Review — end-to-end ✅ (clean approve)

What this ships

v0.50.228 — absorbing @bsgdigital's PR #1150. Fixes renderMd() corrupting raw <pre> blocks during the inline-<code>-to-backtick rewrite.

Six lines in static/ui.js:813-824:

const rawPreStash=[];
s=s.replace(/(<pre\b[^>]*>[\s\S]*?<\/pre>)/gi,m=>{rawPreStash.push(m);return `\x00R${rawPreStash.length-1}\x00`;});
// ... existing strong/b/em/i/code/br rewrites run here ...
s=s.replace(/\x00R(\d+)\x00/g,(_,i)=>rawPreStash[+i]);

Traced against upstream hermes-agent

Pulled fresh nousresearch/hermes-agent tarball. renderMd is purely WebUI-frontend — agent emits text/markdown, not raw <pre> HTML, so this change has zero cross-tool coupling. No agent-side files touched.

End-to-end trace

Token namespace check — no collision

Existing escape tokens in renderMd: \x00F (fence), \x00M (math), \x00Q (blockquote), \x00D (media), \x00C (code), \x00G (img), \x00L (link), \x00O (code outer), \x00A (anchor), \x00B (block-element-line). The new \x00R is the only unused letter near the top — no collision.

Stash/restore ordering

Lines 798-826 of static/ui.js:

Pre blocks are protected through the per-line passes by a separate _al_stash at ui.js:951 which also matches <pre>...</pre> — so restored pre content is re-stashed before per-line list/heading/blockquote work runs. ✅

Behavioural harness — 7/7 pass on PR, 5/7 on master

PASS [Multiline pre>code preserved]
PASS [Two pre blocks separated by paragraph]  
PASS [Pre with class attr]
PASS [Pre containing strong should NOT collapse to **]
PASS [Plain markdown still rewrites]
PASS [<code> outside <pre> still rewrites]
PASS [Empty <pre></pre> preserved]

On master, two failures confirm the bug:

1. <pre><code>line 1\nline 2\nline 3</code></pre> → <pre> `line 1\nline 2\nline 3` </pre> (exactly the corruption the PR description shows)
2. <pre><code>not <strong>bold</strong></code></pre> → <pre><code>not **bold**</code></pre> (bonus: <strong> inside pre also got collapsed pre-fix)

XSS audit — no new surface

The stash just stores the raw <pre>...</pre> substring and restores it verbatim. Whatever was renderable before is renderable now; the fix is purely about preventing rewrites from running inside the block, not about new sink behaviour. The pre block downstream goes through _al_stash again (line 951) which is content-shape-preserving. ✅ No CSP impact — no inline script generation, no new attribute write paths.

Edge-case trace

Tests

• PR's added test (TestRawPreCodePreservation::test_multiline_pre_code_blocks_do_not_degrade_to_backticks): passes. Validates two <pre><code> blocks remain balanced and content isn't backtick-corrupted.
• All 25 renderer behaviour tests: pass.
• Local full suite: 2587 passed, 47 skipped, 1 PR-unrelated pre-existing failure (test_sprint3.py::test_workspace_add_rejects_system_paths — macOS-only, fails on master too).
• CI on PR: ✅ test (3.11), ✅ test (3.12), ✅ test (3.13).
• Behavioural harness: 7/7 pass on PR, 5/7 on master (confirms bug + fix).

Other audit — confirmed correct

• JS syntax: node --check passes.
• Regex non-greediness: [\s\S]*? correctly stops at first </pre>. Combined with gi flags handles multiple blocks and case variants.
• Token format: \x00R<n>\x00 — same shape as existing tokens; the restore regex /\x00R(\d+)\x00/g correctly captures the index.

Minor observations (non-blocking)

• The fix doesn't address <pre> blocks that use <pre> without explicit </pre> (e.g., truncated streaming output mid-render). Acceptable — broken input to a markdown-aware renderer can yield broken output, and the streaming smd path takes a different code path entirely.
• A future cleanup could batch all the HTML-tag stashes (R, A, B, etc.) into a single shared mechanism, but the current named tokens are easy to debug and the bug surface is small.

Recommendation

Approved. Tight 6-line fix that targets a real and reproducible regression. Behavioural harness confirms the bug exists on master (master 5/7, PR 7/7). Token namespace doesn't collide with existing escape tokens, stash/restore ordering is correct relative to the rewrites that needed gating. No new XSS surface, no cross-tool agent concern, CI green on 3.11/3.12/3.13. Parked at approval — ready for the release agent's merge/tag pipeline.