The command palette renders matchContext via dangerouslySetInnerHTML expecting HTML with <mark> tags, but extractSnippet() returned plain text. Wrap the matched term in <mark> tags and escape surrounding text to prevent XSS. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>