From 4ca73ced8d6d30e19a488fd6e1686cfb564af5b3 Mon Sep 17 00:00:00 2001
From: Kpa-clawbot <kpaclawbot@outlook.com>
Date: Thu, 11 Jun 2026 08:07:37 +0000
Subject: [PATCH] fix(#1648 M3): don't escape sprite HTML in mobile channel
 avatar

Mobile channel rows (renderChannelRowMobile) call avatarTextForChannel()
which now returns either a 2-char text abbreviation or Phosphor sprite
HTML (ph-lock / ph-key) for encrypted / user-added channels.

The mobile renderer was unconditionally escapeHtml()-ing the result,
so sprite HTML leaked into the avatar as visible escaped text on
phone-width viewports.

Detect 'starts with <svg' and emit raw HTML in that case; keep
escapeHtml() for the plain-text abbreviation fallback.

Caught by browser-verify (CDP screenshot at 375x812 dark).
---
 public/channels.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/public/channels.js b/public/channels.js
index 913452df..b08b401d 100644
--- a/public/channels.js
+++ b/public/channels.js
@@ -1789,12 +1789,14 @@
       preview = ch.messageCount + ' messages';
     }
     const abbr = avatarTextForChannel(ch);
+    // abbr may be a Phosphor sprite (HTML) or plain text — detect & emit raw vs escaped.
+    const isHtmlAbbr = typeof abbr === 'string' && abbr.startsWith('<svg');
     const sel = selectedHash === ch.hash ? ' selected' : '';
     return '<button type="button" class="ch-row' + sel + '" data-hash="' + escapeHtml(ch.hash) +
       '" role="option" aria-selected="' + (selectedHash === ch.hash ? 'true' : 'false') +
       '" aria-label="' + escapeHtml(name) + '">' +
       '<div class="ch-avatar ch-row-avatar" style="background:' + color +
-      '" aria-hidden="true">' + escapeHtml(abbr) + '</div>' +
+      '" aria-hidden="true">' + (isHtmlAbbr ? abbr : escapeHtml(abbr)) + '</div>' +
       '<div class="ch-row-body">' +
         '<div class="ch-row-line1">' +
           '<span class="ch-row-name">' + escapeHtml(name) + '</span>' +