[taskinen]

Problem

An email with only an HTML body showed its HTML source in the hover preview: tags, styles and all.

JMAP (RFC 8621) lists the only part of an HTML-only email both as its htmlBody and as its textBody. The preview prefers textBody and used its value as-is. That was safe, since the text was escaped, but unreadable. It also made CLAUDE.md's "shows an HTML-only body as plain text" untrue.

Fix

In loadPreviewBody(), a text/html part found in textBody now goes through htmlToText() (added in #40), like the htmlBody parts do. Plain-text parts are unchanged. All HTML the preview shows is now turned into text by that one function, which loads nothing and runs nothing.

CLAUDE.md's Email Preview entry explains why a text/html part can appear in textBody.

Tests

e2e/tests/preview-html.spec.js gets a third body shape: an HTML-only email as JMAP sends it, with the same part in textBody and htmlBody. Every shape now also checks that the preview shows no <p> markup.

• On main: the new shape fails 5 runs out of 5, because the preview shows the HTML source. The other two shapes pass, since nothing loads or runs.
• With the fix:
  • All three shapes pass 30 runs out of 30.
  • The full Playwright suite passes (30 tests).
  • go test -race and go vet pass.

Testing on Fastmail

1. Run git pull, restart the app (go run main.go) and reload the page.
2. Hover an email that has only an HTML body: many newsletters and notifications, or any email whose preview showed HTML tags before.
3. The preview shows the readable text, without tags or CSS.
4. Hover a plain-text email. It looks the same as before.
5. The Console in the developer tools shows no "Content Security Policy" errors.