Refactor/stabilize hint contract

README.md

@@ -8,7 +8,7 @@ Built with Fastify and TypeScript. Uses Groq for inference (`openai/gpt-oss-20b`
 
 - Camper's code, challenge description, and failing tests go in
 - A challenge-type-specific prompt is built and sent to Groq
-- The response is stripped of any code patterns and returned as a plain-text hint
+- The response is sanitized to allow only attribute-free `<code>` markup
 - Per-user and global rate limiting (Redis token buckets) prevent abuse
 - Circuit breaker on the Groq client opens after repeated failures
 
@@ -29,19 +29,28 @@ Request body:
   "description": "Write a function that returns the sum of two numbers",
   "userInput": "function sum(a, b) { a + b }",
   "seed": "function sum(a, b) { }",
-  "hints": [{ "text": "Expected 5 but received undefined", "failed": true }]
+  "hints": [
+    { "text": "The first test passed" },
+    { "text": "Expected 5 but received undefined", "failed": true }
+  ]
 }
 ```
 
+Passing test entries may omit `failed`. At least one entry must explicitly include
+`"failed": true`.
+
 Response:
 
 ```json
 {
-  "hint": "What value does your function currently return when no explicit return statement is present?",
+  "hint": "What value does your <code>sum</code> function return without an explicit <code>return</code> statement?",
   "model_used": "openai/gpt-oss-20b"
 }
 ```
 
+The `hint` value may contain limited HTML. Only attribute-free `<code>` elements are returned;
+all other model-generated tags are safely encoded as text.
+
 ### `GET /health`
 
 Returns service status and uptime. Set `ENABLE_EXTENDED_HEALTH=true` to also check Redis and Groq connectivity.

package.json

@@ -33,10 +33,12 @@
     "dotenv": "^16.0.0",
     "fastify": "^5.7.4",
     "ioredis": "^5.3.1",
-    "pino": "^10.3.1"
+    "pino": "^10.3.1",
+    "sanitize-html": "^2.17.6"
   },
   "devDependencies": {
     "@types/node": "^24.10.14",
+    "@types/sanitize-html": "^2.16.1",
     "nodemon": "^2.0.22",
     "oxlint": "^1.50.0",
     "prettier": "^3.8.1",