Merge branch 'main' into brendan/bitbucket-cloud-permission-syncing

Author: brendan-kellam

CHANGELOG.md

@@ -12,6 +12,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added Bitbucket Cloud OAuth identity provider support (`provider: "bitbucket-cloud"`) for SSO and account-linked permission syncing. [#924](https://github.com/sourcebot-dev/sourcebot/pull/924)
 - Added permission syncing support for Bitbucket Cloud. [#925](https://github.com/sourcebot-dev/sourcebot/pull/925)
 
+### Changed
+- Hide version upgrade toast for askgithub deployment (`EXPERIMENT_ASK_GH_ENABLED`). [#931](https://github.com/sourcebot-dev/sourcebot/pull/931)
+
+### Fixed
+- Fixed text inside angle brackets (e.g., `<id>`) being hidden in chat prompt display due to HTML parsing. [#929](https://github.com/sourcebot-dev/sourcebot/pull/929) [#932](https://github.com/sourcebot-dev/sourcebot/pull/932)
+
 ## [4.11.7] - 2026-02-23
 
 ### Changed

packages/web/src/app/[domain]/askgh/[owner]/[repo]/components/loginModal.tsx

@@ -37,7 +37,7 @@ export const LoginModal = ({
                         providers={providers}
                         callbackUrl={callbackUrl}
                         context="login"
-                        securityNoticeClosable={true}
+                        hideSecurityNotice={true}
                     />
                 </div>
             </DialogContent>

packages/web/src/app/[domain]/layout.tsx

@@ -201,7 +201,7 @@ export default async function Layout(props: LayoutProps) {
             {children}
             <SyntaxReferenceGuide />
             <GitHubStarToast />
-            <UpgradeToast />
+            {env.EXPERIMENT_ASK_GH_ENABLED !== 'true' && <UpgradeToast />}
         </SyntaxGuideProvider>
     )
 }

packages/web/src/app/components/authMethodSelector.tsx

@@ -17,14 +17,16 @@ interface AuthMethodSelectorProps {
     context: "login" | "signup";
     onProviderClick?: (providerId: string) => void;
     securityNoticeClosable?: boolean;
+    hideSecurityNotice?: boolean;
 }
 
 export const AuthMethodSelector = ({
     providers,
     callbackUrl,
     context,
     onProviderClick,
-    securityNoticeClosable = false
+    securityNoticeClosable = false,
+    hideSecurityNotice = false
 }: AuthMethodSelectorProps) => {
     const onSignInWithOauth = useCallback((provider: string) => {
         // Call the optional analytics callback first
@@ -56,7 +58,7 @@ export const AuthMethodSelector = ({
 
     return (
         <>
-            <AuthSecurityNotice closable={securityNoticeClosable} />
+            {!hideSecurityNotice && <AuthSecurityNotice closable={securityNoticeClosable} />}
             <DividerSet
                 elements={[
                     ...(oauthProviders.length > 0 ? [

packages/web/src/features/chat/components/chatThread/chatThreadListItem.tsx

@@ -334,6 +334,7 @@ const ChatThreadListItemComponent = forwardRef<HTMLDivElement, ChatThreadListIte
                             <MarkdownRenderer
                                 content={userQuestion.trim()}
                                 className="prose-p:m-0"
+                                escapeHtml={true}
                             />
                         </div>
 

packages/web/src/features/chat/components/chatThread/markdownRenderer.tsx

@@ -80,6 +80,27 @@ function remarkReferencesPlugin() {
     }
 }
 
+/**
+ * A remark plugin that converts `html` MDAST nodes into `text` nodes,
+ * preserving angle-bracketed content like `<id>` as visible text. Without this,
+ * `<id>` is parsed as an HTML tag and then stripped by sanitization.
+ *
+ * This plugin must run BEFORE remarkReferencesPlugin so that the file-reference
+ * HTML nodes created by that plugin are left intact for rehypeRaw to process.
+ */
+function remarkPreserveHtml() {
+    return function (tree: Nodes) {
+        visit(tree, 'html', (node, index, parent) => {
+            if (index !== undefined && parent && 'children' in parent) {
+                (parent.children as Nodes[])[index] = {
+                    type: 'text',
+                    value: (node as { value: string }).value,
+                };
+            }
+        });
+    };
+}
+
 const remarkTocExtractor = () => {
     return function (tree: Nodes) {
         visit(tree, 'heading', (node: Heading) => {
@@ -101,18 +122,24 @@ const remarkTocExtractor = () => {
 interface MarkdownRendererProps {
     content: string;
     className?: string;
+    /**
+     * When true, angle-bracketed text like `<id>` is preserved as visible text
+     * instead of being parsed as HTML. File references (@file:{...}) are unaffected.
+     */
+    escapeHtml?: boolean;
 }
 
-const MarkdownRendererComponent = forwardRef<HTMLDivElement, MarkdownRendererProps>(({ content, className }, ref) => {
+const MarkdownRendererComponent = forwardRef<HTMLDivElement, MarkdownRendererProps>(({ content, className, escapeHtml = false }, ref) => {
     const router = useRouter();
 
     const remarkPlugins = useMemo((): PluggableList => {
         return [
             remarkGfm,
+            ...(escapeHtml ? [remarkPreserveHtml] : []),
             remarkReferencesPlugin,
             remarkTocExtractor,
         ];
-    }, []);
+    }, [escapeHtml]);
 
     const rehypePlugins = useMemo((): PluggableList => {
         return [