[conwnet]

Summary

Renders ```mermaid code blocks in GitHub1s AI chat responses as diagrams.

• Mermaid blocks open as source. Diagram renders the diagram, Source switches back, and zoom in, zoom out, and reset controls appear while the diagram is shown.
• Mermaid 12.2.0 loads lazily on the first diagram render, so chats without diagrams never download it.
• Diagrams follow the VS Code theme (dark for Dark and High Contrast Dark, default for Light and High Contrast Light) and re-render when the theme changes.
• Rendering uses securityLevel: 'strict'. Invalid or incomplete diagrams keep the source visible and show the parse error in the button tooltip.
• The diagram view, zoom, and scroll position persist while the rest of the response streams. If an open diagram's own source is still streaming, rendering waits until it settles.

Implementation notes

• chat-view.ts: style-src now allows 'unsafe-inline' because Mermaid injects styles without nonces. script-src stays nonce-only.
• webview/index.ts: sets __webpack_nonce__ so the lazily loaded Mermaid chunk passes the script CSP.
• helpers/markdown.ts: chat sanitization uses a private DOMPurify instance, so Mermaid's global DOMPurify hooks cannot change chat output. Links keep target="_blank" and rel="noopener noreferrer".

Review

Reviewed in two rounds (first, second). Every finding was reproduced in headless Chromium against the webview CSP, and all fixes landed in this PR, the last in d896149. Typecheck, the 27 extension tests, and the webview build pass.

Landing in production

Merging to master only updates a Cloudflare Pages preview. github1s.com deploys from the protected release branch.

Environment	Commit	Mermaid
github1s.com (production)	5ad1b60 (v0.35.3)	No
master preview	082d589 (this PR)	Yes

release is 3 commits behind master: #778 (KaTeX), #779 (KaTeX bump), and this PR.

Next steps:

1. Wait for Build & Test and Build & Test with VS Code build on 082d589 to pass. They were still running when this was written.
2. Smoke test on the master preview with any configured model:
   • Ask for a flowchart and a sequence diagram. Check the toggle, zoom, and scrolling.
   • Ask for an invalid diagram. The source should stay visible with the error in the tooltip.
   • Switch between Light, Dark, and High Contrast Light themes with a diagram open.
   • Check that links in responses still open in a new tab and that KaTeX math from feat(ai): markdown supports for katex #778 renders.
3. A maintainer opens a master → release PR titled release 0.35.4 (same patch cadence as release 0.35.3 #777) and merges it. Cloudflare Pages then deploys it to github1s.com.
4. Tag v0.35.4 on release and publish a GitHub release listing feat(ai): markdown supports for katex #778 and feat(ai): add mermaid support to markdown #780.
5. Confirm github1s.com loads /static-<release merge sha>/bootstrap.js, then repeat the smoke test there.

Rollback: roll production back to the previous deployment in Cloudflare Pages, or revert the merge on release.

[Siddhant-K-code]

Checked this end to end with a headless Chromium harness that renders the real Markdown component under the same CSP as chat-view.ts. Lazy chunk loading and the script nonce work, with no CSP violations.

Inline comments cover four bugs I reproduced (HC Light theme, state reset while streaming, silent render failures, shared DOMPurify hooks) plus two nits.

[cloudflare-workers-and-pages]

Deploying github1s with    Cloudflare Pages

Latest commit:	d896149
Status:	✅  Deploy successful!
Preview URL:	https://52757411.github1s-dld.pages.dev
Branch Preview URL:	https://dev.github1s-dld.pages.dev

View logs

[conwnet]

@Siddhant-K-code Thank you for your review, I have made the fixes

[Siddhant-K-code]

Re-reviewed at fd32042. All six earlier comments are addressed. I re-ran the original repros in headless Chromium:

• HC Light now gets the light theme, HC Dark still gets dark.
• The diagram, zoom, and scroll position survive text streaming after the block.
• Failures are logged and the reason shows in the tooltip.
• Links keep noopener noreferrer after a diagram renders.

Typecheck and all 27 tests pass. A themeCSS init directive stays scoped to the SVG and does not leak into the chat UI.

Two remaining UX issues inline, both with suggestions I applied and verified locally.

[Siddhant-K-code]

Approving. I pushed d896149 with the two fixes from my last review: the toggle label now matches the visible view, and an open diagram no longer re-renders on every streamed token. Typecheck, all 27 tests, and the webview build pass.

[Siddhant-K-code]

@conwnet - can you trigger a new release?

[conwnet]

@conwnet - can you trigger a new release?

Of course, I will do this in the next few hours