chore: update channels

packages/cli/src/ui/AppContainer.tsx

@@ -1218,13 +1218,23 @@ Logging in with Google... Restarting Gemini CLI to continue.
   const channelsEnabled = config.getChannels().length > 0;
   useEffect(() => {
     if (!channelsEnabled) return;
+    const escapeAttr = (s: string) =>
+      s
+        .replace(/&/g, '&')
+        .replace(/"/g, '"')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
     const handler = (payload: ChannelMessagePayload) => {
       const meta = payload.metadata ?? {};
       const user = meta['user'] ?? payload.sender;
       const chatId = meta['chat_id'] ?? '';
       const msgId = meta['message_id'] ?? '';
       const imagePath = meta['image_path'] ?? '';
-      const formatted = `<channel source="${payload.channelName}" chat_id="${chatId}" message_id="${msgId}" user="${user}"${imagePath ? ` image_path="${imagePath}"` : ''}>\n${payload.content}\n</channel>`;
+      const safeContent = payload.content.replace(
+        /<\/channel>/gi,
+        '&lt;/channel&gt;',
+      );
+      const formatted = `<channel source="${escapeAttr(payload.channelName)}" chat_id="${escapeAttr(chatId)}" message_id="${escapeAttr(msgId)}" user="${escapeAttr(user)}"${imagePath ? ` image_path="${escapeAttr(imagePath)}"` : ''}>\n${safeContent}\n</channel>`;
       addMessage(formatted);
     };
     coreEvents.on(CoreEvent.ChannelMessage, handler);

packages/cli/src/ui/components/views/__snapshots__/ChannelsList.test.tsx.snap

@@ -12,6 +12,6 @@ exports[`<ChannelsList /> > renders correctly with active channels 1`] = `
 
 exports[`<ChannelsList /> > renders correctly with no active channels 1`] = `
 "No active channels.
-MCP servers must declare \`experimental['gemini/channel']\` in their capabilities to act as channels.
+Use --channels <name> to listen for channel messages from MCP servers.
 "
 `;