Preserve expanded details blocks in safe-output bodies by Copilot · Pull Request #75380 · github/gh-aw

Copilot · 2026-11-06T08:53:45Z

Since v1.0.1, safe-output publishing escaped <details open> as text because the report parser recognized only <details>.

Parsing and rendering: Accept the boolean open attribute in inline and two-line summary forms; preserve it through AST normalization and rendering.
Compatibility: Keep plain <details> collapsed and continue rejecting other attributes.
Coverage and release: Add round-trip and attribute-rejection regressions, plus a patch changeset.

This input now remains an expanded details block:

<details open>
<summary>Open</summary>

body

</details>

Fixes <details open> in safe-output bodies renders as escaped text since v1.0.1 #75115

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-11-06T14:01:09Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Design Decision Gate 🏗️

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Design Decision Gate 🏗️ · routed: opus55 xhigh · ~12 AIC · ⌖ ~2 AIC · ⊞ 7.7K · ◷

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-11-06T14:01:11Z

✅ PR Specification Reviewer completed successfully!

Generated by PR Specification Reviewer for #75380

github-actions · 2026-11-06T14:01:19Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-11-06T14:01:20Z

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · routed: gpt56 max · ~3 AIC · ⌖ ~1 AIC · ⊞ 118 · ◷

Generated by Ponytail Reviewer for #75380

github-actions · 2026-11-06T14:01:38Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-11-06T14:01:53Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · routed: gpt56 max · ~1 AIC · ⌖ ~1 AIC · ⊞ 6.3K · ◷

🧪 Test quality analysis by Test Quality Sentinel

github-actions

Reviewed PR head 2464e80870bb35f294202832300855b34f6dfe96 (open, non-draft). Applicable contract: docs/src/content/docs/specs/safe-outputs-specification.md v1.29.18, §6.4 S4.

No blocking conformance violation found. The implementation and tests consistently add support for the boolean <details open> form while retaining collapsed plain <details> and escaping unsupported attributes; existing dangerous-tag and event-handler sanitization obligations remain intact.

I published one inline synchronization proposal: clarify S4 with the exact accepted <details> forms, rejection/escaping rules, v1.29.19 changelog/version update, and matching conformance cases. No specification files are changed by this PR, so the proposal remains unapplied.

Coverage: static review only; tests and conformance scripts were not run, per review instructions. No other directly applicable normative contract was identified.

Generated by PR Specification Reviewer for #75380 · copilot · gpt50 · ~4 AIC · ⌖ ~1 AIC · ⊞ 1.6K
_{Comment /review-specs to run again}

github-actions · 2026-11-06T14:06:59Z

        nodes.push(fromSource({ type: "heading", level: Math.max(minimumHeadingLevel, match[1].length), children: inline(match[2]) }));
        index++;
-      } else if ((match = /^<details>\s*<summary>(.*)<\/summary>$/.exec(line.trim()))) {
+      } else if ((match = /^<details(\s+open)?>\s*<summary>(.*)<\/summary>$/.exec(line.trim()))) {


Specification synchronization proposal (intentional compatible clarification): update docs/src/content/docs/specs/safe-outputs-specification.md §6.4 S4 (currently v1.29.18) to state that <details> and <details open> are the only accepted forms, including inline and next-line summaries; plain <details> remains collapsed; <details open> retains and renders the boolean open; valued, duplicate, event-handler, and other unsupported attributes MUST be rejected or escaped. Proposed replacement for the safe-tag bullet:

- For `<details>` elements, preserve only the exact forms `<details>` and `<details open>`, including when the summary is inline or appears on the following line. - `<details>` MUST remain collapsed. - `<details open>` MUST retain the boolean `open` attribute and render as `<details open>`. - Other `<details>` attributes, including valued `open` attributes, duplicate `open` attributes, event handlers, and mixed unsupported attributes, MUST be rejected or escaped rather than preserved.

Also add a v1.29.19 (2026-11-06) changelog entry and S4 conformance cases matching these tests. This preserves existing sanitization obligations and documents the behavior implemented here.

Updated §6.4 S4 in 2655d49 to define the accepted <details> openings and attribute handling.

github-actions

Reviewed the changed parser, AST normalization, renderer, and regression coverage. No actionable correctness, security, performance, or maintainability issues found in the diff. The specialist pass produced only low-confidence concerns that are either normalized away or non-actionable; no inline comments were warranted. Static review only; tests were not run per review constraints.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~2 AIC · ⌖ ~1 AIC · ⊞ 1.6K
_{Comment /review to run again}

Copilot

🟢 Approval recommended

No active review issues are reported for the change preserving expanded details blocks through safe-output parsing and rendering.

No open issues 🎉

What changed in this PR

Fixes #75115 by preserving expanded <details open> blocks through gh-aw’s safe-output parsing and rendering pipeline.

Changes:

Recognizes open in inline and two-line details openings and preserves it through AST normalization and rendering.
Adds regression coverage for expanded blocks, unchanged collapsed behavior, and rejection of unsupported attributes.
Adds a patch changeset documenting the fix.

File	Description
actions/setup/js/report_markdown.cjs	Parses supported details openings and records the `open` flag.
actions/setup/js/report_html_fidelity.test.cjs	Tests round-trip fidelity, collapsed defaults, and attribute rejection.
actions/setup/js/report_ast.cjs	Defines, normalizes, and renders the optional `open` flag.
.changeset/fix-details-open-safe-output.md	Documents the fix for a patch release.

_{Review effort: Balanced (auto)}

github-actions

Skills-Based Review 🧠

Applied /tdd, /diagnosing-bugs, and /codebase-design. Approving: the fix is a targeted parser/renderer change with regression coverage for the expanded, collapsed, and rejected-attribute cases.

📋 Details

Verification

Traced open through parse (report_markdown.cjs), normalize and render (report_ast.cjs), redaction, sanitize, and sized render. It survives every step.
Ran the parse, AST-shape, render, and round-trip assertions directly with Node. All passed.
Could not run the vitest suite: npm ci failed on a registry TLS certificate error in this environment, so report_html_fidelity.test.cjs is unverified here. CI should cover it.

Notes

✅ Plain <details> stays collapsed, and unsupported attributes (class, onclick, open="true") remain escaped.
✅ Changeset added as a patch.
Optional: one inline nit on strict vs. truthy open checks.

@copilot please address the review comments above.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · routed: haiku55 xhigh · ~4 AIC · ⌖ ~1 AIC · ⊞ 5.4K
_{Comment /matt to run again}

github-actions · 2026-11-06T14:10:45Z

          return (node.type === "alert" ? `[!${node.kind}]\n` : "") + renderBlocks(node.children, node.type === "quote");
        case "details":
-          return `<details>\n<summary>${typeof node.summary === "string" ? escapeSummaryText(node.summary) : renderInlines(node.summary, true)}</summary>\n\n${renderBlocks(node.children)}\n\n</details>`;
+          return `<details${node.open ? " open" : ""}>\n<summary>${typeof node.summary === "string" ? escapeSummaryText(node.summary) : renderInlines(node.summary, true)}</summary>\n\n${renderBlocks(node.children)}\n\n</details>`;


[/codebase-design] Optional consistency nit: the normalizer gates open with a strict node.open === true (line 405), but this renderer uses a truthy check. They are equivalent after normalizeReport, but matching the strict check keeps both sides aligned if a caller ever renders un-normalized nodes.

@copilot please address this.

Changed the renderer to emit open only when node.open === true in 2655d49, matching the normalizer.

gh-aw-bot · 2026-11-06T14:46:31Z

@copilot

Copilot assignment requested for the following outstanding work:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (actions/setup/js/report_markdown.cjs:505): Specification synchronization proposal (intentional compatible clarification): update docs/src/content/docs/specs/safe-outputs-specification.md §6.4 S4 (currently v1.29.18) to state that <details> and <details open> are the only accepted forms, including inline and next-line summaries; plain <details> remains collapsed; <details open> retains and renders the boolean open; valued, duplicate, event-handler, and other unsupported attributes MUST be rejected or escaped. Proposed replacement for the safe-tag bullet: - Preserve expanded details blocks in safe-output bodies #75380 (comment)
Review (actions/setup/js/report_ast.cjs:671): [/codebase-design] Optional consistency nit: the normalizer gates open with a strict node.open === true (line 405), but this renderer uses a truthy check. They are equivalent after normalizeReport, but matching the strict check keeps both sides aligned if a caller ever renders un-normalized nodes. - Preserve expanded details blocks in safe-output bodies #75380 (comment)

Once you start work, post this work summary as a PR comment without the leading Copilot mention, including the Sous-chef head, work, and state lines below, to record that the assignment is running. Apply the necessary fixes on this PR's existing branch, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved; stop when only human review or CI remains. Do not merge or trigger CI.

Sous-chef requested-head: 2464e80
Sous-chef requested-work: 1e594643bc58159cb25ab3d1e9bf0e461d5fb6a8a57725a602550d084b5a75a1 6f484eef834865f45f1b73fe90fddb423725b4bc78b3ee2dd6dbca42c7a0efd7
Sous-chef requested-state: 9e460ee9898c42b2687c69193f3abfa3e14a46941ec8bcc25d6315376556de12

Generated by 👨🍳 PR Sous Chef · pi · haiku45 · ~8 AIC · ⌖ ~15 AIC · ⊞ 1.2K · ◷
_{Comment /souschef to run again}

Copilot · 2026-11-06T14:51:21Z

@copilot

Copilot assignment requested for the following outstanding work:...

Sous-chef requested-head: 2464e80
Sous-chef requested-work: 1e594643bc58159cb25ab3d1e9bf0e461d5fb6a8a57725a602550d084b5a75a1 6f484eef834865f45f1b73fe90fddb423725b4bc78b3ee2dd6dbca42c7a0efd7
Sous-chef requested-state: 9e460ee9898c42b2687c69193f3abfa3e14a46941ec8bcc25d6315376556de12

…pen-escaping Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Initial plan

f04b1af

Copilot AI assigned Copilot and pelikhan Nov 6, 2026

Copilot started work on behalf of pelikhan November 6, 2026 08:54

View session

Copilot AI linked an issue Nov 6, 2026 that may be closed by this pull request

<details open> in safe-output bodies renders as escaped text since v1.0.1 #75115

Open

Fix expanded details blocks in safe-output reports

2464e80

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix escaping of <details open> in safe-output bodies~~ Preserve expanded details blocks in safe-output bodies Nov 6, 2026

Copilot finished work on behalf of pelikhan November 6, 2026 09:17

Copilot AI requested a review from pelikhan November 6, 2026 09:17

github-actions Bot mentioned this pull request Nov 6, 2026

[PR Triage Report] PR triage report - 2026-11-06 #75416

Open

pelikhan marked this pull request as ready for review November 6, 2026 13:59

Copilot AI auto review requested due to automatic review settings November 6, 2026 14:00

Copilot started reviewing on behalf of pelikhan November 6, 2026 14:06

View session

github-actions Bot reviewed Nov 6, 2026

View reviewed changes

Copilot AI reviewed Nov 6, 2026

View reviewed changes

github-actions Bot approved these changes Nov 6, 2026

View reviewed changes

github-actions Bot mentioned this pull request Nov 6, 2026

[pr-sous-chef] PR Sous Chef: Processing complete #75304

Open

Copilot started work on behalf of gh-aw-bot November 6, 2026 14:47

View session

Copilot AI and others added 2 commits November 6, 2026 14:52

Merge remote-tracking branch 'origin/main' into copilot/fix-details-o…

2655d49

…pen-escaping Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Clarify details open safe-output semantics

56c1621

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot November 6, 2026 15:02

Copilot AI requested a review from gh-aw-bot November 6, 2026 15:02

Conversation

Copilot AI commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Design Decision Gate 🏗️

Uh oh!

github-actions Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ponytail Reviewer

Uh oh!

github-actions Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Quality Sentinel

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Verification

Notes

Uh oh!

github-actions Bot Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Nov 6, 2026

Uh oh!

Copilot AI commented Nov 6, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Nov 6, 2026 •

edited

Loading

github-actions Bot commented Nov 6, 2026 •

edited

Loading

github-actions Bot commented Nov 6, 2026 •

edited

Loading

github-actions Bot commented Nov 6, 2026 •

edited

Loading

github-actions Bot commented Nov 6, 2026 •

edited

Loading

github-actions Bot commented Nov 6, 2026 •

edited

Loading

github-actions Bot commented Nov 6, 2026 •

edited

Loading