feat(desktop): open markdown attachments in an in-app viewer panel

[rileycrane]

Summary

Port of berd's markdown-link viewer into Buzz desktop. Clicking a .md/.markdown/.mdx attachment card now opens a right-side auxiliary panel rendering the document with the same markdown pipeline as chat messages, instead of forcing a download.

What's in it

• MarkdownDocPanel — right auxiliary panel with Preview / Code toggle, download button, and close. Hosted in ChannelScreen alongside threads/profiles; participates in narrow-layout single-panel mode and Esc-to-close like the other aux panels.
• FileCard affordance — markdown attachments show an open-panel icon; the card pre-gates on advertised size so a >2 MiB doc never double-fetches just to refuse.
• Panel state in URL (doc/docName params via useChannelPanelHistoryState) — back/forward and reload restore the open document.
• Native 2 MiB cap — the viewer fetches through a markdown-specific fetch_markdown_doc_bytes Tauri command whose cap is owned by Rust: oversized Content-Length is refused before the body is read, and the streamed byte count aborts mid-transfer when the header is missing or dishonest (a forged/absent imeta size can no longer buy a 50 MiB download + IPC copy through the generic media path). Both enforcement points are pure, unit-tested helpers. The command deliberately skips MIME sniffing — bytes are strictly UTF-8-decoded and rendered escaped, and a legitimate .md may begin with bytes that sniff as a blocked type.
• markdownDocFile.ts — strict UTF-8 decode + matching frontend cap; binary-or-oversized files fall back to a friendly error + Download.
• useChannelPaneOpeners — pane-open handlers extracted from ChannelScreen; upstream's requireThreadEditResolution() guard runs first in every opener (same contract as useChannelProfilePanel).
• Nullable MarkdownDocViewerProvider — surfaces without a panel host (forum/projects) keep plain download behavior.
• Aux-pane split (4th commit) — rebasing onto main pushed ChannelPane.tsx/ChannelScreen.tsx over the frozen file-size ratchet, so the agent-session and markdown-doc pane assemblies are extracted into AgentSessionAuxiliaryPanel.tsx + MarkdownDocAuxiliaryPanel.tsx (pure JSX moves, no behavior change; repo policy: split, never bump).
• Selection-tray crash fix (5th commit, pre-existing upstream bug hit while dogfooding this branch) — tiptap v3's editor.view accessor throws until EditorContent attaches the view, and SelectionFormattingTray's wiring effect read editor.view.dom unguarded; navigating to a channel in a dev build could crash the whole channel route into TanStack Router's error screen. The tray now tracks view availability (probe + tiptap mount/unmount events) and gates its DOM wiring on it, with a regression test pinning the probe.

Why it works differently from berd — the Nostr/relay foundation changed three design points:

1. Filename is the only identity. The relay content-addresses uploads ({sha256}.bin, application/octet-stream) and markdown has no magic bytes — the ".md-ness" survives only in the NIP-92 imeta filename tag, so classification is filename-based.
2. Authenticated fetch, not file reads. Relay media URLs 401 in a plain browser (Blossom auth), so content goes through an authenticated Tauri command (SSRF-guarded to the relay /media/ origin). This is also why in-app rendering is the only viable UX — "open in browser" can never work.
3. Content-addressed = immutable — doc content is cached with staleTime: Infinity per session.

No DOMPurify dance needed: buzz's markdown pipeline has no raw-HTML support (no rehype-raw), so doc HTML renders escaped and javascript: hrefs are stripped.

Known limit (documented in-code): Code view skips syntax highlighting past 150 lines — inherited shiki perf guard shared with chat code blocks.

Related issue

N/A — none found (searched issues/PRs for "markdown viewer": no matches).

Testing

At tip aeffcce25, based on main f6e6617a9 (no file overlap with newer main commits):

• Tauri Rust suite green (desktop-tauri-checks lane), including 4 new cap tests: over-cap Content-Length refused, at-cap/absent admitted, streamed cutoff at exactly 2 MiB + 1 with nothing past the cap buffered; cargo clippy -D warnings + cargo fmt --check clean
• Desktop unit suite: 5442 passed / 0 failed (includes 8 markdownDocFile decoder tests + 2 tray view-guard tests)
• Playwright e2e: markdown-doc-viewer.spec.ts (upload → open panel → Preview/Code → download fallback → non-md regression → reload/back-forward contract → forged-size over-cap fallback) + file-attachment.spec.ts baseline: 21/21 passed
• desktop-check (biome/px-text/pubkey-truncation), desktop-typecheck, file-size-check: clean
• All 7 pre-push lanes green at push time

Screenshots: post via scripts/post-screenshots.sh <PR#> ~/.buzz/.scratch/md-viewer after the PR exists (repo policy — no relay media URLs in PR bodies).

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Reviewed head aeffcce256f20e30b45d92d0a8db8216916a31a8 against current base 30d2fc52f96138311f2006627ffc1a6d5ff1865b (merge-base f6e6617a9dcc2308d5039f8afaab974b49fb9577). Requesting changes for one channel-crash regression and one narrow-layout accessibility defect.

I also traced the attachment producer/consumer surfaces, download fallbacks, pane lifecycle, native same-relay/auth boundary, redirect policy, streaming 2 MiB cap, strict UTF-8 decode, and safe markdown rendering. I found no additional blocking defect there. All current GitHub checks pass, but they do not exercise either behavior below faithfully.

[rileycrane]

Updated for the review-feedback commits (view picker moved to its own row below the title).

Preview view

Markdown attachment card with the open-in-panel affordance; the document renders in the right auxiliary panel with the Preview/Code picker on its own row, so the filename keeps the title row.

Code view

Raw source with syntax highlighting; download fallback stays in the header.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Reviewed the follow-up at c4175f4ee50733b071d6123c13c956605308ea44. The Tiptap lifecycle correction is sound: the new probe exercises .dom on the real pre-mount truthy proxy, mount/unmount events match actual view availability, replacement and listener cleanup are covered, and the targeted narrow-layout focus test passes.

The focus-restoration follow-up still has one blocking P2 edge case: a document URL is not a unique opener identity. I reproduced the duplicate-attachment case below in the E2E app; opening the second card and closing the panel focuses the first card. Requesting a stable per-invocation restoration identity and regression coverage.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 78618804ec86a014524ad7d1fb55928e8f5c3edf...77974773ad7451074ffe3ce6db7d95a1f044691c.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 77974773ad7451074ffe3ce6db7d95a1f044691c to authorize a new review.
Any previous review applies only to its recorded range.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Reviewed head 263e1aeed116d9bd02839ecbea7289c335f188bb against base 0ccf934b88f610f5f235862ecd51e2dcbae2cb74. Requesting changes for three reproduced P2 UI/accessibility defects below.

The original static duplicate-card and narrow-layout focus cases now pass, and the branch inherits main's Tiptap lifecycle fix. The remaining issues are dynamic opener identity, thread-origin return focus, and project-home auxiliary-pane arbitration.

Validation: source/contract review plus focused Chromium workflows against a fresh current-head E2E build with the mock Tauri/live-event bridge. I independently reran the live-deletion and thread-origin reproductions and reproduced the project-home conflict. This is not native WKWebView or live-relay validation. Focused decoder/attachment tests reported 91 passes; a separate markdown renderer test file could not load because the shared review checkout lacks linkifyjs. No fresh CI or full-suite/native pass is claimed.

[wesbillman]

The icon and title here seem a bit misaligned.

[delkc]

The markdown files aren't getting this functionality from the Inbox view, but seems like a pretty easy fix (my agent patched it locally for me). Ideally it would be great if we can have it work from any view.

Having the file fully replace a thread in that right panel when you open from there is a little jarring, so I wonder if it could either push the thread into the center like it does when you hit the 3 dots overflow menu in the top right OR if it could pop out over view the view like it does when you hit the "Expand thread" action in the top left of the panel?

[delkc]

🤖 I tested this branch against the team relay and put the follow-up fixes into one atomic commit for consideration:

Suggested commit: 032d2bd4d

git cherry-pick 032d2bd4d

What this changes

• Makes the Preview action stable. Removes the renderer-side relay-origin timing gate that caused valid Markdown cards to alternate between Preview and Download. The native fetch command remains the authoritative relay-origin and 2 MiB security boundary.
• Handles where the file was opened. A document opened from the center timeline uses the normal right panel. Opening from an existing thread preserves that mounted thread rather than replacing it.
• Adds responsive thread behavior. When the channel container can fit two saved panel widths plus a 300px conversation column, the thread shifts left and the document opens as a third panel. Below that threshold, the document stacks over the thread at the existing right-panel width.
• Keeps Inbox local. Opening a document from Inbox no longer navigates into the channel route. On wide windows it becomes a third Inbox panel; on constrained windows it stacks over the Inbox detail. Closing restores the same Inbox conversation.
• Preserves focus and state. Closing returns to the invoking attachment where possible, while the underlying thread/Inbox detail remains mounted with its scroll and reply state intact.
• Adds regression coverage for thread-reply attachments and responsive pane arbitration.

Verification

• TypeScript typecheck
• Repository file-size gate
• 52 focused unit tests
• Biome / git diff --check
• Manual team-relay testing across timeline, thread, DM, and Inbox contexts

I used a commit rather than inline suggestion blocks because the change adds several coordinated files and needs to apply atomically.