#### Brief overview of PR changes/additions
Fixes text containing `<` characters being swallowed when connecting to
games that negotiate MXP via telnet but don't actually send MXP content.
The fix validates text against the MXP specification to distinguish real
MXP tags from regular text, preventing false positives when `<` appears
in normal game text.
#### Motivation for adding to Mudlet
Users reported that typing commands like `echo <test` resulted in no
output on certain games (e.g., Merentha). The `<` character was being
interpreted as the start of an MXP tag, causing text to disappear.
#### Other info (issues closed, discussion etc)
Fixes#8899, #8980
#### Brief overview of PR changes/additions
Fixes MXP support for MUDs that require additional handshaking, and
prevents MXP comments and status tags from appearing as raw text.
#### Motivation for adding to Mudlet
Some MUDs (like Discworld) send extra MXP signals that Mudlet wasn't
handling, causing MXP features like clickable links to not work.
Additionally, MXP comments and status bar tags were being displayed as
raw text instead of being handled properly.
#### Other info (issues closed, discussion etc)
Fixes#8908
---
Before:
<img width="805" height="524" alt="Screenshot 2026-02-06 at 10 10 37 PM"
src="https://github.com/user-attachments/assets/90833481-d6f1-4b3f-bc2a-6f9d1d0cc017"
/>
After:
<img width="798" height="892" alt="Screenshot 2026-02-06 at 10 39 29 PM"
src="https://github.com/user-attachments/assets/b24b8ede-4e1d-4bb9-b55b-ff11ace27d67"
/>
#### Brief overview of PR changes/additions
This PR fixes a security vulnerability where dangerous MXP tags like
`<SEND>` were being processed in open mode, allowing malicious users to
inject commands through chat channels. The fix ensures that only safe
formatting tags are allowed in open mode, while secure and locked modes
continue to work as intended.
#### Motivation for adding to Mudlet
The MXP specification clearly defines three security modes:
- **Open mode** (default): Only basic formatting tags should be allowed
- **Secure mode**: All tags are allowed when explicitly enabled by the
server
- **Locked mode**: No tags are processed
Mudlet was treating open mode the same as secure mode, creating a
security risk where players could send clickable links with commands to
other players through in-game chat that uses open mode.
#### Other info (issues closed, discussion etc)
Closes#8150
**Changes made:**
- Added `TMxpMudlet::startTagReceived()` to validate tags against
current MXP mode
- Open mode now only allows safe formatting tags (B, I, U, COLOR, FONT,
BR, etc.)
- Secure mode continues to allow all tags including SEND, A, VAR, SOUND,
MUSIC
- Locked mode blocks all tags as expected
- Added comprehensive test suite with 5 test cases covering all modes
- All 13 existing tests still pass
**Testing:**
✅ New test: `TMxpModeSecurityTest` with full coverage of mode
transitions
✅ All existing MXP tests continue to pass
✅ Manual testing with live MUD connection confirmed the fix works
