From 02c798438956dec64d70310bbe445b908ab353f2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 08:25:00 +0000
Subject: [PATCH 01/41] Initial plan


From 023b3f001b13f0a7c13a12d1e883657c524aa828 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 08:32:33 +0000
Subject: [PATCH 02/41] fix: make create-work-item body field configurable

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 docs/front-matter.md                 |   1 +
 docs/safe-outputs.md                 |   7 +-
 src/mcp.rs                           |  25 +++++-
 src/safe_outputs/create_work_item.rs | 127 ++++++++++++++++++++++++++-
 src/sanitize.rs                      |  24 +++++
 5 files changed, 177 insertions(+), 7 deletions(-)

diff --git a/docs/front-matter.md b/docs/front-matter.md
index bddcfd9f..d2a2c69f 100644
--- a/docs/front-matter.md
+++ b/docs/front-matter.md
@@ -105,6 +105,7 @@ safe-outputs:                  # optional per-tool configuration for safe output
   staged: false               # cooperative preview default; per-tool override supported
   create-work-item:
     work-item-type: Task
+    description-field: System.Description
     tags:
       - automated
       - agent-created
diff --git a/docs/safe-outputs.md b/docs/safe-outputs.md
index dbba8c4a..79d6b137 100644
--- a/docs/safe-outputs.md
+++ b/docs/safe-outputs.md
@@ -821,11 +821,13 @@ safe-outputs:
 **Note:** The `target` field is required. If omitted, compilation fails with an error. This ensures operators are intentional about which work items agents can comment on.
 
 ### create-work-item
-Creates an Azure DevOps work item.
+Creates an Azure DevOps work item. The agent-provided description is written as
+Markdown, and the executor sets `multilineFieldsFormat` to `Markdown` for the
+field that receives the body.
 
 **Agent parameters:**
 - `title` - A concise title for the work item (required, must be more than 5 characters)
-- `description` - Work item description in markdown format (required, must be more than 30 characters)
+- `description` - Work item description in Markdown format (required, must be more than 30 characters). Inline HTML is preserved for Azure DevOps to render/sanitize.
 - `tags` - Tags to apply to the work item (optional list; each tag must not contain a semicolon). May be subject to the `allowed-tags` allowlist. Merged with any static `tags` configured in front matter.
 
 On success, the MCP tool returns a generated gh-aw-compatible `#aw_...`
@@ -834,6 +836,7 @@ choose this ID; they use the returned value in later safe-output calls.
 
 **Configuration options (front matter):**
 - `work-item-type` - Work item type (default: "Task")
+- `description-field` - Field reference name that receives the agent-provided description. Defaults to `Microsoft.VSTS.TCM.ReproSteps` for `Bug` work items and `System.Description` for all other work item types.
 - `area-path` - Area path for the work item
 - `iteration-path` - Iteration path for the work item
 - `assignee` - Static user to assign (email, UPN, or display name). When omitted, the work item is created unassigned.
diff --git a/src/mcp.rs b/src/mcp.rs
index 83a8d566..682ff1cd 100644
--- a/src/mcp.rs
+++ b/src/mcp.rs
@@ -35,7 +35,7 @@ use crate::safe_outputs::{
     UploadBuildAttachmentResult, UploadPipelineArtifactParams, UploadPipelineArtifactResult,
     UploadWorkitemAttachmentParams, UploadWorkitemAttachmentResult, Validate, anyhow_to_mcp_error,
 };
-use crate::sanitize::{SanitizeContent, sanitize as sanitize_text};
+use crate::sanitize::{SanitizeContent, sanitize as sanitize_text, sanitize_markdown};
 use crate::secure::WorkItemTemporaryId;
 
 /// Sanitize a title into a safe branch name slug.
@@ -813,7 +813,7 @@ can be passed as work_item_id to later safe outputs such as assign-work-item."
         // Sanitize untrusted agent-provided text fields (IS-01)
         let mut sanitized = params.0;
         sanitized.title = sanitize_text(&sanitized.title);
-        sanitized.description = sanitize_text(&sanitized.description);
+        sanitized.description = sanitize_markdown(&sanitized.description);
         let temporary_id = self.write_create_work_item_proposal(sanitized).await?;
         let canonical = temporary_id.canonical();
         info!("Work item queued for creation as {}", canonical);
@@ -2041,6 +2041,27 @@ mod tests {
         assert_eq!(proposals[0]["temporary_id"], temporary_id);
     }
 
+    #[tokio::test]
+    async fn create_work_item_preserves_html_description_in_proposal() {
+        let (safe_outputs, _temp_dir) = create_test_safe_outputs().await;
+        let params = CreateWorkItemParams {
+            title: "Create work item with body".to_string(),
+            description: "<h2>Hi</h2><p>x &lt;string&gt; y</p>".to_string(),
+            tags: Vec::new(),
+        };
+
+        safe_outputs
+            .create_work_item(Parameters(params))
+            .await
+            .unwrap();
+
+        let proposals = safe_outputs.read_safe_output_file().await.unwrap();
+        assert_eq!(
+            proposals[0]["description"],
+            "<h2>Hi</h2><p>x &lt;string&gt; y</p>"
+        );
+    }
+
     #[tokio::test]
     async fn concurrent_create_work_item_calls_generate_distinct_ids() {
         let (safe_outputs, _temp_dir) = create_test_safe_outputs().await;
diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index 6f3b8dd2..7266d37d 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -9,6 +9,7 @@ use super::PATH_SEGMENT;
 use crate::safe_outputs::{
     ExecutionContext, ExecutionResult, Executor, ToolResult, Validate, anyhow_to_mcp_error,
 };
+use crate::sanitize::sanitize_markdown;
 use crate::sanitize::{SanitizeContent, sanitize as sanitize_text, sanitize_config};
 use crate::secure::WorkItemTemporaryId;
 use ado_aw_derive::SanitizeConfig;
@@ -91,7 +92,7 @@ impl TryFrom<(CreateWorkItemParams, WorkItemTemporaryId)> for CreateWorkItemResu
 impl SanitizeContent for CreateWorkItemResult {
     fn sanitize_content_fields(&mut self) {
         self.title = sanitize_text(&self.title);
-        self.description = sanitize_text(&self.description);
+        self.description = sanitize_markdown(&self.description);
         for tag in &mut self.tags {
             *tag = sanitize_config(tag);
         }
@@ -125,6 +126,12 @@ pub struct CreateWorkItemConfig {
     #[serde(default = "default_work_item_type", rename = "work-item-type")]
     pub work_item_type: String,
 
+    /// Field reference name that receives the agent-provided description.
+    /// Defaults to System.Description, except Bug work items default to
+    /// Microsoft.VSTS.TCM.ReproSteps.
+    #[serde(default, rename = "description-field")]
+    pub description_field: Option<String>,
+
     /// Area path for the work item
     #[serde(default, rename = "area-path")]
     pub area_path: Option<String>,
@@ -202,6 +209,7 @@ impl Default for CreateWorkItemConfig {
     fn default() -> Self {
         Self {
             work_item_type: default_work_item_type(),
+            description_field: None,
             area_path: None,
             iteration_path: None,
             assignee: None,
@@ -218,6 +226,25 @@ fn default_work_item_type() -> String {
     "Task".to_string()
 }
 
+const SYSTEM_DESCRIPTION_FIELD: &str = "System.Description";
+const BUG_REPRO_STEPS_FIELD: &str = "Microsoft.VSTS.TCM.ReproSteps";
+
+fn default_description_field_for(work_item_type: &str) -> &'static str {
+    if work_item_type.eq_ignore_ascii_case("Bug") {
+        BUG_REPRO_STEPS_FIELD
+    } else {
+        SYSTEM_DESCRIPTION_FIELD
+    }
+}
+
+fn description_field_for(config: &CreateWorkItemConfig) -> &str {
+    config
+        .description_field
+        .as_deref()
+        .filter(|field| !field.trim().is_empty())
+        .unwrap_or_else(|| default_description_field_for(&config.work_item_type))
+}
+
 /// Build a field patch operation for work item creation
 fn field_op(field: &str, value: impl Into<String>) -> serde_json::Value {
     serde_json::json!({
@@ -431,13 +458,14 @@ impl Executor for CreateWorkItemResult {
         // Build the patch document for work item creation
         let description_with_stats =
             crate::agent_stats::append_stats_to_body(&self.description, ctx, config.include_stats);
+        let description_field = description_field_for(&config);
         let mut patch_doc = vec![
             field_op("System.Title", &self.title),
-            field_op("System.Description", &description_with_stats),
+            field_op(description_field, &description_with_stats),
             // Tell Azure DevOps the description is markdown
             serde_json::json!({
                 "op": "add",
-                "path": "/multilineFieldsFormat/System.Description",
+                "path": format!("/multilineFieldsFormat/{description_field}"),
                 "value": "Markdown"
             }),
         ];
@@ -734,6 +762,7 @@ mod tests {
     fn test_config_defaults() {
         let config = CreateWorkItemConfig::default();
         assert_eq!(config.work_item_type, "Task");
+        assert_eq!(description_field_for(&config), "System.Description");
         assert!(config.area_path.is_none());
         assert!(config.iteration_path.is_none());
         assert!(config.assignee.is_none());
@@ -746,6 +775,7 @@ mod tests {
     fn test_config_deserializes_from_yaml() {
         let yaml = r#"
 work-item-type: Bug
+description-field: Custom.Body
 area-path: "MyProject\\MyTeam"
 assignee: "user@example.com"
 tags:
@@ -759,6 +789,8 @@ custom-fields:
 "#;
         let config: CreateWorkItemConfig = serde_yaml::from_str(yaml).unwrap();
         assert_eq!(config.work_item_type, "Bug");
+        assert_eq!(config.description_field, Some("Custom.Body".to_string()));
+        assert_eq!(description_field_for(&config), "Custom.Body");
         assert_eq!(config.area_path, Some("MyProject\\MyTeam".to_string()));
         assert_eq!(config.assignee, Some("user@example.com".to_string()));
         assert_eq!(config.tags, vec!["agent-created", "automated"]);
@@ -777,8 +809,97 @@ tags:
 "#;
         let config: CreateWorkItemConfig = serde_yaml::from_str(yaml).unwrap();
         assert_eq!(config.work_item_type, "Task"); // default
+        assert_eq!(description_field_for(&config), "System.Description");
         assert!(config.area_path.is_none()); // default
         assert_eq!(config.tags, vec!["my-tag"]);
         assert!(config.allowed_tags.is_empty()); // default
     }
+
+    #[test]
+    fn test_bug_defaults_description_field_to_repro_steps() {
+        let config: CreateWorkItemConfig = serde_yaml::from_str("work-item-type: Bug\n").unwrap();
+        assert_eq!(
+            description_field_for(&config),
+            "Microsoft.VSTS.TCM.ReproSteps"
+        );
+    }
+
+    #[test]
+    fn test_result_sanitization_preserves_description_html() {
+        let mut result = CreateWorkItemResult {
+            name: CreateWorkItemResult::NAME.to_string(),
+            title: "Test work item".to_string(),
+            description: "<h2>Hi</h2><p>x &lt;string&gt; y</p>".to_string(),
+            tags: Vec::new(),
+            temporary_id: WorkItemTemporaryId::parse("#aw_test1").unwrap(),
+        };
+
+        result.sanitize_content_fields();
+
+        assert_eq!(result.description, "<h2>Hi</h2><p>x &lt;string&gt; y</p>");
+    }
+
+    #[tokio::test]
+    async fn test_execute_bug_uses_repro_steps_and_preserves_html() {
+        use std::collections::HashMap;
+        use wiremock::matchers::{body_json, method, path};
+        use wiremock::{Mock, MockServer, ResponseTemplate};
+
+        let server = MockServer::start().await;
+        let expected_patch = serde_json::json!([
+            {
+                "op": "add",
+                "path": "/fields/System.Title",
+                "value": "Bug with visible body"
+            },
+            {
+                "op": "add",
+                "path": "/fields/Microsoft.VSTS.TCM.ReproSteps",
+                "value": "<h2>Hi</h2><p>x &lt;string&gt; y</p>"
+            },
+            {
+                "op": "add",
+                "path": "/multilineFieldsFormat/Microsoft.VSTS.TCM.ReproSteps",
+                "value": "Markdown"
+            }
+        ]);
+        Mock::given(method("POST"))
+            .and(path("/Project/_apis/wit/workitems/$Bug"))
+            .and(body_json(expected_patch))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "id": 42,
+                "_links": {
+                    "html": {
+                        "href": "https://example.test/workitems/42"
+                    }
+                }
+            })))
+            .mount(&server)
+            .await;
+
+        let ctx = ExecutionContext {
+            ado_org_url: Some(server.uri()),
+            ado_project: Some("Project".to_string()),
+            access_token: Some("token".to_string()),
+            tool_configs: HashMap::from([(
+                "create-work-item".to_string(),
+                serde_json::json!({
+                    "work-item-type": "Bug",
+                    "include-stats": false
+                }),
+            )]),
+            ..Default::default()
+        };
+        let mut result = CreateWorkItemResult {
+            name: CreateWorkItemResult::NAME.to_string(),
+            title: "Bug with visible body".to_string(),
+            description: "<h2>Hi</h2><p>x &lt;string&gt; y</p>".to_string(),
+            tags: Vec::new(),
+            temporary_id: WorkItemTemporaryId::parse("#aw_test1").unwrap(),
+        };
+
+        let execution = result.execute_sanitized(&ctx).await.unwrap();
+
+        assert!(execution.success, "{}", execution.message);
+    }
 }
diff --git a/src/sanitize.rs b/src/sanitize.rs
index 47380717..b4d01ac4 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -72,6 +72,24 @@ pub fn sanitize(input: &str) -> String {
     s
 }
 
+/// Sanitize untrusted Markdown content while preserving inline HTML for renderers
+/// that accept it natively.
+pub(crate) fn sanitize_markdown(input: &str) -> String {
+    let mut s = remove_control_characters(input);
+    s = neutralize_pipeline_commands(&s);
+    s = neutralize_mentions(&s);
+    s = neutralize_bot_triggers(&s);
+    s = remove_xml_comments(&s);
+    s = sanitize_url_protocols(&s);
+    s = enforce_content_limits(&s);
+    debug!(
+        "Sanitized markdown content: {} -> {} bytes",
+        input.len(),
+        s.len()
+    );
+    s
+}
+
 /// Sanitize operator-controlled configuration values.
 ///
 /// Applies a subset of the full pipeline appropriate for config identifiers:
@@ -643,6 +661,12 @@ mod tests {
         assert_eq!(remove_xml_comments("before<!-- no end"), "before");
     }
 
+    #[test]
+    fn test_sanitize_markdown_preserves_html_tags() {
+        let input = "<h2>Hi</h2><p>x &lt;string&gt; y</p>";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
     // IS-07b: URL protocol sanitization
     #[test]
     fn test_strip_javascript_protocol() {

From 70f67e75c65f555c56626b5165a443e61ddfafd0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 08:36:06 +0000
Subject: [PATCH 03/41] fix: validate create-work-item description field

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 20 ++++++---
 src/secure.rs                        |  6 +++
 src/validate.rs                      | 66 ++++++++++++++++++++++++++++
 3 files changed, 87 insertions(+), 5 deletions(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index 7266d37d..c8410709 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -11,7 +11,7 @@ use crate::safe_outputs::{
 };
 use crate::sanitize::sanitize_markdown;
 use crate::sanitize::{SanitizeContent, sanitize as sanitize_text, sanitize_config};
-use crate::secure::WorkItemTemporaryId;
+use crate::secure::{AdoWorkItemFieldRef, WorkItemTemporaryId};
 use ado_aw_derive::SanitizeConfig;
 use anyhow::{Context, ensure};
 
@@ -130,7 +130,8 @@ pub struct CreateWorkItemConfig {
     /// Defaults to System.Description, except Bug work items default to
     /// Microsoft.VSTS.TCM.ReproSteps.
     #[serde(default, rename = "description-field")]
-    pub description_field: Option<String>,
+    #[sanitize_config(skip)]
+    pub description_field: Option<AdoWorkItemFieldRef>,
 
     /// Area path for the work item
     #[serde(default, rename = "area-path")]
@@ -240,8 +241,8 @@ fn default_description_field_for(work_item_type: &str) -> &'static str {
 fn description_field_for(config: &CreateWorkItemConfig) -> &str {
     config
         .description_field
-        .as_deref()
-        .filter(|field| !field.trim().is_empty())
+        .as_ref()
+        .map(AdoWorkItemFieldRef::as_str)
         .unwrap_or_else(|| default_description_field_for(&config.work_item_type))
 }
 
@@ -789,7 +790,7 @@ custom-fields:
 "#;
         let config: CreateWorkItemConfig = serde_yaml::from_str(yaml).unwrap();
         assert_eq!(config.work_item_type, "Bug");
-        assert_eq!(config.description_field, Some("Custom.Body".to_string()));
+        assert_eq!(config.description_field.as_deref(), Some("Custom.Body"));
         assert_eq!(description_field_for(&config), "Custom.Body");
         assert_eq!(config.area_path, Some("MyProject\\MyTeam".to_string()));
         assert_eq!(config.assignee, Some("user@example.com".to_string()));
@@ -824,6 +825,15 @@ tags:
         );
     }
 
+    #[test]
+    fn test_config_rejects_invalid_description_field() {
+        let error =
+            serde_yaml::from_str::<CreateWorkItemConfig>("description-field: System/Description\n")
+                .unwrap_err();
+
+        assert!(error.to_string().contains("work item field"));
+    }
+
     #[test]
     fn test_result_sanitization_preserves_description_html() {
         let mut result = CreateWorkItemResult {
diff --git a/src/secure.rs b/src/secure.rs
index 3737101b..8fdcb94b 100644
--- a/src/secure.rs
+++ b/src/secure.rs
@@ -36,6 +36,7 @@
 //! - [`AdoOrganization`] — an Azure DevOps Services organization name.
 //! - [`AdoProject`] — an Azure DevOps project name or GUID.
 //! - [`AdoRepository`] — an Azure DevOps repository name or GUID.
+//! - [`AdoWorkItemFieldRef`] — an Azure DevOps work item field reference name.
 //! - [`Version`] — a version string (`1.2.3`, `latest`).
 //! - [`SemanticVersion`] — an exact semantic version (`1.2.3`, `2.0.0-beta.1`).
 //!
@@ -199,6 +200,11 @@ validated_string! {
     }
 }
 
+validated_string! {
+    /// An Azure DevOps work item field reference name.
+    AdoWorkItemFieldRef, "work item field", validate::validate_ado_work_item_field_ref
+}
+
 validated_string! {
     /// A git ref name obeying `git check-ref-format`.
     GitRefName, "ref", validate::validate_git_ref_name
diff --git a/src/validate.rs b/src/validate.rs
index 13c66a7c..e0402f20 100644
--- a/src/validate.rs
+++ b/src/validate.rs
@@ -747,6 +747,42 @@ pub fn is_valid_guid(s: &str) -> bool {
         })
 }
 
+/// Validate an Azure DevOps work item field reference name.
+///
+/// Field reference names are dot-separated identifier segments such as
+/// `System.Description` or `Microsoft.VSTS.TCM.ReproSteps`. Keeping this strict
+/// also prevents JSON Pointer path corruption when the field reference is used
+/// in JSON Patch paths like `/fields/<ref>`.
+pub fn validate_ado_work_item_field_ref(s: &str, label: &str) -> Result<()> {
+    anyhow::ensure!(!s.is_empty(), "{label} must not be empty");
+
+    let mut segment_count = 0;
+    for segment in s.split('.') {
+        segment_count += 1;
+        anyhow::ensure!(
+            !segment.is_empty(),
+            "{label} must not contain empty '.' segments"
+        );
+
+        let mut chars = segment.chars();
+        let first = chars.next().expect("segment is non-empty");
+        anyhow::ensure!(
+            first.is_ascii_alphabetic(),
+            "{label} segment '{segment}' must start with an ASCII letter"
+        );
+        anyhow::ensure!(
+            chars.all(|ch| ch.is_ascii_alphanumeric() || ch == '_'),
+            "{label} segment '{segment}' may only contain ASCII letters, digits, or '_'"
+        );
+    }
+
+    anyhow::ensure!(
+        segment_count >= 2,
+        "{label} must contain at least one '.' separator"
+    );
+    Ok(())
+}
+
 // ── Git reference / commit validators ────────────────────────────────────────
 
 /// Return `true` if `s` is a full 40-character lowercase-or-uppercase hex SHA.
@@ -1306,6 +1342,36 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    #[test]
+    fn test_validate_ado_work_item_field_ref() {
+        for valid in [
+            "System.Description",
+            "Microsoft.VSTS.TCM.ReproSteps",
+            "Custom.My_Field1",
+        ] {
+            assert!(
+                validate_ado_work_item_field_ref(valid, "field").is_ok(),
+                "{valid}"
+            );
+        }
+
+        for invalid in [
+            "",
+            "System",
+            "System.",
+            ".Description",
+            "System/Description",
+            "System~Description",
+            "System.Description[0]",
+            "1System.Description",
+        ] {
+            assert!(
+                validate_ado_work_item_field_ref(invalid, "field").is_err(),
+                "{invalid}"
+            );
+        }
+    }
+
     // ── Git ref / commit validators ────────────────────────────────────
 
     #[test]

From bbda2cb0a0cd2e6f21594d1f65112b83332f20be Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 08:38:10 +0000
Subject: [PATCH 04/41] fix: harden work item markdown sanitization

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 40 ++++++++++++++++++++++++++++++++++++----
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index b4d01ac4..bd323da2 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -72,14 +72,15 @@ pub fn sanitize(input: &str) -> String {
     s
 }
 
-/// Sanitize untrusted Markdown content while preserving inline HTML for renderers
-/// that accept it natively.
+/// Sanitize untrusted Markdown content while preserving ordinary inline HTML for
+/// renderers that accept it natively.
 pub(crate) fn sanitize_markdown(input: &str) -> String {
     let mut s = remove_control_characters(input);
     s = neutralize_pipeline_commands(&s);
     s = neutralize_mentions(&s);
     s = neutralize_bot_triggers(&s);
     s = remove_xml_comments(&s);
+    s = neutralize_dangerous_html(&s);
     s = sanitize_url_protocols(&s);
     s = enforce_content_limits(&s);
     debug!(
@@ -254,6 +255,16 @@ static RE_AB_LINK: LazyLock<regex_lite::Regex> =
     LazyLock::new(|| regex_lite::Regex::new(r"\bAB#(\d+)").unwrap());
 static RE_SLASH_CMD: LazyLock<regex_lite::Regex> =
     LazyLock::new(|| regex_lite::Regex::new(r"(?m)^(/[a-zA-Z][\w-]*)").unwrap());
+static RE_DANGEROUS_HTML_TAG: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
+    regex_lite::Regex::new(r"(?i)</?\s*(script|iframe|object|embed)\b[^>]*>").unwrap()
+});
+static RE_EVENT_HANDLER_ATTR_DQ: LazyLock<regex_lite::Regex> =
+    LazyLock::new(|| regex_lite::Regex::new(r#"(?i)\s+on[a-z][a-z0-9_-]*\s*=\s*"[^"]*""#).unwrap());
+static RE_EVENT_HANDLER_ATTR_SQ: LazyLock<regex_lite::Regex> =
+    LazyLock::new(|| regex_lite::Regex::new(r#"(?i)\s+on[a-z][a-z0-9_-]*\s*=\s*'[^']*'"#).unwrap());
+static RE_EVENT_HANDLER_ATTR_BARE: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
+    regex_lite::Regex::new(r#"(?i)\s+on[a-z][a-z0-9_-]*\s*=\s*[^\s"'=<>`]+"#).unwrap()
+});
 
 /// Neutralize bot command patterns and Azure DevOps work item link syntax.
 fn neutralize_bot_triggers(input: &str) -> String {
@@ -334,6 +345,13 @@ fn escape_html_fragment(input: &str) -> String {
     result
 }
 
+fn neutralize_dangerous_html(input: &str) -> String {
+    let s = RE_DANGEROUS_HTML_TAG.replace_all(input, "").to_string();
+    let s = RE_EVENT_HANDLER_ATTR_DQ.replace_all(&s, "").to_string();
+    let s = RE_EVENT_HANDLER_ATTR_SQ.replace_all(&s, "").to_string();
+    RE_EVENT_HANDLER_ATTR_BARE.replace_all(&s, "").to_string()
+}
+
 fn markdown_protected_ranges(input: &str) -> Vec<Range<usize>> {
     let fence_ranges = fenced_code_ranges(input);
     let mut ranges = Vec::new();
@@ -667,6 +685,21 @@ mod tests {
         assert_eq!(sanitize_markdown(input), input);
     }
 
+    #[test]
+    fn test_sanitize_markdown_neutralizes_active_html() {
+        let input = r#"<h2 onclick="alert(1)">Hi</h2><script>alert(1)</script><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=alert(1)>"#;
+        let output = sanitize_markdown(input);
+
+        assert!(output.contains("<h2>Hi</h2>"));
+        assert!(output.contains(r#"<a href="(redacted)alert(1)">link</a>"#));
+        assert!(output.contains("<img src=x>"));
+        assert!(!output.contains("<script"));
+        assert!(!output.contains("onclick"));
+        assert!(!output.contains("onmouseover"));
+        assert!(!output.contains("onerror"));
+        assert!(!output.contains("javascript:"));
+    }
+
     // IS-07b: URL protocol sanitization
     #[test]
     fn test_strip_javascript_protocol() {
@@ -873,8 +906,7 @@ mod tests {
 
     #[test]
     fn test_sanitize_custom_payload_neutralizes_commands_and_controls() {
-        let input =
-            "first\x00\x1b[31m\n##vso[task.setvariable variable=X]owned\n##[error]failed";
+        let input = "first\x00\x1b[31m\n##vso[task.setvariable variable=X]owned\n##[error]failed";
         let result = sanitize_custom_payload(input);
         assert!(!result.contains('\0'));
         assert!(!result.contains('\x1b'));

From bfefbdbc1867fe012f03ac214946418e5109ea2b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 08:41:19 +0000
Subject: [PATCH 05/41] fix: broaden active html sanitization

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 41 ++++++++++++++++++++++++++++-------------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index bd323da2..23ef151e 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -256,14 +256,19 @@ static RE_AB_LINK: LazyLock<regex_lite::Regex> =
 static RE_SLASH_CMD: LazyLock<regex_lite::Regex> =
     LazyLock::new(|| regex_lite::Regex::new(r"(?m)^(/[a-zA-Z][\w-]*)").unwrap());
 static RE_DANGEROUS_HTML_TAG: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r"(?i)</?\s*(script|iframe|object|embed)\b[^>]*>").unwrap()
+    regex_lite::Regex::new(
+        r"(?i)</?\s*(script|iframe|object|embed|form|input|button|textarea|select|option|base|meta|link|svg|math)\b[^>]*>",
+    )
+    .unwrap()
+});
+static RE_EVENT_HANDLER_ATTR_DQ: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
+    regex_lite::Regex::new(r#"(?i)(^|[<\s])on[a-z][a-z0-9_-]*\s*=\s*"[^"]*""#).unwrap()
+});
+static RE_EVENT_HANDLER_ATTR_SQ: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
+    regex_lite::Regex::new(r#"(?i)(^|[<\s])on[a-z][a-z0-9_-]*\s*=\s*'[^']*'"#).unwrap()
 });
-static RE_EVENT_HANDLER_ATTR_DQ: LazyLock<regex_lite::Regex> =
-    LazyLock::new(|| regex_lite::Regex::new(r#"(?i)\s+on[a-z][a-z0-9_-]*\s*=\s*"[^"]*""#).unwrap());
-static RE_EVENT_HANDLER_ATTR_SQ: LazyLock<regex_lite::Regex> =
-    LazyLock::new(|| regex_lite::Regex::new(r#"(?i)\s+on[a-z][a-z0-9_-]*\s*=\s*'[^']*'"#).unwrap());
 static RE_EVENT_HANDLER_ATTR_BARE: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)\s+on[a-z][a-z0-9_-]*\s*=\s*[^\s"'=<>`]+"#).unwrap()
+    regex_lite::Regex::new(r#"(?i)(^|[<\s])on[a-z][a-z0-9_-]*\s*=\s*[^\s"'=<>`]*"#).unwrap()
 });
 
 /// Neutralize bot command patterns and Azure DevOps work item link syntax.
@@ -347,9 +352,15 @@ fn escape_html_fragment(input: &str) -> String {
 
 fn neutralize_dangerous_html(input: &str) -> String {
     let s = RE_DANGEROUS_HTML_TAG.replace_all(input, "").to_string();
-    let s = RE_EVENT_HANDLER_ATTR_DQ.replace_all(&s, "").to_string();
-    let s = RE_EVENT_HANDLER_ATTR_SQ.replace_all(&s, "").to_string();
-    RE_EVENT_HANDLER_ATTR_BARE.replace_all(&s, "").to_string()
+    let s = RE_EVENT_HANDLER_ATTR_DQ
+        .replace_all(&s, |caps: &regex_lite::Captures| caps[1].to_string())
+        .to_string();
+    let s = RE_EVENT_HANDLER_ATTR_SQ
+        .replace_all(&s, |caps: &regex_lite::Captures| caps[1].to_string())
+        .to_string();
+    RE_EVENT_HANDLER_ATTR_BARE
+        .replace_all(&s, |caps: &regex_lite::Captures| caps[1].to_string())
+        .to_string()
 }
 
 fn markdown_protected_ranges(input: &str) -> Vec<Range<usize>> {
@@ -687,13 +698,17 @@ mod tests {
 
     #[test]
     fn test_sanitize_markdown_neutralizes_active_html() {
-        let input = r#"<h2 onclick="alert(1)">Hi</h2><script>alert(1)</script><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=alert(1)>"#;
+        let input = r#"<h2 onclick="alert(1)">Hi</h2><script>alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=>"#;
         let output = sanitize_markdown(input);
 
-        assert!(output.contains("<h2>Hi</h2>"));
-        assert!(output.contains(r#"<a href="(redacted)alert(1)">link</a>"#));
-        assert!(output.contains("<img src=x>"));
+        assert!(output.contains("<h2 "));
+        assert!(output.contains(">Hi</h2>"));
+        assert!(output.contains(r#"<a href="(redacted)alert(1)" "#));
+        assert!(output.contains(">link</a>"));
+        assert!(output.contains("<img src=x "));
         assert!(!output.contains("<script"));
+        assert!(!output.contains("<svg"));
+        assert!(!output.contains("<form"));
         assert!(!output.contains("onclick"));
         assert!(!output.contains("onmouseover"));
         assert!(!output.contains("onerror"));

From 977785adc50393333a45d5e155d4833d6adc67a9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 08:43:21 +0000
Subject: [PATCH 06/41] fix: handle quoted dangerous html tags

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 23ef151e..3b14146b 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -257,18 +257,18 @@ static RE_SLASH_CMD: LazyLock<regex_lite::Regex> =
     LazyLock::new(|| regex_lite::Regex::new(r"(?m)^(/[a-zA-Z][\w-]*)").unwrap());
 static RE_DANGEROUS_HTML_TAG: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
     regex_lite::Regex::new(
-        r"(?i)</?\s*(script|iframe|object|embed|form|input|button|textarea|select|option|base|meta|link|svg|math)\b[^>]*>",
+        r#"(?i)</?\s*(script|iframe|object|embed|form|input|button|textarea|select|option|base|meta|link|svg|math)\b([^>"']|"[^"]*"|'[^']*')*>"#,
     )
     .unwrap()
 });
 static RE_EVENT_HANDLER_ATTR_DQ: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)(^|[<\s])on[a-z][a-z0-9_-]*\s*=\s*"[^"]*""#).unwrap()
+    regex_lite::Regex::new(r#"(?i)([<\s])on[a-z][a-z0-9_-]*\s*=\s*"[^"]*""#).unwrap()
 });
 static RE_EVENT_HANDLER_ATTR_SQ: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)(^|[<\s])on[a-z][a-z0-9_-]*\s*=\s*'[^']*'"#).unwrap()
+    regex_lite::Regex::new(r#"(?i)([<\s])on[a-z][a-z0-9_-]*\s*=\s*'[^']*'"#).unwrap()
 });
 static RE_EVENT_HANDLER_ATTR_BARE: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)(^|[<\s])on[a-z][a-z0-9_-]*\s*=\s*[^\s"'=<>`]*"#).unwrap()
+    regex_lite::Regex::new(r#"(?i)([<\s])on[a-z][a-z0-9_-]*\s*=\s*[^\s"'=<>`]*"#).unwrap()
 });
 
 /// Neutralize bot command patterns and Azure DevOps work item link syntax.
@@ -698,7 +698,7 @@ mod tests {
 
     #[test]
     fn test_sanitize_markdown_neutralizes_active_html() {
-        let input = r#"<h2 onclick="alert(1)">Hi</h2><script>alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=>"#;
+        let input = r#"<h2 onclick="alert(1)">Hi</h2><script data-x="a>b">alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=>"#;
         let output = sanitize_markdown(input);
 
         assert!(output.contains("<h2 "));

From d35cae1ed96d029fb38c8fd431f67c70906c9ba7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 08:45:22 +0000
Subject: [PATCH 07/41] fix: scan dangerous html tags safely

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 86 ++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 78 insertions(+), 8 deletions(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 3b14146b..5a225ad3 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -255,12 +255,6 @@ static RE_AB_LINK: LazyLock<regex_lite::Regex> =
     LazyLock::new(|| regex_lite::Regex::new(r"\bAB#(\d+)").unwrap());
 static RE_SLASH_CMD: LazyLock<regex_lite::Regex> =
     LazyLock::new(|| regex_lite::Regex::new(r"(?m)^(/[a-zA-Z][\w-]*)").unwrap());
-static RE_DANGEROUS_HTML_TAG: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(
-        r#"(?i)</?\s*(script|iframe|object|embed|form|input|button|textarea|select|option|base|meta|link|svg|math)\b([^>"']|"[^"]*"|'[^']*')*>"#,
-    )
-    .unwrap()
-});
 static RE_EVENT_HANDLER_ATTR_DQ: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
     regex_lite::Regex::new(r#"(?i)([<\s])on[a-z][a-z0-9_-]*\s*=\s*"[^"]*""#).unwrap()
 });
@@ -351,7 +345,7 @@ fn escape_html_fragment(input: &str) -> String {
 }
 
 fn neutralize_dangerous_html(input: &str) -> String {
-    let s = RE_DANGEROUS_HTML_TAG.replace_all(input, "").to_string();
+    let s = strip_dangerous_html_tags(input);
     let s = RE_EVENT_HANDLER_ATTR_DQ
         .replace_all(&s, |caps: &regex_lite::Captures| caps[1].to_string())
         .to_string();
@@ -363,6 +357,79 @@ fn neutralize_dangerous_html(input: &str) -> String {
         .to_string()
 }
 
+fn strip_dangerous_html_tags(input: &str) -> String {
+    let mut output = String::with_capacity(input.len());
+    let mut index = 0;
+
+    while index < input.len() {
+        let rest = &input[index..];
+        if rest.starts_with('<')
+            && let Some(end) = html_tag_end(input, index)
+        {
+            let tag = &input[index..=end];
+            if is_dangerous_html_tag(tag) {
+                index = end + 1;
+                continue;
+            }
+        }
+
+        let ch = rest.chars().next().expect("index is within input");
+        output.push(ch);
+        index += ch.len_utf8();
+    }
+
+    output
+}
+
+fn html_tag_end(input: &str, start: usize) -> Option<usize> {
+    let mut quote = None;
+    for (offset, ch) in input[start + 1..].char_indices() {
+        if let Some(quoted_by) = quote {
+            if ch == quoted_by {
+                quote = None;
+            }
+        } else if ch == '"' || ch == '\'' {
+            quote = Some(ch);
+        } else if ch == '>' {
+            return Some(start + 1 + offset);
+        }
+    }
+    None
+}
+
+fn is_dangerous_html_tag(tag: &str) -> bool {
+    let mut chars = tag.chars();
+    if chars.next() != Some('<') {
+        return false;
+    }
+
+    let rest = chars.as_str().trim_start();
+    let rest = rest.strip_prefix('/').unwrap_or(rest).trim_start();
+    let name: String = rest
+        .chars()
+        .take_while(|ch| ch.is_ascii_alphanumeric())
+        .collect();
+
+    matches!(
+        name.to_ascii_lowercase().as_str(),
+        "script"
+            | "iframe"
+            | "object"
+            | "embed"
+            | "form"
+            | "input"
+            | "button"
+            | "textarea"
+            | "select"
+            | "option"
+            | "base"
+            | "meta"
+            | "link"
+            | "svg"
+            | "math"
+    )
+}
+
 fn markdown_protected_ranges(input: &str) -> Vec<Range<usize>> {
     let fence_ranges = fenced_code_ranges(input);
     let mut ranges = Vec::new();
@@ -698,7 +765,7 @@ mod tests {
 
     #[test]
     fn test_sanitize_markdown_neutralizes_active_html() {
-        let input = r#"<h2 onclick="alert(1)">Hi</h2><script data-x="a>b">alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=>"#;
+        let input = r#"<h2 onclick="alert(1)">Hi</h2><script data-x="a>b">alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=doWork(1)>"#;
         let output = sanitize_markdown(input);
 
         assert!(output.contains("<h2 "));
@@ -707,11 +774,14 @@ mod tests {
         assert!(output.contains(">link</a>"));
         assert!(output.contains("<img src=x "));
         assert!(!output.contains("<script"));
+        assert!(!output.contains("data-x"));
+        assert!(!output.contains("a>b"));
         assert!(!output.contains("<svg"));
         assert!(!output.contains("<form"));
         assert!(!output.contains("onclick"));
         assert!(!output.contains("onmouseover"));
         assert!(!output.contains("onerror"));
+        assert!(!output.contains("doWork"));
         assert!(!output.contains("javascript:"));
     }
 

From 41b6067b6998629b8fac86514d563c2d8301d21e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 08:47:42 +0000
Subject: [PATCH 08/41] fix: scope html event sanitization to tags

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 56 +++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 47 insertions(+), 9 deletions(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 5a225ad3..18ed34a6 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -346,8 +346,38 @@ fn escape_html_fragment(input: &str) -> String {
 
 fn neutralize_dangerous_html(input: &str) -> String {
     let s = strip_dangerous_html_tags(input);
+    strip_event_handler_attrs_in_tags(&s)
+}
+
+fn strip_event_handler_attrs_in_tags(input: &str) -> String {
+    let mut output = String::with_capacity(input.len());
+    let mut index = 0;
+
+    while index < input.len() {
+        let rest = &input[index..];
+        if rest.starts_with('<') {
+            if let Some(end) = html_tag_end(input, index) {
+                output.push_str(&strip_event_handler_attrs(&input[index..=end]));
+                index = end + 1;
+                continue;
+            }
+
+            output.push_str("&lt;");
+            index += '<'.len_utf8();
+            continue;
+        }
+
+        let ch = rest.chars().next().expect("index is within input");
+        output.push(ch);
+        index += ch.len_utf8();
+    }
+
+    output
+}
+
+fn strip_event_handler_attrs(tag: &str) -> String {
     let s = RE_EVENT_HANDLER_ATTR_DQ
-        .replace_all(&s, |caps: &regex_lite::Captures| caps[1].to_string())
+        .replace_all(tag, |caps: &regex_lite::Captures| caps[1].to_string())
         .to_string();
     let s = RE_EVENT_HANDLER_ATTR_SQ
         .replace_all(&s, |caps: &regex_lite::Captures| caps[1].to_string())
@@ -363,12 +393,18 @@ fn strip_dangerous_html_tags(input: &str) -> String {
 
     while index < input.len() {
         let rest = &input[index..];
-        if rest.starts_with('<')
-            && let Some(end) = html_tag_end(input, index)
-        {
-            let tag = &input[index..=end];
-            if is_dangerous_html_tag(tag) {
-                index = end + 1;
+        if rest.starts_with('<') {
+            if let Some(end) = html_tag_end(input, index) {
+                let tag = &input[index..=end];
+                if is_dangerous_html_tag(tag) {
+                    index = end + 1;
+                    continue;
+                }
+            } else if is_dangerous_html_tag(rest) {
+                break;
+            } else {
+                output.push_str("&lt;");
+                index += '<'.len_utf8();
                 continue;
             }
         }
@@ -765,7 +801,7 @@ mod tests {
 
     #[test]
     fn test_sanitize_markdown_neutralizes_active_html() {
-        let input = r#"<h2 onclick="alert(1)">Hi</h2><script data-x="a>b">alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=doWork(1)>"#;
+        let input = r#"<h2 onclick="alert(1)">Hi</h2><script data-x="a>b">alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=doWork(1)> prose onclick="kept"<script src=x"#;
         let output = sanitize_markdown(input);
 
         assert!(output.contains("<h2 "));
@@ -773,12 +809,14 @@ mod tests {
         assert!(output.contains(r#"<a href="(redacted)alert(1)" "#));
         assert!(output.contains(">link</a>"));
         assert!(output.contains("<img src=x "));
+        assert!(output.contains(r#"prose onclick="kept""#));
         assert!(!output.contains("<script"));
+        assert!(!output.contains("<script src"));
         assert!(!output.contains("data-x"));
         assert!(!output.contains("a>b"));
         assert!(!output.contains("<svg"));
         assert!(!output.contains("<form"));
-        assert!(!output.contains("onclick"));
+        assert!(!output.contains("<h2 onclick"));
         assert!(!output.contains("onmouseover"));
         assert!(!output.contains("onerror"));
         assert!(!output.contains("doWork"));

From a9e5b8c83ead664d3cb2efdb43cffefd6719a1b4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 08:49:18 +0000
Subject: [PATCH 09/41] fix: escape unclosed html tags

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 18ed34a6..046bb7b4 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -400,8 +400,6 @@ fn strip_dangerous_html_tags(input: &str) -> String {
                     index = end + 1;
                     continue;
                 }
-            } else if is_dangerous_html_tag(rest) {
-                break;
             } else {
                 output.push_str("&lt;");
                 index += '<'.len_utf8();
@@ -810,6 +808,7 @@ mod tests {
         assert!(output.contains(">link</a>"));
         assert!(output.contains("<img src=x "));
         assert!(output.contains(r#"prose onclick="kept""#));
+        assert!(output.contains("&lt;script src=x"));
         assert!(!output.contains("<script"));
         assert!(!output.contains("<script src"));
         assert!(!output.contains("data-x"));

From 7ca1523599564de30e385c582f4e9face39d8279 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:02:20 +0000
Subject: [PATCH 10/41] fix: address create work item review findings

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 163 ++++++++++++++++++++++++++-
 src/sanitize.rs                      |  66 +++++++++--
 2 files changed, 211 insertions(+), 18 deletions(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index c8410709..cbfd2c65 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -12,6 +12,7 @@ use crate::safe_outputs::{
 use crate::sanitize::sanitize_markdown;
 use crate::sanitize::{SanitizeContent, sanitize as sanitize_text, sanitize_config};
 use crate::secure::{AdoWorkItemFieldRef, WorkItemTemporaryId};
+use crate::validate::validate_ado_work_item_field_ref;
 use ado_aw_derive::SanitizeConfig;
 use anyhow::{Context, ensure};
 
@@ -255,6 +256,54 @@ fn field_op(field: &str, value: impl Into<String>) -> serde_json::Value {
     })
 }
 
+fn validate_unique_patch_field<'a>(
+    fields: &mut Vec<(&'static str, &'a str)>,
+    label: &'static str,
+    field: &'a str,
+) -> anyhow::Result<()> {
+    if let Some((existing_label, existing_field)) = fields
+        .iter()
+        .find(|(_, existing_field)| existing_field.eq_ignore_ascii_case(field))
+    {
+        anyhow::bail!(
+            "{label} field '{field}' duplicates {existing_label} field '{existing_field}'"
+        );
+    }
+
+    fields.push((label, field));
+    Ok(())
+}
+
+fn validate_patch_fields(
+    config: &CreateWorkItemConfig,
+    description_field: &str,
+    has_tags: bool,
+) -> anyhow::Result<()> {
+    let mut fields = Vec::new();
+    validate_unique_patch_field(&mut fields, "title", "System.Title")?;
+    validate_unique_patch_field(&mut fields, "description-field", description_field)?;
+
+    if config.area_path.is_some() {
+        validate_unique_patch_field(&mut fields, "area-path", "System.AreaPath")?;
+    }
+    if config.iteration_path.is_some() {
+        validate_unique_patch_field(&mut fields, "iteration-path", "System.IterationPath")?;
+    }
+    if config.assignee.is_some() {
+        validate_unique_patch_field(&mut fields, "assignee", "System.AssignedTo")?;
+    }
+    if has_tags {
+        validate_unique_patch_field(&mut fields, "tags", "System.Tags")?;
+    }
+
+    for field in config.custom_fields.keys() {
+        validate_ado_work_item_field_ref(field, "safe-outputs.create-work-item.custom-fields key")?;
+        validate_unique_patch_field(&mut fields, "custom-fields", field)?;
+    }
+
+    Ok(())
+}
+
 /// Build an artifact link relation patch operation
 fn artifact_link_op(project: &str, repository_id: &str, branch: &str) -> serde_json::Value {
     // Azure DevOps artifact link URL format for Git branch refs:
@@ -456,10 +505,21 @@ impl Executor for CreateWorkItemResult {
         );
         debug!("API URL: {}", url);
 
+        let mut all_tags = config.tags.clone();
+        for tag in &self.tags {
+            if !all_tags.iter().any(|t| t.eq_ignore_ascii_case(tag)) {
+                all_tags.push(tag.clone());
+            }
+        }
+
         // Build the patch document for work item creation
         let description_with_stats =
             crate::agent_stats::append_stats_to_body(&self.description, ctx, config.include_stats);
         let description_field = description_field_for(&config);
+        if let Err(error) = validate_patch_fields(&config, description_field, !all_tags.is_empty())
+        {
+            return Ok(ExecutionResult::failure(error.to_string()));
+        }
         let mut patch_doc = vec![
             field_op("System.Title", &self.title),
             field_op(description_field, &description_with_stats),
@@ -489,12 +549,6 @@ impl Executor for CreateWorkItemResult {
             patch_doc.push(field_op("System.AssignedTo", assignee));
         }
         // Merge static config tags with validated agent-provided tags (dedup, case-insensitive)
-        let mut all_tags = config.tags.clone();
-        for tag in &self.tags {
-            if !all_tags.iter().any(|t| t.eq_ignore_ascii_case(tag)) {
-                all_tags.push(tag.clone());
-            }
-        }
         if !all_tags.is_empty() {
             patch_doc.push(field_op("System.Tags", all_tags.join("; ")));
         }
@@ -834,6 +888,62 @@ tags:
         assert!(error.to_string().contains("work item field"));
     }
 
+    #[test]
+    fn test_patch_field_validation_rejects_description_field_title_collision() {
+        let mut config = CreateWorkItemConfig::default();
+        config.description_field = Some(AdoWorkItemFieldRef::parse("System.Title").unwrap());
+        let error = validate_patch_fields(&config, description_field_for(&config), false)
+            .unwrap_err()
+            .to_string();
+
+        assert!(error.contains("description-field field 'System.Title' duplicates title field"));
+    }
+
+    #[test]
+    fn test_patch_field_validation_rejects_custom_field_title_collision() {
+        let mut config = CreateWorkItemConfig::default();
+        config
+            .custom_fields
+            .insert("System.Title".to_string(), "overridden title".to_string());
+        let error = validate_patch_fields(&config, description_field_for(&config), false)
+            .unwrap_err()
+            .to_string();
+
+        assert!(error.contains("custom-fields field 'System.Title' duplicates title field"));
+    }
+
+    #[test]
+    fn test_patch_field_validation_rejects_custom_field_description_collision() {
+        let mut config = CreateWorkItemConfig {
+            work_item_type: "Bug".to_string(),
+            ..Default::default()
+        };
+        config.custom_fields.insert(
+            "Microsoft.VSTS.TCM.ReproSteps".to_string(),
+            "overridden body".to_string(),
+        );
+        let error = validate_patch_fields(&config, description_field_for(&config), false)
+            .unwrap_err()
+            .to_string();
+
+        assert!(error.contains(
+            "custom-fields field 'Microsoft.VSTS.TCM.ReproSteps' duplicates description-field field"
+        ));
+    }
+
+    #[test]
+    fn test_patch_field_validation_rejects_invalid_custom_field_ref() {
+        let mut config = CreateWorkItemConfig::default();
+        config
+            .custom_fields
+            .insert("System/Title".to_string(), "bad field".to_string());
+        let error = validate_patch_fields(&config, description_field_for(&config), false)
+            .unwrap_err()
+            .to_string();
+
+        assert!(error.contains("safe-outputs.create-work-item.custom-fields key"));
+    }
+
     #[test]
     fn test_result_sanitization_preserves_description_html() {
         let mut result = CreateWorkItemResult {
@@ -912,4 +1022,45 @@ tags:
 
         assert!(execution.success, "{}", execution.message);
     }
+
+    #[tokio::test]
+    async fn test_execute_rejects_duplicate_description_custom_field() {
+        use std::collections::HashMap;
+
+        let ctx = ExecutionContext {
+            ado_org_url: Some("https://example.test".to_string()),
+            ado_project: Some("Project".to_string()),
+            access_token: Some("token".to_string()),
+            tool_configs: HashMap::from([(
+                "create-work-item".to_string(),
+                serde_json::json!({
+                    "work-item-type": "Bug",
+                    "custom-fields": {
+                        "Microsoft.VSTS.TCM.ReproSteps": "overridden body"
+                    },
+                    "include-stats": false
+                }),
+            )]),
+            ..Default::default()
+        };
+        let mut result = CreateWorkItemResult {
+            name: CreateWorkItemResult::NAME.to_string(),
+            title: "Bug with duplicate body".to_string(),
+            description: "This description is long enough to pass MCP parameter validation."
+                .to_string(),
+            tags: Vec::new(),
+            temporary_id: WorkItemTemporaryId::parse("#aw_test1").unwrap(),
+        };
+
+        let execution = result.execute_sanitized(&ctx).await.unwrap();
+
+        assert!(!execution.success);
+        assert!(
+            execution.message.contains(
+                "custom-fields field 'Microsoft.VSTS.TCM.ReproSteps' duplicates description-field field"
+            ),
+            "{}",
+            execution.message
+        );
+    }
 }
diff --git a/src/sanitize.rs b/src/sanitize.rs
index 046bb7b4..28a62ecb 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -345,7 +345,14 @@ fn escape_html_fragment(input: &str) -> String {
 }
 
 fn neutralize_dangerous_html(input: &str) -> String {
-    let s = strip_dangerous_html_tags(input);
+    let mut s = input.to_string();
+    loop {
+        let stripped = strip_dangerous_html_tags(&s);
+        if stripped == s {
+            break;
+        }
+        s = stripped;
+    }
     strip_event_handler_attrs_in_tags(&s)
 }
 
@@ -798,27 +805,62 @@ mod tests {
     }
 
     #[test]
-    fn test_sanitize_markdown_neutralizes_active_html() {
-        let input = r#"<h2 onclick="alert(1)">Hi</h2><script data-x="a>b">alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form><a href="javascript:alert(1)" onmouseover='x'>link</a><img src=x onerror=doWork(1)> prose onclick="kept"<script src=x"#;
-        let output = sanitize_markdown(input);
+    fn test_sanitize_markdown_strips_dangerous_tags() {
+        let output = sanitize_markdown(
+            r#"<script data-x="a>b">alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form>"#,
+        );
 
-        assert!(output.contains("<h2 "));
-        assert!(output.contains(">Hi</h2>"));
-        assert!(output.contains(r#"<a href="(redacted)alert(1)" "#));
-        assert!(output.contains(">link</a>"));
-        assert!(output.contains("<img src=x "));
-        assert!(output.contains(r#"prose onclick="kept""#));
-        assert!(output.contains("&lt;script src=x"));
         assert!(!output.contains("<script"));
-        assert!(!output.contains("<script src"));
         assert!(!output.contains("data-x"));
         assert!(!output.contains("a>b"));
         assert!(!output.contains("<svg"));
         assert!(!output.contains("<form"));
+    }
+
+    #[test]
+    fn test_sanitize_markdown_strips_nested_dangerous_tags_to_fixed_point() {
+        let output = sanitize_markdown("<scr<script>ipt>alert(1)</scr</script>ipt>");
+
+        assert_eq!(output, "alert(1)");
+        assert!(!output.contains("<script"));
+    }
+
+    #[test]
+    fn test_sanitize_markdown_strips_event_handler_attrs_in_tags() {
+        let output = sanitize_markdown(
+            r#"<h2 onclick="alert(1)">Hi</h2><a href="https://example.test" onmouseover='x'>link</a><img src=x onerror=doWork(1)>"#,
+        );
+
+        assert!(output.contains("<h2 "));
+        assert!(output.contains(">Hi</h2>"));
+        assert!(output.contains(r#"<a href="https://example.test" "#));
+        assert!(output.contains(">link</a>"));
+        assert!(output.contains("<img src=x "));
         assert!(!output.contains("<h2 onclick"));
         assert!(!output.contains("onmouseover"));
         assert!(!output.contains("onerror"));
         assert!(!output.contains("doWork"));
+    }
+
+    #[test]
+    fn test_sanitize_markdown_preserves_event_handler_text_outside_tags() {
+        let output = sanitize_markdown(r#"prose onclick="kept""#);
+
+        assert_eq!(output, r#"prose onclick="kept""#);
+    }
+
+    #[test]
+    fn test_sanitize_markdown_escapes_unclosed_dangerous_tag() {
+        let output = sanitize_markdown("<script src=x");
+
+        assert_eq!(output, "&lt;script src=x");
+    }
+
+    #[test]
+    fn test_sanitize_markdown_redacts_dangerous_url_protocols_in_html() {
+        let output = sanitize_markdown(r#"<a href="javascript:alert(1)">link</a>"#);
+
+        assert_eq!(output, r#"<a href="(redacted)alert(1)">link</a>"#);
         assert!(!output.contains("javascript:"));
     }
 

From 2b183f5b0a1ce70484585a8e008cd32021a542b4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:03:35 +0000
Subject: [PATCH 11/41] fix: make custom field validation deterministic

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index cbfd2c65..0771b1eb 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -296,7 +296,9 @@ fn validate_patch_fields(
         validate_unique_patch_field(&mut fields, "tags", "System.Tags")?;
     }
 
-    for field in config.custom_fields.keys() {
+    let mut custom_fields: Vec<_> = config.custom_fields.keys().map(String::as_str).collect();
+    custom_fields.sort_unstable();
+    for field in custom_fields {
         validate_ado_work_item_field_ref(field, "safe-outputs.create-work-item.custom-fields key")?;
         validate_unique_patch_field(&mut fields, "custom-fields", field)?;
     }

From ed527723a55c81d5b3af05db0bc66f3f1c95fad1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:05:52 +0000
Subject: [PATCH 12/41] fix: validate custom work item fields as field refs

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 64 +++++++++++++++++++---------
 1 file changed, 44 insertions(+), 20 deletions(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index 0771b1eb..69ddead0 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -12,7 +12,6 @@ use crate::safe_outputs::{
 use crate::sanitize::sanitize_markdown;
 use crate::sanitize::{SanitizeContent, sanitize as sanitize_text, sanitize_config};
 use crate::secure::{AdoWorkItemFieldRef, WorkItemTemporaryId};
-use crate::validate::validate_ado_work_item_field_ref;
 use ado_aw_derive::SanitizeConfig;
 use anyhow::{Context, ensure};
 
@@ -121,7 +120,7 @@ impl SanitizeContent for CreateWorkItemResult {
 ///       repository: "my-repo-name"  # optional, defaults to current repo
 ///       branch: "main"              # optional, defaults to "main"
 /// ```
-#[derive(Debug, Clone, SanitizeConfig, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct CreateWorkItemConfig {
     /// Work item type (default: "Task")
     #[serde(default = "default_work_item_type", rename = "work-item-type")]
@@ -131,7 +130,6 @@ pub struct CreateWorkItemConfig {
     /// Defaults to System.Description, except Bug work items default to
     /// Microsoft.VSTS.TCM.ReproSteps.
     #[serde(default, rename = "description-field")]
-    #[sanitize_config(skip)]
     pub description_field: Option<AdoWorkItemFieldRef>,
 
     /// Area path for the work item
@@ -160,12 +158,10 @@ pub struct CreateWorkItemConfig {
     /// Additional custom fields as key-value pairs
     /// Keys should be the full field reference name (e.g., "Custom.MyField")
     #[serde(default, rename = "custom-fields")]
-    #[sanitize_config(sanitize_keys)]
-    pub custom_fields: std::collections::HashMap<String, String>,
+    pub custom_fields: std::collections::HashMap<AdoWorkItemFieldRef, String>,
 
     /// Artifact link configuration for GitHub Copilot integration
     #[serde(default, rename = "artifact-link")]
-    #[sanitize_config(nested)]
     pub artifact_link: ArtifactLinkConfig,
 
     /// Whether to include agent execution stats in the output (default: true).
@@ -176,6 +172,25 @@ pub struct CreateWorkItemConfig {
     pub include_stats: bool,
 }
 
+impl crate::sanitize::SanitizeConfig for CreateWorkItemConfig {
+    fn sanitize_config_fields(&mut self) {
+        self.work_item_type = sanitize_config(&self.work_item_type);
+        self.area_path = self.area_path.as_deref().map(sanitize_config);
+        self.iteration_path = self.iteration_path.as_deref().map(sanitize_config);
+        self.assignee = self.assignee.as_deref().map(sanitize_config);
+        self.tags = self.tags.iter().map(|tag| sanitize_config(tag)).collect();
+        self.allowed_tags = self
+            .allowed_tags
+            .iter()
+            .map(|tag| sanitize_config(tag))
+            .collect();
+        for value in self.custom_fields.values_mut() {
+            *value = sanitize_config(value);
+        }
+        crate::sanitize::SanitizeConfig::sanitize_config_fields(&mut self.artifact_link);
+    }
+}
+
 /// Configuration for artifact links (repository linking for GitHub Copilot)
 #[derive(Debug, Clone, SanitizeConfig, Serialize, Deserialize)]
 pub struct ArtifactLinkConfig {
@@ -296,10 +311,13 @@ fn validate_patch_fields(
         validate_unique_patch_field(&mut fields, "tags", "System.Tags")?;
     }
 
-    let mut custom_fields: Vec<_> = config.custom_fields.keys().map(String::as_str).collect();
+    let mut custom_fields: Vec<_> = config
+        .custom_fields
+        .keys()
+        .map(AdoWorkItemFieldRef::as_str)
+        .collect();
     custom_fields.sort_unstable();
     for field in custom_fields {
-        validate_ado_work_item_field_ref(field, "safe-outputs.create-work-item.custom-fields key")?;
         validate_unique_patch_field(&mut fields, "custom-fields", field)?;
     }
 
@@ -853,7 +871,9 @@ custom-fields:
         assert_eq!(config.tags, vec!["agent-created", "automated"]);
         assert_eq!(config.allowed_tags, vec!["agent-*", "review"]);
         assert_eq!(
-            config.custom_fields.get("Custom.Priority"),
+            config
+                .custom_fields
+                .get(&AdoWorkItemFieldRef::parse("Custom.Priority").unwrap()),
             Some(&"High".to_string())
         );
     }
@@ -906,7 +926,10 @@ tags:
         let mut config = CreateWorkItemConfig::default();
         config
             .custom_fields
-            .insert("System.Title".to_string(), "overridden title".to_string());
+            .insert(
+                AdoWorkItemFieldRef::parse("System.Title").unwrap(),
+                "overridden title".to_string(),
+            );
         let error = validate_patch_fields(&config, description_field_for(&config), false)
             .unwrap_err()
             .to_string();
@@ -921,7 +944,7 @@ tags:
             ..Default::default()
         };
         config.custom_fields.insert(
-            "Microsoft.VSTS.TCM.ReproSteps".to_string(),
+            AdoWorkItemFieldRef::parse("Microsoft.VSTS.TCM.ReproSteps").unwrap(),
             "overridden body".to_string(),
         );
         let error = validate_patch_fields(&config, description_field_for(&config), false)
@@ -934,16 +957,17 @@ tags:
     }
 
     #[test]
-    fn test_patch_field_validation_rejects_invalid_custom_field_ref() {
-        let mut config = CreateWorkItemConfig::default();
-        config
-            .custom_fields
-            .insert("System/Title".to_string(), "bad field".to_string());
-        let error = validate_patch_fields(&config, description_field_for(&config), false)
-            .unwrap_err()
-            .to_string();
+    fn test_config_rejects_invalid_custom_field_ref() {
+        let error = serde_yaml::from_str::<CreateWorkItemConfig>(
+            r#"
+custom-fields:
+  System/Title: bad field
+"#,
+        )
+        .unwrap_err()
+        .to_string();
 
-        assert!(error.contains("safe-outputs.create-work-item.custom-fields key"));
+        assert!(error.contains("work item field"));
     }
 
     #[test]

From 270bc6d628ba655e6f6613aedd4f0f70bde62015 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:06:51 +0000
Subject: [PATCH 13/41] test: tighten create work item collision assertions

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index 69ddead0..ba3d993f 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -918,7 +918,10 @@ tags:
             .unwrap_err()
             .to_string();
 
-        assert!(error.contains("description-field field 'System.Title' duplicates title field"));
+        assert_eq!(
+            error,
+            "description-field field 'System.Title' duplicates title field 'System.Title'"
+        );
     }
 
     #[test]
@@ -934,7 +937,10 @@ tags:
             .unwrap_err()
             .to_string();
 
-        assert!(error.contains("custom-fields field 'System.Title' duplicates title field"));
+        assert_eq!(
+            error,
+            "custom-fields field 'System.Title' duplicates title field 'System.Title'"
+        );
     }
 
     #[test]
@@ -951,9 +957,10 @@ tags:
             .unwrap_err()
             .to_string();
 
-        assert!(error.contains(
-            "custom-fields field 'Microsoft.VSTS.TCM.ReproSteps' duplicates description-field field"
-        ));
+        assert_eq!(
+            error,
+            "custom-fields field 'Microsoft.VSTS.TCM.ReproSteps' duplicates description-field field 'Microsoft.VSTS.TCM.ReproSteps'"
+        );
     }
 
     #[test]

From 65e3b16600dcd91d35d6bb2efdc9bfa46c912cf1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:07:54 +0000
Subject: [PATCH 14/41] refactor: sanitize work item tag config in place

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index ba3d993f..27340606 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -178,12 +178,12 @@ impl crate::sanitize::SanitizeConfig for CreateWorkItemConfig {
         self.area_path = self.area_path.as_deref().map(sanitize_config);
         self.iteration_path = self.iteration_path.as_deref().map(sanitize_config);
         self.assignee = self.assignee.as_deref().map(sanitize_config);
-        self.tags = self.tags.iter().map(|tag| sanitize_config(tag)).collect();
-        self.allowed_tags = self
-            .allowed_tags
-            .iter()
-            .map(|tag| sanitize_config(tag))
-            .collect();
+        for tag in &mut self.tags {
+            *tag = sanitize_config(tag.as_str());
+        }
+        for tag in &mut self.allowed_tags {
+            *tag = sanitize_config(tag.as_str());
+        }
         for value in self.custom_fields.values_mut() {
             *value = sanitize_config(value);
         }

From 256d00b0c735b10676999b4116a37e460a86e2aa Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:08:52 +0000
Subject: [PATCH 15/41] fix: clarify default work item body field collisions

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index 27340606..faf680d7 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -296,7 +296,12 @@ fn validate_patch_fields(
 ) -> anyhow::Result<()> {
     let mut fields = Vec::new();
     validate_unique_patch_field(&mut fields, "title", "System.Title")?;
-    validate_unique_patch_field(&mut fields, "description-field", description_field)?;
+    let description_label = if config.description_field.is_some() {
+        "description-field"
+    } else {
+        "default description-field"
+    };
+    validate_unique_patch_field(&mut fields, description_label, description_field)?;
 
     if config.area_path.is_some() {
         validate_unique_patch_field(&mut fields, "area-path", "System.AreaPath")?;
@@ -959,7 +964,7 @@ tags:
 
         assert_eq!(
             error,
-            "custom-fields field 'Microsoft.VSTS.TCM.ReproSteps' duplicates description-field field 'Microsoft.VSTS.TCM.ReproSteps'"
+            "custom-fields field 'Microsoft.VSTS.TCM.ReproSteps' duplicates default description-field field 'Microsoft.VSTS.TCM.ReproSteps'"
         );
     }
 
@@ -1090,7 +1095,7 @@ custom-fields:
         assert!(!execution.success);
         assert!(
             execution.message.contains(
-                "custom-fields field 'Microsoft.VSTS.TCM.ReproSteps' duplicates description-field field"
+                "custom-fields field 'Microsoft.VSTS.TCM.ReproSteps' duplicates default description-field field"
             ),
             "{}",
             execution.message

From 786379c13e7c5f7d2c49524b31c9c891a526631a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:10:07 +0000
Subject: [PATCH 16/41] refactor: align work item field validation order

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index faf680d7..dec7b13b 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -321,7 +321,7 @@ fn validate_patch_fields(
         .keys()
         .map(AdoWorkItemFieldRef::as_str)
         .collect();
-    custom_fields.sort_unstable();
+    custom_fields.sort_unstable_by(|a, b| a.to_ascii_lowercase().cmp(&b.to_ascii_lowercase()));
     for field in custom_fields {
         validate_unique_patch_field(&mut fields, "custom-fields", field)?;
     }
@@ -530,6 +530,7 @@ impl Executor for CreateWorkItemResult {
         );
         debug!("API URL: {}", url);
 
+        let description_field = description_field_for(&config);
         let mut all_tags = config.tags.clone();
         for tag in &self.tags {
             if !all_tags.iter().any(|t| t.eq_ignore_ascii_case(tag)) {
@@ -540,7 +541,6 @@ impl Executor for CreateWorkItemResult {
         // Build the patch document for work item creation
         let description_with_stats =
             crate::agent_stats::append_stats_to_body(&self.description, ctx, config.include_stats);
-        let description_field = description_field_for(&config);
         if let Err(error) = validate_patch_fields(&config, description_field, !all_tags.is_empty())
         {
             return Ok(ExecutionResult::failure(error.to_string()));

From d32e204e98aaeea6a4d32497a4eab668a46f45cd Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 19:27:43 +0000
Subject: [PATCH 17/41] fix: harden markdown html sanitization

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 97 ++++++++++++++++++++++++++++
 src/sanitize.rs                      | 37 ++++++++++-
 2 files changed, 133 insertions(+), 1 deletion(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index dec7b13b..b8406959 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -883,6 +883,69 @@ custom-fields:
         );
     }
 
+    #[test]
+    fn test_config_sanitizes_all_string_fields() {
+        let custom_field = AdoWorkItemFieldRef::parse("Custom.Value").unwrap();
+        let mut custom_fields = std::collections::HashMap::new();
+        custom_fields.insert(
+            custom_field.clone(),
+            "custom##vso[task.setvariable]".to_string(),
+        );
+        let mut config = CreateWorkItemConfig {
+            work_item_type: "Task##vso[task.setvariable]".to_string(),
+            description_field: Some(AdoWorkItemFieldRef::parse("Custom.Body").unwrap()),
+            area_path: Some("area\u{8}##[error]".to_string()),
+            iteration_path: Some("iteration##[section]".to_string()),
+            assignee: Some("assignee##vso[task.logissue]".to_string()),
+            tags: vec!["tag##[warning]".to_string()],
+            allowed_tags: vec!["allowed##vso[task.complete]".to_string()],
+            custom_fields,
+            artifact_link: ArtifactLinkConfig {
+                enabled: true,
+                repository: Some("repo##[debug]".to_string()),
+                branch: "branch##vso[build.addbuildtag]".to_string(),
+            },
+            include_stats: true,
+        };
+
+        crate::sanitize::SanitizeConfig::sanitize_config_fields(&mut config);
+
+        assert_eq!(
+            config.work_item_type,
+            sanitize_config("Task##vso[task.setvariable]")
+        );
+        assert_eq!(config.description_field.as_deref(), Some("Custom.Body"));
+        assert_eq!(
+            config.area_path.as_deref(),
+            Some(sanitize_config("area\u{8}##[error]").as_str())
+        );
+        assert_eq!(
+            config.iteration_path.as_deref(),
+            Some(sanitize_config("iteration##[section]").as_str())
+        );
+        assert_eq!(
+            config.assignee.as_deref(),
+            Some(sanitize_config("assignee##vso[task.logissue]").as_str())
+        );
+        assert_eq!(config.tags, vec![sanitize_config("tag##[warning]")]);
+        assert_eq!(
+            config.allowed_tags,
+            vec![sanitize_config("allowed##vso[task.complete]")]
+        );
+        assert_eq!(
+            config.custom_fields.get(&custom_field),
+            Some(&sanitize_config("custom##vso[task.setvariable]"))
+        );
+        assert_eq!(
+            config.artifact_link.repository.as_deref(),
+            Some(sanitize_config("repo##[debug]").as_str())
+        );
+        assert_eq!(
+            config.artifact_link.branch,
+            sanitize_config("branch##vso[build.addbuildtag]")
+        );
+    }
+
     #[test]
     fn test_config_partial_deserialize_uses_defaults() {
         let yaml = r#"
@@ -968,6 +1031,40 @@ tags:
         );
     }
 
+    #[test]
+    fn test_patch_field_validation_rejects_custom_field_builtin_collisions() {
+        let cases = [
+            ("area-path", "System.AreaPath", false),
+            ("iteration-path", "System.IterationPath", false),
+            ("assignee", "System.AssignedTo", false),
+            ("tags", "System.Tags", true),
+        ];
+
+        for (label, field, has_tags) in cases {
+            let mut config = CreateWorkItemConfig::default();
+            match label {
+                "area-path" => config.area_path = Some("Project\\Area".to_string()),
+                "iteration-path" => config.iteration_path = Some("Project\\Iteration".to_string()),
+                "assignee" => config.assignee = Some("user@example.test".to_string()),
+                "tags" => config.tags = vec!["configured".to_string()],
+                _ => unreachable!("test case labels are exhaustive"),
+            }
+            config.custom_fields.insert(
+                AdoWorkItemFieldRef::parse(field).unwrap(),
+                "overridden built-in field".to_string(),
+            );
+
+            let error = validate_patch_fields(&config, description_field_for(&config), has_tags)
+                .unwrap_err()
+                .to_string();
+
+            assert_eq!(
+                error,
+                format!("custom-fields field '{field}' duplicates {label} field '{field}'")
+            );
+        }
+    }
+
     #[test]
     fn test_config_rejects_invalid_custom_field_ref() {
         let error = serde_yaml::from_str::<CreateWorkItemConfig>(
diff --git a/src/sanitize.rs b/src/sanitize.rs
index 28a62ecb..76025b8a 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -407,6 +407,11 @@ fn strip_dangerous_html_tags(input: &str) -> String {
                     index = end + 1;
                     continue;
                 }
+                if tag[1..].contains('<') {
+                    output.push('<');
+                    index += '<'.len_utf8();
+                    continue;
+                }
             } else {
                 output.push_str("&lt;");
                 index += '<'.len_utf8();
@@ -424,16 +429,20 @@ fn strip_dangerous_html_tags(input: &str) -> String {
 
 fn html_tag_end(input: &str, start: usize) -> Option<usize> {
     let mut quote = None;
+    let mut last_non_ws = None;
     for (offset, ch) in input[start + 1..].char_indices() {
         if let Some(quoted_by) = quote {
             if ch == quoted_by {
                 quote = None;
             }
-        } else if ch == '"' || ch == '\'' {
+        } else if (ch == '"' || ch == '\'') && last_non_ws == Some('=') {
             quote = Some(ch);
         } else if ch == '>' {
             return Some(start + 1 + offset);
         }
+        if quote.is_none() && !ch.is_whitespace() {
+            last_non_ws = Some(ch);
+        }
     }
     None
 }
@@ -468,6 +477,7 @@ fn is_dangerous_html_tag(tag: &str) -> bool {
             | "link"
             | "svg"
             | "math"
+            | "style"
     )
 }
 
@@ -825,6 +835,22 @@ mod tests {
         assert!(!output.contains("<script"));
     }
 
+    #[test]
+    fn test_sanitize_markdown_strips_dangerous_tags_embedded_in_attribute_values() {
+        let output = sanitize_markdown(r#"<div title="><script>alert(1)</script>">safe</div>"#);
+
+        assert_eq!(output, r#"<div title=">alert(1)">safe</div>"#);
+        assert!(!output.contains("<script"));
+    }
+
+    #[test]
+    fn test_sanitize_markdown_strips_style_tags() {
+        let output = sanitize_markdown("<style>body{display:none}</style><p>safe</p>");
+
+        assert_eq!(output, "body{display:none}<p>safe</p>");
+        assert!(!output.contains("<style"));
+    }
+
     #[test]
     fn test_sanitize_markdown_strips_event_handler_attrs_in_tags() {
         let output = sanitize_markdown(
@@ -849,6 +875,15 @@ mod tests {
         assert_eq!(output, r#"prose onclick="kept""#);
     }
 
+    #[test]
+    fn test_sanitize_markdown_strips_event_handler_attrs_with_quote_in_unquoted_value() {
+        let output = sanitize_markdown(r#"<img src="safe.png" data-x=a"b onerror=alert(1)>"#);
+
+        assert_eq!(output, r#"<img src="safe.png" data-x=a"b >"#);
+        assert!(!output.contains("onerror"));
+        assert!(!output.contains("alert"));
+    }
+
     #[test]
     fn test_sanitize_markdown_escapes_unclosed_dangerous_tag() {
         let output = sanitize_markdown("<script src=x");

From 1b1fa7189a46594c381e29fac89a4e07cde24540 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 19:31:19 +0000
Subject: [PATCH 18/41] test: clarify sanitizer regression name

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 76025b8a..155d5a9a 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -836,7 +836,7 @@ mod tests {
     }
 
     #[test]
-    fn test_sanitize_markdown_strips_dangerous_tags_embedded_in_attribute_values() {
+    fn test_sanitize_markdown_strips_dangerous_tags_folded_into_attribute_span() {
         let output = sanitize_markdown(r#"<div title="><script>alert(1)</script>">safe</div>"#);
 
         assert_eq!(output, r#"<div title=">alert(1)">safe</div>"#);

From b14f429443ae378621d6ed6b23454501b39b1a12 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 20:49:13 +0000
Subject: [PATCH 19/41] fix: preserve fenced markdown code during html
 sanitization

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 155d5a9a..f99340eb 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -345,6 +345,10 @@ fn escape_html_fragment(input: &str) -> String {
 }
 
 fn neutralize_dangerous_html(input: &str) -> String {
+    apply_outside_markdown_protected_ranges(input, neutralize_dangerous_html_fragment)
+}
+
+fn neutralize_dangerous_html_fragment(input: &str) -> String {
     let mut s = input.to_string();
     loop {
         let stripped = strip_dangerous_html_tags(&s);
@@ -356,6 +360,26 @@ fn neutralize_dangerous_html(input: &str) -> String {
     strip_event_handler_attrs_in_tags(&s)
 }
 
+fn apply_outside_markdown_protected_ranges(
+    input: &str,
+    mut transform: impl FnMut(&str) -> String,
+) -> String {
+    let protected = markdown_protected_ranges(input);
+    if protected.is_empty() {
+        return transform(input);
+    }
+
+    let mut result = String::with_capacity(input.len());
+    let mut cursor = 0;
+    for range in protected {
+        result.push_str(&transform(&input[cursor..range.start]));
+        result.push_str(&input[range.start..range.end]);
+        cursor = range.end;
+    }
+    result.push_str(&transform(&input[cursor..]));
+    result
+}
+
 fn strip_event_handler_attrs_in_tags(input: &str) -> String {
     let mut output = String::with_capacity(input.len());
     let mut index = 0;
@@ -827,6 +851,16 @@ mod tests {
         assert!(!output.contains("<form"));
     }
 
+    #[test]
+    fn test_sanitize_markdown_preserves_dangerous_html_in_fenced_code_blocks() {
+        let input = "```html\n<script>alert(1)</script>\n<img src=x onerror=evil()>\n```\n<script>tail</script><img src=x onerror=evil()>";
+
+        assert_eq!(
+            sanitize_markdown(input),
+            "```html\n<script>alert(1)</script>\n<img src=x onerror=evil()>\n```\ntail<img src=x >"
+        );
+    }
+
     #[test]
     fn test_sanitize_markdown_strips_nested_dangerous_tags_to_fixed_point() {
         let output = sanitize_markdown("<scr<script>ipt>alert(1)</scr</script>ipt>");

From 48b6a6f1a415312f44eef09f53b47c56fcc25a2c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:47:26 +0000
Subject: [PATCH 20/41] fix: address final create-work-item review findings

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/safe_outputs/create_work_item.rs | 58 ++++++++++++++++++++++++----
 src/sanitize.rs                      | 34 ++++++++++++++--
 2 files changed, 81 insertions(+), 11 deletions(-)

diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index b8406959..c3ddd27e 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -316,19 +316,26 @@ fn validate_patch_fields(
         validate_unique_patch_field(&mut fields, "tags", "System.Tags")?;
     }
 
-    let mut custom_fields: Vec<_> = config
-        .custom_fields
-        .keys()
-        .map(AdoWorkItemFieldRef::as_str)
-        .collect();
-    custom_fields.sort_unstable_by(|a, b| a.to_ascii_lowercase().cmp(&b.to_ascii_lowercase()));
-    for field in custom_fields {
+    for (field, _) in sorted_custom_fields(&config.custom_fields) {
         validate_unique_patch_field(&mut fields, "custom-fields", field)?;
     }
 
     Ok(())
 }
 
+fn sorted_custom_fields(
+    custom_fields: &std::collections::HashMap<AdoWorkItemFieldRef, String>,
+) -> Vec<(&str, &str)> {
+    let mut custom_fields: Vec<_> = custom_fields
+        .iter()
+        .map(|(field, value)| (field.as_str(), value.as_str()))
+        .collect();
+    custom_fields.sort_unstable_by(|(a, _), (b, _)| {
+        a.to_ascii_lowercase().cmp(&b.to_ascii_lowercase())
+    });
+    custom_fields
+}
+
 /// Build an artifact link relation patch operation
 fn artifact_link_op(project: &str, repository_id: &str, branch: &str) -> serde_json::Value {
     // Azure DevOps artifact link URL format for Git branch refs:
@@ -579,7 +586,7 @@ impl Executor for CreateWorkItemResult {
         }
 
         // Add any custom fields
-        for (field, value) in &config.custom_fields {
+        for (field, value) in sorted_custom_fields(&config.custom_fields) {
             patch_doc.push(field_op(field, value));
         }
 
@@ -1031,6 +1038,23 @@ tags:
         );
     }
 
+    #[test]
+    fn test_patch_field_validation_rejects_custom_field_default_system_description_collision() {
+        let mut config = CreateWorkItemConfig::default();
+        config.custom_fields.insert(
+            AdoWorkItemFieldRef::parse("System.Description").unwrap(),
+            "overridden body".to_string(),
+        );
+        let error = validate_patch_fields(&config, description_field_for(&config), false)
+            .unwrap_err()
+            .to_string();
+
+        assert_eq!(
+            error,
+            "custom-fields field 'System.Description' duplicates default description-field field 'System.Description'"
+        );
+    }
+
     #[test]
     fn test_patch_field_validation_rejects_custom_field_builtin_collisions() {
         let cases = [
@@ -1065,6 +1089,24 @@ tags:
         }
     }
 
+    #[test]
+    fn test_sorted_custom_fields_orders_case_insensitively() {
+        let mut custom_fields = std::collections::HashMap::new();
+        custom_fields.insert(
+            AdoWorkItemFieldRef::parse("Custom.Zeta").unwrap(),
+            "last".to_string(),
+        );
+        custom_fields.insert(
+            AdoWorkItemFieldRef::parse("Custom.alpha").unwrap(),
+            "first".to_string(),
+        );
+
+        assert_eq!(
+            sorted_custom_fields(&custom_fields),
+            vec![("Custom.alpha", "first"), ("Custom.Zeta", "last")]
+        );
+    }
+
     #[test]
     fn test_config_rejects_invalid_custom_field_ref() {
         let error = serde_yaml::from_str::<CreateWorkItemConfig>(
diff --git a/src/sanitize.rs b/src/sanitize.rs
index f99340eb..b1de4f58 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -80,6 +80,7 @@ pub(crate) fn sanitize_markdown(input: &str) -> String {
     s = neutralize_mentions(&s);
     s = neutralize_bot_triggers(&s);
     s = remove_xml_comments(&s);
+    s = enforce_content_limits(&s);
     s = neutralize_dangerous_html(&s);
     s = sanitize_url_protocols(&s);
     s = enforce_content_limits(&s);
@@ -256,13 +257,13 @@ static RE_AB_LINK: LazyLock<regex_lite::Regex> =
 static RE_SLASH_CMD: LazyLock<regex_lite::Regex> =
     LazyLock::new(|| regex_lite::Regex::new(r"(?m)^(/[a-zA-Z][\w-]*)").unwrap());
 static RE_EVENT_HANDLER_ATTR_DQ: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)([<\s])on[a-z][a-z0-9_-]*\s*=\s*"[^"]*""#).unwrap()
+    regex_lite::Regex::new(r#"(?i)([<\s/])on[a-z][a-z0-9_-]*\s*=\s*"[^"]*""#).unwrap()
 });
 static RE_EVENT_HANDLER_ATTR_SQ: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)([<\s])on[a-z][a-z0-9_-]*\s*=\s*'[^']*'"#).unwrap()
+    regex_lite::Regex::new(r#"(?i)([<\s/])on[a-z][a-z0-9_-]*\s*=\s*'[^']*'"#).unwrap()
 });
 static RE_EVENT_HANDLER_ATTR_BARE: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)([<\s])on[a-z][a-z0-9_-]*\s*=\s*[^\s"'=<>`]*"#).unwrap()
+    regex_lite::Regex::new(r#"(?i)([<\s/])on[a-z][a-z0-9_-]*\s*=\s*[^\s"'=<>`]*"#).unwrap()
 });
 
 /// Neutralize bot command patterns and Azure DevOps work item link syntax.
@@ -869,6 +870,22 @@ mod tests {
         assert!(!output.contains("<script"));
     }
 
+    #[test]
+    fn test_sanitize_markdown_strips_folded_dangerous_tags_to_fixed_point() {
+        for tag in [
+            "iframe", "object", "embed", "form", "input", "button", "textarea", "select", "option",
+            "base", "meta", "link", "svg", "math", "style",
+        ] {
+            let split = tag.len() / 2;
+            let (prefix, suffix) = tag.split_at(split);
+            let input = format!("<{prefix}<{tag}>{suffix}>payload</{prefix}</{tag}>{suffix}>");
+            let output = sanitize_markdown(&input);
+
+            assert_eq!(output, "payload", "{tag}");
+            assert!(!output.contains(&format!("<{tag}")), "{tag}: {output}");
+        }
+    }
+
     #[test]
     fn test_sanitize_markdown_strips_dangerous_tags_folded_into_attribute_span() {
         let output = sanitize_markdown(r#"<div title="><script>alert(1)</script>">safe</div>"#);
@@ -902,6 +919,17 @@ mod tests {
         assert!(!output.contains("doWork"));
     }
 
+    #[test]
+    fn test_sanitize_markdown_strips_slash_separated_event_handler_attrs() {
+        let output = sanitize_markdown(r#"<img/onerror=alert(1)><a/onmouseover="evil()">link</a>"#);
+
+        assert_eq!(output, r#"<img/><a/>link</a>"#);
+        assert!(!output.contains("onerror"));
+        assert!(!output.contains("onmouseover"));
+        assert!(!output.contains("alert"));
+        assert!(!output.contains("evil"));
+    }
+
     #[test]
     fn test_sanitize_markdown_preserves_event_handler_text_outside_tags() {
         let output = sanitize_markdown(r#"prose onclick="kept""#);

From 7527a963e4c078525067d6d87cf37e0852013245 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:48:41 +0000
Subject: [PATCH 21/41] test: relax folded html sanitizer regression assertion

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index b1de4f58..4816cc0f 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -881,8 +881,9 @@ mod tests {
             let input = format!("<{prefix}<{tag}>{suffix}>payload</{prefix}</{tag}>{suffix}>");
             let output = sanitize_markdown(&input);
 
-            assert_eq!(output, "payload", "{tag}");
+            assert!(output.contains("payload"), "{tag}: {output}");
             assert!(!output.contains(&format!("<{tag}")), "{tag}: {output}");
+            assert!(!output.contains(&format!("</{tag}")), "{tag}: {output}");
         }
     }
 

From f9f0e6293ed771cb91b667c0d77842f390bac5be Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:49:57 +0000
Subject: [PATCH 22/41] fix: normalize slash-separated event handler removal

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 4816cc0f..2ef4f867 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -409,16 +409,24 @@ fn strip_event_handler_attrs_in_tags(input: &str) -> String {
 
 fn strip_event_handler_attrs(tag: &str) -> String {
     let s = RE_EVENT_HANDLER_ATTR_DQ
-        .replace_all(tag, |caps: &regex_lite::Captures| caps[1].to_string())
+        .replace_all(tag, event_handler_attr_replacement)
         .to_string();
     let s = RE_EVENT_HANDLER_ATTR_SQ
-        .replace_all(&s, |caps: &regex_lite::Captures| caps[1].to_string())
+        .replace_all(&s, event_handler_attr_replacement)
         .to_string();
     RE_EVENT_HANDLER_ATTR_BARE
-        .replace_all(&s, |caps: &regex_lite::Captures| caps[1].to_string())
+        .replace_all(&s, event_handler_attr_replacement)
         .to_string()
 }
 
+fn event_handler_attr_replacement(caps: &regex_lite::Captures) -> String {
+    if &caps[1] == "/" {
+        " ".to_string()
+    } else {
+        caps[1].to_string()
+    }
+}
+
 fn strip_dangerous_html_tags(input: &str) -> String {
     let mut output = String::with_capacity(input.len());
     let mut index = 0;
@@ -924,7 +932,7 @@ mod tests {
     fn test_sanitize_markdown_strips_slash_separated_event_handler_attrs() {
         let output = sanitize_markdown(r#"<img/onerror=alert(1)><a/onmouseover="evil()">link</a>"#);
 
-        assert_eq!(output, r#"<img/><a/>link</a>"#);
+        assert_eq!(output, r#"<img ><a >link</a>"#);
         assert!(!output.contains("onerror"));
         assert!(!output.contains("onmouseover"));
         assert!(!output.contains("alert"));

From fa22b7e067f93ce50d7963b3a895fb847dd29c85 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:51:13 +0000
Subject: [PATCH 23/41] test: use direct folded tag reconstruction case

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 2ef4f867..5ce90bb3 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -886,7 +886,8 @@ mod tests {
         ] {
             let split = tag.len() / 2;
             let (prefix, suffix) = tag.split_at(split);
-            let input = format!("<{prefix}<{tag}>{suffix}>payload</{prefix}</{tag}>{suffix}>");
+            let input =
+                format!("<{prefix}<{tag}></{tag}>{suffix}>payload</{prefix}</{tag}>{suffix}>");
             let output = sanitize_markdown(&input);
 
             assert!(output.contains("payload"), "{tag}: {output}");

From b4fe7737ed7de0678f52186af80bb2970d23d3fe Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:52:21 +0000
Subject: [PATCH 24/41] test: avoid exact whitespace in slash handler
 regression

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 5ce90bb3..c513d2c9 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -933,7 +933,10 @@ mod tests {
     fn test_sanitize_markdown_strips_slash_separated_event_handler_attrs() {
         let output = sanitize_markdown(r#"<img/onerror=alert(1)><a/onmouseover="evil()">link</a>"#);
 
-        assert_eq!(output, r#"<img ><a >link</a>"#);
+        assert!(output.contains("<img"), "{output}");
+        assert!(output.contains("link</a>"), "{output}");
+        assert!(!output.contains("<img/"), "{output}");
+        assert!(!output.contains("<a/"), "{output}");
         assert!(!output.contains("onerror"));
         assert!(!output.contains("onmouseover"));
         assert!(!output.contains("alert"));

From baeb62b52fe24626e912a0c7d60380283d796560 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:53:05 +0000
Subject: [PATCH 25/41] test: document folded tag regression shape

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index c513d2c9..8ed85110 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -886,6 +886,9 @@ mod tests {
         ] {
             let split = tag.len() / 2;
             let (prefix, suffix) = tag.split_at(split);
+            // The inner dangerous tag is removed first; the surrounding
+            // prefix/suffix then fold back into the original tag name, which
+            // the fixed-point pass must also remove.
             let input =
                 format!("<{prefix}<{tag}></{tag}>{suffix}>payload</{prefix}</{tag}>{suffix}>");
             let output = sanitize_markdown(&input);

From 1bf627432b7eb2c3e8886cdfc09fcd7973b45c80 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:54:07 +0000
Subject: [PATCH 26/41] test: fix folded dangerous tag regression shape

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 8ed85110..f973af9a 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -889,8 +889,7 @@ mod tests {
             // The inner dangerous tag is removed first; the surrounding
             // prefix/suffix then fold back into the original tag name, which
             // the fixed-point pass must also remove.
-            let input =
-                format!("<{prefix}<{tag}></{tag}>{suffix}>payload</{prefix}</{tag}>{suffix}>");
+            let input = format!("<{prefix}<{tag}></{tag}>{suffix}>payload</{prefix}{suffix}>");
             let output = sanitize_markdown(&input);
 
             assert!(output.contains("payload"), "{tag}: {output}");

From 62700c3e5d5bf5cc1e3408a7c83fc1bda2a7aca0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:55:01 +0000
Subject: [PATCH 27/41] refactor: make event handler replacement signature
 explicit

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index f973af9a..2dd8d75c 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -419,7 +419,7 @@ fn strip_event_handler_attrs(tag: &str) -> String {
         .to_string()
 }
 
-fn event_handler_attr_replacement(caps: &regex_lite::Captures) -> String {
+fn event_handler_attr_replacement(caps: &regex_lite::Captures<'_>) -> String {
     if &caps[1] == "/" {
         " ".to_string()
     } else {

From 2d0325a64b73e8cbd7c5b5cedd5fc2423aa39f24 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:56:11 +0000
Subject: [PATCH 28/41] refactor: simplify event handler separator replacement

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 2dd8d75c..8d8fa8cd 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -420,11 +420,7 @@ fn strip_event_handler_attrs(tag: &str) -> String {
 }
 
 fn event_handler_attr_replacement(caps: &regex_lite::Captures<'_>) -> String {
-    if &caps[1] == "/" {
-        " ".to_string()
-    } else {
-        caps[1].to_string()
-    }
+    caps[1].replace('/', " ")
 }
 
 fn strip_dangerous_html_tags(input: &str) -> String {

From a287f3338ab459da55a09cca48acc989b69a953c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:57:20 +0000
Subject: [PATCH 29/41] test: focus slash handler regression on removed payload

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize.rs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/sanitize.rs b/src/sanitize.rs
index 8d8fa8cd..31f59a48 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -931,7 +931,6 @@ mod tests {
     fn test_sanitize_markdown_strips_slash_separated_event_handler_attrs() {
         let output = sanitize_markdown(r#"<img/onerror=alert(1)><a/onmouseover="evil()">link</a>"#);
 
-        assert!(output.contains("<img"), "{output}");
         assert!(output.contains("link</a>"), "{output}");
         assert!(!output.contains("<img/"), "{output}");
         assert!(!output.contains("<a/"), "{output}");

From eba900abee947393f7037407f9e12fb4b95383f7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 20 Aug 2026 06:17:03 +0000
Subject: [PATCH 30/41] refactor(sanitize): allowlist-based Markdown sanitizer

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 Cargo.lock               | 186 ++++++++++++++
 Cargo.toml               |   2 +
 docs/safe-outputs.md     |  37 ++-
 src/sanitize.rs          | 426 ++++---------------------------
 src/sanitize/markdown.rs | 533 +++++++++++++++++++++++++++++++++++++++
 5 files changed, 806 insertions(+), 378 deletions(-)
 create mode 100644 src/sanitize/markdown.rs

diff --git a/Cargo.lock b/Cargo.lock
index c1f5303c..affe77d6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -13,6 +13,7 @@ name = "ado-aw"
 version = "0.50.0"
 dependencies = [
  "ado-aw-derive",
+ "ammonia",
  "anyhow",
  "async-trait",
  "base64",
@@ -26,6 +27,7 @@ dependencies = [
  "inventory",
  "log",
  "percent-encoding",
+ "pulldown-cmark",
  "rand",
  "regex-lite",
  "reqwest",
@@ -62,6 +64,18 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "ammonia"
+version = "4.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc6d763210e2eb7670d1a5183a08bebefa3f97db2a738a684f2ce00bd49f681d"
+dependencies = [
+ "cssparser",
+ "html5ever",
+ "maplit",
+ "url",
+]
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -375,6 +389,17 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "cssparser"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98"
+dependencies = [
+ "dtoa-short",
+ "itoa",
+ "smallvec",
+]
+
 [[package]]
 name = "darling"
 version = "0.23.0"
@@ -501,6 +526,21 @@ dependencies = [
  "litrs",
 ]
 
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
 [[package]]
 name = "dyn-clone"
 version = "1.0.20"
@@ -800,6 +840,16 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
+[[package]]
+name = "html5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
+dependencies = [
+ "log",
+ "markup5ever",
+]
+
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -1231,6 +1281,23 @@ version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
+[[package]]
+name = "maplit"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
+
+[[package]]
+name = "markup5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
+dependencies = [
+ "log",
+ "tendril",
+ "web_atoms",
+]
+
 [[package]]
 name = "memchr"
 version = "2.7.6"
@@ -1282,6 +1349,12 @@ dependencies = [
  "tempfile",
 ]
 
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -1397,6 +1470,45 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
@@ -1439,6 +1551,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -1458,6 +1576,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "pulldown-cmark"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
+dependencies = [
+ "bitflags",
+ "memchr",
+ "unicase",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.43"
@@ -1941,6 +2070,12 @@ dependencies = [
  "bstr",
 ]
 
+[[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
 [[package]]
 name = "slab"
 version = "0.4.11"
@@ -1969,6 +2104,30 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "string_cache"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -2046,6 +2205,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "tendril"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
+dependencies = [
+ "new_debug_unreachable",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.18"
@@ -2240,6 +2408,12 @@ version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
 
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.22"
@@ -2442,6 +2616,18 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "web_atoms"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba8b815c1b593dc0baf78dd0f4fc8fdb2de53198fb1163738093e9a311c33fb3"
+dependencies = [
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
diff --git a/Cargo.toml b/Cargo.toml
index 3be0ece6..b87c009c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,6 +36,8 @@ indexmap = "2"
 zip = { version = "8.6.0", default-features = false, features = ["deflate"] }
 semver = "1.0.28"
 inventory = "0.3.24"
+ammonia = "4.1.4"
+pulldown-cmark = { version = "0.13.4", default-features = false }
 
 [dev-dependencies]
 reqwest = { version = "0.12", features = ["blocking"] }
diff --git a/docs/safe-outputs.md b/docs/safe-outputs.md
index 79d6b137..059095f1 100644
--- a/docs/safe-outputs.md
+++ b/docs/safe-outputs.md
@@ -233,6 +233,41 @@ section). It is additive and build-scoped: it appears as one extra section
 alongside any `task.uploadsummary` tabs your own steps publish (including under
 `target: job` / `target: stage`), and never collides with them.
 
+### Markdown body sanitization
+
+Safe outputs whose body is stored as Markdown (today: `create-work-item`'s
+`description`) go through a Markdown-aware sanitizer rather than blanket HTML
+escaping, so headings, lists, tables and code fences survive.
+
+The policy is:
+
+- **Transport sanitization applies to the whole document.** Control characters
+  and ANSI escapes are removed, Azure DevOps logging commands (`##vso[`, `##[`)
+  are wrapped in backticks, HTML comments are removed, and the content size and
+  line count caps are enforced.
+- **Code is left alone.** [pulldown-cmark](https://docs.rs/pulldown-cmark)
+  identifies code spans, fenced and indented code blocks; no rendering
+  transformation is applied inside them, so a fence showing `<script>` or
+  `@mention` stays readable.
+- **Inline HTML is allowlisted, not blocklisted.**
+  [ammonia](https://docs.rs/ammonia) keeps a small set of formatting tags that
+  have a Markdown equivalent (`a`, `b`/`strong`, `i`/`em`, `code`, `pre`,
+  headings, lists, tables, `img`, `blockquote`, …) with a small attribute
+  allowlist (`href`, `src`, `alt`, `title`, `width`, `height`, `colspan`,
+  `rowspan`, `align`). Everything else — `script`, `style`, `iframe`, `form`,
+  SVG/MathML, `on*` handlers, `style`/`class`/`id` attributes — is dropped;
+  `script` and `style` also lose their contents.
+- **URLs are scheme-allowlisted.** `http`, `https`, `mailto` and relative
+  destinations are allowed everywhere (HTML attributes, Markdown links and
+  images, autolinks and reference definitions). Any other scheme is dropped from
+  HTML attributes and replaced with `(redacted)` in Markdown destinations.
+- **Mentions and bot triggers are neutralized outside code.** `@name`,
+  `fixes #123` and `AB#123` are wrapped in backticks so they cannot notify
+  people or link work items.
+
+A bare `<` in prose is stored as `&lt;`, which Markdown renders as `<`; that is
+what stops dropped markup from being re-parsed.
+
 ### Executor authentication
 
 All write-bearing safe outputs (e.g. `create-pull-request`,
@@ -827,7 +862,7 @@ field that receives the body.
 
 **Agent parameters:**
 - `title` - A concise title for the work item (required, must be more than 5 characters)
-- `description` - Work item description in Markdown format (required, must be more than 30 characters). Inline HTML is preserved for Azure DevOps to render/sanitize.
+- `description` - Work item description in Markdown format (required, must be more than 30 characters). Markdown is preserved; see [Markdown body sanitization](#markdown-body-sanitization) for the HTML and URL policy applied to it.
 - `tags` - Tags to apply to the work item (optional list; each tag must not contain a semicolon). May be subject to the `allowed-tags` allowlist. Merged with any static `tags` configured in front matter.
 
 On success, the MCP tool returns a generated gh-aw-compatible `#aw_...`
diff --git a/src/sanitize.rs b/src/sanitize.rs
index 31f59a48..57653be2 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -16,7 +16,8 @@
 //!   identifiers like area paths, wiki names, or assignee emails.
 
 use log::debug;
-use std::ops::Range;
+
+mod markdown;
 
 /// Trait for types that contain untrusted agent-generated text fields.
 ///
@@ -72,17 +73,21 @@ pub fn sanitize(input: &str) -> String {
     s
 }
 
-/// Sanitize untrusted Markdown content while preserving ordinary inline HTML for
-/// renderers that accept it natively.
+/// Sanitize untrusted Markdown content that Azure DevOps renders as Markdown.
+///
+/// Transport sanitization (control characters, pipeline commands, XML
+/// comments, content caps) applies to the whole document. Mention/bot-trigger
+/// neutralization and the HTML allowlist apply only outside Markdown code
+/// spans and code fences — see [`markdown`] for the HTML and URL policy.
 pub(crate) fn sanitize_markdown(input: &str) -> String {
     let mut s = remove_control_characters(input);
     s = neutralize_pipeline_commands(&s);
-    s = neutralize_mentions(&s);
-    s = neutralize_bot_triggers(&s);
     s = remove_xml_comments(&s);
     s = enforce_content_limits(&s);
-    s = neutralize_dangerous_html(&s);
-    s = sanitize_url_protocols(&s);
+    s = markdown::sanitize_markdown_html(&s, |text| {
+        let text = neutralize_mentions(text);
+        neutralize_bot_triggers(&text)
+    });
     s = enforce_content_limits(&s);
     debug!(
         "Sanitized markdown content: {} -> {} bytes",
@@ -256,15 +261,6 @@ static RE_AB_LINK: LazyLock<regex_lite::Regex> =
     LazyLock::new(|| regex_lite::Regex::new(r"\bAB#(\d+)").unwrap());
 static RE_SLASH_CMD: LazyLock<regex_lite::Regex> =
     LazyLock::new(|| regex_lite::Regex::new(r"(?m)^(/[a-zA-Z][\w-]*)").unwrap());
-static RE_EVENT_HANDLER_ATTR_DQ: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)([<\s/])on[a-z][a-z0-9_-]*\s*=\s*"[^"]*""#).unwrap()
-});
-static RE_EVENT_HANDLER_ATTR_SQ: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)([<\s/])on[a-z][a-z0-9_-]*\s*=\s*'[^']*'"#).unwrap()
-});
-static RE_EVENT_HANDLER_ATTR_BARE: LazyLock<regex_lite::Regex> = LazyLock::new(|| {
-    regex_lite::Regex::new(r#"(?i)([<\s/])on[a-z][a-z0-9_-]*\s*=\s*[^\s"'=<>`]*"#).unwrap()
-});
 
 /// Neutralize bot command patterns and Azure DevOps work item link syntax.
 fn neutralize_bot_triggers(input: &str) -> String {
@@ -307,7 +303,7 @@ fn remove_xml_comments(input: &str) -> String {
 
 /// Convert HTML/XML tags to safe HTML entities (IS-06).
 fn escape_html_tags(input: &str) -> String {
-    let protected = markdown_protected_ranges(input);
+    let protected = markdown::code_ranges(input);
     if protected.is_empty() {
         return escape_html_fragment(input);
     }
@@ -345,324 +341,6 @@ fn escape_html_fragment(input: &str) -> String {
     result
 }
 
-fn neutralize_dangerous_html(input: &str) -> String {
-    apply_outside_markdown_protected_ranges(input, neutralize_dangerous_html_fragment)
-}
-
-fn neutralize_dangerous_html_fragment(input: &str) -> String {
-    let mut s = input.to_string();
-    loop {
-        let stripped = strip_dangerous_html_tags(&s);
-        if stripped == s {
-            break;
-        }
-        s = stripped;
-    }
-    strip_event_handler_attrs_in_tags(&s)
-}
-
-fn apply_outside_markdown_protected_ranges(
-    input: &str,
-    mut transform: impl FnMut(&str) -> String,
-) -> String {
-    let protected = markdown_protected_ranges(input);
-    if protected.is_empty() {
-        return transform(input);
-    }
-
-    let mut result = String::with_capacity(input.len());
-    let mut cursor = 0;
-    for range in protected {
-        result.push_str(&transform(&input[cursor..range.start]));
-        result.push_str(&input[range.start..range.end]);
-        cursor = range.end;
-    }
-    result.push_str(&transform(&input[cursor..]));
-    result
-}
-
-fn strip_event_handler_attrs_in_tags(input: &str) -> String {
-    let mut output = String::with_capacity(input.len());
-    let mut index = 0;
-
-    while index < input.len() {
-        let rest = &input[index..];
-        if rest.starts_with('<') {
-            if let Some(end) = html_tag_end(input, index) {
-                output.push_str(&strip_event_handler_attrs(&input[index..=end]));
-                index = end + 1;
-                continue;
-            }
-
-            output.push_str("&lt;");
-            index += '<'.len_utf8();
-            continue;
-        }
-
-        let ch = rest.chars().next().expect("index is within input");
-        output.push(ch);
-        index += ch.len_utf8();
-    }
-
-    output
-}
-
-fn strip_event_handler_attrs(tag: &str) -> String {
-    let s = RE_EVENT_HANDLER_ATTR_DQ
-        .replace_all(tag, event_handler_attr_replacement)
-        .to_string();
-    let s = RE_EVENT_HANDLER_ATTR_SQ
-        .replace_all(&s, event_handler_attr_replacement)
-        .to_string();
-    RE_EVENT_HANDLER_ATTR_BARE
-        .replace_all(&s, event_handler_attr_replacement)
-        .to_string()
-}
-
-fn event_handler_attr_replacement(caps: &regex_lite::Captures<'_>) -> String {
-    caps[1].replace('/', " ")
-}
-
-fn strip_dangerous_html_tags(input: &str) -> String {
-    let mut output = String::with_capacity(input.len());
-    let mut index = 0;
-
-    while index < input.len() {
-        let rest = &input[index..];
-        if rest.starts_with('<') {
-            if let Some(end) = html_tag_end(input, index) {
-                let tag = &input[index..=end];
-                if is_dangerous_html_tag(tag) {
-                    index = end + 1;
-                    continue;
-                }
-                if tag[1..].contains('<') {
-                    output.push('<');
-                    index += '<'.len_utf8();
-                    continue;
-                }
-            } else {
-                output.push_str("&lt;");
-                index += '<'.len_utf8();
-                continue;
-            }
-        }
-
-        let ch = rest.chars().next().expect("index is within input");
-        output.push(ch);
-        index += ch.len_utf8();
-    }
-
-    output
-}
-
-fn html_tag_end(input: &str, start: usize) -> Option<usize> {
-    let mut quote = None;
-    let mut last_non_ws = None;
-    for (offset, ch) in input[start + 1..].char_indices() {
-        if let Some(quoted_by) = quote {
-            if ch == quoted_by {
-                quote = None;
-            }
-        } else if (ch == '"' || ch == '\'') && last_non_ws == Some('=') {
-            quote = Some(ch);
-        } else if ch == '>' {
-            return Some(start + 1 + offset);
-        }
-        if quote.is_none() && !ch.is_whitespace() {
-            last_non_ws = Some(ch);
-        }
-    }
-    None
-}
-
-fn is_dangerous_html_tag(tag: &str) -> bool {
-    let mut chars = tag.chars();
-    if chars.next() != Some('<') {
-        return false;
-    }
-
-    let rest = chars.as_str().trim_start();
-    let rest = rest.strip_prefix('/').unwrap_or(rest).trim_start();
-    let name: String = rest
-        .chars()
-        .take_while(|ch| ch.is_ascii_alphanumeric())
-        .collect();
-
-    matches!(
-        name.to_ascii_lowercase().as_str(),
-        "script"
-            | "iframe"
-            | "object"
-            | "embed"
-            | "form"
-            | "input"
-            | "button"
-            | "textarea"
-            | "select"
-            | "option"
-            | "base"
-            | "meta"
-            | "link"
-            | "svg"
-            | "math"
-            | "style"
-    )
-}
-
-fn markdown_protected_ranges(input: &str) -> Vec<Range<usize>> {
-    let fence_ranges = fenced_code_ranges(input);
-    let mut ranges = Vec::new();
-    let mut cursor = 0;
-
-    for fence in &fence_ranges {
-        if cursor < fence.start {
-            collect_inline_code_ranges(input, cursor, fence.start, &mut ranges);
-        }
-        ranges.push(fence.clone());
-        cursor = fence.end;
-    }
-
-    if cursor < input.len() {
-        collect_inline_code_ranges(input, cursor, input.len(), &mut ranges);
-    }
-
-    ranges
-}
-
-fn fenced_code_ranges(input: &str) -> Vec<Range<usize>> {
-    let mut ranges = Vec::new();
-    let mut line_start = 0;
-
-    while line_start < input.len() {
-        let (line_end, next_line_start) = line_bounds(input, line_start);
-        let line = &input[line_start..line_end];
-
-        if let Some((marker, count)) = parse_fence_opener(line)
-            && let Some(block_end) = find_matching_fence_end(input, next_line_start, marker, count)
-        {
-            ranges.push(line_start..block_end);
-            line_start = block_end;
-            continue;
-        }
-
-        line_start = next_line_start;
-    }
-
-    ranges
-}
-
-fn collect_inline_code_ranges(
-    input: &str,
-    start: usize,
-    end: usize,
-    ranges: &mut Vec<Range<usize>>,
-) {
-    let bytes = input.as_bytes();
-    let mut i = start;
-
-    while i < end {
-        if bytes[i] != b'`' {
-            i += 1;
-            continue;
-        }
-
-        let tick_count = count_repeated_byte(bytes, i, end, b'`');
-        // Be intentionally conservative here: we only preserve single-line inline code spans.
-        // CommonMark allows a code span to wrap a newline, but treating unmatched backticks as
-        // ordinary text keeps escaping active in ambiguous multi-line cases.
-        let inline_code_boundary = input[i..end]
-            .find('\n')
-            .map(|offset| i + offset)
-            .unwrap_or(end);
-        let mut cursor = i + tick_count;
-        let mut matched_end = None;
-
-        while cursor < inline_code_boundary {
-            if bytes[cursor] == b'`' {
-                let candidate_count =
-                    count_repeated_byte(bytes, cursor, inline_code_boundary, b'`');
-                if candidate_count == tick_count {
-                    matched_end = Some(cursor + candidate_count);
-                    break;
-                }
-                cursor += candidate_count;
-            } else {
-                cursor += 1;
-            }
-        }
-
-        if let Some(span_end) = matched_end {
-            ranges.push(i..span_end);
-            i = span_end;
-        } else {
-            i += tick_count;
-        }
-    }
-}
-
-fn line_bounds(input: &str, line_start: usize) -> (usize, usize) {
-    let line_end = input[line_start..]
-        .find('\n')
-        .map(|offset| line_start + offset)
-        .unwrap_or(input.len());
-    let next_line_start = if line_end < input.len() {
-        line_end + 1
-    } else {
-        input.len()
-    };
-    (line_end, next_line_start)
-}
-
-fn parse_fence_opener(line: &str) -> Option<(u8, usize)> {
-    let indent = line.bytes().take_while(|b| *b == b' ').count();
-    if indent > 3 {
-        return None;
-    }
-
-    let rest = &line.as_bytes()[indent..];
-    let marker = *rest.first()?;
-    if marker != b'`' && marker != b'~' {
-        return None;
-    }
-
-    let count = rest.iter().take_while(|&&b| b == marker).count();
-    (count >= 3).then_some((marker, count))
-}
-
-fn find_matching_fence_end(
-    input: &str,
-    mut line_start: usize,
-    marker: u8,
-    min_count: usize,
-) -> Option<usize> {
-    while line_start < input.len() {
-        let (line_end, next_line_start) = line_bounds(input, line_start);
-        let line = &input[line_start..line_end];
-        let indent = line.bytes().take_while(|b| *b == b' ').count();
-
-        if indent <= 3 {
-            let rest = &line.as_bytes()[indent..];
-            let count = rest.iter().take_while(|&&b| b == marker).count();
-            if count >= min_count && rest[count..].iter().all(|b| matches!(b, b' ' | b'\t')) {
-                return Some(next_line_start);
-            }
-        }
-
-        line_start = next_line_start;
-    }
-
-    None
-}
-
-fn count_repeated_byte(bytes: &[u8], start: usize, end: usize, byte: u8) -> usize {
-    let mut count = 0;
-    while start + count < end && bytes[start + count] == byte {
-        count += 1;
-    }
-    count
-}
-
 // ── IS-07b: URL protocol sanitization ──────────────────────────────────────
 
 /// Strip unsafe URL protocols (javascript:, data:, file:, vbscript:).
@@ -838,7 +516,7 @@ mod tests {
     }
 
     #[test]
-    fn test_sanitize_markdown_preserves_html_tags() {
+    fn test_sanitize_markdown_preserves_allowlisted_html_tags() {
         let input = "<h2>Hi</h2><p>x &lt;string&gt; y</p>";
         assert_eq!(sanitize_markdown(input), input);
     }
@@ -849,11 +527,11 @@ mod tests {
             r#"<script data-x="a>b">alert(1)</script><svg onload=alert(1)></svg><form action="https://evil.test"></form>"#,
         );
 
-        assert!(!output.contains("<script"));
-        assert!(!output.contains("data-x"));
-        assert!(!output.contains("a>b"));
-        assert!(!output.contains("<svg"));
-        assert!(!output.contains("<form"));
+        assert!(!output.contains("<script"), "{output}");
+        assert!(!output.contains("data-x"), "{output}");
+        assert!(!output.contains("alert(1)"), "{output}");
+        assert!(!output.contains("<svg"), "{output}");
+        assert!(!output.contains("<form"), "{output}");
     }
 
     #[test]
@@ -862,29 +540,28 @@ mod tests {
 
         assert_eq!(
             sanitize_markdown(input),
-            "```html\n<script>alert(1)</script>\n<img src=x onerror=evil()>\n```\ntail<img src=x >"
+            "```html\n<script>alert(1)</script>\n<img src=x onerror=evil()>\n```\n<img src=\"x\">"
         );
     }
 
     #[test]
-    fn test_sanitize_markdown_strips_nested_dangerous_tags_to_fixed_point() {
+    fn test_sanitize_markdown_strips_nested_dangerous_tags() {
         let output = sanitize_markdown("<scr<script>ipt>alert(1)</scr</script>ipt>");
 
-        assert_eq!(output, "alert(1)");
-        assert!(!output.contains("<script"));
+        assert!(!output.contains("<script"), "{output}");
+        assert!(!output.contains("<scr"), "{output}");
     }
 
     #[test]
-    fn test_sanitize_markdown_strips_folded_dangerous_tags_to_fixed_point() {
+    fn test_sanitize_markdown_strips_folded_dangerous_tags() {
         for tag in [
             "iframe", "object", "embed", "form", "input", "button", "textarea", "select", "option",
             "base", "meta", "link", "svg", "math", "style",
         ] {
             let split = tag.len() / 2;
             let (prefix, suffix) = tag.split_at(split);
-            // The inner dangerous tag is removed first; the surrounding
-            // prefix/suffix then fold back into the original tag name, which
-            // the fixed-point pass must also remove.
+            // Folding a tag name around another tag used to defeat the
+            // blocklist; an allowlist drops every unrecognised tag instead.
             let input = format!("<{prefix}<{tag}></{tag}>{suffix}>payload</{prefix}{suffix}>");
             let output = sanitize_markdown(&input);
 
@@ -898,16 +575,15 @@ mod tests {
     fn test_sanitize_markdown_strips_dangerous_tags_folded_into_attribute_span() {
         let output = sanitize_markdown(r#"<div title="><script>alert(1)</script>">safe</div>"#);
 
-        assert_eq!(output, r#"<div title=">alert(1)">safe</div>"#);
-        assert!(!output.contains("<script"));
+        assert!(output.contains("safe</div>"), "{output}");
+        assert!(!output.contains("<script"), "{output}");
     }
 
     #[test]
-    fn test_sanitize_markdown_strips_style_tags() {
+    fn test_sanitize_markdown_strips_style_tags_and_their_content() {
         let output = sanitize_markdown("<style>body{display:none}</style><p>safe</p>");
 
-        assert_eq!(output, "body{display:none}<p>safe</p>");
-        assert!(!output.contains("<style"));
+        assert_eq!(output, "<p>safe</p>");
     }
 
     #[test]
@@ -916,15 +592,16 @@ mod tests {
             r#"<h2 onclick="alert(1)">Hi</h2><a href="https://example.test" onmouseover='x'>link</a><img src=x onerror=doWork(1)>"#,
         );
 
-        assert!(output.contains("<h2 "));
-        assert!(output.contains(">Hi</h2>"));
-        assert!(output.contains(r#"<a href="https://example.test" "#));
-        assert!(output.contains(">link</a>"));
-        assert!(output.contains("<img src=x "));
-        assert!(!output.contains("<h2 onclick"));
-        assert!(!output.contains("onmouseover"));
-        assert!(!output.contains("onerror"));
-        assert!(!output.contains("doWork"));
+        assert!(output.contains("<h2>Hi</h2>"), "{output}");
+        assert!(
+            output.contains(r#"<a href="https://example.test">link</a>"#),
+            "{output}"
+        );
+        assert!(output.contains(r#"<img src="x">"#), "{output}");
+        assert!(!output.contains("onclick"), "{output}");
+        assert!(!output.contains("onmouseover"), "{output}");
+        assert!(!output.contains("onerror"), "{output}");
+        assert!(!output.contains("doWork"), "{output}");
     }
 
     #[test]
@@ -932,12 +609,10 @@ mod tests {
         let output = sanitize_markdown(r#"<img/onerror=alert(1)><a/onmouseover="evil()">link</a>"#);
 
         assert!(output.contains("link</a>"), "{output}");
-        assert!(!output.contains("<img/"), "{output}");
-        assert!(!output.contains("<a/"), "{output}");
-        assert!(!output.contains("onerror"));
-        assert!(!output.contains("onmouseover"));
-        assert!(!output.contains("alert"));
-        assert!(!output.contains("evil"));
+        assert!(!output.contains("onerror"), "{output}");
+        assert!(!output.contains("onmouseover"), "{output}");
+        assert!(!output.contains("alert"), "{output}");
+        assert!(!output.contains("evil"), "{output}");
     }
 
     #[test]
@@ -951,24 +626,21 @@ mod tests {
     fn test_sanitize_markdown_strips_event_handler_attrs_with_quote_in_unquoted_value() {
         let output = sanitize_markdown(r#"<img src="safe.png" data-x=a"b onerror=alert(1)>"#);
 
-        assert_eq!(output, r#"<img src="safe.png" data-x=a"b >"#);
-        assert!(!output.contains("onerror"));
-        assert!(!output.contains("alert"));
+        assert_eq!(output, r#"<img src="safe.png">"#);
     }
 
     #[test]
-    fn test_sanitize_markdown_escapes_unclosed_dangerous_tag() {
+    fn test_sanitize_markdown_drops_unclosed_dangerous_tag() {
         let output = sanitize_markdown("<script src=x");
 
-        assert_eq!(output, "&lt;script src=x");
+        assert!(!output.contains("script"), "{output}");
     }
 
     #[test]
-    fn test_sanitize_markdown_redacts_dangerous_url_protocols_in_html() {
+    fn test_sanitize_markdown_drops_dangerous_url_protocols_in_html() {
         let output = sanitize_markdown(r#"<a href="javascript:alert(1)">link</a>"#);
 
-        assert_eq!(output, r#"<a href="(redacted)alert(1)">link</a>"#);
-        assert!(!output.contains("javascript:"));
+        assert_eq!(output, "<a>link</a>");
     }
 
     // IS-07b: URL protocol sanitization
diff --git a/src/sanitize/markdown.rs b/src/sanitize/markdown.rs
new file mode 100644
index 00000000..92717bd7
--- /dev/null
+++ b/src/sanitize/markdown.rs
@@ -0,0 +1,533 @@
+//! Markdown-aware sanitization for untrusted agent content that Azure DevOps
+//! renders as Markdown (for example a work item description field stored with
+//! `multilineFieldsFormat: Markdown`).
+//!
+//! The policy has two halves:
+//!
+//! * **Markdown structure** — [`pulldown_cmark`] parses the content so the
+//!   sanitizer knows which source ranges are code spans, code fences and
+//!   autolinks (left verbatim), and which ranges are link/image destinations
+//!   (checked against a URL scheme allowlist).
+//! * **Inline HTML** — everything outside those protected ranges goes through
+//!   an [`ammonia`] allowlist. Azure DevOps only renders a small subset of HTML
+//!   inside Markdown fields (and explicitly blocks scripting constructs such as
+//!   `<script>` and `<iframe>`), so the allowlist starts from the tags that
+//!   have a Markdown equivalent instead of trying to enumerate dangerous tags.
+//!
+//! Enumerating *dangerous* tags is what the previous hand-rolled implementation
+//! did; every new evasion (folded tags, unquoted attributes, decoded schemes)
+//! needed another special case. Allowlisting is closed by construction: anything
+//! the parser does not recognise as an allowed tag is dropped, and anything that
+//! is not an allowed URL scheme is removed.
+
+use std::collections::{HashMap, HashSet};
+use std::ops::Range;
+use std::sync::LazyLock;
+
+use ammonia::{Builder, UrlRelative};
+use pulldown_cmark::{Event, LinkType, Options, Parser, Tag};
+
+/// Placeholder substituted for a destination whose scheme is not allowed.
+const REDACTED: &str = "(redacted)";
+
+/// HTML tags preserved inside a Markdown description.
+///
+/// Restricted to formatting elements that have a Markdown equivalent, so a
+/// renderer that ignores raw HTML still shows equivalent content.
+const ALLOWED_TAGS: &[&str] = &[
+    "a",
+    "b",
+    "blockquote",
+    "br",
+    "code",
+    "dd",
+    "del",
+    "details",
+    "div",
+    "dl",
+    "dt",
+    "em",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "hr",
+    "i",
+    "img",
+    "ins",
+    "kbd",
+    "li",
+    "ol",
+    "p",
+    "pre",
+    "s",
+    "samp",
+    "span",
+    "strong",
+    "sub",
+    "summary",
+    "sup",
+    "table",
+    "tbody",
+    "td",
+    "tfoot",
+    "th",
+    "thead",
+    "tr",
+    "u",
+    "ul",
+];
+
+/// URL schemes allowed in HTML attributes and in Markdown link/image
+/// destinations. Everything else (`javascript:`, `data:`, `file:`,
+/// `vbscript:`, …) is denied because it is not on this list.
+const ALLOWED_URL_SCHEMES: &[&str] = &["http", "https", "mailto"];
+
+static CLEANER: LazyLock<Builder<'static>> = LazyLock::new(|| {
+    let mut builder = Builder::empty();
+    builder
+        .tags(ALLOWED_TAGS.iter().copied().collect())
+        .clean_content_tags(["script", "style"].into_iter().collect())
+        .generic_attributes(["title"].into_iter().collect())
+        .tag_attributes(tag_attributes())
+        .url_schemes(ALLOWED_URL_SCHEMES.iter().copied().collect())
+        .url_relative(UrlRelative::PassThrough)
+        .link_rel(None)
+        .strip_comments(true);
+    builder
+});
+
+fn tag_attributes() -> HashMap<&'static str, HashSet<&'static str>> {
+    let mut attributes: HashMap<&'static str, HashSet<&'static str>> = HashMap::new();
+    attributes.insert("a", ["href"].into_iter().collect());
+    attributes.insert(
+        "img",
+        ["src", "alt", "width", "height"].into_iter().collect(),
+    );
+    for cell in ["td", "th"] {
+        attributes.insert(cell, ["colspan", "rowspan", "align"].into_iter().collect());
+    }
+    attributes
+}
+
+/// Apply the HTML allowlist and URL scheme policy to `input`, leaving Markdown
+/// code spans, code fences and autolinks untouched.
+///
+/// `transform_text` is applied to every non-protected source range before the
+/// HTML allowlist runs, so caller-owned text transformations (mentions, bot
+/// triggers) also skip code.
+pub(super) fn sanitize_markdown_html(
+    input: &str,
+    mut transform_text: impl FnMut(&str) -> String,
+) -> String {
+    let mut result = String::with_capacity(input.len());
+    let mut cursor = 0;
+
+    for region in regions(input) {
+        let range = region.range();
+        if range.start < cursor {
+            // Overlapping regions can only happen for nested constructs; the
+            // outer one already covered this range.
+            continue;
+        }
+        result.push_str(&clean_html(&transform_text(&input[cursor..range.start])));
+        match region {
+            Region::Protected(_) => result.push_str(&input[range.clone()]),
+            Region::Redact(_) => result.push_str(REDACTED),
+        }
+        cursor = range.end;
+    }
+
+    result.push_str(&clean_html(&transform_text(&input[cursor..])));
+    result
+}
+
+/// Source ranges of Markdown code spans, code fences and indented code blocks.
+///
+/// Exposed for the plain-text sanitizer, which escapes HTML tags everywhere
+/// except inside code.
+pub(super) fn code_ranges(input: &str) -> Vec<Range<usize>> {
+    let mut ranges = Vec::new();
+    let mut skip_until = 0;
+
+    for (event, range) in Parser::new_ext(input, options()).into_offset_iter() {
+        if range.start < skip_until {
+            continue;
+        }
+        match event {
+            Event::Code(_) => ranges.push(range),
+            Event::Start(Tag::CodeBlock(_)) => {
+                skip_until = range.end;
+                ranges.push(range);
+            }
+            _ => {}
+        }
+    }
+
+    ranges
+}
+
+enum Region {
+    /// Copied through verbatim.
+    Protected(Range<usize>),
+    /// Replaced with [`REDACTED`].
+    Redact(Range<usize>),
+}
+
+impl Region {
+    fn range(&self) -> Range<usize> {
+        match self {
+            Region::Protected(range) | Region::Redact(range) => range.clone(),
+        }
+    }
+}
+
+fn options() -> Options {
+    Options::ENABLE_TABLES
+        | Options::ENABLE_STRIKETHROUGH
+        | Options::ENABLE_TASKLISTS
+        | Options::ENABLE_FOOTNOTES
+}
+
+fn regions(input: &str) -> Vec<Region> {
+    let mut regions: Vec<Region> = Vec::new();
+    let mut skip_until = 0;
+
+    let mut iter = Parser::new_ext(input, options()).into_offset_iter();
+    let events: Vec<_> = iter.by_ref().collect();
+
+    for (event, range) in events {
+        if range.start < skip_until {
+            continue;
+        }
+        match event {
+            Event::Code(_) => regions.push(Region::Protected(range)),
+            Event::Start(Tag::CodeBlock(_)) => {
+                skip_until = range.end;
+                regions.push(Region::Protected(range));
+            }
+            Event::Start(Tag::Link {
+                link_type,
+                dest_url,
+                ..
+            })
+            | Event::Start(Tag::Image {
+                link_type,
+                dest_url,
+                ..
+            }) => {
+                if scheme_allowed(&dest_url) {
+                    if matches!(link_type, LinkType::Autolink | LinkType::Email) {
+                        // `<https://example.test>` must not be rewritten by the
+                        // HTML allowlist, which would parse it as a bogus tag.
+                        skip_until = range.end;
+                        regions.push(Region::Protected(range));
+                    } else if let Some(destination) = locate_destination(input, &range, &dest_url) {
+                        // A destination is a URL, not prose: text transforms
+                        // such as @mention wrapping must not rewrite it.
+                        regions.push(Region::Protected(destination));
+                    }
+                    continue;
+                }
+
+                match link_type {
+                    // The destination lives in a reference definition, which is
+                    // handled separately below.
+                    LinkType::Reference
+                    | LinkType::ReferenceUnknown
+                    | LinkType::Collapsed
+                    | LinkType::CollapsedUnknown
+                    | LinkType::Shortcut
+                    | LinkType::ShortcutUnknown => {}
+                    _ => {
+                        skip_until = range.end;
+                        regions.push(Region::Redact(
+                            locate_destination(input, &range, &dest_url).unwrap_or(range),
+                        ));
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+
+    for (_, definition) in iter.reference_definitions().iter() {
+        let Some(range) = locate_destination(input, &definition.span, &definition.dest) else {
+            continue;
+        };
+        if scheme_allowed(&definition.dest) {
+            regions.push(Region::Protected(range));
+        } else {
+            regions.push(Region::Redact(range));
+        }
+    }
+
+    regions.sort_by_key(|region| region.range().start);
+    regions
+}
+
+/// Find the literal destination text inside the element's source range.
+///
+/// `dest_url` is the parser's decoded destination, so it does not always appear
+/// verbatim in the source (percent/entity/backslash escapes). Callers fall back
+/// to redacting the whole element when it cannot be located.
+fn locate_destination(input: &str, span: &Range<usize>, dest_url: &str) -> Option<Range<usize>> {
+    if dest_url.is_empty() {
+        return None;
+    }
+    let source = input.get(span.clone())?;
+    let offset = source.find(dest_url)?;
+    let start = span.start + offset;
+    Some(start..start + dest_url.len())
+}
+
+/// Deny-by-default scheme check: relative destinations and fragments are
+/// allowed, absolute ones must use an allowed scheme.
+fn scheme_allowed(dest_url: &str) -> bool {
+    let trimmed = dest_url.trim();
+    let Some(colon) = trimmed.find(':') else {
+        return true;
+    };
+    let scheme = &trimmed[..colon];
+    // A colon that appears after a path separator is not a scheme delimiter.
+    if scheme.contains('/') || scheme.contains('?') || scheme.contains('#') {
+        return true;
+    }
+    // The parser has already decoded entities, so an evasion like
+    // `java&Tab;script:` arrives here with the whitespace in place.
+    let scheme = scheme.trim().to_ascii_lowercase();
+    ALLOWED_URL_SCHEMES.contains(&scheme.as_str())
+}
+
+fn clean_html(input: &str) -> String {
+    if input.is_empty() {
+        return String::new();
+    }
+    let cleaned = CLEANER.clean(input).to_string();
+    restore_markdown_text(&cleaned)
+}
+
+/// Undo the one piece of HTML text escaping that changes how Markdown renders.
+///
+/// The serializer escapes `<`, `>` and `&` in text nodes. `&lt;` must stay
+/// escaped — that is what stops a dropped tag from being re-parsed as markup —
+/// and an escaped `&`/`>` in the middle of a line renders identically to the
+/// raw character. A leading `>` is different: it opens a blockquote, so it is
+/// restored at the start of every line.
+fn restore_markdown_text(input: &str) -> String {
+    let mut result = String::with_capacity(input.len());
+    for line in input.split_inclusive('\n') {
+        result.push_str(&restore_blockquote_markers(line));
+    }
+    result
+}
+
+fn restore_blockquote_markers(line: &str) -> String {
+    let mut rest = line;
+    let mut prefix = String::new();
+
+    loop {
+        let indent = rest.len() - rest.trim_start_matches(' ').len();
+        if indent > 3 {
+            break;
+        }
+        let Some(after) = rest[indent..].strip_prefix("&gt;") else {
+            break;
+        };
+        prefix.push_str(&rest[..indent]);
+        prefix.push('>');
+        rest = after;
+    }
+
+    if prefix.is_empty() {
+        return line.to_string();
+    }
+    prefix + rest
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::sanitize::sanitize_markdown;
+
+    #[test]
+    fn preserves_plain_markdown_structure() {
+        let input = "# Title\n\n- item one\n- item two\n\n> quoted line\n\n| a | b |\n| - | - |\n| 1 | 2 |\n\n**bold** and _italic_\n";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn escapes_bare_less_than_in_prose() {
+        // `<` stays escaped so a dropped tag can never be re-parsed as markup.
+        // Markdown renders the entity as the original character.
+        assert_eq!(sanitize_markdown("a < b"), "a &lt; b");
+    }
+
+    #[test]
+    fn preserves_nested_blockquotes() {
+        let input = "> outer\n> > inner\n";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn preserves_markdown_links_with_allowed_schemes() {
+        let input = "[docs](https://learn.microsoft.com/azure/devops) and [mail](mailto:team@example.test) and [rel](./page.md#frag)";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn preserves_autolinks() {
+        let input = "<https://dev.azure.com/org/project> and <team@example.test>";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn redacts_markdown_link_destination_with_denied_scheme() {
+        let output = sanitize_markdown("[click me](javascript:alert(1))");
+
+        assert!(!output.contains("javascript:"), "{output}");
+        assert!(output.contains("(redacted)"), "{output}");
+        assert!(output.contains("click me"), "{output}");
+    }
+
+    #[test]
+    fn redacts_markdown_image_destination_with_denied_scheme() {
+        let output = sanitize_markdown("![logo](data:text/html;base64,PHNjcmlwdD4=)");
+
+        assert!(!output.contains("data:"), "{output}");
+        assert!(output.contains("(redacted)"), "{output}");
+    }
+
+    #[test]
+    fn redacts_autolink_with_denied_scheme() {
+        let output = sanitize_markdown("<javascript:alert(1)>");
+
+        assert!(!output.contains("javascript:"), "{output}");
+    }
+
+    #[test]
+    fn redacts_reference_definition_with_denied_scheme() {
+        let output = sanitize_markdown("See [the link][ref].\n\n[ref]: vbscript:msgbox(1)\n");
+
+        assert!(!output.contains("vbscript:"), "{output}");
+        assert!(output.contains("(redacted)"), "{output}");
+        assert!(output.contains("the link"), "{output}");
+    }
+
+    #[test]
+    fn preserves_reference_definition_with_allowed_scheme() {
+        let input = "See [the link][ref].\n\n[ref]: https://example.test/page\n";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn strips_denied_scheme_in_html_attribute_regardless_of_encoding() {
+        for href in [
+            "javascript:alert(1)",
+            "JaVaScRiPt:alert(1)",
+            "&#106;avascript:alert(1)",
+            "java\tscript:alert(1)",
+            " javascript:alert(1)",
+            "data:text/html,<h1>hi</h1>",
+            "file:///etc/passwd",
+            "vbscript:msgbox(1)",
+        ] {
+            let output = sanitize_markdown(&format!(r#"<a href="{href}">link</a>"#));
+
+            assert_eq!(output, "<a>link</a>", "href: {href}");
+        }
+    }
+
+    #[test]
+    fn strips_denied_scheme_in_markdown_link_regardless_of_case() {
+        let output = sanitize_markdown("[x](JAVASCRIPT:alert(1))");
+
+        assert!(
+            !output.to_ascii_lowercase().contains("javascript:"),
+            "{output}"
+        );
+    }
+
+    #[test]
+    fn drops_svg_and_mathml_payloads() {
+        let output = sanitize_markdown(
+            "<svg><animate onbegin=alert(1) attributeName=x dur=1s></animate></svg>\
+             <math><mtext><table><mglyph><style><img src=x onerror=alert(1)></style></mglyph></mtext></math>",
+        );
+
+        assert!(!output.contains("<svg"), "{output}");
+        assert!(!output.contains("<math"), "{output}");
+        assert!(!output.contains("onerror"), "{output}");
+        assert!(!output.contains("onbegin"), "{output}");
+        assert!(!output.contains("alert"), "{output}");
+    }
+
+    #[test]
+    fn drops_unquoted_and_malformed_attributes() {
+        let output =
+            sanitize_markdown(r#"<a href=https://example.test onclick=alert(1) x=<b>>link</a>"#);
+
+        assert!(!output.contains("onclick"), "{output}");
+        assert!(!output.contains("alert"), "{output}");
+        assert!(output.contains("link"), "{output}");
+    }
+
+    #[test]
+    fn drops_disallowed_attributes_on_allowed_tags() {
+        let output =
+            sanitize_markdown(r#"<div id="x" class="y" style="color:red" title="ok">text</div>"#);
+
+        assert_eq!(output, r#"<div title="ok">text</div>"#);
+    }
+
+    #[test]
+    fn preserves_html_and_markdown_inside_inline_code_spans() {
+        let input = "Use `<script>alert(1)</script>` and ``a `b` [x](javascript:1)`` inline.";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn preserves_tilde_fenced_and_indented_code_blocks() {
+        let input =
+            "~~~\n<script>alert(1)</script>\n~~~\n\ntext\n\n    <iframe src=evil></iframe>\n";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn skips_mention_and_bot_trigger_neutralization_inside_code() {
+        let input = "```\n@user fixes #12 AB#34\n```\n";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn neutralizes_mentions_and_bot_triggers_outside_code() {
+        let output = sanitize_markdown("@user fixes #12 AB#34");
+
+        assert!(output.contains("`@user`"), "{output}");
+        assert!(output.contains("`fixes #12`"), "{output}");
+        assert!(output.contains("`AB#34`"), "{output}");
+    }
+
+    #[test]
+    fn neutralizes_pipeline_commands_inside_code_blocks() {
+        // Pipeline command neutralization is a transport concern: the string is
+        // echoed by the agent job, where a fence is not a fence.
+        let output = sanitize_markdown("```\n##vso[task.setvariable variable=x]y\n```\n");
+
+        assert!(!output.contains("##vso[task"), "{output}");
+    }
+
+    #[test]
+    fn removes_html_comments_including_unclosed() {
+        assert_eq!(sanitize_markdown("a<!-- <script>x</script> -->b"), "ab");
+        assert_eq!(sanitize_markdown("a<!-- unterminated"), "a");
+    }
+
+    #[test]
+    fn removes_control_characters() {
+        let output = sanitize_markdown("a\x1b[31mb\x00c");
+
+        assert_eq!(output, "abc");
+    }
+}

From bed51f46525ea6ed9f3e09d7c83a64ecc9021c29 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 20 Aug 2026 06:22:06 +0000
Subject: [PATCH 31/41] test(sanitize): cover encoded denied scheme in markdown
 link

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize/markdown.rs | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/sanitize/markdown.rs b/src/sanitize/markdown.rs
index 92717bd7..ecd2a6bd 100644
--- a/src/sanitize/markdown.rs
+++ b/src/sanitize/markdown.rs
@@ -271,8 +271,10 @@ fn regions(input: &str) -> Vec<Region> {
 /// Find the literal destination text inside the element's source range.
 ///
 /// `dest_url` is the parser's decoded destination, so it does not always appear
-/// verbatim in the source (percent/entity/backslash escapes). Callers fall back
-/// to redacting the whole element when it cannot be located.
+/// verbatim in the source (percent/entity/backslash escapes). When it cannot be
+/// located the caller degrades safely: a denied scheme redacts the whole
+/// element, and an allowed destination is simply not marked protected, so it
+/// flows through the HTML allowlist like ordinary text.
 fn locate_destination(input: &str, span: &Range<usize>, dest_url: &str) -> Option<Range<usize>> {
     if dest_url.is_empty() {
         return None;
@@ -524,6 +526,16 @@ mod tests {
         assert_eq!(sanitize_markdown("a<!-- unterminated"), "a");
     }
 
+    #[test]
+    fn redacts_encoded_denied_scheme_in_markdown_link() {
+        // The parser decodes the destination, so the literal source text does
+        // not match; the whole element is redacted rather than passed through.
+        let output = sanitize_markdown("[x](javascript&#58;alert&#40;1&#41;)");
+
+        assert!(!output.contains("javascript"), "{output}");
+        assert!(output.contains("(redacted)"), "{output}");
+    }
+
     #[test]
     fn removes_control_characters() {
         let output = sanitize_markdown("a\x1b[31mb\x00c");

From 2804cd44f84d6c3cf25d6e989051b9965f7d73b2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 21 Aug 2026 10:16:40 +0000
Subject: [PATCH 32/41] test(safe-outputs): verify work item rendering fidelity
 end to end

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 .../__tests__/work-item-scenarios.test.ts     | 141 ++++++++++++++
 .../ado-script/src/executor-e2e/ado-rest.ts   |  26 ++-
 .../scenarios/markdown-rendering-corpus.json  | 143 ++++++++++++++
 .../src/executor-e2e/scenarios/work-item.ts   | 177 ++++++++++++++++++
 src/safe_outputs/create_work_item.rs          |  66 +++++++
 src/sanitize.rs                               |   2 +-
 src/sanitize/markdown.rs                      |  48 +++++
 tests/executor-e2e/README.md                  |  36 +++-
 8 files changed, 635 insertions(+), 4 deletions(-)
 create mode 100644 scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json

diff --git a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
index 6992687d..83e399b2 100644
--- a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
+++ b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
@@ -2,9 +2,12 @@ import { describe, expect, it, vi } from "vitest";
 
 import type { ExecutedRecord, ScenarioContext } from "../scenario.js";
 import { SkipError } from "../scenario.js";
+import renderingCorpus from "../scenarios/markdown-rendering-corpus.json" with { type: "json" };
 import {
   assignWorkItemTemporaryIdHandoff,
+  createBugWorkItemRendering,
   createWorkItem,
+  createWorkItemRendering,
   resolveWorkItemAssignee,
   workItemScenarios,
 } from "../scenarios/work-item.js";
@@ -141,3 +144,141 @@ describe("assign-work-item temporary-ID handoff", () => {
     expect(deleteWorkItem).toHaveBeenCalledWith(42);
   });
 });
+
+describe("create-work-item rendering fidelity", () => {
+  const expected = renderingCorpus.expected.join("\n");
+
+  function renderingCtx(
+    payload: {
+      id: number;
+      fields: Record<string, unknown>;
+      multilineFieldsFormat?: Record<string, unknown>;
+    },
+    typeExists = true,
+  ): ScenarioContext {
+    return {
+      ...fakeCtx(),
+      rest: {
+        getWorkItem: vi.fn(async () => payload),
+        workItemTypeExists: vi.fn(async () => typeExists),
+      } as unknown as ScenarioContext["rest"],
+    };
+  }
+
+  const record: ExecutedRecord = {
+    name: "create_work_item",
+    status: "succeeded",
+    result: { id: 42 },
+  };
+
+  it("registers both description-field scenarios", () => {
+    const ids = workItemScenarios.map((scenario) => scenario.id ?? scenario.tool);
+    expect(ids).toContain("create-work-item-rendering");
+    expect(ids).toContain("create-work-item-rendering-bug");
+  });
+
+  it("proposes the raw (unsanitized) corpus so the executor does the sanitizing", async () => {
+    const entry = await createWorkItemRendering.ndjson(fakeCtx(), {
+      title: "ado-aw-det-77-create-work-item-rendering",
+    });
+    expect(entry.description).toBe(renderingCorpus.input.join("\n"));
+    expect(createWorkItemRendering.config(fakeCtx(), { title: "t" })).toMatchObject({
+      "work-item-type": "Task",
+      "include-stats": false,
+    });
+    expect(createBugWorkItemRendering.config(fakeCtx(), { title: "t" })).toMatchObject({
+      "work-item-type": "Bug",
+    });
+  });
+
+  it("skips when the project does not define the work item type", async () => {
+    await expect(
+      createBugWorkItemRendering.setup(renderingCtx({ id: 42, fields: {} }, false)),
+    ).rejects.toThrow(SkipError);
+  });
+
+  it("accepts a work item whose description round-trips the golden", async () => {
+    const state: { title: string; createdId?: number } = { title: "t" };
+    await createWorkItemRendering.assert(
+      renderingCtx({
+        id: 42,
+        fields: { "System.Description": expected },
+        multilineFieldsFormat: { "System.Description": "Markdown" },
+      }),
+      state,
+      record,
+      [record],
+    );
+    expect(state.createdId).toBe(42);
+  });
+
+  it("records the created id before failing a golden mismatch", async () => {
+    const state: { title: string; createdId?: number } = { title: "t" };
+    await expect(
+      createWorkItemRendering.assert(
+        // Security-clean but not byte-identical: only the golden catches it.
+        renderingCtx({
+          id: 42,
+          fields: { "System.Description": expected.replace("**bold**", "bold") },
+        }),
+        state,
+        record,
+        [record],
+      ),
+    ).rejects.toThrow(/does not match the sanitized golden/);
+    expect(state.createdId).toBe(42);
+  });
+
+  it("fails when the field is not stored as Markdown", async () => {
+    await expect(
+      createWorkItemRendering.assert(
+        renderingCtx({
+          id: 42,
+          fields: { "System.Description": expected },
+          multilineFieldsFormat: { "System.Description": "Html" },
+        }),
+        { title: "t" },
+        record,
+        [record],
+      ),
+    ).rejects.toThrow(/expected "Markdown"/);
+  });
+
+  it("fails when a denied construct survives outside fenced code", async () => {
+    const leaked = `${expected}\n<script>alert(1)</script>`;
+    await expect(
+      createWorkItemRendering.assert(
+        renderingCtx({ id: 42, fields: { "System.Description": leaked } }),
+        { title: "t" },
+        record,
+        [record],
+      ),
+    ).rejects.toThrow(/still contains '<script' outside code/);
+  });
+
+  it("fails when fenced code was mangled", async () => {
+    const mangled = expected.replace(
+      '<script>alert("fenced code is verbatim")</script>',
+      "",
+    );
+    await expect(
+      createWorkItemRendering.assert(
+        renderingCtx({ id: 42, fields: { "System.Description": mangled } }),
+        { title: "t" },
+        record,
+        [record],
+      ),
+    ).rejects.toThrow(/lost fenced code line/);
+  });
+
+  it("asserts the Bug repro-steps field", async () => {
+    await expect(
+      createBugWorkItemRendering.assert(
+        renderingCtx({ id: 42, fields: { "System.Description": expected } }),
+        { title: "t" },
+        record,
+        [record],
+      ),
+    ).rejects.toThrow(/has no string 'Microsoft\.VSTS\.TCM\.ReproSteps'/);
+  });
+});
diff --git a/scripts/ado-script/src/executor-e2e/ado-rest.ts b/scripts/ado-script/src/executor-e2e/ado-rest.ts
index 183ac5b1..65dd24fa 100644
--- a/scripts/ado-script/src/executor-e2e/ado-rest.ts
+++ b/scripts/ado-script/src/executor-e2e/ado-rest.ts
@@ -132,13 +132,35 @@ export class AdoRest {
     return res;
   }
 
-  async getWorkItem(id: number): Promise<{ id: number; fields: Record<string, unknown> }> {
+  async getWorkItem(id: number): Promise<{
+    id: number;
+    fields: Record<string, unknown>;
+    /**
+     * Per-field rendering format (`Markdown` | `Html`). Only present on
+     * organizations where the work-item Markdown feature is enabled, so
+     * callers must treat it as optional.
+     */
+    multilineFieldsFormat?: Record<string, unknown>;
+  }> {
     const path = this.projPath(`_apis/wit/workitems/${id}?api-version=7.1`);
-    const res = await this.request<{ id: number; fields: Record<string, unknown> }>(path);
+    const res = await this.request<{
+      id: number;
+      fields: Record<string, unknown>;
+      multilineFieldsFormat?: Record<string, unknown>;
+    }>(path);
     if (!res) throw new Error(`getWorkItem(${id}) returned no body`);
     return res;
   }
 
+  /** True when the project defines the given work item type (e.g. `Bug`). */
+  async workItemTypeExists(type: string): Promise<boolean> {
+    const path = this.projPath(
+      `_apis/wit/workitemtypes/${AdoRest.seg(type)}?api-version=7.1`,
+    );
+    const res = await this.request<{ name?: string }>(path, { allow404: true });
+    return res !== undefined;
+  }
+
   /** Find the newest live work item with an exact title. Used for cleanup recovery. */
   async findWorkItemByTitle(title: string): Promise<number | undefined> {
     const escapedTitle = title.replaceAll("'", "''");
diff --git a/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json b/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json
new file mode 100644
index 00000000..f721e1aa
--- /dev/null
+++ b/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json
@@ -0,0 +1,143 @@
+{
+  "$comment": [
+    "Shared Markdown rendering-fidelity corpus for the work-item description",
+    "sanitizer (src/sanitize/markdown.rs, applied to create-work-item's",
+    "description). This file is the SINGLE source of truth for both:",
+    "  * the Rust golden test in src/sanitize/markdown.rs (include_str!), and",
+    "  * the create-work-item-rendering executor E2E scenarios",
+    "    (scripts/ado-script/src/executor-e2e/scenarios/work-item.ts).",
+    "Both consume it, so the fast local test and the against-ADO test can never",
+    "disagree about what a human is supposed to see.",
+    "`input` is what an agent proposes; `expected` is the sanitized text that",
+    "must be stored verbatim in the work item's description field. Both are",
+    "arrays of lines joined with \\n."
+  ],
+  "input": [
+    "# Rendering fidelity corpus",
+    "",
+    "Paragraph with **bold**, _italic_, `inline <b>code</b>` and a <b>bold tag</b>.<br />",
+    "Line after the break.",
+    "",
+    "## Lists",
+    "",
+    "1. Ordered item",
+    "2. Ordered item with a nested list",
+    "   - Nested bullet",
+    "   - Nested bullet with [a link](https://example.test/docs)",
+    "",
+    "## Tables",
+    "",
+    "| Field | Value |",
+    "| --- | --- |",
+    "| Markdown table | plain cell |",
+    "",
+    "<table>",
+    "  <tr><th colspan=\"2\">HTML header</th></tr>",
+    "  <tr><td align=\"left\">left</td><td>right</td></tr>",
+    "</table>",
+    "",
+    "## Disclosure and inline tags",
+    "",
+    "<details>",
+    "<summary>Collapsed section</summary>",
+    "",
+    "Body with <kbd>Ctrl</kbd>+<kbd>C</kbd>, H<sub>2</sub>O and x<sup>2</sup>.",
+    "",
+    "</details>",
+    "",
+    "## Links and images",
+    "",
+    "Autolink: <https://example.test/autolink>",
+    "",
+    "Image: ![diagram](https://example.test/diagram.png)",
+    "",
+    "Denied image scheme: ![bad](data:image/svg+xml;base64,AAAA)",
+    "",
+    "Denied link scheme: [click me](javascript:alert(1))",
+    "",
+    "Entity-encoded denied scheme: [encoded](java&#115;cript:alert(1))",
+    "",
+    "## Code",
+    "",
+    "```html",
+    "<script>alert(\"fenced code is verbatim\")</script>",
+    "<a href=\"javascript:alert(1)\">fenced javascript link</a>",
+    "```",
+    "",
+    "## Denied HTML",
+    "",
+    "<script>alert(\"dropped\")</script>",
+    "",
+    "<img src=\"x\" onerror=\"alert(1)\" alt=\"onerror attribute\">",
+    "",
+    "<SCRIPT >alert(\"folded\")</SCRIPT>",
+    "",
+    "<a href=\"java&#115;cript:alert(1)\">entity-encoded href</a>",
+    "",
+    "<iframe src=\"https://example.test/embed\"></iframe>"
+  ],
+  "expected": [
+    "# Rendering fidelity corpus",
+    "",
+    "Paragraph with **bold**, _italic_, `inline <b>code</b>` and a <b>bold tag</b>.<br>",
+    "Line after the break.",
+    "",
+    "## Lists",
+    "",
+    "1. Ordered item",
+    "2. Ordered item with a nested list",
+    "   - Nested bullet",
+    "   - Nested bullet with [a link](https://example.test/docs)",
+    "",
+    "## Tables",
+    "",
+    "| Field | Value |",
+    "| --- | --- |",
+    "| Markdown table | plain cell |",
+    "",
+    "<table>",
+    "  <tbody><tr><th colspan=\"2\">HTML header</th></tr>",
+    "  <tr><td align=\"left\">left</td><td>right</td></tr>",
+    "</tbody></table>",
+    "",
+    "## Disclosure and inline tags",
+    "",
+    "<details>",
+    "<summary>Collapsed section</summary>",
+    "",
+    "Body with <kbd>Ctrl</kbd>+<kbd>C</kbd>, H<sub>2</sub>O and x<sup>2</sup>.",
+    "",
+    "</details>",
+    "",
+    "## Links and images",
+    "",
+    "Autolink: <https://example.test/autolink>",
+    "",
+    "Image: ![diagram](https://example.test/diagram.png)",
+    "",
+    "Denied image scheme: ![bad]((redacted))",
+    "",
+    "Denied link scheme: [click me]((redacted))",
+    "",
+    "Entity-encoded denied scheme: (redacted)",
+    "",
+    "## Code",
+    "",
+    "```html",
+    "<script>alert(\"fenced code is verbatim\")</script>",
+    "<a href=\"javascript:alert(1)\">fenced javascript link</a>",
+    "```",
+    "",
+    "## Denied HTML",
+    "",
+    "",
+    "",
+    "<img src=\"x\" alt=\"onerror attribute\">",
+    "",
+    "",
+    "",
+    "<a>entity-encoded href</a>",
+    "",
+    ""
+  ]
+}
diff --git a/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts b/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts
index 0b9efaf5..cd3215a6 100644
--- a/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts
+++ b/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts
@@ -7,11 +7,37 @@
 import type { ExecutedRecord, PriorEntry, Scenario, ScenarioContext } from "../scenario.js";
 import { SkipError } from "../scenario.js";
 import { detBody, numResult, strResult, Teardown } from "./common.js";
+import renderingCorpus from "./markdown-rendering-corpus.json" with { type: "json" };
 
 const WORK_ITEM_TYPE = "Task";
 const CREATE_TEMPORARY_ID = "#aw_wicreate";
 const ASSIGN_TEMPORARY_ID = "#aw_wiassign";
 
+/**
+ * Rendering-fidelity corpus shared with the Rust golden test in
+ * `src/sanitize/markdown.rs` (which `include_str!`s the same JSON). The Rust
+ * test proves the sanitizer produces `RENDERING_EXPECTED`; these scenarios
+ * prove Azure DevOps stores it back byte-for-byte, so the two together pin
+ * what a human actually sees in a work item.
+ */
+const RENDERING_INPUT = renderingCorpus.input.join("\n");
+const RENDERING_EXPECTED = renderingCorpus.expected.join("\n");
+
+/** Constructs the sanitizer must never let reach a rendered work item. */
+/** Compared case-insensitively, so a folded `<SCRIPT >` is covered too. */
+const DENIED_CONSTRUCTS = ["<script", "onerror=", "<iframe"];
+
+/**
+ * Fenced-code lines that must survive verbatim. They contain the same
+ * constructs as `DENIED_CONSTRUCTS`, so an over-eager "strip it everywhere"
+ * regression fails here rather than silently mangling documentation.
+ */
+const FENCED_VERBATIM = [
+  '<script>alert("fenced code is verbatim")</script>',
+  '<a href="javascript:alert(1)">fenced javascript link</a>',
+];
+
+
 function usableEnvValue(value: string | undefined): string | undefined {
   const trimmed = value?.trim();
   if (!trimmed || /^\$\([^)]+\)$/.test(trimmed)) return undefined;
@@ -254,8 +280,159 @@ export const uploadWorkitemAttachment: Scenario<{ id: number }> = {
   cleanup: async (ctx, state) => ctx.rest.deleteWorkItem(state.id),
 };
 
+/** Strip fenced code blocks so denied constructs are only checked in prose. */
+function outsideFencedCode(text: string): string {
+  const lines = text.split("\n");
+  const kept: string[] = [];
+  let inFence = false;
+  for (const line of lines) {
+    if (line.trimStart().startsWith("```")) {
+      inFence = !inFence;
+      continue;
+    }
+    if (!inFence) kept.push(line);
+  }
+  return kept.join("\n");
+}
+
+/** First line that differs, to make a golden mismatch debuggable. */
+function firstDifference(actual: string, expected: string): string {
+  const a = actual.split("\n");
+  const e = expected.split("\n");
+  for (let i = 0; i < Math.max(a.length, e.length); i++) {
+    if (a[i] !== e[i]) {
+      return `line ${i + 1}: expected ${JSON.stringify(e[i])}, got ${JSON.stringify(a[i])}`;
+    }
+  }
+  return "no line differs (trailing content mismatch)";
+}
+
+/**
+ * Build a rendering-fidelity scenario for one description field.
+ *
+ * `create-work-item` is the only safe output whose body goes through the
+ * Markdown sanitizer, and it writes either `System.Description` (default) or
+ * `Microsoft.VSTS.TCM.ReproSteps` (Bug) with a
+ * `/multilineFieldsFormat/<field>` = `Markdown` patch. One scenario per field
+ * therefore covers every path a sanitizer change can break.
+ */
+function renderingScenario(options: {
+  readonly id: string;
+  readonly workItemType: string;
+  readonly descriptionField: string;
+}): Scenario<{ title: string; createdId?: number }> {
+  const { id: scenarioId, workItemType, descriptionField } = options;
+  return {
+    id: scenarioId,
+    tool: "create-work-item",
+    config: () => ({
+      "work-item-type": workItemType,
+      max: 1,
+      // Appended agent stats would change the stored text and defeat the
+      // byte-for-byte golden comparison.
+      "include-stats": false,
+    }),
+    setup: async (ctx) => {
+      if (!(await ctx.rest.workItemTypeExists(workItemType))) {
+        throw new SkipError(`project does not define the '${workItemType}' work item type`);
+      }
+      return { title: ctx.prefix(scenarioId) };
+    },
+    ndjson: async (_ctx, state) => ({
+      title: state.title,
+      description: RENDERING_INPUT,
+      tags: [],
+      temporary_id: CREATE_TEMPORARY_ID,
+    }),
+    assert: async (ctx, state, record: ExecutedRecord) => {
+      // Record the id before any fallible check so cleanup can still delete it.
+      const id = numResult(record, "id");
+      state.createdId = id;
+
+      const wi = await ctx.rest.getWorkItem(id);
+      const stored = wi.fields[descriptionField];
+      if (typeof stored !== "string") {
+        throw new Error(
+          `work item #${id} has no string '${descriptionField}' (got ${JSON.stringify(stored)})`,
+        );
+      }
+
+      // 1. Security: denied constructs must not survive in prose, while their
+      //    fenced-code twins must survive untouched. Checked before the golden
+      //    so a leak is reported as a leak rather than as a generic mismatch.
+      const prose = outsideFencedCode(stored).toLowerCase();
+      for (const construct of DENIED_CONSTRUCTS) {
+        if (prose.includes(construct.toLowerCase())) {
+          throw new Error(
+            `work item #${id} '${descriptionField}' still contains '${construct}' outside code`,
+          );
+        }
+      }
+      if (prose.includes("javascript:")) {
+        throw new Error(
+          `work item #${id} '${descriptionField}' still contains a javascript: URL outside code`,
+        );
+      }
+      for (const line of FENCED_VERBATIM) {
+        if (!stored.includes(line)) {
+          throw new Error(
+            `work item #${id} '${descriptionField}' lost fenced code line ${JSON.stringify(line)}`,
+          );
+        }
+      }
+
+      // 2. Format: stored as Markdown, otherwise the body renders as literal
+      //    text. Not every organization surfaces this on read — when it is
+      //    absent the executor-side patch is pinned by the Rust unit tests in
+      //    src/safe_outputs/create_work_item.rs instead.
+      const format = wi.multilineFieldsFormat?.[descriptionField];
+      if (format === undefined) {
+        ctx.log(
+          `[${scenarioId}] note: ADO did not surface multilineFieldsFormat for ` +
+            `'${descriptionField}'; format is covered by the executor unit tests`,
+        );
+      } else if (format !== "Markdown") {
+        throw new Error(
+          `work item #${id} stores '${descriptionField}' as ${JSON.stringify(format)}, expected "Markdown"`,
+        );
+      }
+
+      // 3. Golden round-trip: what ADO stored must equal what the sanitizer
+      //    produced, byte for byte. This is the decisive check — any change in
+      //    what the allowlist keeps, drops or rewrites moves the golden, as
+      //    does ADO normalising the payload on the way in.
+      if (stored !== RENDERING_EXPECTED) {
+        throw new Error(
+          `work item #${id} '${descriptionField}' does not match the sanitized golden ` +
+            `(${firstDifference(stored, RENDERING_EXPECTED)})`,
+        );
+      }
+    },
+    cleanup: async (ctx, state) => {
+      const id = state.createdId ?? (await ctx.rest.findWorkItemByTitle(state.title));
+      if (id !== undefined) await ctx.rest.deleteWorkItem(id);
+    },
+  };
+}
+
+/** Task / `System.Description` rendering fidelity. */
+export const createWorkItemRendering = renderingScenario({
+  id: "create-work-item-rendering",
+  workItemType: WORK_ITEM_TYPE,
+  descriptionField: "System.Description",
+});
+
+/** Bug / `Microsoft.VSTS.TCM.ReproSteps` rendering fidelity. */
+export const createBugWorkItemRendering = renderingScenario({
+  id: "create-work-item-rendering-bug",
+  workItemType: "Bug",
+  descriptionField: "Microsoft.VSTS.TCM.ReproSteps",
+});
+
 export const workItemScenarios: Scenario<unknown>[] = [
   createWorkItem,
+  createWorkItemRendering,
+  createBugWorkItemRendering,
   assignWorkItemTemporaryIdHandoff,
   updateWorkItem,
   commentOnWorkItem,
diff --git a/src/safe_outputs/create_work_item.rs b/src/safe_outputs/create_work_item.rs
index c3ddd27e..c8a3b858 100644
--- a/src/safe_outputs/create_work_item.rs
+++ b/src/safe_outputs/create_work_item.rs
@@ -1200,6 +1200,72 @@ custom-fields:
         assert!(execution.success, "{}", execution.message);
     }
 
+    #[tokio::test]
+    async fn test_execute_task_patches_sanitized_markdown_description() {
+        use crate::sanitize::markdown::rendering_corpus;
+        use std::collections::HashMap;
+        use wiremock::matchers::{body_json, method, path};
+        use wiremock::{Mock, MockServer, ResponseTemplate};
+
+        // Pins the two things the executor controls for work item rendering:
+        // the description is the sanitized corpus (byte-for-byte the golden the
+        // executor E2E asserts against a real work item), and the default
+        // System.Description path carries the Markdown format patch. Without
+        // the format patch ADO renders the body as literal text.
+        let server = MockServer::start().await;
+        let expected_patch = serde_json::json!([
+            {
+                "op": "add",
+                "path": "/fields/System.Title",
+                "value": "Rendering corpus"
+            },
+            {
+                "op": "add",
+                "path": "/fields/System.Description",
+                "value": rendering_corpus::expected()
+            },
+            {
+                "op": "add",
+                "path": "/multilineFieldsFormat/System.Description",
+                "value": "Markdown"
+            }
+        ]);
+        Mock::given(method("POST"))
+            .and(path("/Project/_apis/wit/workitems/$Task"))
+            .and(body_json(expected_patch))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "id": 7,
+                "_links": { "html": { "href": "https://example.test/workitems/7" } }
+            })))
+            .mount(&server)
+            .await;
+
+        let ctx = ExecutionContext {
+            ado_org_url: Some(server.uri()),
+            ado_project: Some("Project".to_string()),
+            access_token: Some("token".to_string()),
+            tool_configs: HashMap::from([(
+                "create-work-item".to_string(),
+                serde_json::json!({
+                    "work-item-type": "Task",
+                    "include-stats": false
+                }),
+            )]),
+            ..Default::default()
+        };
+        let mut result = CreateWorkItemResult {
+            name: CreateWorkItemResult::NAME.to_string(),
+            title: "Rendering corpus".to_string(),
+            description: rendering_corpus::input(),
+            tags: Vec::new(),
+            temporary_id: WorkItemTemporaryId::parse("#aw_test1").unwrap(),
+        };
+
+        let execution = result.execute_sanitized(&ctx).await.unwrap();
+
+        assert!(execution.success, "{}", execution.message);
+    }
+
     #[tokio::test]
     async fn test_execute_rejects_duplicate_description_custom_field() {
         use std::collections::HashMap;
diff --git a/src/sanitize.rs b/src/sanitize.rs
index 57653be2..896bee81 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -17,7 +17,7 @@
 
 use log::debug;
 
-mod markdown;
+pub(crate) mod markdown;
 
 /// Trait for types that contain untrusted agent-generated text fields.
 ///
diff --git a/src/sanitize/markdown.rs b/src/sanitize/markdown.rs
index ecd2a6bd..13fd4746 100644
--- a/src/sanitize/markdown.rs
+++ b/src/sanitize/markdown.rs
@@ -349,8 +349,42 @@ fn restore_blockquote_markers(line: &str) -> String {
     prefix + rest
 }
 
+/// Shared work-item rendering-fidelity corpus.
+///
+/// The same JSON is imported by the `create-work-item-rendering` executor E2E
+/// scenarios, so the fast local golden and the against-ADO assertion can never
+/// disagree about what a human is supposed to see in a work item.
+#[cfg(test)]
+pub(crate) mod rendering_corpus {
+    const CORPUS: &str = include_str!(
+        "../../scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json"
+    );
+
+    fn lines(key: &str) -> String {
+        let corpus: serde_json::Value = serde_json::from_str(CORPUS).expect("corpus is valid JSON");
+        corpus[key]
+            .as_array()
+            .unwrap_or_else(|| panic!("corpus key '{key}' is not an array"))
+            .iter()
+            .map(|line| line.as_str().expect("corpus line is not a string"))
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+
+    /// The unsanitized Markdown an agent proposes.
+    pub(crate) fn input() -> String {
+        lines("input")
+    }
+
+    /// The sanitized Markdown that must be stored in the work item.
+    pub(crate) fn expected() -> String {
+        lines("expected")
+    }
+}
+
 #[cfg(test)]
 mod tests {
+    use super::rendering_corpus;
     use crate::sanitize::sanitize_markdown;
 
     #[test]
@@ -542,4 +576,18 @@ mod tests {
 
         assert_eq!(output, "abc");
     }
+
+    #[test]
+    fn work_item_rendering_corpus_matches_golden() {
+        let actual = sanitize_markdown(&rendering_corpus::input());
+
+        assert_eq!(
+            actual,
+            rendering_corpus::expected(),
+            "sanitized rendering corpus changed; \
+             update `expected` in markdown-rendering-corpus.json only when the \
+             new rendering is intentional (it is asserted byte-for-byte against \
+             a real work item by the executor E2E suite)"
+        );
+    }
 }
diff --git a/tests/executor-e2e/README.md b/tests/executor-e2e/README.md
index c5591b67..bfd03be8 100644
--- a/tests/executor-e2e/README.md
+++ b/tests/executor-e2e/README.md
@@ -49,7 +49,9 @@ All deterministically-assertable ADO-write safe outputs plus the flagship
 - **Signals:** `noop`, `missing-tool`, `missing-data`, `report-incomplete`
   (no ADO write path; assert that the executor emits the expected status)
 - **Work items:** `create-work-item`, `assign-work-item`, `update-work-item`,
-  `comment-on-work-item`, `link-work-items`, `upload-workitem-attachment`
+  `comment-on-work-item`, `link-work-items`, `upload-workitem-attachment`, plus
+  two rendering-fidelity scenarios (see [Rendering
+  fidelity](#rendering-fidelity) below)
 - **Wiki:** `create-wiki-page`, `update-wiki-page`
 - **PR:** `add-pr-comment`, `reply-to-pr-comment`, `resolve-pr-thread`,
   `submit-pr-review`, `update-pr`
@@ -81,6 +83,38 @@ handoff verifies `System.AssignedTo` and deletes the scratch item. It uses
 otherwise `BUILD_REQUESTEDFOREMAIL`; it skips when neither provides an
 assignable identity.
 
+### Rendering fidelity
+
+`create-work-item` is the only safe output whose body goes through the Markdown
+sanitizer (`src/sanitize/markdown.rs`), and its stored description is what a
+human actually reads in the work item. Two scenarios pin that rendering:
+
+| Scenario id | Work item type | Field |
+| --- | --- | --- |
+| `create-work-item-rendering` | `Task` | `System.Description` |
+| `create-work-item-rendering-bug` | `Bug` | `Microsoft.VSTS.TCM.ReproSteps` |
+
+Both propose the same **unsanitized** corpus and assert, in order, that the
+stored field:
+
+1. contains no denied construct (`<script`, `onerror=`, `<iframe`, a
+   `javascript:` URL) outside fenced code, while the fenced-code copies of those
+   same strings survive verbatim;
+2. is recorded with `multilineFieldsFormat: Markdown` — when the organization
+   does not surface that on read, the scenario logs a note and the patch stays
+   pinned by the executor unit tests in `src/safe_outputs/create_work_item.rs`;
+3. equals the sanitized golden **byte for byte**.
+
+The corpus and its golden live in one place —
+[`scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json`](../../scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json)
+— imported by the harness and `include_str!`d by the Rust golden test in
+`src/sanitize/markdown.rs`, so the sub-second local test and the against-ADO
+test cannot drift. A deliberate rendering change means updating `expected` in
+that one file; an accidental one fails `cargo test` before it ever reaches ADO.
+
+The Bug scenario skips (rather than fails) when the project does not define the
+`Bug` work item type.
+
 The checked-in pipeline resolves `E2E_WORK_ITEM_ASSIGNEE` from a same-named
 definition/queue-time variable first, then falls back to
 `Build.RequestedForEmail`.

From 99099ff26fcba3e51f9c700644f9260b2b35c393 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 21 Aug 2026 10:17:45 +0000
Subject: [PATCH 33/41] test(safe-outputs): match tilde fences when scoping
 rendering security checks

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 .../ado-script/src/executor-e2e/scenarios/work-item.ts   | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts b/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts
index cd3215a6..2f232e2a 100644
--- a/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts
+++ b/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts
@@ -23,8 +23,10 @@ const ASSIGN_TEMPORARY_ID = "#aw_wiassign";
 const RENDERING_INPUT = renderingCorpus.input.join("\n");
 const RENDERING_EXPECTED = renderingCorpus.expected.join("\n");
 
-/** Constructs the sanitizer must never let reach a rendered work item. */
-/** Compared case-insensitively, so a folded `<SCRIPT >` is covered too. */
+/**
+ * Constructs the sanitizer must never let reach a rendered work item.
+ * Compared case-insensitively, so a folded `<SCRIPT >` is covered too.
+ */
 const DENIED_CONSTRUCTS = ["<script", "onerror=", "<iframe"];
 
 /**
@@ -286,7 +288,8 @@ function outsideFencedCode(text: string): string {
   const kept: string[] = [];
   let inFence = false;
   for (const line of lines) {
-    if (line.trimStart().startsWith("```")) {
+    const trimmed = line.trimStart();
+    if (trimmed.startsWith("```") || trimmed.startsWith("~~~")) {
       inFence = !inFence;
       continue;
     }

From b8a508757d3dd459ced7cfbd864c7a08e806fee4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 21 Aug 2026 10:51:26 +0000
Subject: [PATCH 34/41] fix(sanitize): anchor destination lookup after the
 markdown label

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 .../executor-e2e/__tests__/ado-rest.test.ts   | 48 ++++++++++++
 src/sanitize/markdown.rs                      | 75 +++++++++++++++++--
 2 files changed, 118 insertions(+), 5 deletions(-)
 create mode 100644 scripts/ado-script/src/executor-e2e/__tests__/ado-rest.test.ts

diff --git a/scripts/ado-script/src/executor-e2e/__tests__/ado-rest.test.ts b/scripts/ado-script/src/executor-e2e/__tests__/ado-rest.test.ts
new file mode 100644
index 00000000..9c6a72e2
--- /dev/null
+++ b/scripts/ado-script/src/executor-e2e/__tests__/ado-rest.test.ts
@@ -0,0 +1,48 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { AdoRest } from "../ado-rest.js";
+
+const options = {
+  orgUrl: "https://dev.azure.com/org/",
+  project: "My Project",
+  token: "token",
+};
+
+function stubFetch(responder: (url: string) => Response): ReturnType<typeof vi.fn> {
+  const fetchMock = vi.fn(async (url: string) => responder(String(url)));
+  vi.stubGlobal("fetch", fetchMock);
+  return fetchMock;
+}
+
+describe("AdoRest.workItemTypeExists", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("resolves true and encodes the project and type segments", async () => {
+    const fetchMock = stubFetch(
+      () =>
+        new Response(JSON.stringify({ name: "Bug" }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        }),
+    );
+
+    await expect(new AdoRest(options).workItemTypeExists("User Story")).resolves.toBe(true);
+    expect(fetchMock.mock.calls[0]?.[0]).toBe(
+      "https://dev.azure.com/org/My%20Project/_apis/wit/workitemtypes/User%20Story?api-version=7.1",
+    );
+  });
+
+  it("resolves false when the project does not define the type", async () => {
+    stubFetch(() => new Response("not found", { status: 404 }));
+
+    await expect(new AdoRest(options).workItemTypeExists("Bug")).resolves.toBe(false);
+  });
+
+  it("throws rather than reporting a missing type when the request fails", async () => {
+    stubFetch(() => new Response("denied", { status: 403 }));
+
+    await expect(new AdoRest(options).workItemTypeExists("Bug")).rejects.toThrow("HTTP 403");
+  });
+});
diff --git a/src/sanitize/markdown.rs b/src/sanitize/markdown.rs
index 13fd4746..19867737 100644
--- a/src/sanitize/markdown.rs
+++ b/src/sanitize/markdown.rs
@@ -224,7 +224,9 @@ fn regions(input: &str) -> Vec<Region> {
                         // HTML allowlist, which would parse it as a bogus tag.
                         skip_until = range.end;
                         regions.push(Region::Protected(range));
-                    } else if let Some(destination) = locate_destination(input, &range, &dest_url) {
+                    } else if let Some(destination) =
+                        locate_destination(input, &range, &dest_url, INLINE_LABEL_END)
+                    {
                         // A destination is a URL, not prose: text transforms
                         // such as @mention wrapping must not rewrite it.
                         regions.push(Region::Protected(destination));
@@ -244,7 +246,8 @@ fn regions(input: &str) -> Vec<Region> {
                     _ => {
                         skip_until = range.end;
                         regions.push(Region::Redact(
-                            locate_destination(input, &range, &dest_url).unwrap_or(range),
+                            locate_destination(input, &range, &dest_url, INLINE_LABEL_END)
+                                .unwrap_or(range),
                         ));
                     }
                 }
@@ -254,7 +257,12 @@ fn regions(input: &str) -> Vec<Region> {
     }
 
     for (_, definition) in iter.reference_definitions().iter() {
-        let Some(range) = locate_destination(input, &definition.span, &definition.dest) else {
+        let Some(range) = locate_destination(
+            input,
+            &definition.span,
+            &definition.dest,
+            DEFINITION_LABEL_END,
+        ) else {
             continue;
         };
         if scheme_allowed(&definition.dest) {
@@ -268,19 +276,42 @@ fn regions(input: &str) -> Vec<Region> {
     regions
 }
 
+/// Label terminator that a destination follows in `[label](dest)` links and
+/// `![alt](src)` images.
+const INLINE_LABEL_END: &str = "](";
+/// Label terminator that a destination follows in a `[label]: dest` reference
+/// definition.
+const DEFINITION_LABEL_END: &str = "]:";
+
 /// Find the literal destination text inside the element's source range.
 ///
+/// The search starts *after* the label terminator, because in every syntax that
+/// has a label the destination follows it. Searching the whole span instead
+/// matches the label whenever it repeats the destination text — for
+/// `[javascript:alert(1)](javascript:alert(1))` that redacts the inert label
+/// and leaves the live destination untouched.
+///
 /// `dest_url` is the parser's decoded destination, so it does not always appear
 /// verbatim in the source (percent/entity/backslash escapes). When it cannot be
 /// located the caller degrades safely: a denied scheme redacts the whole
 /// element, and an allowed destination is simply not marked protected, so it
 /// flows through the HTML allowlist like ordinary text.
-fn locate_destination(input: &str, span: &Range<usize>, dest_url: &str) -> Option<Range<usize>> {
+fn locate_destination(
+    input: &str,
+    span: &Range<usize>,
+    dest_url: &str,
+    label_end: &str,
+) -> Option<Range<usize>> {
     if dest_url.is_empty() {
         return None;
     }
     let source = input.get(span.clone())?;
-    let offset = source.find(dest_url)?;
+    // An autolink (`<https://example.test>`) has no label, so the whole span is
+    // the destination and the search starts at the beginning.
+    let search_from = source
+        .rfind(label_end)
+        .map_or(0, |offset| offset + label_end.len());
+    let offset = search_from + source.get(search_from..)?.find(dest_url)?;
     let start = span.start + offset;
     Some(start..start + dest_url.len())
 }
@@ -427,6 +458,40 @@ mod tests {
         assert!(output.contains("click me"), "{output}");
     }
 
+    #[test]
+    fn redacts_destination_when_the_label_repeats_it() {
+        // The destination follows the label, so locating it must not stop at
+        // the first matching bytes — otherwise the label is redacted and the
+        // live destination survives.
+        let output = sanitize_markdown("[javascript:alert(1)](javascript:alert(1))");
+
+        assert_eq!(output, "[javascript:alert(1)]((redacted))", "{output}");
+    }
+
+    #[test]
+    fn redacts_reference_definition_when_the_label_repeats_it() {
+        let output = sanitize_markdown(
+            "See [x][vbscript:msgbox(1)].\n\n[vbscript:msgbox(1)]: vbscript:msgbox(1)\n",
+        );
+
+        assert_eq!(
+            output, "See [x][vbscript:msgbox(1)].\n\n[vbscript:msgbox(1)]: (redacted)\n",
+            "{output}"
+        );
+    }
+
+    #[test]
+    fn protects_allowed_destination_when_the_label_repeats_it() {
+        let input = "[https://example.test/@user](https://example.test/@user)";
+
+        // The label is prose and gets mention neutralization; the destination
+        // is a URL and must be left alone.
+        assert_eq!(
+            sanitize_markdown(input),
+            "[https://example.test/`@user`](https://example.test/@user)"
+        );
+    }
+
     #[test]
     fn redacts_markdown_image_destination_with_denied_scheme() {
         let output = sanitize_markdown("![logo](data:text/html;base64,PHNjcmlwdD4=)");

From 94834cf7f9f3713b649bd52037df881bb69c4d4e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 21 Aug 2026 11:35:00 +0000
Subject: [PATCH 35/41] fix(sanitize): close nested-destination bypass and stop
 deleting prose that looks like markup

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 docs/safe-outputs.md     |  14 +-
 src/sanitize/markdown.rs | 790 ++++++++++++++++++++++++++++++++++++---
 2 files changed, 746 insertions(+), 58 deletions(-)

diff --git a/docs/safe-outputs.md b/docs/safe-outputs.md
index 059095f1..640a78ea 100644
--- a/docs/safe-outputs.md
+++ b/docs/safe-outputs.md
@@ -265,8 +265,18 @@ The policy is:
   `fixes #123` and `AB#123` are wrapped in backticks so they cannot notify
   people or link work items.
 
-A bare `<` in prose is stored as `&lt;`, which Markdown renders as `<`; that is
-what stops dropped markup from being re-parsed.
+Text that only looks like markup is escaped rather than deleted: `Vec<String>`
+in prose is stored as `Vec&lt;String&gt;`, which Markdown renders as the author
+wrote it, and that escaping is also what stops dropped markup from being
+re-parsed. Markup a browser really would parse as a tag still goes to the
+allowlist and is dropped there, so a dangerous payload never reappears as
+visible text.
+
+Cleaning normalizes HTML, so a few inputs come back rendering the same but
+written differently: `\r\n` becomes `\n`, `<br />` becomes `<br>`, a table gains
+an implied `<tbody>`, a mid-line `>` is stored as `&gt;`, and the content of a
+removed raw-text element such as `<noscript>` is escaped rather than kept as
+markup.
 
 ### Executor authentication
 
diff --git a/src/sanitize/markdown.rs b/src/sanitize/markdown.rs
index 19867737..4d589e92 100644
--- a/src/sanitize/markdown.rs
+++ b/src/sanitize/markdown.rs
@@ -19,6 +19,25 @@
 //! needed another special case. Allowlisting is closed by construction: anything
 //! the parser does not recognise as an allowed tag is dropped, and anything that
 //! is not an allowed URL scheme is removed.
+//!
+//! # Assumption
+//!
+//! Content inside a protected range is copied through **verbatim**, so this
+//! module assumes Azure DevOps agrees with [`pulldown_cmark`] about where a
+//! code span, code fence or autolink starts and ends. If the two ever disagree,
+//! markup inside what this module believes is code reaches the renderer
+//! unfiltered. Everything that is *not* code — including a link destination
+//! containing `<` or `>` — is deliberately routed through the allowlist so the
+//! assumption stays confined to code.
+//!
+//! # Known rendering differences
+//!
+//! Cleaning normalises HTML, so a few inputs come back rendering the same but
+//! written differently: `\r\n` becomes `\n`, void elements are rewritten
+//! (`<br />` → `<br>`), an implied `<tbody>` is inserted into a table, a `>` in
+//! the middle of a line is stored as `&gt;`, the leading newline inside a
+//! `<pre>` is dropped, and the content of a raw-text element the allowlist
+//! removes (such as `<noscript>`) is escaped rather than kept as markup.
 
 use std::collections::{HashMap, HashSet};
 use std::ops::Range;
@@ -85,6 +104,241 @@ const ALLOWED_TAGS: &[&str] = &[
 /// `vbscript:`, …) is denied because it is not on this list.
 const ALLOWED_URL_SCHEMES: &[&str] = &["http", "https", "mailto"];
 
+/// Element names a parser really would treat as a tag.
+///
+/// This is *not* a permission list — [`ALLOWED_TAGS`] is. It only decides
+/// whether `<name …>` is markup (hand it to the allowlist, which drops or
+/// cleans it) or prose (escape it, so `Vec<String>` survives). It therefore has
+/// to include the dangerous names too: escaping `<svg onload=alert(1)>` would
+/// turn a dropped payload into visible text.
+const KNOWN_TAGS: &[&str] = &[
+    // HTML
+    "a",
+    "abbr",
+    "acronym",
+    "address",
+    "applet",
+    "area",
+    "article",
+    "aside",
+    "audio",
+    "b",
+    "base",
+    "basefont",
+    "bdi",
+    "bdo",
+    "bgsound",
+    "big",
+    "blink",
+    "blockquote",
+    "body",
+    "br",
+    "button",
+    "canvas",
+    "caption",
+    "center",
+    "cite",
+    "code",
+    "col",
+    "colgroup",
+    "data",
+    "datalist",
+    "dd",
+    "del",
+    "details",
+    "dfn",
+    "dialog",
+    "dir",
+    "div",
+    "dl",
+    "dt",
+    "em",
+    "embed",
+    "fieldset",
+    "figcaption",
+    "figure",
+    "font",
+    "footer",
+    "form",
+    "frame",
+    "frameset",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "head",
+    "header",
+    "hgroup",
+    "hr",
+    "html",
+    "i",
+    "iframe",
+    "image",
+    "img",
+    "input",
+    "ins",
+    "isindex",
+    "kbd",
+    "keygen",
+    "label",
+    "legend",
+    "li",
+    "link",
+    "listing",
+    "main",
+    "map",
+    "mark",
+    "marquee",
+    "menu",
+    "menuitem",
+    "meta",
+    "meter",
+    "nav",
+    "nobr",
+    "noembed",
+    "noframes",
+    "noscript",
+    "object",
+    "ol",
+    "optgroup",
+    "option",
+    "output",
+    "p",
+    "param",
+    "picture",
+    "plaintext",
+    "pre",
+    "progress",
+    "q",
+    "rb",
+    "rp",
+    "rt",
+    "rtc",
+    "ruby",
+    "s",
+    "samp",
+    "script",
+    "search",
+    "section",
+    "select",
+    "slot",
+    "small",
+    "source",
+    "spacer",
+    "span",
+    "strike",
+    "strong",
+    "style",
+    "sub",
+    "summary",
+    "sup",
+    "table",
+    "tbody",
+    "td",
+    "template",
+    "textarea",
+    "tfoot",
+    "th",
+    "thead",
+    "time",
+    "title",
+    "tr",
+    "track",
+    "tt",
+    "u",
+    "ul",
+    "var",
+    "video",
+    "wbr",
+    "xmp",
+    // SVG and MathML names that browsers parse as foreign markup
+    "animate",
+    "animatemotion",
+    "animatetransform",
+    "circle",
+    "clippath",
+    "defs",
+    "desc",
+    "ellipse",
+    "feimage",
+    "filter",
+    "foreignobject",
+    "g",
+    "line",
+    "linegradient",
+    "maction",
+    "malignmark",
+    "math",
+    "menclose",
+    "merror",
+    "mfenced",
+    "mfrac",
+    "mglyph",
+    "mi",
+    "mn",
+    "mo",
+    "mpath",
+    "mroot",
+    "mrow",
+    "ms",
+    "mspace",
+    "msqrt",
+    "mstyle",
+    "msub",
+    "msubsup",
+    "msup",
+    "mtable",
+    "mtd",
+    "mtext",
+    "mtr",
+    "munder",
+    "munderover",
+    "path",
+    "polygon",
+    "polyline",
+    "rect",
+    "semantics",
+    "set",
+    "svg",
+    "switch",
+    "symbol",
+    "text",
+    "textpath",
+    "tspan",
+    "use",
+];
+
+/// Valueless attributes a real tag can carry. No attribute the allowlist keeps
+/// is valueless, so anything else without a value means the `<` was prose.
+const BOOLEAN_ATTRIBUTES: &[&str] = &[
+    "allowfullscreen",
+    "async",
+    "autofocus",
+    "autoplay",
+    "checked",
+    "controls",
+    "default",
+    "defer",
+    "disabled",
+    "hidden",
+    "inert",
+    "ismap",
+    "itemscope",
+    "loop",
+    "multiple",
+    "muted",
+    "nomodule",
+    "novalidate",
+    "open",
+    "playsinline",
+    "readonly",
+    "required",
+    "reversed",
+    "selected",
+];
+
 static CLEANER: LazyLock<Builder<'static>> = LazyLock::new(|| {
     let mut builder = Builder::empty();
     builder
@@ -112,17 +366,37 @@ fn tag_attributes() -> HashMap<&'static str, HashSet<&'static str>> {
     attributes
 }
 
+/// Private-use characters that stand in for content the HTML allowlist must not
+/// see. They are stripped from the input first, so nothing an author writes can
+/// forge one.
+const PLACEHOLDER_OPEN: char = '\u{E000}';
+const PLACEHOLDER_CLOSE: char = '\u{E001}';
+/// Stands in for a line-leading blockquote marker while the allowlist runs, so
+/// a `>` the author wrote as markup survives and a `&gt;` the author wrote as
+/// text is never promoted to markup.
+const BLOCKQUOTE_MARKER: char = '\u{E002}';
+
+const SENTINELS: [char; 3] = [PLACEHOLDER_OPEN, PLACEHOLDER_CLOSE, BLOCKQUOTE_MARKER];
+
 /// Apply the HTML allowlist and URL scheme policy to `input`, leaving Markdown
 /// code spans, code fences and autolinks untouched.
 ///
 /// `transform_text` is applied to every non-protected source range before the
 /// HTML allowlist runs, so caller-owned text transformations (mentions, bot
 /// triggers) also skip code.
+///
+/// Protected and redacted ranges are swapped for placeholders and the document
+/// is cleaned in a **single** pass, so inline HTML that spans a code span
+/// (`<b>bold `code` more</b>`) is not rebalanced around the code span.
 pub(super) fn sanitize_markdown_html(
     input: &str,
     mut transform_text: impl FnMut(&str) -> String,
 ) -> String {
-    let mut result = String::with_capacity(input.len());
+    let input = strip_sentinels(input);
+    let input = input.as_ref();
+
+    let mut assembled = String::with_capacity(input.len());
+    let mut verbatim: Vec<&str> = Vec::new();
     let mut cursor = 0;
 
     for region in regions(input) {
@@ -132,15 +406,273 @@ pub(super) fn sanitize_markdown_html(
             // outer one already covered this range.
             continue;
         }
-        result.push_str(&clean_html(&transform_text(&input[cursor..range.start])));
-        match region {
-            Region::Protected(_) => result.push_str(&input[range.clone()]),
-            Region::Redact(_) => result.push_str(REDACTED),
-        }
+        assembled.push_str(&transform_text(&input[cursor..range.start]));
+        let text = match region {
+            Region::Protected(_) => &input[range.clone()],
+            Region::Redact(_) => REDACTED,
+        };
+        assembled.push(PLACEHOLDER_OPEN);
+        assembled.push_str(&verbatim.len().to_string());
+        assembled.push(PLACEHOLDER_CLOSE);
+        verbatim.push(text);
         cursor = range.end;
     }
+    assembled.push_str(&transform_text(&input[cursor..]));
+
+    let assembled = escape_non_tag_markup(&assembled);
+    let assembled = mark_blockquotes(&assembled);
+
+    restore(&clean_html(&assembled), &verbatim)
+}
+
+fn strip_sentinels(input: &str) -> std::borrow::Cow<'_, str> {
+    if input.contains(SENTINELS) {
+        std::borrow::Cow::Owned(input.replace(SENTINELS, ""))
+    } else {
+        std::borrow::Cow::Borrowed(input)
+    }
+}
+
+/// Replace every line-leading blockquote marker with [`BLOCKQUOTE_MARKER`].
+///
+/// The allowlist escapes `>` in text, and an escaped marker at the start of a
+/// line no longer opens a blockquote. Recording the markers *before* cleaning
+/// is what keeps the restore honest: only a `>` the author actually wrote as
+/// markup comes back.
+///
+/// Runs after [`escape_non_tag_markup`], so every remaining `<` really does
+/// open a tag: a `>` that closes a tag written across two lines is left alone
+/// instead of being mistaken for a blockquote marker.
+fn mark_blockquotes(input: &str) -> String {
+    let mut result = String::with_capacity(input.len());
+    let mut in_tag = false;
+
+    for line in input.split_inclusive('\n') {
+        let mut rest = line;
+        if !in_tag {
+            loop {
+                let indent = rest.len() - rest.trim_start_matches(' ').len();
+                if indent > 3 {
+                    break;
+                }
+                let Some(after) = rest[indent..].strip_prefix('>') else {
+                    break;
+                };
+                result.push_str(&rest[..indent]);
+                result.push(BLOCKQUOTE_MARKER);
+                rest = after;
+            }
+        }
+
+        for character in rest.chars() {
+            match character {
+                '<' => in_tag = true,
+                '>' => in_tag = false,
+                _ => {}
+            }
+        }
+        result.push_str(rest);
+    }
 
-    result.push_str(&clean_html(&transform_text(&input[cursor..])));
+    result
+}
+
+/// Escape every `<` that does not start something an HTML parser would treat as
+/// a tag, so text that merely looks like markup survives as text.
+///
+/// The allowlist *deletes* markup it does not recognise, which would silently
+/// eat `Vec<String>` out of a description. Escaping first means unknown markup
+/// degrades to `&lt;`, while anything a browser really would parse as a tag
+/// still reaches the allowlist and is dropped or cleaned there.
+fn escape_non_tag_markup(input: &str) -> String {
+    let mut result = String::with_capacity(input.len());
+    let mut rest = input;
+
+    while let Some(offset) = rest.find('<') {
+        result.push_str(&rest[..offset]);
+        if starts_html_tag(&rest[offset + 1..]) {
+            result.push('<');
+        } else {
+            result.push_str("&lt;");
+        }
+        rest = &rest[offset + 1..];
+    }
+    result.push_str(rest);
+    result
+}
+
+/// How far past a `<` the tag test looks. Every `<` in the document is tested,
+/// so an unbounded scan would be quadratic on input made of nothing but `<`.
+/// A start tag longer than this is treated as markup and handed to the
+/// allowlist, which is the same thing that happens to an unterminated tag.
+const TAG_SCAN_LIMIT: usize = 256;
+
+/// Whether the text following a `<` is markup rather than prose.
+///
+/// True for comments, doctypes and processing instructions (all removed by the
+/// allowlist), and for a start or end tag whose name is a real HTML, SVG or
+/// MathML element written with plausible attribute syntax. Bare attributes are
+/// the discriminator that keeps `if a<b and b>c` prose: no allowed attribute is
+/// valueless, so a valueless attribute that is not a known boolean attribute
+/// means the author was not writing a tag.
+fn starts_html_tag(rest: &str) -> bool {
+    let rest = bounded(rest);
+    if rest.starts_with('!') || rest.starts_with('?') {
+        return true;
+    }
+
+    let (closing, rest) = match rest.strip_prefix('/') {
+        Some(rest) => (true, rest),
+        None => (false, rest),
+    };
+
+    let name_len = rest
+        .find(|c: char| c.is_whitespace() || c == '/' || c == '>')
+        .unwrap_or(rest.len());
+    let name = &rest[..name_len];
+    if !name
+        .chars()
+        .next()
+        .is_some_and(|first| first.is_ascii_alphabetic())
+        || !KNOWN_TAGS.contains(&name.to_ascii_lowercase().as_str())
+    {
+        return false;
+    }
+
+    let rest = &rest[name_len..];
+    if closing {
+        // `</b>`; anything else after the name is not how an end tag is written.
+        return rest.trim_start().starts_with('>') || rest.trim().is_empty();
+    }
+    plausible_attributes(rest)
+}
+
+/// The first [`TAG_SCAN_LIMIT`] bytes of `input`, cut on a character boundary.
+fn bounded(input: &str) -> &str {
+    let mut end = input.len().min(TAG_SCAN_LIMIT);
+    while !input.is_char_boundary(end) {
+        end -= 1;
+    }
+    &input[..end]
+}
+
+/// Whether the remainder of a start tag is written as plausible attributes.
+///
+/// An unterminated tag (`<script src=x`) is left to the allowlist, which drops
+/// it — escaping it instead would resurrect the payload as visible text.
+fn plausible_attributes(rest: &str) -> bool {
+    let mut rest = rest.trim_start();
+
+    loop {
+        rest = rest.trim_start_matches(['/', ' ', '\t', '\n', '\r']);
+        if rest.is_empty() {
+            return true;
+        }
+        if rest.starts_with('>') {
+            return true;
+        }
+
+        let name_len = rest
+            .find(|c: char| c.is_whitespace() || c == '=' || c == '/' || c == '>')
+            .unwrap_or(rest.len());
+        let name = &rest[..name_len];
+        if name.is_empty() {
+            return false;
+        }
+        rest = rest[name_len..].trim_start();
+
+        let Some(value) = rest.strip_prefix('=') else {
+            if !BOOLEAN_ATTRIBUTES.contains(&name.to_ascii_lowercase().as_str()) {
+                return false;
+            }
+            continue;
+        };
+
+        let value = value.trim_start();
+        rest = match value.chars().next() {
+            Some(quote @ ('"' | '\'')) => match value[1..].find(quote) {
+                Some(end) => &value[1 + end + 1..],
+                // An unterminated quoted value swallows the rest of the input;
+                // the allowlist drops the whole tag.
+                None => return true,
+            },
+            _ => {
+                let end = value
+                    .find(|c: char| c.is_whitespace() || c == '>')
+                    .unwrap_or(value.len());
+                &value[end..]
+            }
+        };
+    }
+}
+
+/// Put back everything the allowlist was not allowed to see, and undo the one
+/// piece of text escaping that changes how Markdown renders.
+fn restore(cleaned: &str, verbatim: &[&str]) -> String {
+    let restored = unescape_ampersands(cleaned).replace(BLOCKQUOTE_MARKER, ">");
+
+    let mut result = String::with_capacity(restored.len());
+    let mut rest = restored.as_str();
+
+    while let Some(offset) = rest.find(PLACEHOLDER_OPEN) {
+        result.push_str(&rest[..offset]);
+        let after = &rest[offset + PLACEHOLDER_OPEN.len_utf8()..];
+        let Some(end) = after.find(PLACEHOLDER_CLOSE) else {
+            // The allowlist truncated the placeholder, so its content is gone
+            // with the markup that contained it.
+            rest = after;
+            continue;
+        };
+        if let Some(text) = after[..end]
+            .parse::<usize>()
+            .ok()
+            .and_then(|index| verbatim.get(index))
+        {
+            result.push_str(text);
+        }
+        rest = &after[end + PLACEHOLDER_CLOSE.len_utf8()..];
+    }
+    result.push_str(rest);
+    result
+}
+
+/// Undo `&` escaping in text so prose (`R&D`) and bare URLs
+/// (`https://example.test/x?a=1&b=2`, which Azure DevOps autolinks) keep the
+/// character the author wrote.
+///
+/// `&lt;` must stay escaped — that is what stops a dropped tag being re-parsed
+/// as markup — and escaping inside a tag is left alone, so an attribute value
+/// can never be decoded into a different URL than the one the allowlist
+/// approved.
+fn unescape_ampersands(input: &str) -> String {
+    let mut result = String::with_capacity(input.len());
+    let mut in_tag = false;
+
+    let mut rest = input;
+    while let Some(offset) = rest.find(['<', '>', '&']) {
+        result.push_str(&rest[..offset]);
+        match &rest[offset..offset + 1] {
+            "<" => {
+                in_tag = true;
+                result.push('<');
+                rest = &rest[offset + 1..];
+            }
+            ">" => {
+                in_tag = false;
+                result.push('>');
+                rest = &rest[offset + 1..];
+            }
+            _ if !in_tag && rest[offset..].starts_with("&amp;") => {
+                result.push('&');
+                rest = &rest[offset + "&amp;".len()..];
+            }
+            _ => {
+                result.push('&');
+                rest = &rest[offset + 1..];
+            }
+        }
+    }
+    result.push_str(rest);
     result
 }
 
@@ -225,7 +757,7 @@ fn regions(input: &str) -> Vec<Region> {
                         skip_until = range.end;
                         regions.push(Region::Protected(range));
                     } else if let Some(destination) =
-                        locate_destination(input, &range, &dest_url, INLINE_LABEL_END)
+                        protectable_destination(input, &range, &dest_url, INLINE_LABEL_END)
                     {
                         // A destination is a URL, not prose: text transforms
                         // such as @mention wrapping must not rewrite it.
@@ -244,7 +776,12 @@ fn regions(input: &str) -> Vec<Region> {
                     | LinkType::Shortcut
                     | LinkType::ShortcutUnknown => {}
                     _ => {
-                        skip_until = range.end;
+                        // Only the destination is redacted, so nested elements
+                        // (`[![alt](vbscript:inner)](vbscript:outer)`) keep
+                        // being walked and have their own destinations checked.
+                        // When the destination cannot be located the whole
+                        // element is redacted instead, and the overlapping
+                        // nested regions are dropped while rebuilding.
                         regions.push(Region::Redact(
                             locate_destination(input, &range, &dest_url, INLINE_LABEL_END)
                                 .unwrap_or(range),
@@ -257,17 +794,21 @@ fn regions(input: &str) -> Vec<Region> {
     }
 
     for (_, definition) in iter.reference_definitions().iter() {
-        let Some(range) = locate_destination(
+        if scheme_allowed(&definition.dest) {
+            if let Some(range) = protectable_destination(
+                input,
+                &definition.span,
+                &definition.dest,
+                DEFINITION_LABEL_END,
+            ) {
+                regions.push(Region::Protected(range));
+            }
+        } else if let Some(range) = locate_destination(
             input,
             &definition.span,
             &definition.dest,
             DEFINITION_LABEL_END,
-        ) else {
-            continue;
-        };
-        if scheme_allowed(&definition.dest) {
-            regions.push(Region::Protected(range));
-        } else {
+        ) {
             regions.push(Region::Redact(range));
         }
     }
@@ -283,6 +824,36 @@ const INLINE_LABEL_END: &str = "](";
 /// definition.
 const DEFINITION_LABEL_END: &str = "]:";
 
+/// Find a destination that may be copied through verbatim.
+///
+/// Protected ranges bypass the HTML allowlist, so a destination is only
+/// eligible when it cannot itself carry markup: a destination containing `<`
+/// or `>` falls through to the allowlist, which escapes it. That keeps the
+/// module's guarantee (nothing outside the tag allowlist reaches the output)
+/// true even when the renderer's idea of where a destination ends differs from
+/// [`pulldown_cmark`]'s.
+///
+/// A destination wrapped in pointy brackets (`[a](<https://example.test/a b>)`)
+/// keeps the brackets inside the protected range, so a destination containing
+/// spaces is not broken by escaping the delimiters.
+fn protectable_destination(
+    input: &str,
+    span: &Range<usize>,
+    dest_url: &str,
+    label_end: &str,
+) -> Option<Range<usize>> {
+    let range = locate_destination(input, span, dest_url, label_end)?;
+    let destination = input.get(range.clone())?;
+    if destination.contains('<') || destination.contains('>') {
+        return None;
+    }
+
+    if input[..range.start].ends_with('<') && input[range.end..].starts_with('>') {
+        return Some(range.start - 1..range.end + 1);
+    }
+    Some(range)
+}
+
 /// Find the literal destination text inside the element's source range.
 ///
 /// The search starts *after* the label terminator, because in every syntax that
@@ -338,46 +909,7 @@ fn clean_html(input: &str) -> String {
     if input.is_empty() {
         return String::new();
     }
-    let cleaned = CLEANER.clean(input).to_string();
-    restore_markdown_text(&cleaned)
-}
-
-/// Undo the one piece of HTML text escaping that changes how Markdown renders.
-///
-/// The serializer escapes `<`, `>` and `&` in text nodes. `&lt;` must stay
-/// escaped — that is what stops a dropped tag from being re-parsed as markup —
-/// and an escaped `&`/`>` in the middle of a line renders identically to the
-/// raw character. A leading `>` is different: it opens a blockquote, so it is
-/// restored at the start of every line.
-fn restore_markdown_text(input: &str) -> String {
-    let mut result = String::with_capacity(input.len());
-    for line in input.split_inclusive('\n') {
-        result.push_str(&restore_blockquote_markers(line));
-    }
-    result
-}
-
-fn restore_blockquote_markers(line: &str) -> String {
-    let mut rest = line;
-    let mut prefix = String::new();
-
-    loop {
-        let indent = rest.len() - rest.trim_start_matches(' ').len();
-        if indent > 3 {
-            break;
-        }
-        let Some(after) = rest[indent..].strip_prefix("&gt;") else {
-            break;
-        };
-        prefix.push_str(&rest[..indent]);
-        prefix.push('>');
-        rest = after;
-    }
-
-    if prefix.is_empty() {
-        return line.to_string();
-    }
-    prefix + rest
+    CLEANER.clean(input).to_string()
 }
 
 /// Shared work-item rendering-fidelity corpus.
@@ -642,6 +1174,152 @@ mod tests {
         assert_eq!(output, "abc");
     }
 
+    #[test]
+    fn redacts_nested_denied_destinations() {
+        // The outer element is not skipped wholesale, so the inner image's
+        // destination is checked too.
+        assert_eq!(
+            sanitize_markdown("[![x](vbscript:inner)](vbscript:outer)"),
+            "[![x]((redacted))]((redacted))"
+        );
+
+        let output =
+            sanitize_markdown("[![x](data:text/html,<script>alert(1)</script>)](javascript:o)");
+
+        assert!(!output.contains("data:"), "{output}");
+        assert!(!output.contains("<script"), "{output}");
+    }
+
+    #[test]
+    fn cleans_markup_smuggled_into_an_allowed_destination() {
+        // A destination carrying `<` or `>` is never copied through verbatim,
+        // so the tag allowlist still sees every byte of it.
+        let output = sanitize_markdown("[x](https://e.test/a<img/onerror=alert(1)>)");
+
+        assert!(!output.contains("onerror"), "{output}");
+
+        let output = sanitize_markdown("[r]: https://e.test/<script>\n");
+
+        assert!(!output.contains("<script"), "{output}");
+    }
+
+    #[test]
+    fn preserves_pointy_bracket_destination_with_spaces() {
+        let input = "[a](<https://example.test/a b>)";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn escapes_text_that_only_looks_like_a_tag() {
+        // Unknown markup degrades to an entity instead of being deleted, so a
+        // description keeps the author's text.
+        assert_eq!(
+            sanitize_markdown("Fix `Vec<String>` and Vec<String> and Map<K,V>"),
+            "Fix `Vec<String>` and Vec&lt;String&gt; and Map&lt;K,V&gt;"
+        );
+        assert_eq!(sanitize_markdown("<tag>"), "&lt;tag&gt;");
+        assert_eq!(
+            sanitize_markdown("<www.example.test>"),
+            "&lt;www.example.test&gt;"
+        );
+    }
+
+    #[test]
+    fn escapes_prose_that_parses_as_a_tag_with_bare_attributes() {
+        // `<b and b>` is a valid start tag to an HTML parser, which would
+        // delete the text between the angle brackets.
+        assert_eq!(
+            sanitize_markdown("if a<b and b>c then"),
+            "if a&lt;b and b&gt;c then"
+        );
+    }
+
+    #[test]
+    fn preserves_boolean_attributes_on_real_tags() {
+        // A valueless attribute that a tag really can carry stays markup; the
+        // allowlist drops the attribute itself.
+        assert_eq!(
+            sanitize_markdown("<details open>text</details>"),
+            "<details>text</details>"
+        );
+    }
+
+    #[test]
+    fn does_not_promote_author_escaped_text_to_a_blockquote() {
+        let input = "&gt; not quoted\n";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn does_not_steal_the_close_of_a_tag_written_across_lines() {
+        // A `>` on its own line closes the tag above it; treating it as a
+        // blockquote marker would leave an unterminated tag and delete the text
+        // that follows.
+        assert_eq!(sanitize_markdown("<b\n>text</b>\n"), "<b>text</b>\n");
+    }
+
+    #[test]
+    fn preserves_inline_html_spanning_a_code_span() {
+        // The document is cleaned in one pass, so the open tag is not closed at
+        // the code span boundary.
+        let input = "<b>bold `code` more</b>";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn preserves_ampersands_in_prose_and_bare_urls() {
+        let input = "https://example.test/x?a=1&b=2 and R&D";
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn keeps_attribute_entities_escaped() {
+        // Decoding `&amp;` inside an attribute could turn an approved URL into
+        // a denied one, so escaping is only undone in text.
+        let input = r#"<a href="&amp;#106;avascript:alert(1)">x</a>"#;
+        assert_eq!(sanitize_markdown(input), input);
+    }
+
+    #[test]
+    fn tag_test_is_bounded_on_adversarial_input() {
+        // Every `<` is tested, so the scan is capped: an input made of nothing
+        // but `<` must stay linear rather than rescanning the document each
+        // time.
+        let start = std::time::Instant::now();
+        let output = sanitize_markdown(&"<b x=1 ".repeat(50_000));
+
+        assert!(!output.contains('<'), "unterminated tags are dropped");
+        assert!(start.elapsed().as_secs() < 10, "{:?}", start.elapsed());
+    }
+
+    #[test]
+    fn is_idempotent() {
+        for input in [
+            "[![x](vbscript:inner)](vbscript:outer)",
+            "Fix `Vec<String>` and Vec<String>",
+            "if a<b and b>c then",
+            "> quote\n> > nested\n",
+            "&gt; not quoted\n",
+            "https://example.test/x?a=1&b=2 and R&D",
+            "<b>bold `code` more</b>",
+            &rendering_corpus::input(),
+        ] {
+            let once = sanitize_markdown(input);
+
+            assert_eq!(sanitize_markdown(&once), once, "input: {input:?}");
+        }
+    }
+
+    #[test]
+    fn ignores_forged_internal_sentinels() {
+        // The private-use characters that stand in for protected content are
+        // stripped from the input, so they cannot be used to smuggle text past
+        // the allowlist or to forge a blockquote.
+        let output = sanitize_markdown("a\u{E000}0\u{E001}b\u{E002}> c");
+
+        assert_eq!(output, "a0b&gt; c");
+    }
+
     #[test]
     fn work_item_rendering_corpus_matches_golden() {
         let actual = sanitize_markdown(&rendering_corpus::input());

From 58cd00ac63781b0fec78c2c3a465ee6f6aad5b16 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 21 Aug 2026 11:39:06 +0000
Subject: [PATCH 36/41] test(sanitize): spell out what a forged sentinel may
 not do

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
---
 src/sanitize/markdown.rs | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/src/sanitize/markdown.rs b/src/sanitize/markdown.rs
index 4d589e92..638f24c1 100644
--- a/src/sanitize/markdown.rs
+++ b/src/sanitize/markdown.rs
@@ -1314,10 +1314,18 @@ mod tests {
     fn ignores_forged_internal_sentinels() {
         // The private-use characters that stand in for protected content are
         // stripped from the input, so they cannot be used to smuggle text past
-        // the allowlist or to forge a blockquote.
-        let output = sanitize_markdown("a\u{E000}0\u{E001}b\u{E002}> c");
+        // the allowlist or to forge a blockquote. The forged placeholder is
+        // gone (`0` is left as the ordinary text it was), and the `>` is
+        // treated as the mid-line text it now is, which the allowlist stores
+        // escaped.
+        assert_eq!(
+            sanitize_markdown("a\u{E000}0\u{E001}b\u{E002}> c"),
+            "a0b&gt; c"
+        );
 
-        assert_eq!(output, "a0b&gt; c");
+        // A forged blockquote sentinel cannot move a `>` to the start of a
+        // line either: the marker only comes back where the author wrote one.
+        assert_eq!(sanitize_markdown("\u{E002}quoted?\n"), "quoted?\n");
     }
 
     #[test]

From 56c29c575e8a7dc824a125c34a0da11a1d2164c4 Mon Sep 17 00:00:00 2001
From: James Devine <devinejames@microsoft.com>
Date: Tue, 1 Sep 2026 11:30:30 +0100
Subject: [PATCH 37/41] fix(test): account for ADO markdown normalization

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3c8e5f36-958b-48ea-99cd-d7c14b5eb8da
---
 AGENTS.md                                     |  2 +
 docs/safe-outputs.md                          |  6 ++
 .../__tests__/work-item-scenarios.test.ts     | 41 ++++------
 .../scenarios/markdown-rendering-corpus.json  | 71 ++++++++++++++++-
 .../src/executor-e2e/scenarios/work-item.ts   | 78 ++++++-------------
 src/sanitize/markdown.rs                      |  7 +-
 tests/executor-e2e/README.md                  | 17 ++--
 7 files changed, 123 insertions(+), 99 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index ba1804a5..03a2f497 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -200,6 +200,8 @@ fail-closed and only pauses when the agent actually proposed a reviewed output.
 │   ├── version.rs        # Semver parsing/comparison shared across the CLI (pipeline header versions, release tags, codemod cutovers)
 │   ├── ndjson.rs         # NDJSON parsing utilities
 │   ├── sanitize.rs       # Input sanitization for safe outputs
+│   ├── sanitize/
+│   │   └── markdown.rs   # Markdown structure parsing plus HTML/URL allowlisting
 │   ├── secure.rs         # Validated newtype value objects (parse-don't-validate path/identifier types)
 │   ├── validate.rs       # Structural input validators (char allowlists, format checks, injection detectors)
 │   ├── agent_stats.rs    # OTel-based agent statistics parsing (token usage, duration, turns)
diff --git a/docs/safe-outputs.md b/docs/safe-outputs.md
index fbfc695a..a8b2aea8 100644
--- a/docs/safe-outputs.md
+++ b/docs/safe-outputs.md
@@ -278,6 +278,12 @@ an implied `<tbody>`, a mid-line `>` is stored as `&gt;`, and the content of a
 removed raw-text element such as `<noscript>` is escaped rather than kept as
 markup.
 
+Azure DevOps then applies its own server-side Markdown sanitization when the
+work item is stored. That service-side pass may further normalize safe HTML and
+remove dangerous HTML even when it appeared inside a code fence. The compiler
+tests pin ado-aw's pre-storage output separately from the executor E2E fixture
+that pins the representation returned by Azure DevOps.
+
 ### Executor authentication
 
 All write-bearing safe outputs (e.g. `create-pull-request`,
diff --git a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
index 83e399b2..7c85734e 100644
--- a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
+++ b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
@@ -146,7 +146,7 @@ describe("assign-work-item temporary-ID handoff", () => {
 });
 
 describe("create-work-item rendering fidelity", () => {
-  const expected = renderingCorpus.expected.join("\n");
+  const adoExpected = renderingCorpus.ado_expected.join("\n");
 
   function renderingCtx(
     payload: {
@@ -197,13 +197,13 @@ describe("create-work-item rendering fidelity", () => {
     ).rejects.toThrow(SkipError);
   });
 
-  it("accepts a work item whose description round-trips the golden", async () => {
+  it("accepts a work item whose description matches ADO normalization", async () => {
     const state: { title: string; createdId?: number } = { title: "t" };
     await createWorkItemRendering.assert(
       renderingCtx({
         id: 42,
-        fields: { "System.Description": expected },
-        multilineFieldsFormat: { "System.Description": "Markdown" },
+        fields: { "System.Description": adoExpected },
+        multilineFieldsFormat: { "System.Description": "markdown" },
       }),
       state,
       record,
@@ -212,20 +212,20 @@ describe("create-work-item rendering fidelity", () => {
     expect(state.createdId).toBe(42);
   });
 
-  it("records the created id before failing a golden mismatch", async () => {
+  it("records the created id before failing an ADO golden mismatch", async () => {
     const state: { title: string; createdId?: number } = { title: "t" };
     await expect(
       createWorkItemRendering.assert(
-        // Security-clean but not byte-identical: only the golden catches it.
+        // Security-clean but not byte-identical: only the ADO golden catches it.
         renderingCtx({
           id: 42,
-          fields: { "System.Description": expected.replace("**bold**", "bold") },
+          fields: { "System.Description": adoExpected.replace("**bold**", "bold") },
         }),
         state,
         record,
         [record],
       ),
-    ).rejects.toThrow(/does not match the sanitized golden/);
+    ).rejects.toThrow(/does not match the ADO rendering golden/);
     expect(state.createdId).toBe(42);
   });
 
@@ -234,7 +234,7 @@ describe("create-work-item rendering fidelity", () => {
       createWorkItemRendering.assert(
         renderingCtx({
           id: 42,
-          fields: { "System.Description": expected },
+          fields: { "System.Description": adoExpected },
           multilineFieldsFormat: { "System.Description": "Html" },
         }),
         { title: "t" },
@@ -244,8 +244,8 @@ describe("create-work-item rendering fidelity", () => {
     ).rejects.toThrow(/expected "Markdown"/);
   });
 
-  it("fails when a denied construct survives outside fenced code", async () => {
-    const leaked = `${expected}\n<script>alert(1)</script>`;
+  it("fails when a denied construct survives ADO storage", async () => {
+    const leaked = `${adoExpected}\n<script>alert(1)</script>`;
     await expect(
       createWorkItemRendering.assert(
         renderingCtx({ id: 42, fields: { "System.Description": leaked } }),
@@ -253,28 +253,13 @@ describe("create-work-item rendering fidelity", () => {
         record,
         [record],
       ),
-    ).rejects.toThrow(/still contains '<script' outside code/);
-  });
-
-  it("fails when fenced code was mangled", async () => {
-    const mangled = expected.replace(
-      '<script>alert("fenced code is verbatim")</script>',
-      "",
-    );
-    await expect(
-      createWorkItemRendering.assert(
-        renderingCtx({ id: 42, fields: { "System.Description": mangled } }),
-        { title: "t" },
-        record,
-        [record],
-      ),
-    ).rejects.toThrow(/lost fenced code line/);
+    ).rejects.toThrow(/still contains '<script'/);
   });
 
   it("asserts the Bug repro-steps field", async () => {
     await expect(
       createBugWorkItemRendering.assert(
-        renderingCtx({ id: 42, fields: { "System.Description": expected } }),
+        renderingCtx({ id: 42, fields: { "System.Description": adoExpected } }),
         { title: "t" },
         record,
         [record],
diff --git a/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json b/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json
index f721e1aa..15a72443 100644
--- a/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json
+++ b/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json
@@ -6,11 +6,10 @@
     "  * the Rust golden test in src/sanitize/markdown.rs (include_str!), and",
     "  * the create-work-item-rendering executor E2E scenarios",
     "    (scripts/ado-script/src/executor-e2e/scenarios/work-item.ts).",
-    "Both consume it, so the fast local test and the against-ADO test can never",
-    "disagree about what a human is supposed to see.",
+    "`expected` pins the output of ado-aw's sanitizer before the request.",
+    "`ado_expected` pins Azure DevOps' additional server-side normalization.",
     "`input` is what an agent proposes; `expected` is the sanitized text that",
-    "must be stored verbatim in the work item's description field. Both are",
-    "arrays of lines joined with \\n."
+    "ado-aw sends. All three values are arrays of lines joined with \\n."
   ],
   "input": [
     "# Rendering fidelity corpus",
@@ -139,5 +138,69 @@
     "<a>entity-encoded href</a>",
     "",
     ""
+  ],
+  "ado_expected": [
+    "# Rendering fidelity corpus",
+    "",
+    "Paragraph with **bold**, _italic_, `inline <b>code</b>` and a <b>bold tag</b>.<br>",
+    "Line after the break.",
+    "",
+    "## Lists",
+    "",
+    "1. Ordered item",
+    "2. Ordered item with a nested list",
+    "   - Nested bullet",
+    "   - Nested bullet with [a link](https://example.test/docs)",
+    "",
+    "## Tables",
+    "",
+    "| Field | Value |",
+    "| --- | --- |",
+    "| Markdown table | plain cell |",
+    "",
+    "<table>",
+    "  <tbody><tr><th colspan=2>HTML header</th></tr>",
+    "  <tr><td align=left>left </td><td>right </td></tr>",
+    "</tbody></table>",
+    "",
+    "## Disclosure and inline tags",
+    "",
+    "<details>",
+    "<summary>Collapsed section</summary>",
+    "",
+    "Body with Ctrl+C, H<sub>2</sub>O and x<sup>2</sup>.",
+    "",
+    "</details>",
+    "",
+    "## Links and images",
+    "",
+    "Autolink: ",
+    "",
+    "Image: ![diagram](https://example.test/diagram.png)",
+    "",
+    "Denied image scheme: ![bad]((redacted))",
+    "",
+    "Denied link scheme: [click me]((redacted))",
+    "",
+    "Entity-encoded denied scheme: (redacted)",
+    "",
+    "## Code",
+    "",
+    "```html",
+    "",
+    "<a>fenced javascript link</a>",
+    "```",
+    "",
+    "## Denied HTML",
+    "",
+    "",
+    "",
+    "<img src=x alt=\"onerror attribute\">",
+    "",
+    "",
+    "",
+    "<a>entity-encoded href</a>",
+    "",
+    ""
   ]
 }
diff --git a/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts b/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts
index 2f232e2a..73be0f63 100644
--- a/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts
+++ b/scripts/ado-script/src/executor-e2e/scenarios/work-item.ts
@@ -16,12 +16,12 @@ const ASSIGN_TEMPORARY_ID = "#aw_wiassign";
 /**
  * Rendering-fidelity corpus shared with the Rust golden test in
  * `src/sanitize/markdown.rs` (which `include_str!`s the same JSON). The Rust
- * test proves the sanitizer produces `RENDERING_EXPECTED`; these scenarios
- * prove Azure DevOps stores it back byte-for-byte, so the two together pin
- * what a human actually sees in a work item.
+ * test proves the sanitizer produces `expected`; these scenarios prove Azure
+ * DevOps applies the separately pinned `ado_expected` normalization, so the
+ * two boundaries cannot be confused.
  */
 const RENDERING_INPUT = renderingCorpus.input.join("\n");
-const RENDERING_EXPECTED = renderingCorpus.expected.join("\n");
+const ADO_RENDERING_EXPECTED = renderingCorpus.ado_expected.join("\n");
 
 /**
  * Constructs the sanitizer must never let reach a rendered work item.
@@ -29,17 +29,6 @@ const RENDERING_EXPECTED = renderingCorpus.expected.join("\n");
  */
 const DENIED_CONSTRUCTS = ["<script", "onerror=", "<iframe"];
 
-/**
- * Fenced-code lines that must survive verbatim. They contain the same
- * constructs as `DENIED_CONSTRUCTS`, so an over-eager "strip it everywhere"
- * regression fails here rather than silently mangling documentation.
- */
-const FENCED_VERBATIM = [
-  '<script>alert("fenced code is verbatim")</script>',
-  '<a href="javascript:alert(1)">fenced javascript link</a>',
-];
-
-
 function usableEnvValue(value: string | undefined): string | undefined {
   const trimmed = value?.trim();
   if (!trimmed || /^\$\([^)]+\)$/.test(trimmed)) return undefined;
@@ -282,22 +271,6 @@ export const uploadWorkitemAttachment: Scenario<{ id: number }> = {
   cleanup: async (ctx, state) => ctx.rest.deleteWorkItem(state.id),
 };
 
-/** Strip fenced code blocks so denied constructs are only checked in prose. */
-function outsideFencedCode(text: string): string {
-  const lines = text.split("\n");
-  const kept: string[] = [];
-  let inFence = false;
-  for (const line of lines) {
-    const trimmed = line.trimStart();
-    if (trimmed.startsWith("```") || trimmed.startsWith("~~~")) {
-      inFence = !inFence;
-      continue;
-    }
-    if (!inFence) kept.push(line);
-  }
-  return kept.join("\n");
-}
-
 /** First line that differs, to make a golden mismatch debuggable. */
 function firstDifference(actual: string, expected: string): string {
   const a = actual.split("\n");
@@ -331,8 +304,8 @@ function renderingScenario(options: {
     config: () => ({
       "work-item-type": workItemType,
       max: 1,
-      // Appended agent stats would change the stored text and defeat the
-      // byte-for-byte golden comparison.
+      // Appended agent stats would change the stored text and defeat the ADO
+      // server-normalization golden comparison.
       "include-stats": false,
     }),
     setup: async (ctx) => {
@@ -360,29 +333,23 @@ function renderingScenario(options: {
         );
       }
 
-      // 1. Security: denied constructs must not survive in prose, while their
-      //    fenced-code twins must survive untouched. Checked before the golden
-      //    so a leak is reported as a leak rather than as a generic mismatch.
-      const prose = outsideFencedCode(stored).toLowerCase();
+      // 1. Security: ADO applies its own sanitizer after the executor, including
+      //    inside fenced code, so no denied construct may survive anywhere in
+      //    the stored value. Checked before the golden so a leak is reported as
+      //    a leak rather than as a generic mismatch.
+      const normalized = stored.toLowerCase();
       for (const construct of DENIED_CONSTRUCTS) {
-        if (prose.includes(construct.toLowerCase())) {
+        if (normalized.includes(construct.toLowerCase())) {
           throw new Error(
-            `work item #${id} '${descriptionField}' still contains '${construct}' outside code`,
+            `work item #${id} '${descriptionField}' still contains '${construct}'`,
           );
         }
       }
-      if (prose.includes("javascript:")) {
+      if (normalized.includes("javascript:")) {
         throw new Error(
-          `work item #${id} '${descriptionField}' still contains a javascript: URL outside code`,
+          `work item #${id} '${descriptionField}' still contains a javascript: URL`,
         );
       }
-      for (const line of FENCED_VERBATIM) {
-        if (!stored.includes(line)) {
-          throw new Error(
-            `work item #${id} '${descriptionField}' lost fenced code line ${JSON.stringify(line)}`,
-          );
-        }
-      }
 
       // 2. Format: stored as Markdown, otherwise the body renders as literal
       //    text. Not every organization surfaces this on read — when it is
@@ -394,20 +361,19 @@ function renderingScenario(options: {
           `[${scenarioId}] note: ADO did not surface multilineFieldsFormat for ` +
             `'${descriptionField}'; format is covered by the executor unit tests`,
         );
-      } else if (format !== "Markdown") {
+      } else if (typeof format !== "string" || format.toLowerCase() !== "markdown") {
         throw new Error(
           `work item #${id} stores '${descriptionField}' as ${JSON.stringify(format)}, expected "Markdown"`,
         );
       }
 
-      // 3. Golden round-trip: what ADO stored must equal what the sanitizer
-      //    produced, byte for byte. This is the decisive check — any change in
-      //    what the allowlist keeps, drops or rewrites moves the golden, as
-      //    does ADO normalising the payload on the way in.
-      if (stored !== RENDERING_EXPECTED) {
+      // 3. ADO round-trip: what the service returns must equal the separately
+      //    observed server-normalization golden byte for byte. The Rust golden
+      //    pins what the executor sends; this one pins what ADO stores.
+      if (stored !== ADO_RENDERING_EXPECTED) {
         throw new Error(
-          `work item #${id} '${descriptionField}' does not match the sanitized golden ` +
-            `(${firstDifference(stored, RENDERING_EXPECTED)})`,
+          `work item #${id} '${descriptionField}' does not match the ADO rendering golden ` +
+            `(${firstDifference(stored, ADO_RENDERING_EXPECTED)})`,
         );
       }
     },
diff --git a/src/sanitize/markdown.rs b/src/sanitize/markdown.rs
index 638f24c1..942eea32 100644
--- a/src/sanitize/markdown.rs
+++ b/src/sanitize/markdown.rs
@@ -915,8 +915,9 @@ fn clean_html(input: &str) -> String {
 /// Shared work-item rendering-fidelity corpus.
 ///
 /// The same JSON is imported by the `create-work-item-rendering` executor E2E
-/// scenarios, so the fast local golden and the against-ADO assertion can never
-/// disagree about what a human is supposed to see in a work item.
+/// scenarios. Its `expected` value pins this sanitizer's output, while
+/// `ado_expected` separately pins Azure DevOps' additional server-side
+/// normalization.
 #[cfg(test)]
 pub(crate) mod rendering_corpus {
     const CORPUS: &str = include_str!(
@@ -939,7 +940,7 @@ pub(crate) mod rendering_corpus {
         lines("input")
     }
 
-    /// The sanitized Markdown that must be stored in the work item.
+    /// The sanitized Markdown sent to Azure DevOps before server normalization.
     pub(crate) fn expected() -> String {
         lines("expected")
     }
diff --git a/tests/executor-e2e/README.md b/tests/executor-e2e/README.md
index bfd03be8..e10c0950 100644
--- a/tests/executor-e2e/README.md
+++ b/tests/executor-e2e/README.md
@@ -97,20 +97,21 @@ human actually reads in the work item. Two scenarios pin that rendering:
 Both propose the same **unsanitized** corpus and assert, in order, that the
 stored field:
 
-1. contains no denied construct (`<script`, `onerror=`, `<iframe`, a
-   `javascript:` URL) outside fenced code, while the fenced-code copies of those
-   same strings survive verbatim;
+1. contains no denied construct (`<script`, `onerror=`, `<iframe`, or a
+   `javascript:` URL) after Azure DevOps applies its own server-side
+   sanitization, including inside fenced code;
 2. is recorded with `multilineFieldsFormat: Markdown` — when the organization
    does not surface that on read, the scenario logs a note and the patch stays
    pinned by the executor unit tests in `src/safe_outputs/create_work_item.rs`;
-3. equals the sanitized golden **byte for byte**.
+3. equals the observed Azure DevOps normalization golden **byte for byte**.
 
-The corpus and its golden live in one place —
+The corpus and both goldens live in one place —
 [`scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json`](../../scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json)
 — imported by the harness and `include_str!`d by the Rust golden test in
-`src/sanitize/markdown.rs`, so the sub-second local test and the against-ADO
-test cannot drift. A deliberate rendering change means updating `expected` in
-that one file; an accidental one fails `cargo test` before it ever reaches ADO.
+`src/sanitize/markdown.rs`. `expected` pins what the ado-aw sanitizer sends;
+`ado_expected` pins what Azure DevOps returns after its additional
+normalization. A deliberate change to either boundary is explicit in the same
+fixture.
 
 The Bug scenario skips (rather than fails) when the project does not define the
 `Bug` work item type.

From a50ddb7c7fabfba950213cf2a450c06934002ebc Mon Sep 17 00:00:00 2001
From: James Devine <devinejames@microsoft.com>
Date: Tue, 1 Sep 2026 11:42:29 +0100
Subject: [PATCH 38/41] test(executor-e2e): cover markdown storage guards

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3c8e5f36-958b-48ea-99cd-d7c14b5eb8da
---
 .../__tests__/work-item-scenarios.test.ts     | 46 +++++++++++--------
 1 file changed, 28 insertions(+), 18 deletions(-)

diff --git a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
index 7c85734e..d1ca79b4 100644
--- a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
+++ b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
@@ -197,20 +197,23 @@ describe("create-work-item rendering fidelity", () => {
     ).rejects.toThrow(SkipError);
   });
 
-  it("accepts a work item whose description matches ADO normalization", async () => {
-    const state: { title: string; createdId?: number } = { title: "t" };
-    await createWorkItemRendering.assert(
-      renderingCtx({
-        id: 42,
-        fields: { "System.Description": adoExpected },
-        multilineFieldsFormat: { "System.Description": "markdown" },
-      }),
-      state,
-      record,
-      [record],
-    );
-    expect(state.createdId).toBe(42);
-  });
+  it.each(["Markdown", "markdown"])(
+    "accepts the work-item Markdown format with %s casing",
+    async (format) => {
+      const state: { title: string; createdId?: number } = { title: "t" };
+      await createWorkItemRendering.assert(
+        renderingCtx({
+          id: 42,
+          fields: { "System.Description": adoExpected },
+          multilineFieldsFormat: { "System.Description": format },
+        }),
+        state,
+        record,
+        [record],
+      );
+      expect(state.createdId).toBe(42);
+    },
+  );
 
   it("records the created id before failing an ADO golden mismatch", async () => {
     const state: { title: string; createdId?: number } = { title: "t" };
@@ -244,16 +247,23 @@ describe("create-work-item rendering fidelity", () => {
     ).rejects.toThrow(/expected "Markdown"/);
   });
 
-  it("fails when a denied construct survives ADO storage", async () => {
-    const leaked = `${adoExpected}\n<script>alert(1)</script>`;
+  it.each([
+    ["script", "<script>alert(1)</script>", /still contains '<script'/],
+    ["event handler", '<img src="x" onerror="alert(1)">', /still contains 'onerror='/],
+    ["iframe", '<iframe src="https://example.test"></iframe>', /still contains '<iframe'/],
+    ["javascript URL", "[click](javascript:alert(1))", /still contains a javascript: URL/],
+  ])("fails when a denied %s survives ADO storage", async (_name, leaked, error) => {
     await expect(
       createWorkItemRendering.assert(
-        renderingCtx({ id: 42, fields: { "System.Description": leaked } }),
+        renderingCtx({
+          id: 42,
+          fields: { "System.Description": `${adoExpected}\n${leaked}` },
+        }),
         { title: "t" },
         record,
         [record],
       ),
-    ).rejects.toThrow(/still contains '<script'/);
+    ).rejects.toThrow(error);
   });
 
   it("asserts the Bug repro-steps field", async () => {

From daba3629d627744731c5e64d7ef9e65486bb72bf Mon Sep 17 00:00:00 2001
From: James Devine <devinejames@microsoft.com>
Date: Tue, 1 Sep 2026 11:55:58 +0100
Subject: [PATCH 39/41] test(executor-e2e): cover missing format metadata

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3c8e5f36-958b-48ea-99cd-d7c14b5eb8da
---
 .../__tests__/work-item-scenarios.test.ts     | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
index d1ca79b4..34592fc4 100644
--- a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
+++ b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
@@ -215,6 +215,28 @@ describe("create-work-item rendering fidelity", () => {
     },
   );
 
+  it("logs and continues when ADO omits the Markdown format metadata", async () => {
+    const log = vi.fn();
+    const ctx = {
+      ...renderingCtx({
+        id: 42,
+        fields: { "System.Description": adoExpected },
+      }),
+      log,
+    };
+
+    await createWorkItemRendering.assert(
+      ctx,
+      { title: "t" },
+      record,
+      [record],
+    );
+
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining("ADO did not surface multilineFieldsFormat"),
+    );
+  });
+
   it("records the created id before failing an ADO golden mismatch", async () => {
     const state: { title: string; createdId?: number } = { title: "t" };
     await expect(

From e01901678f7356971b2f9d9e97c37f4851884c90 Mon Sep 17 00:00:00 2001
From: James Devine <devinejames@microsoft.com>
Date: Tue, 1 Sep 2026 15:14:39 +0100
Subject: [PATCH 40/41] fix(sanitize): close markdown validation gaps

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3c8e5f36-958b-48ea-99cd-d7c14b5eb8da
---
 .../scenarios/markdown-rendering-corpus.json  | 24 +++++++
 src/sanitize.rs                               | 67 +++++++++++--------
 src/sanitize/markdown.rs                      | 39 +++++++++--
 tests/executor-e2e/azure-pipelines.yml        |  4 ++
 4 files changed, 99 insertions(+), 35 deletions(-)

diff --git a/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json b/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json
index 15a72443..18c6f96e 100644
--- a/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json
+++ b/scripts/ado-script/src/executor-e2e/scenarios/markdown-rendering-corpus.json
@@ -56,6 +56,14 @@
     "",
     "Entity-encoded denied scheme: [encoded](java&#115;cript:alert(1))",
     "",
+    "Escaped denied reference: [escaped][escaped-ref]",
+    "",
+    "[escaped-ref]: javascript\\:alert(1)",
+    "",
+    "Entity-encoded denied reference: [entity][entity-ref]",
+    "",
+    "[entity-ref]: java&#115;cript:alert(1)",
+    "",
     "## Code",
     "",
     "```html",
@@ -120,6 +128,14 @@
     "",
     "Entity-encoded denied scheme: (redacted)",
     "",
+    "Escaped denied reference: [escaped][escaped-ref]",
+    "",
+    "(redacted)",
+    "",
+    "Entity-encoded denied reference: [entity][entity-ref]",
+    "",
+    "(redacted)",
+    "",
     "## Code",
     "",
     "```html",
@@ -184,6 +200,14 @@
     "",
     "Entity-encoded denied scheme: (redacted)",
     "",
+    "Escaped denied reference: [escaped][escaped-ref]",
+    "",
+    "(redacted)",
+    "",
+    "Entity-encoded denied reference: [entity][entity-ref]",
+    "",
+    "(redacted)",
+    "",
     "## Code",
     "",
     "```html",
diff --git a/src/sanitize.rs b/src/sanitize.rs
index 896bee81..fd460728 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -209,41 +209,35 @@ pub(crate) fn neutralize_pipeline_commands(input: &str) -> String {
 /// Wrap @mentions in backticks to prevent unintended notifications.
 fn neutralize_mentions(input: &str) -> String {
     let mut result = String::with_capacity(input.len());
-    let mut chars = input.char_indices().peekable();
-
-    while let Some((i, c)) = chars.next() {
-        if c == '@' {
-            // Don't neutralize if already inside backticks
-            let before = &input[..i];
-            let open_backticks = before.matches('`').count();
-            if open_backticks % 2 == 1 {
-                // Inside inline code – leave as is
+    let mut chars = input.chars().peekable();
+    let mut inside_backticks = false;
+
+    while let Some(c) = chars.next() {
+        match c {
+            '`' => {
                 result.push(c);
-                continue;
+                inside_backticks = !inside_backticks;
             }
+            '@' if !inside_backticks => {
+                let mut mention = String::from("@");
+                while let Some(&next_c) = chars.peek() {
+                    if next_c.is_alphanumeric() || next_c == '_' || next_c == '-' || next_c == '.' {
+                        mention.push(next_c);
+                        chars.next();
+                    } else {
+                        break;
+                    }
+                }
 
-            // Collect the mention word
-            let mut mention = String::from("@");
-            while let Some(&(_, next_c)) = chars.peek() {
-                if next_c.is_alphanumeric() || next_c == '_' || next_c == '-' || next_c == '.' {
-                    mention.push(next_c);
-                    chars.next();
+                if mention.len() > 1 {
+                    result.push('`');
+                    result.push_str(&mention);
+                    result.push('`');
                 } else {
-                    break;
+                    result.push('@');
                 }
             }
-
-            if mention.len() > 1 {
-                // Wrap in backticks
-                result.push('`');
-                result.push_str(&mention);
-                result.push('`');
-            } else {
-                // Bare '@' with no username – keep as-is
-                result.push('@');
-            }
-        } else {
-            result.push(c);
+            _ => result.push(c),
         }
     }
 
@@ -453,6 +447,21 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_neutralize_mentions_scales_at_content_limit() {
+        use std::time::{Duration, Instant};
+
+        let input = "@a ".repeat(MAX_CONTENT_BYTES / 3);
+        let started = Instant::now();
+        let output = neutralize_mentions(&input);
+
+        assert!(
+            started.elapsed() < Duration::from_secs(5),
+            "mention neutralization exceeded the linear-time budget"
+        );
+        assert_eq!(output.matches("`@a`").count(), MAX_CONTENT_BYTES / 3);
+    }
+
     // IS-05: Bot trigger / work item link protection
     #[test]
     fn test_neutralize_fixes() {
diff --git a/src/sanitize/markdown.rs b/src/sanitize/markdown.rs
index 942eea32..e18780b8 100644
--- a/src/sanitize/markdown.rs
+++ b/src/sanitize/markdown.rs
@@ -803,12 +803,19 @@ fn regions(input: &str) -> Vec<Region> {
             ) {
                 regions.push(Region::Protected(range));
             }
-        } else if let Some(range) = locate_destination(
-            input,
-            &definition.span,
-            &definition.dest,
-            DEFINITION_LABEL_END,
-        ) {
+        } else {
+            // The parser decodes entity/backslash escapes in destinations, so
+            // the decoded value may not occur byte-for-byte in the source.
+            // Denied definitions must fail closed just like inline links:
+            // redact the complete definition when its destination cannot be
+            // located deterministically.
+            let range = locate_destination(
+                input,
+                &definition.span,
+                &definition.dest,
+                DEFINITION_LABEL_END,
+            )
+            .unwrap_or_else(|| definition.span.clone());
             regions.push(Region::Redact(range));
         }
     }
@@ -1049,6 +1056,26 @@ mod tests {
         assert!(output.contains("the link"), "{output}");
     }
 
+    #[test]
+    fn redacts_backslash_escaped_denied_reference_definition() {
+        let output = sanitize_markdown("See [the link][ref].\n\n[ref]: javascript\\:alert(1)\n");
+
+        assert!(!output.contains("javascript"), "{output}");
+        assert!(!output.contains("\\:"), "{output}");
+        assert!(output.contains("(redacted)"), "{output}");
+        assert!(output.contains("the link"), "{output}");
+    }
+
+    #[test]
+    fn redacts_entity_encoded_denied_reference_definition() {
+        let output = sanitize_markdown("See [the link][ref].\n\n[ref]: java&#115;cript:alert(1)\n");
+
+        assert!(!output.contains("&#115;"), "{output}");
+        assert!(!output.contains("alert(1)"), "{output}");
+        assert!(output.contains("(redacted)"), "{output}");
+        assert!(output.contains("the link"), "{output}");
+    }
+
     #[test]
     fn preserves_reference_definition_with_allowed_scheme() {
         let input = "See [the link][ref].\n\n[ref]: https://example.test/page\n";
diff --git a/tests/executor-e2e/azure-pipelines.yml b/tests/executor-e2e/azure-pipelines.yml
index bee3f821..83e030e1 100644
--- a/tests/executor-e2e/azure-pipelines.yml
+++ b/tests/executor-e2e/azure-pipelines.yml
@@ -19,6 +19,10 @@ pr:
       - main
   paths:
     include:
+      - Cargo.toml
+      - Cargo.lock
+      - src/sanitize.rs
+      - src/sanitize/**
       - src/safe_outputs/**
       - scripts/ado-script/src/executor-e2e/**
       - tests/executor-e2e/**

From 12e478a707dae1f78eabdb0b260fabb23f478317 Mon Sep 17 00:00:00 2001
From: James Devine <devinejames@microsoft.com>
Date: Tue, 1 Sep 2026 15:25:46 +0100
Subject: [PATCH 41/41] test(executor-e2e): cover Bug rendering success

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3c8e5f36-958b-48ea-99cd-d7c14b5eb8da
---
 .../__tests__/work-item-scenarios.test.ts     | 21 ++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
index 34592fc4..3d93cd0f 100644
--- a/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
+++ b/scripts/ado-script/src/executor-e2e/__tests__/work-item-scenarios.test.ts
@@ -288,7 +288,26 @@ describe("create-work-item rendering fidelity", () => {
     ).rejects.toThrow(error);
   });
 
-  it("asserts the Bug repro-steps field", async () => {
+  it("accepts the Bug repro-steps rendering path", async () => {
+    const state: { title: string; createdId?: number } = { title: "t" };
+
+    await createBugWorkItemRendering.assert(
+      renderingCtx({
+        id: 42,
+        fields: { "Microsoft.VSTS.TCM.ReproSteps": adoExpected },
+        multilineFieldsFormat: {
+          "Microsoft.VSTS.TCM.ReproSteps": "markdown",
+        },
+      }),
+      state,
+      record,
+      [record],
+    );
+
+    expect(state.createdId).toBe(42);
+  });
+
+  it("rejects a Bug response that omits the repro-steps field", async () => {
     await expect(
       createBugWorkItemRendering.assert(
         renderingCtx({ id: 42, fields: { "System.Description": adoExpected } }),