Chat messages render markdown via marked (code blocks, lists, tables,
links) with a DOMParser-based sanitizer that strips script/style/iframe/
event-handlers and javascript:/data: URLs; links open in a new tab. The
agent owns its own links (netdisk, showcase, anywhere) as the user asked.
Verified: formatted agent reply renders, injected <script> stays inert.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- src/Chat.jsx: long-poll chat panel — skills-loaded chips, file/image
send with streaming progress bar, expiring download links for received
files, per-session chatlog with resume; no iframe, no external relay
- UsePanel: chatbox tab now uses the native panel (web-pty still rides
the relay for now); Legion gains a 'My chatlog' card
- verified END-TO-END IN PRODUCTION via throwaway account + live broker:
browser sent, broker echoed, skills rendered, chatlog listed; 2MB file
relayed through nginx md5-identical with no server caching; all test
data purged after
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
