完善聊天 Markdown 安全显示

为 Direct Codex 流式正文恢复可访问标签

将 HTML 标签转义为可见纯文本

保留 Markdown 内容安全渲染边界

apps/ai-game-creator-shell/src/components/ChatMarkdownMessage/index.tsx

@@ -59,12 +59,12 @@ const markdownComponents: Components = {
   ),
   p: ({ children }) => <p className="m-0 break-words">{children}</p>,
   ul: ({ children }) => (
-    <ul className="m-0 list-disc space-y-1 pl-5">{children}</ul>
+    <ul className="m-0 list-none space-y-1 pl-0">{children}</ul>
   ),
   ol: ({ children }) => (
     <ol className="m-0 list-decimal space-y-1 pl-5">{children}</ol>
   ),
-  li: ({ children }) => <li className="break-words">{children}</li>,
+  li: ({ children }) => <li className="break-words">- {children}</li>,
   blockquote: ({ children }) => (
     <blockquote className="m-0 border-l-2 border-(--platform-surface-border) pl-3 text-(--platform-text-soft)">
       {children}
@@ -112,6 +112,12 @@ const markdownComponents: Components = {
   ),
 };
 
+function escapeHtmlTagsForDisplay(text: string) {
+  return text.replace(/<\/?[A-Za-z][^>]*>/gu, (tag) =>
+    tag.replaceAll('<', '&lt;').replaceAll('>', '&gt;'),
+  );
+}
+
 export function ChatMarkdownMessage({
   text,
   role,
@@ -134,7 +140,7 @@ export function ChatMarkdownMessage({
           remarkPlugins={[remarkGfm]}
           components={markdownComponents}
         >
-          {text}
+          {escapeHtmlTagsForDisplay(text)}
         </ReactMarkdown>
       </div>
     </MarkdownErrorBoundary>

apps/ai-game-creator-shell/src/features/project-workspace/ProjectSupervisorView.tsx

@@ -175,11 +175,13 @@ export function ProjectSupervisorView({
                 <strong>{directActivity || '陶泥儿正在处理'}</strong>
               </header>
               {transientReply ? (
-                <ChatMarkdownMessage
-                  role="assistant"
-                  text={transientReply}
-                  streaming
-                />
+                <div aria-label="陶泥儿实时回复">
+                  <ChatMarkdownMessage
+                    role="assistant"
+                    text={transientReply}
+                    streaming
+                  />
+                </div>
               ) : null}
             </section>
           ) : transientReply ? (