Function htmlToPlainText

browse/src/security-classifier.ts:268–281

* Strip HTML tags and collapse whitespace. TestSavantAI was trained on * plain text, not markup — feeding it raw HTML massively reduces recall * because all the tag noise dilutes the injection signal. Callers that * already have plain text (page snapshot innerText, tool output strings) * get no-

(input: string)

 * get no-op behavior; callers with HTML get the markup stripped.
 */
function htmlToPlainText(input: string): string {
  // Fast path: if no angle brackets, it's already plain text.
  if (!input.includes('<')) return input;
  return input
    .replace(/<(script|style)[^>]*>[\s\S]*?<\/\1>/gi, ' ') // drop script/style bodies entirely
    .replace(/<[^>]+>/g, ' ')                               // drop tags
    .replace(/&nbsp;/g, ' ')
    .replace(/&amp;/g, '&')
    .replace(/&lt;/g, '<')
    .replace(/&gt;/g, '>')
    .replace(/&quot;/g, '"')
    .replace(/\s+/g, ' ')
    .trim();
}

export async function scanPageContent(text: string): Promise<LayerSignal> {
  if (!text || text.length === 0) {