(non-collapsible) or directly // into

(collapsible). Nesting a div // inside

caused weird browser-native height behavior and made // the header visibly inflate; flattening fixes it. const headerInner = `${escapeHtml(langLabel)}` + `${lineCount} lines` + `` const codeBody = `

${linesHtml}

` if (shouldCollapse) { const openAttr = openByDefault ? ' open' : '' return `

`
        + `${headerInner}`
        + codeBody
        + `

` } return `

`
      + `${headerInner}
`
      + codeBody
      + `

` }, link({ href, title, tokens }: Tokens.Link): string { // marked v15 passes already-parsed inline tokens; render them ourselves so // that the inner content keeps any bold/italic formatting from `[**x**](u)`. const innerHtml = (this as unknown as { parser: { parseInline: (t: unknown[]) => string } }) .parser.parseInline(tokens) if (!href || !SAFE_LINK_RE.test(href)) { // Dangerous scheme — render the inner content as plain content (no anchor). return innerHtml } // Defense against LLMs hallucinating a host on tool-returned download URLs. // /api/v1/files/generated/ is always same-origin; multiple models have // been observed prepending bogus schemes/hosts (https://localhost:8080, // https://ai-tools-system.com, …) when echoing the URL back, breaking the // download. Strip any prepended scheme://host so the link works regardless // of what the model wrote. const hostStripped = /^https?:\/\/[^/]+(\/api\/v1\/files\/generated\/.+)$/i.exec(href) const safeHref = hostStripped ? hostStripped[1] : href let extra = '' try { const url = new URL(safeHref, typeof window !== 'undefined' ? window.location.href : 'http://localhost/') if (typeof window !== 'undefined' && url.origin !== window.location.origin) { extra = ' target="_blank" rel="noopener noreferrer"' } } catch { // Malformed URL — treat as same-origin (relative link path). } const titleAttr = title ? ` title="${escapeHtml(title)}"` : '' // Inline-preview tool-generated image files instead of showing a // download-only link. render_html_image / image generation return // `[cover.png](/api/v1/files/generated/)`; without this the chat only // offers a download and the user can never *see* the picture. The // generated-file endpoint is permitAll, so a same-origin loads // without an auth header. Detection is by the link label's extension // (the URL itself carries only a UUID). Clicking the image opens it // full-size in a new tab (see useGlobalFileDownloadClick). const labelText = innerHtml.replace(/<[^>]*>/g, '').trim() const isFileApi = /^\/api\/v1\/(files|chat\/files)\//.test(safeHref) if (isFileApi && /\.(png|jpe?g|gif|webp|bmp|svg)$/i.test(labelText)) { const alt = escapeHtml(labelText) return ` ${alt}

` } return `${innerHtml}` }, } // --------------------------------------------------------------------------- // marked instance // --------------------------------------------------------------------------- const markedInstance = new Marked({ gfm: true, breaks: true, renderer: customRenderer, }) // --------------------------------------------------------------------------- // DOMPurify config — allow Markdown + custom blocks (code-block, KaTeX/Mermaid // placeholders) and the inline copy SVG button. // --------------------------------------------------------------------------- const purifyConfig = { ADD_ATTR: [ 'target', 'rel', 'class', 'data-code', 'data-echarts-option', 'data-wiki-title', 'data-slug', 'data-citation-index', 'data-citation-title', 'data-tex', 'data-mermaid', 'data-mermaid-download', 'x1', 'y1', 'x2', 'y2', 'aria-label', 'open', 'type', 'viewBox', 'fill', 'stroke', 'stroke-width', 'd', 'x', 'y', 'width', 'height', 'rx', 'ry', 'points', ], ADD_TAGS: [ 'input', 'button', 'svg', 'path', 'rect', 'polyline', 'circle', 'line', 'span', 'details', 'summary', ], // Defence in depth: even if a malicious href slips past our link() // override, DOMPurify drops anything outside this whitelist. ALLOWED_URI_REGEXP: /^(?:https?:|mailto:|#|\/|\.\/|\.\.\/)/i, } // The custom ALLOWED_URI_REGEXP above also vets non-URI attribute *values*, so // DOMPurify strips `target="_blank"`, `rel="noopener"`, `referrerpolicy="..."` // etc. (their values don't match the URL whitelist). For product cards we need // those back: the buy link must open in a new tab instead of navigating away // from the chat, and marketplace CDN thumbnails (e.g. 360buyimg) are hotlink- // protected and only load with `referrer-policy: no-referrer`. An // afterSanitizeAttributes hook re-applies them with fixed, safe values — // attributes set inside this hook are NOT re-validated, so this is the // canonical DOMPurify pattern. Scoped strictly to product-card nodes so no // other rendered markdown changes behaviour. let productCardHookRegistered = false function ensureProductCardHook(): void { if (productCardHookRegistered) return productCardHookRegistered = true DOMPurify.addHook('afterSanitizeAttributes', (node: Element) => { if (!node || typeof node.tagName !== 'string') return const tag = node.tagName.toLowerCase() if (tag === 'a' && node.classList?.contains('product-card')) { node.setAttribute('target', '_blank') node.setAttribute('rel', 'noopener noreferrer') } else if (tag === 'img' && typeof node.closest === 'function' && node.closest('.product-cards')) { node.setAttribute('referrerpolicy', 'no-referrer') node.setAttribute('loading', 'lazy') node.setAttribute('decoding', 'async') } }) } ensureProductCardHook() // --------------------------------------------------------------------------- // LRU render cache // --------------------------------------------------------------------------- // Streaming token-by-token defeats this (each delta produces a new key) but // scrolling history and re-renders of completed messages are common, and the // cost of marked + highlight.js + DOMPurify is non-trivial for long messages. const RENDER_CACHE = new Map() const RENDER_CACHE_CAP = 200 function cacheKey(text: string, wikilink: WikilinkMode): string { // Compact key — collisions on the order of 10^-6 in single-conversation // scope, and a false hit only causes a "stale" render of unchanged content // (no security implication since cached values are sanitized HTML). // The wikilink mode is part of the key so a 'none' caller cannot read back // a 'legacy'-substituted cached entry of the same source. return `${wikilink}:${text.length}:${text.slice(0, 40)}:${text.slice(-40)}` } // --------------------------------------------------------------------------- // Public API // --------------------------------------------------------------------------- /** * Wikilink handling mode for {@link useMarkdownRenderer}. * * - `'legacy'` (default): pre-markdown string substitution of `[[Title]]` into * ``, dispatching the global * `wiki-link-click` event when clicked. Kept for chat / other views that * already rely on this behaviour. * - `'none'`: skip wikilink substitution entirely. Use this when the caller * wants to walk the rendered DOM itself and resolve `[[...]]` against an * authoritative `{slug, title}` index — the dedicated path used by the Wiki * page viewer, where the legacy "guess slug from title" approach is unsafe. */ export type WikilinkMode = 'legacy' | 'none' export interface RenderMarkdownOptions { /** How to handle `[[...]]` syntax. Defaults to `'legacy'`. */ wikilink?: WikilinkMode /** * Streaming-friendly render. When `true`, the renderer skips code-block * language auto-detection (the most expensive step) and bypasses the LRU * cache. Use it for the throttled mid-stream renders driven by * {@link useStreamingMarkdown}; the final render must run with this off so * the completed message gets full-fidelity highlighting. */ streaming?: boolean } // Module-level flag read by the custom code renderer. Safe because // `markedInstance.parse()` runs fully synchronously (JS single-threaded) — the // flag is set immediately before the parse and cleared in a `finally`, so it // can never leak across renders. let streamingRenderMode = false // --------------------------------------------------------------------------- // Wiki citation pre-processor // --------------------------------------------------------------------------- // Parses the canonical "来源：" source table appended by the backend's // SourceEvidenceLedger.appendWikiSourceTable() to build a citation index → // title map, then replaces every [n] marker in the answer body with a // clickable and wraps entire source-table rows so the full line is // clickable. function preprocessWikiCitations(text: string): string { let sourceIdx = -1 const dblIdx = text.indexOf('\n\n来源：') if (dblIdx >= 0) { sourceIdx = dblIdx + 2 } else { const sngIdx = text.indexOf('\n来源：') if (sngIdx >= 0) { sourceIdx = sngIdx + 1 } else if (text.startsWith('来源：')) { sourceIdx = 0 } } if (sourceIdx < 0) return text const body = text.slice(0, sourceIdx) const sourceSection = text.slice(sourceIdx) const map = new Map() const sourceLineRe = /^\[(\d+)\]\s+(.+)$/gm let slMatch: RegExpExecArray | null while ((slMatch = sourceLineRe.exec(sourceSection)) !== null) { const index = parseInt(slMatch[1], 10) if (map.has(index)) continue const fullContent = slMatch[2].trim() const title = fullContent.split(' - ')[0].trim() if (title) map.set(index, title) } if (map.size === 0) return text // Body: replace only the [n] marker. const bodyWithCitations = body.replace( /\[(\d+)\]/g, (match, indexStr: string) => { const idx = parseInt(indexStr, 10) const title = map.get(idx) if (!title) return match return ( '' + match + '' ) }, ) // Source table: wrap the entire row. const sourceWithCitations = sourceSection.replace( /^(\s*\[(\d+)\]\s+.+)$/gm, (fullLine, _content, indexStr: string) => { const idx = parseInt(indexStr, 10) const title = map.get(idx) if (!title) return fullLine return ( '' + fullLine + '' ) }, ) return bodyWithCitations + sourceWithCitations } export function useMarkdownRenderer() { function renderMarkdown(content: string, opts?: RenderMarkdownOptions): string { if (!content) return '' const wikilink: WikilinkMode = opts?.wikilink ?? 'legacy' const streaming = opts?.streaming ?? false const k = cacheKey(content, wikilink) // Streaming renders bypass the cache entirely: their length-based keys // collide with the final full-fidelity render of the same text, and a // streaming entry (no auto-highlight) must never be served as the final // result. if (!streaming) { const cached = RENDER_CACHE.get(k) if (cached !== undefined) { // Refresh LRU position — re-insert at the tail. RENDER_CACHE.delete(k) RENDER_CACHE.set(k, cached) return cached } } // 1. LaTeX placeholders (skips fenced/inline code). const withLatex = preprocessLatex(content) // 2. Wiki link substitution: [[Title]] → . // Skipped in 'none' mode so the caller can do its own DOM postprocess. const withWikiLinks = wikilink === 'none' ? withLatex : // Split `[[slug|display]]` into slug + display halves so the // `data-wiki-title` attribute carries the slug ALONE (the cross-KB // lookup keys off that) and the visible label is the display text // (the alias an author chose). The earlier single-capture regex // copied the whole bracket interior — including the literal `|` — // into both, producing `data-wiki-title="slug|display"` lookups // that the backend would never resolve. withLatex.replace( /\[\[([^\]|]+)(?:\|([^\]]+))?\]\]/g, (_match, slug: string, alias?: string) => { const target = slug.trim().replace(/"/g, '"') const visible = (alias?.trim() || slug.trim()).replace(/"/g, '"') return ( '' + visible + '' ) }, ) // 2.5 Wiki citation preprocessing: [n] → const withCitations = preprocessWikiCitations(withWikiLinks) // 3. Marked → 4. DOMPurify. let rawHtml: string streamingRenderMode = streaming try { rawHtml = markedInstance.parse(withCitations) as string } finally { streamingRenderMode = false } const result = DOMPurify.sanitize(rawHtml, purifyConfig) if (streaming) { // Throwaway render — don't pollute the LRU with low-fidelity entries. return result } // Evict oldest entry when at capacity (Map preserves insertion order). if (RENDER_CACHE.size >= RENDER_CACHE_CAP) { const oldestKey = RENDER_CACHE.keys().next().value if (oldestKey !== undefined) RENDER_CACHE.delete(oldestKey) } RENDER_CACHE.set(k, result) return result } function escapeText(text: string): string { return escapeHtml(text) } return { renderMarkdown, escapeText, markedInstance, } } // Direct singletons for tests / advanced callers. export { markedInstance, purifyConfig } export default markedInstance