[codex] Fix template expression parsing compatibility

[xsploit]

Summary

• normalize POML input before XML parsing so raw < and & in text/attribute values no longer explode before template evaluation
• decode XML entities before evaluating template expressions, including &&, <, and >
• support multiline wrapped attribute expressions, missing-variable fallback expressions, optional bare identifiers in if guards, and <if condition="..."> wrappers
• add a semantic <tool-policy> component alias and regression coverage for the compatibility cases

Root Cause

POML templates are parsed as XML before template expressions are evaluated. That means common JavaScript expression characters such as < and & can fail at the XML lexer layer, while XML entity escapes can survive into the JavaScript evaluator without being decoded. Separately, missing context variables throw before fallback expressions like missing || "fallback" can work.

This is related to #197, which reports unexpected character: ->&<- while rendering a POML file.

Validation

• npm test -- --runInBand packages/poml/tests
• npm run build-cli
• python -m pytest python/tests/test_poml_formats.py python/tests/test_basic.py
• npx prettier --check packages/poml/file.tsx packages/poml/components/instructions.tsx packages/poml/tests/file.test.tsx

[xsploit]

@microsoft-github-policy-service agree

[Copilot]

Pull request overview

This PR improves POML template compatibility by preventing XML parsing failures caused by XML-sensitive characters in template expressions/content, and by decoding XML entities before expression evaluation. It also extends conditional templating support and adds a <tool-policy> component alias with regression tests.

Changes:

• Normalize POML input prior to XML parsing and unescape XML entities before evaluating template expressions / meta eval blocks.
• Expand template conditional support (XML-sensitive operators, <if condition="..."> wrapper, multiline {{ ... }} attribute expressions, missing-variable fallbacks).
• Add <tool-policy> component alias and regression tests covering the compatibility cases.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
packages/poml/file.tsx	Normalizes XML input, unescapes entity text, extends if handling, updates expression evaluation semantics, and adds shared content processing helper.
packages/poml/components/instructions.tsx	Introduces ToolPolicy component with toolPolicy / tool-policy aliases.
packages/poml/tests/file.test.tsx	Adds regression tests for XML-sensitive operators/entities, <if condition>, missing-variable fallbacks, multiline attribute expressions, and <tool-policy>.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[xsploit]

Addressed the Copilot review comments in 39593a7:

• Switched XML-sensitive input normalization to length-preserving sentinels so parser offsets continue to map to original source ranges.
• Wrapped looped output in keyed React fragments.
• Refactored normal element child rendering through processXmlContents() so and normal elements share the same content-processing path.
• Added regression coverage for inside for loops and expression ranges with raw < / && operators.

Validation rerun:

• npm test -- --runInBand packages/poml/tests
• npm run build-cli
• python -m pytest python/tests/test_poml_formats.py python/tests/test_basic.py
• npx prettier --check packages/poml/components/instructions.tsx packages/poml/file.tsx packages/poml/tests/file.test.tsx