expected &lt;script&gt; in output: %s", out)
+	}
+	if !strings.Contains(out, "a&amp;b") {
+		t.Errorf("expected a&amp;b in output: %s", out)
+	}
 }
 
 func TestPolicyRemoveThenRecompile(t *testing.T) {