22 lock items: G mapping headings, ink-only quiet underline links, task
list svg, cream blockquote (no left line), data-numeric tables, image
frame, details/summary chev. Two declared optical 偏离 (focus halo 2px,
task-list svg margin-top 2px) inline as comments.

Source: docs/design/preview/markdown-body.html · STANDARDS.md#L43

FORBID_TAGS adds iframe/form/input/object/embed alongside script/style.
ALLOWED_URI_REGEXP rejects javascript:/data:/vbscript: while accepting
http(s), mailto, file, relative paths, and anchors. Config exposed for
unit tests so we can assert without a DOM in the bun test env.

marked emits <input type=checkbox> for GFM task list syntax. Replace
each checkbox with a 16px circle (unchecked) or circle-check (checked)
SVG and tag the parent UL with .task-list so markdown.css picks up the
W3 layout. Read-only — agent output, not user-editable.

Adds happy-dom registrator preload to packages/ui so DOM-mutating logic
can be unit tested without an Electron shell.

Companion to previous commit. Exports rewriteTaskListsForTest and
sanitizeConfig from markdown.tsx, adds @happy-dom/global-registrator to
ui dev deps so the test can mutate real DOM nodes.

resolveLinkAction classifies hrefs into external/reveal/anchor/block.
setupLinkClicks intercepts clicks on rendered <a> and dispatches via
onLinkOpenExternal/onLinkRevealPath props (consumer wires to
window.api.openLink and showItemInFolder). javascript: / data: / non
http(s) schemes blocked. Anchors keep default browser behavior.

Bundles in setupImageClicks (T12) since the cleanup wiring shares the
same effect; consumers pass onImageClick to receive image src on click.

When no explicit onLinkOpenExternal/onLinkRevealPath handler is passed,
fall back to window.api.openLink / showItemInFolder so existing
<Markdown> call sites in message-part work without prop drilling.
Web/storybook fallback (window.open) still applies when window.api
is absent.

Eight new stories (Headings/LinksInkOnly/TaskList/Blockquote/Table/
Details/Math/HtmlWhitelist) demonstrate each W3 lock area with sample
content so future contributors can see the rendered surface without
touching production.

P1 — drop "input" from FORBID_TAGS so GFM task-list checkboxes survive
DOMPurify; an uponSanitizeElement hook strips any non-checkbox input.
The previous config sanitized away the very element rewriteTaskLists
needed to find, leaving raw checkboxes invisible in production.

P1 — rewriteTaskLists now walks input[type=checkbox] descendants and
locates the LI via closest(), covering loose-list output where marked
wraps the checkbox in <p>. Tags the LI itself (not the parent UL) with
.task-item so non-task siblings keep their bullet.

P1 — resolveLinkAction blocks protocol-relative URLs (//host) before
they fall into reveal, and routes mailto: to external instead of block.

P2 — link click listener is registered in capture phase so descendant
stopPropagation cannot bypass routing. Anchors scroll within the
markdown container so Electron's hash router stays untouched.

P2 — markdown.css table tabular-nums + right-align now also matches
align=right (marked's default for | ---: | syntax).

P2 — decorate() injects a chevron SVG into details > summary so the
W3 chev rotation fires without authors writing the SVG by hand.

Tests cover the new sanitize→decorate integration path.

…editorial

Two findings from the third handtest round.

Root cause for "click still does nothing":
The desktop build runs markdown through a main-process native parser at
packages/desktop-electron/src/main/markdown.ts. That parser carries its
own marked.Renderer with its own link override, which still tagged every
link as `class="external-link" target="_blank"`. The earlier fix in the
UI-side jsParser branch never took effect for the desktop, because the
desktop never runs that branch. HMR reload could not have helped — it
was always the wrong file. Mirror the host-only filter into the
main-process renderer so hash anchors and repo paths stop being routed
to shell.openExternal.

Table redesign — editorial typographic:
The inset frame still read as muddy because in light mode bg-cream is
only ~5% darker than bg-base, so the header tint disappeared and the
1 px outer frame became the only signal. Rather than fight the surface
tokens, drop the frame entirely. The table now sits borderless in the
prose flow with a transparent header anchored by a single firm rule
(`border-base`) under the head row, matching the typographic pattern
used by Codex / ChatGPT / NYT story tables. Row dividers stay at
`border-weak` so the body remains scannable in dark mode. First and
last cells flush with body text so the table aligns to the column
rather than indenting into a panel.

…l case

Table padding: revert to the W3 lock §L43 cell density (sm × md = 8px ×
12px), matching the lock-table preview reference. The earlier inset/
editorial iteration stretched the rows for breathing room, but at
chat density that read as gappy. Header keeps --bg-cream per W3 lock;
two minor token deviations remain (head/body split uses --border-base,
row dividers use --border-weak) — both required for the table to read
clearly in dark mode where the W3 lock's --border-weaker tier collapses
into the surface. Outer frame removed.

Anchor links: drop the `#top` -> scrollIntoView root special case. In
chat the surrounding container scrolls, not the markdown root, so the
behavior was just "align the answer's top with the viewport top" — not
the document-top semantics users expect from #top. Anchor handler now
only scrolls when the fragment matches a real id within the markdown
body. Unmatched fragments preventDefault and no-op, which keeps Electron
from navigating to localhost:5173/#anchor without claiming a feature
that doesn't make sense in chat.

Phase 1 diagnostic logs (now removed) confirmed the renderer pipeline is
correct end-to-end: setupLinkClicks attaches, capture-phase click fires,
href resolves to {kind:'reveal', path:'packages/ui/...'}, fallback dials
window.api.showItemInFolder. The reveal still appeared to no-op because
shell.showItemInFolder requires an absolute path on macOS — relative
paths silently do nothing. Resolve relative reveal targets against the
main-process cwd before handing them to shell. Caller-provided
onLinkRevealPath remains the canonical channel for chat to inject the
session workspace cwd later; this only fixes the unscoped fallback.

Diagnostic logs (now removed) showed shell.showItemInFolder receiving
a relative path (`packages/ui/src/components/markdown.tsx`) and
process.cwd() in the Electron main process being `/Users/yuhan` — not
the user's session workspace. Resolving against process.cwd in the
main process therefore reveals the wrong file or no file at all.

The renderer is the only layer that knows the chat session's workspace
cwd (via useData().directory). Wrap the chat-side Markdown call sites
in a MessageMarkdown component that injects an onLinkRevealPath handler
joining the session directory with the relative path before invoking
window.api.showItemInFolder. Main-process IPC reverts to assuming an
absolute path — that's the contract for callers, and it stops the
silent-wrong-file failure mode for unscoped fallbacks.

Markdown component itself is unchanged; the new behavior only kicks in
for the chat surface that has session context. Storybook and other
out-of-chat callers continue to work as a transparent renderer.

Previously every scheme that wasn't https / mailto fell through to
{kind: "block"}, which forced the click router to grow a new branch
every time a scheme was added to the sanitize allowlist. Flip the
relationship: the click router now denies only the truly dangerous
schemes (javascript / data / vbscript) and routes everything else as
external. Whether a given scheme actually reaches the router stays
governed by the DOMPurify ALLOWED_URI_REGEXP allowlist — which is the
correct gate for "is this surface allowed at all". Adding a new scheme
(vscode://, ssh://, tel:, …) is now a one-line allowlist edit instead
of a coordinated change across two files.

Tests cover the new contract: vbscript stays blocked; vscode://file/foo
and tel:+15551234 now resolve to external, mirroring how a future
allowlist expansion would surface them.

Single underline-color shift (fg-weak → currentColor) was visually
imperceptible — hand-test hit "looks like nothing happens on hover".
NN/g classifies single-property color-only as low-contrast hover; for
inline link affordance the recommended bar is color + shape combined.

Hover now mutates three underline properties together:
  text-decoration-color: fg-weak → fg-strong
  text-decoration-thickness: 1px → 2px
  text-underline-offset: 3px → 4px
80ms ease-out per property (sits in NN/g's 80–150ms color-class window).

Why not switch text color to brand orange: DESIGN.md L120 reserves
--brand-primary for selected / active / running surfaces and explicitly
forbids text fill. Brand orange on hover would also collide with the
active-tab 1px brand underline pattern and produce a "neon flicker" in
chat replies that contain multiple links per paragraph.

All three changes are paint, not layout — no inline reflow, no
line-box recalc, no surrounding text shift.

GitHub Advisory Database flags 3.3.1 with multiple MODERATE-severity
sanitizer-bypass advisories that are all patched by 3.4.0+:
  - ADD_ATTR predicate skips URI validation (≤ 3.3.1)
  - USE_PROFILES prototype pollution allows event handlers (≤ 3.3.1)
  - mutation-XSS via re-contextualization (< 3.3.2)
  - SAFE_FOR_TEMPLATES bypass in RETURN_DOM (< 3.4.0)
  - prototype pollution to XSS via CUSTOM_ELEMENT_HANDLING (< 3.4.0)
  - ADD_TAGS function form bypasses FORBID_TAGS (≤ 3.3.3)

3.4.2 is the current latest. Markdown sanitizer test suite (31 tests)
passes unchanged — our config only uses FORBID_TAGS / FORBID_CONTENTS /
ALLOWED_URI_REGEXP, none of which are touched by the 3.4 API changes.

setupLinkClicks/setupImageClicks attach a single click listener once and
its callback closes over the prop value at attach time. With Solid's
mergeProps + the !linkCleanup / !imageCleanup gates the listener was
never re-attached, so a parent component swapping onLinkOpenExternal /
onLinkRevealPath / onImageClick after the first render kept calling the
original (often undefined) handler.

Wrap the call in a thin arrow function so the event handler reads the
current reactive prop value at click time. Listeners stay attached
exactly once; the prop just becomes a live read.

Code copy-button only revealed on hover; keyboard users could Tab onto
an opacity:0 button, an invisible click target. Add :focus-within to
the trigger so the button appears the moment focus enters the code
block, matching :hover semantics for pointer users.

The task-item LI was a flex container with the icon as the first item
and everything else as raw siblings. In loose lists or when the label
contained a nested <ul>/<p>, those blocks became additional flex
siblings of the icon and rendered to its right instead of underneath
the label.

Group everything after the svg into a single span[data-slot=
"task-label"] so the LI's flex axis only sees [icon, label]. The label
keeps its block layout internally; nested ul/p naturally flow below
the first text line. CSS gives the label flex: 1 1 0 + min-width: 0
so long lines wrap instead of overflowing.

Leading-whitespace strip now also covers the loose-list case where the
first text node sits inside <p>, not directly under the label. Two new
tests lock both behaviors (nested ul stays in label wrapper; loose
list <p> firstChild has no leading space).

resolveLinkAction's generic scheme regex (`/^[a-z][a-z0-9+.-]*:/i`)
matches `C:\path\to\file.ts` because a single letter followed by `:` is
a valid scheme shape. That routed Windows absolute paths to the
external/browser handler instead of the file-reveal path, breaking
local-file reveal on Windows.

Catch the drive-letter form (`<letter>:\` or `<letter>:/`) before the
generic scheme test so it short-circuits to `{kind: "reveal", path}`.
Posix and protocol-relative cases stay unchanged. Test coverage added
for both `\` and `/` separators.

The image rule had `cursor: zoom-in` on every markdown img. onImageClick
is optional in the component API, so when no host wired it, every
image still advertised a zoom affordance that did nothing on click.

Move the cursor rule onto a `&[data-image-click] img` nested selector
and have the Markdown root expose `data-image-click` only when
local.onImageClick is set. Images get the default cursor when no
handler is wired; nothing else about the image style changes.

Bring sanitize allowlist in line with resolveLinkAction's `//host` block
so the click-router rule and the DOMPurify gate enforce the same policy.
Add lookahead for `//` and tighten the no-colon fallback; the previous
allowlist let `//evil.com/x` pass into sanitized DOM even though the
click router blocks navigation.

Story docs and fixture still described the earlier "cream bg, no left
line" direction. The W3 lock landed on a 2px border-weak left rule with
fg-weak text (Markdown industry convention, not BAN 1 — see markdown.css
§7). Update the storybook copy to match the implementation so reviewers
see the same surface twice.