Merge branch 'develop' into feat/ui-lib

2026-02-09 16:51:26 +05:30
parent ce5b7e310e 67112647e8
commit 76b1769731
969 changed files with 30544 additions and 7332 deletions
@@ -84,21 +84,28 @@ export const PORTALS_EVENTS = Object.freeze({
  PREVIEW_ARTICLE: 'Previewed article',
 });

-export const OPEN_AI_EVENTS = Object.freeze({
-  SUMMARIZE: 'OpenAI: Used summarize',
-  REPLY_SUGGESTION: 'OpenAI: Used reply suggestion',
-  REPHRASE: 'OpenAI: Used rephrase',
-  FIX_SPELLING_AND_GRAMMAR: 'OpenAI: Used fix spelling and grammar',
-  SHORTEN: 'OpenAI: Used shorten',
-  EXPAND: 'OpenAI: Used expand',
-  MAKE_FRIENDLY: 'OpenAI: Used make friendly',
-  MAKE_FORMAL: 'OpenAI: Used make formal',
-  SIMPLIFY: 'OpenAI: Used simplify',
-  APPLY_LABEL_SUGGESTION: 'OpenAI: Apply label from suggestion',
-  DISMISS_LABEL_SUGGESTION: 'OpenAI: Dismiss label suggestions',
-  ADDED_AI_INTEGRATION_VIA_CTA_BUTTON:
-    'OpenAI: Added AI integration via CTA button',
-  DISMISS_AI_SUGGESTION: 'OpenAI: Dismiss AI suggestions',
+export const CAPTAIN_EVENTS = Object.freeze({
+  // Rewrite events (with operation attribute in payload)
+  REWRITE_USED: 'Captain: Rewrite used',
+  REWRITE_APPLIED: 'Captain: Rewrite applied',
+  REWRITE_DISMISSED: 'Captain: Rewrite dismissed',
+
+  // Summarize events
+  SUMMARIZE_USED: 'Captain: Summarize used',
+  SUMMARIZE_APPLIED: 'Captain: Summarize applied',
+  SUMMARIZE_DISMISSED: 'Captain: Summarize dismissed',
+
+  // Reply suggestion events
+  REPLY_SUGGESTION_USED: 'Captain: Reply suggestion used',
+  REPLY_SUGGESTION_APPLIED: 'Captain: Reply suggestion applied',
+  REPLY_SUGGESTION_DISMISSED: 'Captain: Reply suggestion dismissed',
+
+  // Follow-up events
+  FOLLOW_UP_SENT: 'Captain: Follow-up sent',
+
+  // Label suggestions
+  LABEL_SUGGESTION_APPLIED: 'Captain: Label suggestion applied',
+  LABEL_SUGGESTION_DISMISSED: 'Captain: Label suggestion dismissed',
 });

 export const COPILOT_EVENTS = Object.freeze({
@@ -1,4 +1,4 @@
-import posthog from 'posthog-js';
+import * as amplitude from '@amplitude/analytics-browser';

 /**
 * AnalyticsHelper class to initialize and track user analytics
@@ -26,12 +26,10 @@ export class AnalyticsHelper {
      return;
    }

-    posthog.init(this.analyticsToken, {
-      api_host: 'https://app.posthog.com',
-      capture_pageview: false,
-      persistence: 'localStorage+cookie',
+    amplitude.init(this.analyticsToken, {
+      defaultTracking: false,
    });
-    this.analytics = posthog;
+    this.analytics = amplitude;
  }

  /**
@@ -45,20 +43,26 @@ export class AnalyticsHelper {
    }

    this.user = user;
-    this.analytics.identify(this.user.id.toString(), {
-      email: this.user.email,
-      name: this.user.name,
-      avatar: this.user.avatar_url,
-    });
+    this.analytics.setUserId(`user-${this.user.id.toString()}`);
+
+    const identifyEvent = new amplitude.Identify();
+    identifyEvent.set('email', this.user.email);
+    identifyEvent.set('name', this.user.name);
+    identifyEvent.set('avatar', this.user.avatar_url);
+    this.analytics.identify(identifyEvent);

    const { accounts, account_id: accountId } = this.user;
    const [currentAccount] = accounts.filter(
      account => account.id === accountId
    );
    if (currentAccount) {
-      this.analytics.group('company', currentAccount.id.toString(), {
-        name: currentAccount.name,
-      });
+      const groupId = `account-${currentAccount.id.toString()}`;
+
+      this.analytics.setGroup('company', groupId);
+
+      const groupIdentify = new amplitude.Identify();
+      groupIdentify.set('name', currentAccount.name);
+      this.analytics.groupIdentify('company', groupId, groupIdentify);
    }
  }

@@ -72,20 +76,21 @@ export class AnalyticsHelper {
    if (!this.analytics) {
      return;
    }
-    this.analytics.capture(eventName, properties);
+    this.analytics.track(eventName, properties);
  }

  /**
   * Track the page views
   * @function
-   * @param {Object} params - Page view properties
+   * @param {string} pageName - Page name
+   * @param {Object} [properties={}] - Page view properties
   */
-  page(params) {
+  page(pageName, properties = {}) {
    if (!this.analytics) {
      return;
    }

-    this.analytics.capture('$pageview', params);
+    this.analytics.track('$pageview', { pageName, ...properties });
  }
 }

@@ -1,12 +1,15 @@
 import helperObject, { AnalyticsHelper } from '../';

-vi.mock('posthog-js', () => ({
-  default: {
-    init: vi.fn(),
-    identify: vi.fn(),
-    capture: vi.fn(),
-    group: vi.fn(),
-  },
+vi.mock('@amplitude/analytics-browser', () => ({
+  init: vi.fn(),
+  setUserId: vi.fn(),
+  identify: vi.fn(),
+  setGroup: vi.fn(),
+  groupIdentify: vi.fn(),
+  track: vi.fn(),
+  Identify: vi.fn(() => ({
+    set: vi.fn(),
+  })),
 }));

 describe('helperObject', () => {
@@ -22,12 +25,12 @@ describe('AnalyticsHelper', () => {
  });

  describe('init', () => {
-    it('should initialize posthog with the correct token', async () => {
+    it('should initialize amplitude with the correct token', async () => {
      await analyticsHelper.init();
      expect(analyticsHelper.analytics).not.toBe(null);
    });

-    it('should not initialize posthog if token is not provided', async () => {
+    it('should not initialize amplitude if token is not provided', async () => {
      analyticsHelper = new AnalyticsHelper();
      await analyticsHelper.init();
      expect(analyticsHelper.analytics).toBe(null);
@@ -36,10 +39,15 @@ describe('AnalyticsHelper', () => {

  describe('identify', () => {
    beforeEach(() => {
-      analyticsHelper.analytics = { identify: vi.fn(), group: vi.fn() };
+      analyticsHelper.analytics = {
+        setUserId: vi.fn(),
+        identify: vi.fn(),
+        setGroup: vi.fn(),
+        groupIdentify: vi.fn(),
+      };
    });

-    it('should call identify on posthog with correct arguments', () => {
+    it('should call setUserId and identify on amplitude with correct arguments', () => {
      analyticsHelper.identify({
        id: 123,
        email: 'test@example.com',
@@ -49,19 +57,18 @@ describe('AnalyticsHelper', () => {
        account_id: 1,
      });

-      expect(analyticsHelper.analytics.identify).toHaveBeenCalledWith('123', {
-        email: 'test@example.com',
-        name: 'Test User',
-        avatar: 'avatar_url',
-      });
-      expect(analyticsHelper.analytics.group).toHaveBeenCalledWith(
-        'company',
-        '1',
-        { name: 'Account 1' }
+      expect(analyticsHelper.analytics.setUserId).toHaveBeenCalledWith(
+        'user-123'
      );
+      expect(analyticsHelper.analytics.identify).toHaveBeenCalled();
+      expect(analyticsHelper.analytics.setGroup).toHaveBeenCalledWith(
+        'company',
+        'account-1'
+      );
+      expect(analyticsHelper.analytics.groupIdentify).toHaveBeenCalled();
    });

-    it('should call identify on posthog without group', () => {
+    it('should call identify on amplitude without group', () => {
      analyticsHelper.identify({
        id: 123,
        email: 'test@example.com',
@@ -71,10 +78,10 @@ describe('AnalyticsHelper', () => {
        account_id: 5,
      });

-      expect(analyticsHelper.analytics.group).not.toHaveBeenCalled();
+      expect(analyticsHelper.analytics.setGroup).not.toHaveBeenCalled();
    });

-    it('should not call analytics.page if analytics is null', () => {
+    it('should not call analytics methods if analytics is null', () => {
      analyticsHelper.analytics = null;
      analyticsHelper.identify({});
      expect(analyticsHelper.analytics).toBe(null);
@@ -83,27 +90,27 @@ describe('AnalyticsHelper', () => {

  describe('track', () => {
    beforeEach(() => {
-      analyticsHelper.analytics = { capture: vi.fn() };
+      analyticsHelper.analytics = { track: vi.fn() };
      analyticsHelper.user = { id: 123 };
    });

-    it('should call capture on posthog with correct arguments', () => {
+    it('should call track on amplitude with correct arguments', () => {
      analyticsHelper.track('Test Event', { prop1: 'value1', prop2: 'value2' });
-      expect(analyticsHelper.analytics.capture).toHaveBeenCalledWith(
+      expect(analyticsHelper.analytics.track).toHaveBeenCalledWith(
        'Test Event',
        { prop1: 'value1', prop2: 'value2' }
      );
    });

-    it('should call capture on posthog with default properties', () => {
+    it('should call track on amplitude with default properties', () => {
      analyticsHelper.track('Test Event');
-      expect(analyticsHelper.analytics.capture).toHaveBeenCalledWith(
+      expect(analyticsHelper.analytics.track).toHaveBeenCalledWith(
        'Test Event',
        {}
      );
    });

-    it('should not call capture on posthog if analytics is not initialized', () => {
+    it('should not call track on amplitude if analytics is not initialized', () => {
      analyticsHelper.analytics = null;
      analyticsHelper.track('Test Event', { prop1: 'value1', prop2: 'value2' });
      expect(analyticsHelper.analytics).toBe(null);
@@ -112,24 +119,25 @@ describe('AnalyticsHelper', () => {

  describe('page', () => {
    beforeEach(() => {
-      analyticsHelper.analytics = { capture: vi.fn() };
+      analyticsHelper.analytics = { track: vi.fn() };
    });

-    it('should call the capture method for pageview with the correct arguments', () => {
-      const params = {
-        name: 'Test page',
-        url: '/test',
+    it('should call the track method for pageview with the correct arguments', () => {
+      const pageName = 'home';
+      const properties = {
+        path: '/test',
+        name: 'home',
      };
-      analyticsHelper.page(params);
-      expect(analyticsHelper.analytics.capture).toHaveBeenCalledWith(
+      analyticsHelper.page(pageName, properties);
+      expect(analyticsHelper.analytics.track).toHaveBeenCalledWith(
        '$pageview',
-        params
+        { pageName: 'home', path: '/test', name: 'home' }
      );
    });

-    it('should not call analytics.capture if analytics is null', () => {
+    it('should not call analytics.track if analytics is null', () => {
      analyticsHelper.analytics = null;
-      analyticsHelper.page();
+      analyticsHelper.page('home');
      expect(analyticsHelper.analytics).toBe(null);
    });
  });
@@ -34,45 +34,35 @@ export function extractTextFromMarkdown(markdown) {

 /**
 * Strip unsupported markdown formatting based on channel capabilities.
+ * Uses MARKDOWN_PATTERNS from editor constants.
 *
 * @param {string} markdown - markdown text to process
 * @param {string} channelType - The channel type to check supported formatting
+ * @param {boolean} cleanWhitespace - Whether to clean up extra whitespace and blank lines (default: true for signatures)
 * @returns {string} - The markdown with unsupported formatting removed
 */
-export function stripUnsupportedSignatureMarkdown(markdown, channelType) {
+export function stripUnsupportedMarkdown(
+  markdown,
+  channelType,
+  cleanWhitespace = true
+) {
  if (!markdown) return '';

  const { marks = [], nodes = [] } = FORMATTING[channelType] || {};
-  const has = (arr, key) => arr.includes(key);
+  const supported = [...marks, ...nodes];

-  // Define stripping rules: [condition, pattern, replacement]
-  const rules = [
-    [!has(nodes, 'image'), /!\[.*?\]\(.*?\)/g, ''],
-    [!has(marks, 'link'), /\[([^\]]+)\]\([^)]+\)/g, '$1'],
-    [!has(nodes, 'codeBlock'), /```[\s\S]*?```/g, ''],
-    [!has(marks, 'code'), /`([^`]+)`/g, '$1'],
-    [!has(marks, 'strong'), /\*\*([^*]+)\*\*/g, '$1'],
-    [!has(marks, 'strong'), /__([^_]+)__/g, '$1'],
-    [!has(marks, 'em'), /\*([^*]+)\*/g, '$1'],
-    // Match _text_ only at word boundaries (whitespace/string start/end)
-    // Preserves underscores in URLs (e.g., https://example.com/path_name) and variable names
-    [
-      !has(marks, 'em'),
-      /(?<=^|[\s])_([^_\s][^_]*[^_\s]|[^_\s])_(?=$|[\s])/g,
-      '$1',
-    ],
-    [!has(marks, 'strike'), /~~([^~]+)~~/g, '$1'],
-    [!has(nodes, 'blockquote'), /^>\s?/gm, ''],
-    [!has(nodes, 'bulletList'), /^[-*+]\s+/gm, ''],
-    [!has(nodes, 'orderedList'), /^\d+\.\s+/gm, ''],
-  ];
+  // Apply patterns from MARKDOWN_PATTERNS for unsupported types
+  const result = MARKDOWN_PATTERNS.reduce((text, { type, patterns }) => {
+    if (supported.includes(type)) return text;
+    return patterns.reduce(
+      (t, { pattern, replacement }) => t.replace(pattern, replacement),
+      text
+    );
+  }, markdown);

-  const result = rules.reduce(
-    (text, [shouldStrip, pattern, replacement]) =>
-      shouldStrip ? text.replace(pattern, replacement) : text,
-    markdown
-  );
+  if (!cleanWhitespace) return result;

+  // Clean whitespace for signatures
  return result
    .split('\n')
    .map(line => line.trim())
@@ -173,7 +163,7 @@ export function getEffectiveChannelType(channelType, medium) {
 export function appendSignature(body, signature, channelType) {
  // Strip only unsupported formatting based on channel capabilities
  const preparedSignature = channelType
-    ? stripUnsupportedSignatureMarkdown(signature, channelType)
+    ? stripUnsupportedMarkdown(signature, channelType)
    : signature;
  const cleanedSignature = cleanSignature(preparedSignature);
  // if signature is already present, return body
@@ -186,27 +176,22 @@ export function appendSignature(body, signature, channelType) {

 /**
 * Removes the signature from the body, along with the signature delimiter.
- * Tries to find both the original signature and the stripped version.
+ * Tries multiple signature variants: original, channel-stripped, and fully stripped.
 *
 * @param {string} body - The body to remove the signature from.
 * @param {string} signature - The signature to remove.
 * @param {string} channelType - Optional. The effective channel type for channel-specific stripping.
- *                               For Twilio channels, pass the result of getEffectiveChannelType().
 * @returns {string} - The body with the signature removed.
 */
 export function removeSignature(body, signature, channelType) {
-  // Build list of signatures to try: original, channel-stripped, and fully stripped
-  const cleanedSignature = cleanSignature(signature);
+  // Build unique list of signature variants to try
  const channelStripped = channelType
-    ? cleanSignature(stripUnsupportedSignatureMarkdown(signature, channelType))
+    ? cleanSignature(stripUnsupportedMarkdown(signature, channelType))
    : null;
-  const fullyStripped = cleanSignature(extractTextFromMarkdown(signature));
-
-  // Try signatures in order: original → channel-specific → fully stripped
  const signaturesToTry = [
-    cleanedSignature,
+    cleanSignature(signature),
    channelStripped,
-    fullyStripped,
+    cleanSignature(extractTextFromMarkdown(signature)),
  ].filter((sig, i, arr) => sig && arr.indexOf(sig) === i); // Remove nulls and duplicates

  // Find the first matching signature
@@ -225,17 +210,12 @@ export function removeSignature(body, signature, channelType) {
    newBody = newBody.substring(0, signatureIndex).trimEnd();
  }

-  // let's find the delimiter and remove it
-  const delimiterIndex = newBody.lastIndexOf(SIGNATURE_DELIMITER);
-  if (
-    delimiterIndex !== -1 &&
-    delimiterIndex === newBody.length - SIGNATURE_DELIMITER.length // this will ensure the delimiter is at the end
-  ) {
+  // Remove delimiter if it's at the end
+  if (newBody.endsWith(SIGNATURE_DELIMITER)) {
    // if the delimiter is at the end, remove it
-    newBody = newBody.substring(0, delimiterIndex);
+    newBody = newBody.slice(0, -SIGNATURE_DELIMITER.length);
  }

-  // return the value
  return newBody;
 }

@@ -539,12 +519,19 @@ export const getContentNode = (
 /**
 * Get the formatting configuration for a specific channel type.
 * Returns the appropriate marks, nodes, and menu items for the editor.
+ * TODO: We're hiding captain, enable it back when we add selection improvements
 *
 * @param {string} channelType - The channel type (e.g., 'Channel::FacebookPage', 'Channel::WebWidget')
 * @returns {Object} The formatting configuration with marks, nodes, and menu properties
 */
-export function getFormattingForEditor(channelType) {
-  return FORMATTING[channelType] || FORMATTING['Context::Default'];
+export function getFormattingForEditor(channelType, showCaptain = false) {
+  const formatting = FORMATTING[channelType] || FORMATTING['Context::Default'];
+  return {
+    ...formatting,
+    menu: showCaptain
+      ? formatting.menu
+      : formatting.menu.filter(item => item !== 'copilot'),
+  };
 }

 /**
@@ -1,3 +1,5 @@
+import DOMPurify from 'dompurify';
+
 // Quote detection strategies
 const QUOTE_INDICATORS = [
  '.gmail_quote_container',
@@ -29,7 +31,7 @@ export class EmailQuoteExtractor {
  static extractQuotes(htmlContent) {
    // Create a temporary DOM element to parse HTML
    const tempDiv = document.createElement('div');
-    tempDiv.innerHTML = htmlContent;
+    tempDiv.innerHTML = DOMPurify.sanitize(htmlContent);

    // Remove elements matching class selectors
    QUOTE_INDICATORS.forEach(selector => {
@@ -56,7 +58,7 @@ export class EmailQuoteExtractor {
   */
  static hasQuotes(htmlContent) {
    const tempDiv = document.createElement('div');
-    tempDiv.innerHTML = htmlContent;
+    tempDiv.innerHTML = DOMPurify.sanitize(htmlContent);

    // Check for class-based quotes
    // eslint-disable-next-line no-restricted-syntax
@@ -20,6 +20,7 @@ const FEATURE_HELP_URLS = {
  webhook: 'https://chwt.app/hc/webhooks',
  billing: 'https://chwt.app/pricing',
  saml: 'https://chwt.app/hc/saml',
+  captain_billing: 'https://chwt.app/hc/captain_billing',
 };

 export function getHelpUrlForFeature(featureName) {
@@ -1,4 +1,5 @@
 import { format, parseISO, isValid as isValidDate } from 'date-fns';
+import DOMPurify from 'dompurify';

 /**
 * Extracts plain text from HTML content
@@ -13,7 +14,7 @@ export const extractPlainTextFromHtml = html => {
    return html.replace(/<[^>]*>/g, ' ');
  }
  const tempDiv = document.createElement('div');
-  tempDiv.innerHTML = html;
+  tempDiv.innerHTML = DOMPurify.sanitize(html);
  return tempDiv.textContent || tempDiv.innerText || '';
 };

@@ -5,7 +5,7 @@ import {
  replaceSignature,
  cleanSignature,
  extractTextFromMarkdown,
-  stripUnsupportedSignatureMarkdown,
+  stripUnsupportedMarkdown,
  insertAtCursor,
  findNodeToInsertImage,
  setURLWithQueryAndSize,
@@ -145,25 +145,19 @@ describe('appendSignature', () => {
  });
 });

-describe('stripUnsupportedSignatureMarkdown', () => {
+describe('stripUnsupportedMarkdown', () => {
  const richSignature =
    '**Bold** _italic_ [link](http://example.com) ![](http://localhost:3000/image.png)';

  it('keeps all formatting for Email channel (supports image, link, strong, em)', () => {
-    const result = stripUnsupportedSignatureMarkdown(
-      richSignature,
-      'Channel::Email'
-    );
+    const result = stripUnsupportedMarkdown(richSignature, 'Channel::Email');
    expect(result).toContain('**Bold**');
    expect(result).toContain('_italic_');
    expect(result).toContain('[link](http://example.com)');
    expect(result).toContain('![](http://localhost:3000/image.png)');
  });
  it('strips images but keeps bold/italic for Api channel', () => {
-    const result = stripUnsupportedSignatureMarkdown(
-      richSignature,
-      'Channel::Api'
-    );
+    const result = stripUnsupportedMarkdown(richSignature, 'Channel::Api');
    expect(result).toContain('**Bold**');
    expect(result).toContain('_italic_');
    expect(result).toContain('link'); // link text kept
@@ -171,20 +165,14 @@ describe('stripUnsupportedSignatureMarkdown', () => {
    expect(result).not.toContain('![]('); // image removed
  });
  it('strips images but keeps bold/italic/link for Telegram channel', () => {
-    const result = stripUnsupportedSignatureMarkdown(
-      richSignature,
-      'Channel::Telegram'
-    );
+    const result = stripUnsupportedMarkdown(richSignature, 'Channel::Telegram');
    expect(result).toContain('**Bold**');
    expect(result).toContain('_italic_');
    expect(result).toContain('[link](http://example.com)');
    expect(result).not.toContain('![](');
  });
  it('strips all formatting for SMS channel', () => {
-    const result = stripUnsupportedSignatureMarkdown(
-      richSignature,
-      'Channel::Sms'
-    );
+    const result = stripUnsupportedMarkdown(richSignature, 'Channel::Sms');
    expect(result).toContain('Bold');
    expect(result).toContain('italic');
    expect(result).toContain('link');
@@ -194,8 +182,52 @@ describe('stripUnsupportedSignatureMarkdown', () => {
    expect(result).not.toContain('![](');
  });
  it('returns empty string for empty input', () => {
-    expect(stripUnsupportedSignatureMarkdown('', 'Channel::Api')).toBe('');
-    expect(stripUnsupportedSignatureMarkdown(null, 'Channel::Api')).toBe('');
+    expect(stripUnsupportedMarkdown('', 'Channel::Api')).toBe('');
+    expect(stripUnsupportedMarkdown(null, 'Channel::Api')).toBe('');
+  });
+
+  describe('with cleanWhitespace parameter', () => {
+    const textWithWhitespace =
+      '**Bold** text\n\nWith multiple\n\nLine breaks\n\n  And spaces  ';
+
+    it('cleans whitespace when cleanWhitespace=true (default)', () => {
+      const result = stripUnsupportedMarkdown(
+        textWithWhitespace,
+        'Channel::Api',
+        true
+      );
+      expect(result).toBe(
+        '**Bold** text\nWith multiple\nLine breaks\nAnd spaces'
+      );
+      expect(result).not.toContain('\n\n');
+      expect(result).not.toContain('  ');
+    });
+
+    it('preserves whitespace when cleanWhitespace=false', () => {
+      const result = stripUnsupportedMarkdown(
+        textWithWhitespace,
+        'Channel::Api',
+        false
+      );
+      expect(result).toContain('\n\n');
+      expect(result).toContain('  And spaces  ');
+      expect(result).toBe(
+        '**Bold** text\n\nWith multiple\n\nLine breaks\n\n  And spaces  '
+      );
+    });
+
+    it('strips formatting but preserves whitespace for messages', () => {
+      const messageWithFormatting = '**Bold**\n\n`code`\n\nNormal text';
+      const result = stripUnsupportedMarkdown(
+        messageWithFormatting,
+        'Channel::Sms',
+        false
+      );
+      expect(result).toBe('Bold\n\ncode\n\nNormal text');
+      expect(result).toContain('\n\n');
+      expect(result).not.toContain('**');
+      expect(result).not.toContain('`');
+    });
  });
 });

@@ -763,62 +795,6 @@ describe('getContentNode', () => {
 });

 describe('getFormattingForEditor', () => {
-  describe('channel-specific formatting', () => {
-    it('returns full formatting for Email channel', () => {
-      const result = getFormattingForEditor('Channel::Email');
-
-      expect(result).toEqual(FORMATTING['Channel::Email']);
-    });
-
-    it('returns full formatting for WebWidget channel', () => {
-      const result = getFormattingForEditor('Channel::WebWidget');
-
-      expect(result).toEqual(FORMATTING['Channel::WebWidget']);
-    });
-
-    it('returns limited formatting for WhatsApp channel', () => {
-      const result = getFormattingForEditor('Channel::Whatsapp');
-
-      expect(result).toEqual(FORMATTING['Channel::Whatsapp']);
-    });
-
-    it('returns no formatting for API channel', () => {
-      const result = getFormattingForEditor('Channel::Api');
-
-      expect(result).toEqual(FORMATTING['Channel::Api']);
-    });
-
-    it('returns limited formatting for FacebookPage channel', () => {
-      const result = getFormattingForEditor('Channel::FacebookPage');
-
-      expect(result).toEqual(FORMATTING['Channel::FacebookPage']);
-    });
-
-    it('returns no formatting for TwitterProfile channel', () => {
-      const result = getFormattingForEditor('Channel::TwitterProfile');
-
-      expect(result).toEqual(FORMATTING['Channel::TwitterProfile']);
-    });
-
-    it('returns no formatting for SMS channel', () => {
-      const result = getFormattingForEditor('Channel::Sms');
-
-      expect(result).toEqual(FORMATTING['Channel::Sms']);
-    });
-
-    it('returns limited formatting for Telegram channel', () => {
-      const result = getFormattingForEditor('Channel::Telegram');
-
-      expect(result).toEqual(FORMATTING['Channel::Telegram']);
-    });
-
-    it('returns formatting for Instagram channel', () => {
-      const result = getFormattingForEditor('Channel::Instagram');
-
-      expect(result).toEqual(FORMATTING['Channel::Instagram']);
-    });
-  });
-
  describe('context-specific formatting', () => {
    it('returns default formatting for Context::Default', () => {
      const result = getFormattingForEditor('Context::Default');
@@ -896,6 +872,22 @@ describe('stripUnsupportedFormatting', () => {
      expect(stripUnsupportedFormatting(content, fullSchema)).toBe(content);
    });

+    it('preserves autolinks when schema supports links', () => {
+      const content = 'Check out <https://cegrafic.com/catalogo/>';
+      expect(stripUnsupportedFormatting(content, fullSchema)).toBe(content);
+    });
+
+    it('preserves various URI scheme autolinks', () => {
+      const content =
+        'Email <mailto:user@example.com> or call <tel:+1234567890>';
+      expect(stripUnsupportedFormatting(content, fullSchema)).toBe(content);
+    });
+
+    it('preserves email autolinks', () => {
+      const content = 'Contact us at <support@chatwoot.com>';
+      expect(stripUnsupportedFormatting(content, fullSchema)).toBe(content);
+    });
+
    it('preserves lists when schema supports them', () => {
      const content = '- item 1\n- item 2\n1. first\n2. second';
      expect(stripUnsupportedFormatting(content, fullSchema)).toBe(content);
@@ -967,6 +959,38 @@ describe('stripUnsupportedFormatting', () => {
      ).toBe('Check this link');
    });

+    it('converts autolinks to plain URLs when schema does not support links', () => {
+      const content = 'Visit <https://cegrafic.com/catalogo/> for more info';
+      const expected = 'Visit https://cegrafic.com/catalogo/ for more info';
+      expect(stripUnsupportedFormatting(content, emptySchema)).toBe(expected);
+    });
+
+    it('handles multiple autolinks in content', () => {
+      const content = 'Check <https://example.com> and <https://test.com>';
+      const expected = 'Check https://example.com and https://test.com';
+      expect(stripUnsupportedFormatting(content, emptySchema)).toBe(expected);
+    });
+
+    it('converts URI scheme autolinks to plain text', () => {
+      const content =
+        'Email <mailto:support@example.com> or call <tel:+1234567890>';
+      const expected =
+        'Email mailto:support@example.com or call tel:+1234567890';
+      expect(stripUnsupportedFormatting(content, emptySchema)).toBe(expected);
+    });
+
+    it('converts email autolinks to plain text', () => {
+      const content = 'Reach us at <admin@chatwoot.com> for help';
+      const expected = 'Reach us at admin@chatwoot.com for help';
+      expect(stripUnsupportedFormatting(content, emptySchema)).toBe(expected);
+    });
+
+    it('handles mixed autolink types', () => {
+      const content = 'Visit <https://example.com> or email <info@example.com>';
+      const expected = 'Visit https://example.com or email info@example.com';
+      expect(stripUnsupportedFormatting(content, emptySchema)).toBe(expected);
+    });
+
    it('strips bullet list markers', () => {
      expect(
        stripUnsupportedFormatting('- item 1\n- item 2', emptySchema)
@@ -96,4 +96,58 @@ describe('EmailQuoteExtractor', () => {
  it('detects quotes for trailing blockquotes even when signatures follow text', () => {
    expect(EmailQuoteExtractor.hasQuotes(EMAIL_WITH_SIGNATURE)).toBe(true);
  });
+
+  describe('HTML sanitization', () => {
+    it('removes onerror handlers from img tags in extractQuotes', () => {
+      const maliciousHtml = '<p>Hello</p><img src="x" onerror="alert(1)">';
+      const cleanedHtml = EmailQuoteExtractor.extractQuotes(maliciousHtml);
+
+      expect(cleanedHtml).not.toContain('onerror');
+      expect(cleanedHtml).toContain('<p>Hello</p>');
+    });
+
+    it('removes onerror handlers from img tags in hasQuotes', () => {
+      const maliciousHtml = '<p>Hello</p><img src="x" onerror="alert(1)">';
+      // Should not throw and should safely check for quotes
+      const result = EmailQuoteExtractor.hasQuotes(maliciousHtml);
+      expect(result).toBe(false);
+    });
+
+    it('removes script tags in extractQuotes', () => {
+      const maliciousHtml =
+        '<p>Content</p><script>alert("xss")</script><p>More</p>';
+      const cleanedHtml = EmailQuoteExtractor.extractQuotes(maliciousHtml);
+
+      expect(cleanedHtml).not.toContain('<script');
+      expect(cleanedHtml).not.toContain('alert');
+      expect(cleanedHtml).toContain('<p>Content</p>');
+      expect(cleanedHtml).toContain('<p>More</p>');
+    });
+
+    it('removes onclick handlers in extractQuotes', () => {
+      const maliciousHtml = '<p onclick="alert(1)">Click me</p>';
+      const cleanedHtml = EmailQuoteExtractor.extractQuotes(maliciousHtml);
+
+      expect(cleanedHtml).not.toContain('onclick');
+      expect(cleanedHtml).toContain('Click me');
+    });
+
+    it('removes javascript: URLs in extractQuotes', () => {
+      const maliciousHtml = '<a href="javascript:alert(1)">Link</a>';
+      const cleanedHtml = EmailQuoteExtractor.extractQuotes(maliciousHtml);
+
+      // eslint-disable-next-line no-script-url
+      expect(cleanedHtml).not.toContain('javascript:');
+      expect(cleanedHtml).toContain('Link');
+    });
+
+    it('removes encoded payloads with event handlers in extractQuotes', () => {
+      const maliciousHtml =
+        '<img src="x" id="PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==" onerror="eval(atob(this.id))">';
+      const cleanedHtml = EmailQuoteExtractor.extractQuotes(maliciousHtml);
+
+      expect(cleanedHtml).not.toContain('onerror');
+      expect(cleanedHtml).not.toContain('eval');
+    });
+  });
 });
@@ -33,6 +33,26 @@ describe('quotedEmailHelper', () => {
      expect(result).toContain('Line 1');
      expect(result).toContain('Line 2');
    });
+
+    it('sanitizes onerror handlers from img tags', () => {
+      const html = '<p>Hello</p><img src="x" onerror="alert(1)">';
+      const result = extractPlainTextFromHtml(html);
+      expect(result).toBe('Hello');
+    });
+
+    it('sanitizes script tags', () => {
+      const html = '<p>Safe</p><script>alert(1)</script><p>Content</p>';
+      const result = extractPlainTextFromHtml(html);
+      expect(result).toContain('Safe');
+      expect(result).toContain('Content');
+      expect(result).not.toContain('alert');
+    });
+
+    it('sanitizes onclick handlers', () => {
+      const html = '<p onclick="alert(1)">Click me</p>';
+      const result = extractPlainTextFromHtml(html);
+      expect(result).toBe('Click me');
+    });
  });

  describe('getEmailSenderName', () => {
@@ -127,6 +127,7 @@ const validateSingleAction = action => {
    'resolve_conversation',
    'remove_assigned_team',
    'open_conversation',
+    'pending_conversation',
  ];

  if (