feat: add DocumentSegment for inline HTML/SVG/Mermaid rendering by heimanba · Pull Request #50 · modelstudioai/OpenAgentPack

heimanba · 2026-07-21T07:13:33Z

Summary

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously unreadable due to a three-layer failure: server-side truncation at 4000 chars → artifact extraction blind spot for inline documents → rehype-sanitize stripping all HTML tags. The result was "内容已截断" with raw text only.

This PR adds a general DocumentSegment type to the artifact pipeline that handles any self-contained rich document output by agents.

Changes

artifact.ts — extractDocumentSpans() with two-pass detection: fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html>. Two-pass extractArtifacts(): documents first, then URL extraction on remaining text. Added resolveDocumentContent() (wraps Mermaid in HTML shell with CDN mermaid@11), documentTypeLabel(), extractHtmlTitle().
session-event-sanitizer.ts — New DOCUMENT_TEXT_LIMIT = 32K for document-containing events (vs 4K default / 8K tool). HTML-safe truncation at tag boundaries.
InlineArtifactCard.tsx — New InlineDocumentCard: 240px sandboxed iframe preview in timeline with "新窗口" button.
ArtifactView.tsx — New DocumentFrame: full-height iframe with toolbar for left-panel preview.
desktop.css — Styles for .inline-document-card, .inline-document-frame, etc.
artifact.test.ts — 13 new test cases covering extraction, resolution, and edge cases (44 total tests).

Test plan

44/44 unit tests pass (including 13 new document extraction tests)
TypeScript zero errors across webui + SDK
biome lint clean (pre-commit hook passes)
Browser verification: inline iframe preview renders with correct HTML content, "新窗口" opens full document in new window, scrolling works inside iframe
Pre-push verification harness passes (typecheck, architecture, tests)

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously truncated to 4000 chars server-side, then stripped of all HTML tags by rehype-sanitize, leaving only raw text. This three-layer failure made rich documents unreadable. Add a general DocumentSegment type to the artifact pipeline: - extractDocumentSpans(): two-pass detection — fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html> - Server sanitizer: raise text limit to 32K for document-containing events, with HTML-safe truncation at tag boundaries - InlineArtifactCard: new InlineDocumentCard with 240px sandboxed iframe preview in the timeline - ArtifactView: new DocumentFrame for full-height left-panel preview - Mermaid content wrapped in an HTML shell with CDN mermaid@11 13 new test cases covering extraction, resolution, and edge cases. Change-Id: I76108b0e606938fc5f3cbc34d7f78d6b52dadcd8 Co-developed-by: Qoder CLI <noreply@qoder.com>

Remove pointer-events:none from .inline-document-frame so users can scroll inside the 240px iframe preview to inspect document content. Change-Id: I6288215632c55aeb2b61315d9d219dbd22c55e30 Co-developed-by: Qoder CLI <noreply@qoder.com>

Address CodeQL "Incomplete URL substring sanitization" finding by using reserved example.test domains instead of fonts.googleapis.com in test fixtures. Change-Id: I38596faa833c770757bcf91131d99a72e8868d21 Co-developed-by: Qoder CLI <noreply@qoder.com>

heimanba · 2026-07-21T07:13:33Z

Summary

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously unreadable due to a three-layer failure: server-side truncation at 4000 chars → artifact extraction blind spot for inline documents → rehype-sanitize stripping all HTML tags. The result was "内容已截断" with raw text only.

This PR adds a general DocumentSegment type to the artifact pipeline that handles any self-contained rich document output by agents.

Changes

artifact.ts — extractDocumentSpans() with two-pass detection: fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html>. Two-pass extractArtifacts(): documents first, then URL extraction on remaining text. Added resolveDocumentContent() (wraps Mermaid in HTML shell with CDN mermaid@11), documentTypeLabel(), extractHtmlTitle().
session-event-sanitizer.ts — New DOCUMENT_TEXT_LIMIT = 32K for document-containing events (vs 4K default / 8K tool). HTML-safe truncation at tag boundaries.
InlineArtifactCard.tsx — New InlineDocumentCard: 240px sandboxed iframe preview in timeline with "新窗口" button.
ArtifactView.tsx — New DocumentFrame: full-height iframe with toolbar for left-panel preview.
desktop.css — Styles for .inline-document-card, .inline-document-frame, etc.
artifact.test.ts — 13 new test cases covering extraction, resolution, and edge cases (44 total tests).

Test plan

44/44 unit tests pass (including 13 new document extraction tests)
TypeScript zero errors across webui + SDK
biome lint clean (pre-commit hook passes)
Browser verification: inline iframe preview renders with correct HTML content, "新窗口" opens full document in new window, scrolling works inside iframe
Pre-push verification harness passes (typecheck, architecture, tests)

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously truncated to 4000 chars server-side, then stripped of all HTML tags by rehype-sanitize, leaving only raw text. This three-layer failure made rich documents unreadable. Add a general DocumentSegment type to the artifact pipeline: - extractDocumentSpans(): two-pass detection — fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html> - Server sanitizer: raise text limit to 32K for document-containing events, with HTML-safe truncation at tag boundaries - InlineArtifactCard: new InlineDocumentCard with 240px sandboxed iframe preview in the timeline - ArtifactView: new DocumentFrame for full-height left-panel preview - Mermaid content wrapped in an HTML shell with CDN mermaid@11 13 new test cases covering extraction, resolution, and edge cases. Change-Id: I76108b0e606938fc5f3cbc34d7f78d6b52dadcd8 Co-developed-by: Qoder CLI <noreply@qoder.com>

Remove pointer-events:none from .inline-document-frame so users can scroll inside the 240px iframe preview to inspect document content. Change-Id: I6288215632c55aeb2b61315d9d219dbd22c55e30 Co-developed-by: Qoder CLI <noreply@qoder.com>

Address CodeQL "Incomplete URL substring sanitization" finding by using reserved example.test domains instead of fonts.googleapis.com in test fixtures. Change-Id: I38596faa833c770757bcf91131d99a72e8868d21 Co-developed-by: Qoder CLI <noreply@qoder.com>

heimanba · 2026-07-21T07:13:33Z

Summary

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously unreadable due to a three-layer failure: server-side truncation at 4000 chars → artifact extraction blind spot for inline documents → rehype-sanitize stripping all HTML tags. The result was "内容已截断" with raw text only.

This PR adds a general DocumentSegment type to the artifact pipeline that handles any self-contained rich document output by agents.

Changes

artifact.ts — extractDocumentSpans() with two-pass detection: fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html>. Two-pass extractArtifacts(): documents first, then URL extraction on remaining text. Added resolveDocumentContent() (wraps Mermaid in HTML shell with CDN mermaid@11), documentTypeLabel(), extractHtmlTitle().
session-event-sanitizer.ts — New DOCUMENT_TEXT_LIMIT = 32K for document-containing events (vs 4K default / 8K tool). HTML-safe truncation at tag boundaries.
InlineArtifactCard.tsx — New InlineDocumentCard: 240px sandboxed iframe preview in timeline with "新窗口" button.
ArtifactView.tsx — New DocumentFrame: full-height iframe with toolbar for left-panel preview.
desktop.css — Styles for .inline-document-card, .inline-document-frame, etc.
artifact.test.ts — 13 new test cases covering extraction, resolution, and edge cases (44 total tests).

Test plan

44/44 unit tests pass (including 13 new document extraction tests)
TypeScript zero errors across webui + SDK
biome lint clean (pre-commit hook passes)
Browser verification: inline iframe preview renders with correct HTML content, "新窗口" opens full document in new window, scrolling works inside iframe
Pre-push verification harness passes (typecheck, architecture, tests)

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously truncated to 4000 chars server-side, then stripped of all HTML tags by rehype-sanitize, leaving only raw text. This three-layer failure made rich documents unreadable. Add a general DocumentSegment type to the artifact pipeline: - extractDocumentSpans(): two-pass detection — fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html> - Server sanitizer: raise text limit to 32K for document-containing events, with HTML-safe truncation at tag boundaries - InlineArtifactCard: new InlineDocumentCard with 240px sandboxed iframe preview in the timeline - ArtifactView: new DocumentFrame for full-height left-panel preview - Mermaid content wrapped in an HTML shell with CDN mermaid@11 13 new test cases covering extraction, resolution, and edge cases. Change-Id: I76108b0e606938fc5f3cbc34d7f78d6b52dadcd8 Co-developed-by: Qoder CLI <noreply@qoder.com>

Remove pointer-events:none from .inline-document-frame so users can scroll inside the 240px iframe preview to inspect document content. Change-Id: I6288215632c55aeb2b61315d9d219dbd22c55e30 Co-developed-by: Qoder CLI <noreply@qoder.com>

Address CodeQL "Incomplete URL substring sanitization" finding by using reserved example.test domains instead of fonts.googleapis.com in test fixtures. Change-Id: I38596faa833c770757bcf91131d99a72e8868d21 Co-developed-by: Qoder CLI <noreply@qoder.com>

heimanba · 2026-07-21T07:13:33Z

Summary

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously unreadable due to a three-layer failure: server-side truncation at 4000 chars → artifact extraction blind spot for inline documents → rehype-sanitize stripping all HTML tags. The result was "内容已截断" with raw text only.

This PR adds a general DocumentSegment type to the artifact pipeline that handles any self-contained rich document output by agents.

Changes

artifact.ts — extractDocumentSpans() with two-pass detection: fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html>. Two-pass extractArtifacts(): documents first, then URL extraction on remaining text. Added resolveDocumentContent() (wraps Mermaid in HTML shell with CDN mermaid@11), documentTypeLabel(), extractHtmlTitle().
session-event-sanitizer.ts — New DOCUMENT_TEXT_LIMIT = 32K for document-containing events (vs 4K default / 8K tool). HTML-safe truncation at tag boundaries.
InlineArtifactCard.tsx — New InlineDocumentCard: 240px sandboxed iframe preview in timeline with "新窗口" button.
ArtifactView.tsx — New DocumentFrame: full-height iframe with toolbar for left-panel preview.
desktop.css — Styles for .inline-document-card, .inline-document-frame, etc.
artifact.test.ts — 13 new test cases covering extraction, resolution, and edge cases (44 total tests).

Test plan

44/44 unit tests pass (including 13 new document extraction tests)
TypeScript zero errors across webui + SDK
biome lint clean (pre-commit hook passes)
Browser verification: inline iframe preview renders with correct HTML content, "新窗口" opens full document in new window, scrolling works inside iframe
Pre-push verification harness passes (typecheck, architecture, tests)

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously truncated to 4000 chars server-side, then stripped of all HTML tags by rehype-sanitize, leaving only raw text. This three-layer failure made rich documents unreadable. Add a general DocumentSegment type to the artifact pipeline: - extractDocumentSpans(): two-pass detection — fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html> - Server sanitizer: raise text limit to 32K for document-containing events, with HTML-safe truncation at tag boundaries - InlineArtifactCard: new InlineDocumentCard with 240px sandboxed iframe preview in the timeline - ArtifactView: new DocumentFrame for full-height left-panel preview - Mermaid content wrapped in an HTML shell with CDN mermaid@11 13 new test cases covering extraction, resolution, and edge cases. Change-Id: I76108b0e606938fc5f3cbc34d7f78d6b52dadcd8 Co-developed-by: Qoder CLI <noreply@qoder.com>

Remove pointer-events:none from .inline-document-frame so users can scroll inside the 240px iframe preview to inspect document content. Change-Id: I6288215632c55aeb2b61315d9d219dbd22c55e30 Co-developed-by: Qoder CLI <noreply@qoder.com>

Address CodeQL "Incomplete URL substring sanitization" finding by using reserved example.test domains instead of fonts.googleapis.com in test fixtures. Change-Id: I38596faa833c770757bcf91131d99a72e8868d21 Co-developed-by: Qoder CLI <noreply@qoder.com>

heimanba · 2026-07-21T07:13:33Z

Summary

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously unreadable due to a three-layer failure: server-side truncation at 4000 chars → artifact extraction blind spot for inline documents → rehype-sanitize stripping all HTML tags. The result was "内容已截断" with raw text only.

This PR adds a general DocumentSegment type to the artifact pipeline that handles any self-contained rich document output by agents.

Changes

artifact.ts — extractDocumentSpans() with two-pass detection: fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html>. Two-pass extractArtifacts(): documents first, then URL extraction on remaining text. Added resolveDocumentContent() (wraps Mermaid in HTML shell with CDN mermaid@11), documentTypeLabel(), extractHtmlTitle().
session-event-sanitizer.ts — New DOCUMENT_TEXT_LIMIT = 32K for document-containing events (vs 4K default / 8K tool). HTML-safe truncation at tag boundaries.
InlineArtifactCard.tsx — New InlineDocumentCard: 240px sandboxed iframe preview in timeline with "新窗口" button.
ArtifactView.tsx — New DocumentFrame: full-height iframe with toolbar for left-panel preview.
desktop.css — Styles for .inline-document-card, .inline-document-frame, etc.
artifact.test.ts — 13 new test cases covering extraction, resolution, and edge cases (44 total tests).

Test plan

44/44 unit tests pass (including 13 new document extraction tests)
TypeScript zero errors across webui + SDK
biome lint clean (pre-commit hook passes)
Browser verification: inline iframe preview renders with correct HTML content, "新窗口" opens full document in new window, scrolling works inside iframe
Pre-push verification harness passes (typecheck, architecture, tests)

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously truncated to 4000 chars server-side, then stripped of all HTML tags by rehype-sanitize, leaving only raw text. This three-layer failure made rich documents unreadable. Add a general DocumentSegment type to the artifact pipeline: - extractDocumentSpans(): two-pass detection — fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html> - Server sanitizer: raise text limit to 32K for document-containing events, with HTML-safe truncation at tag boundaries - InlineArtifactCard: new InlineDocumentCard with 240px sandboxed iframe preview in the timeline - ArtifactView: new DocumentFrame for full-height left-panel preview - Mermaid content wrapped in an HTML shell with CDN mermaid@11 13 new test cases covering extraction, resolution, and edge cases. Change-Id: I76108b0e606938fc5f3cbc34d7f78d6b52dadcd8 Co-developed-by: Qoder CLI <noreply@qoder.com>

Remove pointer-events:none from .inline-document-frame so users can scroll inside the 240px iframe preview to inspect document content. Change-Id: I6288215632c55aeb2b61315d9d219dbd22c55e30 Co-developed-by: Qoder CLI <noreply@qoder.com>

Address CodeQL "Incomplete URL substring sanitization" finding by using reserved example.test domains instead of fonts.googleapis.com in test fixtures. Change-Id: I38596faa833c770757bcf91131d99a72e8868d21 Co-developed-by: Qoder CLI <noreply@qoder.com>

heimanba · 2026-07-21T07:13:33Z

Summary

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously unreadable due to a three-layer failure: server-side truncation at 4000 chars → artifact extraction blind spot for inline documents → rehype-sanitize stripping all HTML tags. The result was "内容已截断" with raw text only.

This PR adds a general DocumentSegment type to the artifact pipeline that handles any self-contained rich document output by agents.

Changes

artifact.ts — extractDocumentSpans() with two-pass detection: fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html>. Two-pass extractArtifacts(): documents first, then URL extraction on remaining text. Added resolveDocumentContent() (wraps Mermaid in HTML shell with CDN mermaid@11), documentTypeLabel(), extractHtmlTitle().
session-event-sanitizer.ts — New DOCUMENT_TEXT_LIMIT = 32K for document-containing events (vs 4K default / 8K tool). HTML-safe truncation at tag boundaries.
InlineArtifactCard.tsx — New InlineDocumentCard: 240px sandboxed iframe preview in timeline with "新窗口" button.
ArtifactView.tsx — New DocumentFrame: full-height iframe with toolbar for left-panel preview.
desktop.css — Styles for .inline-document-card, .inline-document-frame, etc.
artifact.test.ts — 13 new test cases covering extraction, resolution, and edge cases (44 total tests).

Test plan

44/44 unit tests pass (including 13 new document extraction tests)
TypeScript zero errors across webui + SDK
biome lint clean (pre-commit hook passes)
Browser verification: inline iframe preview renders with correct HTML content, "新窗口" opens full document in new window, scrolling works inside iframe
Pre-push verification harness passes (typecheck, architecture, tests)

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously truncated to 4000 chars server-side, then stripped of all HTML tags by rehype-sanitize, leaving only raw text. This three-layer failure made rich documents unreadable. Add a general DocumentSegment type to the artifact pipeline: - extractDocumentSpans(): two-pass detection — fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html> - Server sanitizer: raise text limit to 32K for document-containing events, with HTML-safe truncation at tag boundaries - InlineArtifactCard: new InlineDocumentCard with 240px sandboxed iframe preview in the timeline - ArtifactView: new DocumentFrame for full-height left-panel preview - Mermaid content wrapped in an HTML shell with CDN mermaid@11 13 new test cases covering extraction, resolution, and edge cases. Change-Id: I76108b0e606938fc5f3cbc34d7f78d6b52dadcd8 Co-developed-by: Qoder CLI <noreply@qoder.com>

Remove pointer-events:none from .inline-document-frame so users can scroll inside the 240px iframe preview to inspect document content. Change-Id: I6288215632c55aeb2b61315d9d219dbd22c55e30 Co-developed-by: Qoder CLI <noreply@qoder.com>

Address CodeQL "Incomplete URL substring sanitization" finding by using reserved example.test domains instead of fonts.googleapis.com in test fixtures. Change-Id: I38596faa833c770757bcf91131d99a72e8868d21 Co-developed-by: Qoder CLI <noreply@qoder.com>

heimanba · 2026-07-21T07:13:33Z

Summary

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously unreadable due to a three-layer failure: server-side truncation at 4000 chars → artifact extraction blind spot for inline documents → rehype-sanitize stripping all HTML tags. The result was "内容已截断" with raw text only.

This PR adds a general DocumentSegment type to the artifact pipeline that handles any self-contained rich document output by agents.

Changes

artifact.ts — extractDocumentSpans() with two-pass detection: fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html>. Two-pass extractArtifacts(): documents first, then URL extraction on remaining text. Added resolveDocumentContent() (wraps Mermaid in HTML shell with CDN mermaid@11), documentTypeLabel(), extractHtmlTitle().
session-event-sanitizer.ts — New DOCUMENT_TEXT_LIMIT = 32K for document-containing events (vs 4K default / 8K tool). HTML-safe truncation at tag boundaries.
InlineArtifactCard.tsx — New InlineDocumentCard: 240px sandboxed iframe preview in timeline with "新窗口" button.
ArtifactView.tsx — New DocumentFrame: full-height iframe with toolbar for left-panel preview.
desktop.css — Styles for .inline-document-card, .inline-document-frame, etc.
artifact.test.ts — 13 new test cases covering extraction, resolution, and edge cases (44 total tests).

Test plan

44/44 unit tests pass (including 13 new document extraction tests)
TypeScript zero errors across webui + SDK
biome lint clean (pre-commit hook passes)
Browser verification: inline iframe preview renders with correct HTML content, "新窗口" opens full document in new window, scrolling works inside iframe
Pre-push verification harness passes (typecheck, architecture, tests)

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously truncated to 4000 chars server-side, then stripped of all HTML tags by rehype-sanitize, leaving only raw text. This three-layer failure made rich documents unreadable. Add a general DocumentSegment type to the artifact pipeline: - extractDocumentSpans(): two-pass detection — fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html> - Server sanitizer: raise text limit to 32K for document-containing events, with HTML-safe truncation at tag boundaries - InlineArtifactCard: new InlineDocumentCard with 240px sandboxed iframe preview in the timeline - ArtifactView: new DocumentFrame for full-height left-panel preview - Mermaid content wrapped in an HTML shell with CDN mermaid@11 13 new test cases covering extraction, resolution, and edge cases. Change-Id: I76108b0e606938fc5f3cbc34d7f78d6b52dadcd8 Co-developed-by: Qoder CLI <noreply@qoder.com>

Remove pointer-events:none from .inline-document-frame so users can scroll inside the 240px iframe preview to inspect document content. Change-Id: I6288215632c55aeb2b61315d9d219dbd22c55e30 Co-developed-by: Qoder CLI <noreply@qoder.com>

Address CodeQL "Incomplete URL substring sanitization" finding by using reserved example.test domains instead of fonts.googleapis.com in test fixtures. Change-Id: I38596faa833c770757bcf91131d99a72e8868d21 Co-developed-by: Qoder CLI <noreply@qoder.com>

heimanba · 2026-07-21T07:13:33Z

Summary

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously unreadable due to a three-layer failure: server-side truncation at 4000 chars → artifact extraction blind spot for inline documents → rehype-sanitize stripping all HTML tags. The result was "内容已截断" with raw text only.

This PR adds a general DocumentSegment type to the artifact pipeline that handles any self-contained rich document output by agents.

Changes

artifact.ts — extractDocumentSpans() with two-pass detection: fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html>. Two-pass extractArtifacts(): documents first, then URL extraction on remaining text. Added resolveDocumentContent() (wraps Mermaid in HTML shell with CDN mermaid@11), documentTypeLabel(), extractHtmlTitle().
session-event-sanitizer.ts — New DOCUMENT_TEXT_LIMIT = 32K for document-containing events (vs 4K default / 8K tool). HTML-safe truncation at tag boundaries.
InlineArtifactCard.tsx — New InlineDocumentCard: 240px sandboxed iframe preview in timeline with "新窗口" button.
ArtifactView.tsx — New DocumentFrame: full-height iframe with toolbar for left-panel preview.
desktop.css — Styles for .inline-document-card, .inline-document-frame, etc.
artifact.test.ts — 13 new test cases covering extraction, resolution, and edge cases (44 total tests).

Test plan

44/44 unit tests pass (including 13 new document extraction tests)
TypeScript zero errors across webui + SDK
biome lint clean (pre-commit hook passes)
Browser verification: inline iframe preview renders with correct HTML content, "新窗口" opens full document in new window, scrolling works inside iframe
Pre-push verification harness passes (typecheck, architecture, tests)

Agent responses containing full documents (HTML reports, SVG diagrams, Mermaid charts) were previously truncated to 4000 chars server-side, then stripped of all HTML tags by rehype-sanitize, leaving only raw text. This three-layer failure made rich documents unreadable. Add a general DocumentSegment type to the artifact pipeline: - extractDocumentSpans(): two-pass detection — fenced code blocks with document languages (html/svg/mermaid, ≥500 chars) and inline HTML documents (≥1000 chars), including truncated streams missing </html> - Server sanitizer: raise text limit to 32K for document-containing events, with HTML-safe truncation at tag boundaries - InlineArtifactCard: new InlineDocumentCard with 240px sandboxed iframe preview in the timeline - ArtifactView: new DocumentFrame for full-height left-panel preview - Mermaid content wrapped in an HTML shell with CDN mermaid@11 13 new test cases covering extraction, resolution, and edge cases. Change-Id: I76108b0e606938fc5f3cbc34d7f78d6b52dadcd8 Co-developed-by: Qoder CLI <noreply@qoder.com>

Remove pointer-events:none from .inline-document-frame so users can scroll inside the 240px iframe preview to inspect document content. Change-Id: I6288215632c55aeb2b61315d9d219dbd22c55e30 Co-developed-by: Qoder CLI <noreply@qoder.com>

Address CodeQL "Incomplete URL substring sanitization" finding by using reserved example.test domains instead of fonts.googleapis.com in test fixtures. Change-Id: I38596faa833c770757bcf91131d99a72e8868d21 Co-developed-by: Qoder CLI <noreply@qoder.com>

heimanba added 2 commits July 21, 2026 14:55

github-advanced-securityBot found potential problems Jul 21, 2026
View reviewed changes