fix(copilot): address the confirmed review findings

Five findings from the review, each reproduced before being fixed and
mutation-checked after.

The nesting rule on the matched-pair path tested for anything tag-shaped while
the streaming path tested for the tag NAMES. Reasoning that mentioned `<div>` or
a generic was therefore released as visible prose — the model's thinking on
screen because of an incidental angle bracket. Both paths now share one
predicate, hasSpecialTagMarker, so they cannot disagree about whether a body was
ever a tag. The broad regex keeps its other job: on a JSON body an invented name
like `</workflow_resource>` really is stray content.

Not changed, and worth saying why: a `<thinking>` body containing a REAL nested
tag still releases and renders it. Suppressing it instead would mean the
streaming path shows a card and the close then retracts it, which is the defect
the previous commit fixed. Security rated the containment loss P2 while noting it
grants no capability the top-level path lacks — a stream that can nest a tag can
emit one at top level, which already rendered.

unclosedTagCannotResolve blanked a full window before viability rejected the body
on its first character, which is the common case of a tag name in prose. Testing
that first: 43ms per streaming parse at 84KB, now 2ms.

The unclosed path sliced the whole remaining buffer and then bounded it, copying
the rest of the message per opener per chunk. inspectFrom slices once, bounded.

A message that is ONLY a discarded payload rendered the raw JSON: discard emits
no segment by design, so it reached the empty-segments fallback, whose job is to
never blank a plain-text message. It now knows a discard happened. Pre-existing,
but discard only became a first-class outcome on this branch.

Three docstrings still pointed at resolveTagAt for decisions the refactor moved
into classifyBody and resumeForClass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: j15z

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.test.ts

@@ -522,6 +522,36 @@ describe('parseSpecialTags with <question>', () => {
     expect(renderedText(done.segments)).toBe('a <thinking>b <thinking> c')
   })
 
+  it('keeps reasoning suppressed when the body merely contains angle brackets', () => {
+    // The nesting rule keys on tag NAMES, not on anything tag-shaped. Reasoning
+    // that mentions `<div>` or a generic is still reasoning; releasing it would
+    // put the model's thinking on screen for an incidental angle bracket.
+    const { segments } = parseSpecialTags('a <thinking>weighing a <div> here</thinking> b', false)
+
+    expect(segments.some((segment) => segment.type === 'thinking')).toBe(true)
+    expect(visibleView(segments).text).toBe('a  b')
+  })
+
+  it('renders nothing for a message that is only a discarded payload', () => {
+    // `discard` emits no segment, so this is the one case that can end the parse
+    // with an empty segment list. The fallback for an empty list is to emit the
+    // raw content — which would put back the exact raw JSON the discard removed.
+    const { segments } = parseSpecialTags('<question>{"type":"single_select"}</question>', false)
+
+    expect(visibleView(segments).text).toBe('')
+  })
+
+  it('settles a long prose mention without scanning the whole window', () => {
+    // Viability rejects on the first non-whitespace character when it is not `{`
+    // or `[` — the common case. Testing that before blanking avoids copying a
+    // full window per opener per chunk: 43ms to 2ms on this input.
+    const content = 'The <workspace_resource> tag is used here. '.repeat(2000)
+
+    const startedAt = performance.now()
+    parseSpecialTags(content, true)
+    expect(performance.now() - startedAt).toBeLessThan(20)
+  })
+
   it('does not let a late thinking close swallow content already on screen', () => {
     // A nested marker disproves the outer <thinking> mid-stream, so its text is
     // released and the inner tag renders as a card. A prose body has no shape to

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx

@@ -397,7 +397,7 @@ export function parseTextTagBody(body: string): string | null {
  *
  * Separates "the agent formed a payload that failed its shape guard" from "this
  * was never JSON" — the line that decides whether a failed body may be dropped
- * or must be shown (see {@link resolveTagAt}). Costs a second parse of a body
+ * or must be shown (see {@link classifyBody}). Costs a second parse of a body
  * that already failed one, which is the rare path; the common cases never reach
  * it, since a valid payload returns earlier and prose is rejected by the cheaper
  * viability rule before this runs.
@@ -545,7 +545,7 @@ const MAX_UNCLOSED_BODY_SCAN = 4096
  * a string does not end it early. Handles an unterminated trailing string, which
  * is the normal state mid-stream.
  *
- * Index preservation is load-bearing, not decorative: {@link resolveTagAt} takes an
+ * Index preservation is load-bearing, not decorative: {@link resumeForClass} takes an
  * offset found in the blanked copy and applies it to the RAW body. Iteration is by
  * code point, so a blanked astral character must emit `char.length` spaces —
  * emitting one would shrink the output and shift every later offset left.
@@ -643,17 +643,34 @@ function isViableJsonPrefixOf(scannable: string): boolean {
  * A false positive would merely show text early that a later chunk resolves
  * into a tag — the end-of-stream parse still produces the correct final render.
  */
+/**
+ * Whether `text` contains a marker for one of the tags this parser knows.
+ *
+ * Deliberately the tag NAMES rather than anything tag-shaped. A prose body may
+ * legitimately contain `<div>` or `Promise<void>`; only a marker the parser
+ * would itself act on proves the enclosing opener was text. Shared so the
+ * streaming and matched-pair paths cannot answer the same question differently
+ * — them disagreeing is what let a late close swallow content already on screen.
+ */
+function hasSpecialTagMarker(text: string): boolean {
+  return SPECIAL_TAG_NAMES.some((name) => text.includes(`</${name}>`) || text.includes(`<${name}>`))
+}
+
 function unclosedTagCannotResolve(
   tagName: (typeof SPECIAL_TAG_NAMES)[number],
   body: string
 ): boolean {
   const pending = dropArrivingClose(body, `</${tagName}>`)
 
-  if (!JSON_BODY_TAG_NAMES.has(tagName)) {
-    return SPECIAL_TAG_NAMES.some(
-      (name) => pending.includes(`</${name}>`) || pending.includes(`<${name}>`)
-    )
-  }
+  if (!JSON_BODY_TAG_NAMES.has(tagName)) return hasSpecialTagMarker(pending)
+
+  // Cheap rejection before the expensive one. isViableJsonPrefixOf decides on
+  // the first non-whitespace character when it is not `{` or `[` — which is the
+  // common case, a tag name mentioned in prose — so testing it here avoids
+  // blanking up to a full window of text only to throw the copy away. Measured
+  // at 86KB of such prose: 43ms per streaming parse before, 2.4ms after.
+  const firstChar = pending.trimStart().charAt(0)
+  if (firstChar !== '' && firstChar !== '{' && firstChar !== '[') return true
 
   // Blank string literals first so braces and brackets inside JSON strings do
   // not throw off the depth count.
@@ -701,7 +718,7 @@ type TagResolution =
  * really was a payload that failed its shape guard.
  *
  * The two reasons resume differently, which is why they are distinguished
- * rather than collapsed into a boolean (see {@link resolveTagAt}).
+ * rather than collapsed into a boolean (see {@link resumeForClass}).
  */
 type LiteralTextVerdict =
   /**
@@ -799,6 +816,20 @@ function inspectWithin(body: string): InspectedBody {
     : { text: body, truncated: false }
 }
 
+/**
+ * {@link inspectWithin} for a body that has not been cut out of the buffer yet.
+ *
+ * Slices once, already bounded. Taking `content.slice(bodyStart)` first and
+ * bounding after copies the entire rest of the message — on every opener, on
+ * every streamed chunk — and throws all but the window away.
+ */
+function inspectFrom(content: string, bodyStart: number): InspectedBody {
+  const end = bodyStart + MAX_UNCLOSED_BODY_SCAN
+  return end < content.length
+    ? { text: content.slice(bodyStart, end), truncated: true }
+    : { text: content.slice(bodyStart), truncated: false }
+}
+
 /**
  * What a matched body turned out to BE — independent of what the parser does
  * about it, and of where it resumes.
@@ -844,9 +875,12 @@ function classifyBody(tagName: (typeof SPECIAL_TAG_NAMES)[number], body: string)
   const isJsonBodied = JSON_BODY_TAG_NAMES.has(tagName)
 
   if (!isJsonBodied) {
-    // Prose bodies are never blanked, so a marker here is real and its index is
-    // exact.
-    if (TAG_SHAPED_MARKER.test(body)) return { kind: 'prose-nested-marker' }
+    // The same predicate the streaming path uses, so the two cannot disagree
+    // about whether this body was ever a tag. Tag NAMES, not anything
+    // tag-shaped: reasoning that mentions `<div>` or `Promise<void>` is still
+    // reasoning, and releasing it as prose would put the model's thinking on
+    // screen for an incidental angle bracket.
+    if (hasSpecialTagMarker(body)) return { kind: 'prose-nested-marker' }
   }
 
   const parsed = parseSpecialTagData(tagName, body)
@@ -938,7 +972,7 @@ function resolveTagAt(
   const closeIdx = memoizedIndexOf(closeCache, content, closeTag, bodyStart)
 
   if (closeIdx === -1) {
-    const inspected = inspectWithin(content.slice(bodyStart))
+    const inspected = inspectFrom(content, bodyStart)
     if (isStreaming && !unclosedTagCannotResolve(tagName, inspected.text)) {
       return { outcome: 'pending' }
     }
@@ -981,6 +1015,7 @@ export function parseSpecialTags(content: string, isStreaming: boolean): ParsedS
 
   const openerCache: IndexOfCache = new Map()
   const closeCache: IndexOfCache = new Map()
+  let discardedTag = false
 
   while (cursor < content.length) {
     let nearestStart = -1
@@ -1029,12 +1064,20 @@ export function parseSpecialTags(content: string, isStreaming: boolean): ParsedS
       segments.push(resolution.segment)
     } else if (resolution.outcome === 'literal') {
       pushText(content.slice(nearestStart, resolution.resumeAt))
+    } else {
+      // `discard` deliberately emits nothing. Remembering that it happened is
+      // what keeps the fallback below from undoing it.
+      discardedTag = true
     }
 
     cursor = resolution.resumeAt
   }
 
-  if (segments.length === 0 && !hasPendingTag) {
+  // A message with no segments is normally a message with nothing in it, and
+  // emitting the raw content is the right floor. But a discard produces no
+  // segment BY DESIGN, so without this guard a message that is only a broken
+  // payload falls through and renders the exact raw JSON the discard removed.
+  if (segments.length === 0 && !hasPendingTag && !discardedTag) {
     segments.push({ type: 'text', content })
   }