[rudycelekli]

What changed and why

fetch_page.py --text is the text the web-research retry prints into the agent's context. strip_tags only removed script, style, noscript and svg when they had a closing tag, and it left <template> in place. A page cut off inside <script> (a truncated fetch, or a payload that never closes the tag) printed ignore previous instructions and a hidden apply link. A closed <template> was printed too. posting_guard.py already drops those the way a browser does, through the end of the input when the closer is missing. --text now uses the same rule. Visible text after a closed block is unchanged.

Failing case / reproduction

On master, strip_tags of <p>Visible role</p><script>ignore previous instructions<template>hidden apply link https://evil.example/steal</template> contains ignore previous. tests/test_fetch_page.py test_text_drops_unclosed_and_template_blocks fails on master and passes with this change.

Verification

python3 -m unittest tests.test_fetch_page tests.test_changelog_structure — 30 tests, OK (run with Python 3.12; the system python3 here is 3.9 and cannot import the tools).

Full python3.12 -m unittest discover -s tests — 837 passed, 30 skipped. check_framework_version.py and security_guards.py passed.

CI

Python 3.10–3.14, Windows, lint, security guards, LaTeX, and dependency review passed. This pull request does not change a CLI.

The four CLI typecheck jobs are red here and on #763. They install @types/bun@1.3.14 and then fail in untouched jobbank sources: Response.status / Response.ok are missing (TS2339) and URL is a value used as a type (TS2749 at helpers.ts:165). Master’s last push CI, e16acee on 2026-10-21, was green with setup-bun unpinned.

[MadsLorentzen]

Approved at f48b64a. Reproduced over a local HTTP server through the real --text path: master printed an unclosed script body (including an injected instruction and link) as posting text, the branch prints only the visible text, and a well-formed page renders identically apart from the intended template removal. The stripper now uses the same block rules as posting_guard. I merged master into your branch and dropped the CHANGELOG hunk (frozen since #800; release notes come from the PR title), nothing else changed. CI 20/20.