fix: incorrect cursor position after inserting mention

[abhinavkrin]

Proposed changes (including videos or screenshots)

When inserting a user/channel mention while the caret is not at the end of the message, the cursor jumped to an incorrect position instead of landing right after the inserted mention, making continued typing and editing awkward.

The root cause was in replaceText in createComposerAPI.ts: after replacing the partial trigger (e.g. @j) with the full mention, the new cursor position was computed from the textarea's live caret position before the replacement (selectionStart) rather than from where the text was actually inserted (selection.start). It also reset the caret back to the original position when a selection existed. This only appeared correct when mentioning at the end of the line, where the overshoot was clamped to the string length.

The cursor is now placed at selection.start + text.length, so it always lands immediately after the inserted mention regardless of where in the message it is inserted. Added unit tests for replaceText covering insertion at the start, middle, and end of a message.

Issue(s)

Steps to test or reproduce

1. Open any channel and type a message in the composer
2. Move the cursor to the beginning of the message
3. Type @ and select a user mention
4. Expected result: the cursor is placed immediately after the inserted mention, and you can continue typing naturally from that position

Further comments

CORE-2266

Summary by CodeRabbit

• Bug Fixes
  • Fixed the cursor/selection position in the message composer after inserting or replacing a mention, including when added at the start, middle, or end of the message.
  • Ensured the selection correctly collapses immediately after the inserted mention text.
• Tests
  • Added Jest coverage for mention/text replacement in the composer to verify textarea value updates and cursor/selection behavior across common insertion positions.

[dionisio-bot]

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

[changeset-bot]

🦋 Changeset detected

Latest commit: c7acfb1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@rocket.chat/meteor	Patch
@rocket.chat/core-typings	Patch
@rocket.chat/rest-typings	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4cbc8751-23bc-4996-a440-a889161781e3

📥 Commits

Reviewing files that changed from the base of the PR and between ba6ce67 and c7acfb1.

📒 Files selected for processing (1)

• apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts

📜 Recent review details

⏰ Context from checks skipped due to timeout. (4)

• GitHub Check: cubic · AI code reviewer
• GitHub Check: CodeQL-Build
• GitHub Check: Hacktron Security Check
• GitHub Check: CodeQL-Build

⚠️ CI failures not shown inline (4)

GitHub Check: Dionisio QA: Some checks did not pass

Conclusion: failure

View job details

**Conclusion:** failure
### Steps
- ✅ **No merge conflicts**
- ❌ **QA assured** — This PR is missing the 'stat: QA assured' label
- ✅ **Mergeable**
- ✅ **Has milestone or project**
- ✅ **Valid PR title**
- ✅ **Correct target version**

---

GitHub Check: Dionisio QA: Some checks did not pass

Conclusion: failure

View job details

**Conclusion:** failure
### Steps
- ✅ **No merge conflicts**
- ❌ **QA assured** — This PR is missing the 'stat: QA assured' label
- ✅ **Mergeable**
- ✅ **Has milestone or project**
- ✅ **Valid PR title**
- ✅ **Correct target version**

---

GitHub Check: Dionisio QA: Some checks did not pass

Conclusion: failure

View job details

**Conclusion:** failure
### Steps
- ✅ **No merge conflicts**
- ❌ **QA assured** — This PR is missing the 'stat: QA assured' label
- ✅ **Mergeable**
- ✅ **Has milestone or project**
- ✅ **Valid PR title**
- ✅ **Correct target version**

---

GitHub Check: Dionisio QA: Some checks did not pass

Conclusion: failure

View job details

**Conclusion:** failure
### Steps
- ✅ **No merge conflicts**
- ❌ **QA assured** — This PR is missing the 'stat: QA assured' label
- ✅ **Mergeable**
- ✅ **Has milestone or project**
- ✅ **Valid PR title**
- ✅ **Correct target version**

🧰 Additional context used

📓 Path-based instructions (2)

**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

• apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts

**/*.spec.ts

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.spec.ts: Use descriptive test names that clearly communicate expected behavior in Playwright tests
Use .spec.ts extension for test files (e.g., login.spec.ts)

Files:

• apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts

🧠 Learnings (5)

📚 Learning: 2026-02-24T19:22:48.358Z

Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 38493
File: apps/meteor/tests/e2e/omnichannel/omnichannel-send-pdf-transcript.spec.ts:66-67
Timestamp: 2026-02-24T19:22:48.358Z
Learning: In Playwright end-to-end tests (e.g., under apps/meteor/tests/e2e/...), prefer locating elements by translated text (getByText) and ARIA roles (getByRole) over data-qa attributes. If translation values change, update the corresponding test locators accordingly. Never use data-qa locators. This guideline applies to all Playwright e2e test specs in the repository and helps keep tests robust to UI text changes and accessible semantics.

Applied to files:

• apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts

📚 Learning: 2026-02-26T19:25:44.063Z

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.

Applied to files:

• apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts

📚 Learning: 2026-02-26T19:25:44.063Z

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.

Applied to files:

• apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts

📚 Learning: 2026-03-06T18:10:15.268Z

Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 39397
File: packages/gazzodown/src/code/CodeBlock.spec.tsx:47-68
Timestamp: 2026-03-06T18:10:15.268Z
Learning: In tests (especially those using testing-library/dom/jsdom) for Rocket.Chat components, the HTML <code> element has an implicit ARIA role of 'code'. Therefore, screen.getByRole('code') or screen.findByRole('code') will locate <code> elements even without a role attribute. Do not flag findByRole('code') as invalid in reviews; prefer using the implicit role instead of adding role="code" unless necessary for accessibility.

Applied to files:

• apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts

📚 Learning: 2026-05-06T12:21:44.083Z

Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.

Applied to files:

• apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts

🪛 ast-grep (0.44.1)

apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts

[warning] 20-20: Direct modification of innerHTML or outerHTML properties detected. Modifying these properties with unsanitized user input can lead to XSS vulnerabilities. Use safe alternatives or sanitize content first.
Context: document.body.innerHTML = ''
Note: [CWE-79] Improper Neutralization of Input During Web Page Generation

(dom-content-modification)

🔇 Additional comments (1)

apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts (1)

20-22: LGTM!

---

Walkthrough

The message composer now places the cursor at the end of inserted text after replaceText, adds regression tests for mention insertion positions, and includes a patch changeset note.

Changes

Message composer cursor fix

Layer / File(s)	Summary
replaceText cursor placement apps/meteor/app/ui-message/client/messageBox/createComposerAPI.ts	replaceText now sets both selection endpoints to the computed insertion cursor after replacement.
Regression coverage and release note apps/meteor/app/ui-message/client/messageBox/createComposerAPI.spec.ts, .changeset/moody-eggs-juggle.md	The new spec covers mention insertion at the start, middle, and end of a message, and the changeset records the patch release note.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: type: bug

Suggested reviewers: MartinSchoeler

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main fix: correcting cursor position after inserting a mention.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (1)

• CORE-2266: Request failed with status code 401

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.48%. Comparing base (aa96fe5) to head (c7acfb1).
⚠️ Report is 134 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #41074      +/-   ##
===========================================
- Coverage    70.09%   69.48%   -0.62%     
===========================================
  Files         3363     3663     +300     
  Lines       129711   145482   +15771     
  Branches     22494    26041    +3547     
===========================================
+ Hits         90922   101086   +10164     
- Misses       35476    40107    +4631     
- Partials      3313     4289     +976     

Flag	Coverage Δ
e2e	59.41% <66.66%> (+0.06%)	⬆️
e2e-api	50.31% <ø> (+4.04%)	⬆️
unit	70.44% <100.00%> (+0.44%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[yash-rajpal]

LGTM! Just one nitpick.