44b340dc1a
- Add reversible write tools to the per-user agent toolset (page create/update/ move/soft-delete; comment reply + resolve), exposed under the user's JWT and enforced by Docmost CASL; no permanent/force delete (D3). - Non-spoofable agent provenance: sign actor/aiChatId into the access and collab tokens (TokenService), propagate via jwt.strategy onto the request, and set pages.last_updated_source/last_updated_ai_chat_id on REST create/update/move and comments.created_source/resolved_source/ai_chat_id. - packages/mcp: add an optional getCollabToken provider (content-edit provenance) and guard against empty tokens; service-account /mcp path unchanged. Frontend: - Admin 'AI / Models' settings section: provider/model/embedding/base URL, a write-only API key field, system prompt, and Test connection. - AI chat panel (useChat + DefaultChatTransport): conversation list, streamed messages, tool-call action log and page citations; header entry point gated on settings.ai.chat. Compile-verified (server nest build + client tsc/vite); not yet live-tested. Known gaps: history 'AI agent' badge (C3), vector RAG (D), external MCP (E); chat tool-card citation links pending a fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
21 lines
926 B
TypeScript
21 lines
926 B
TypeScript
import { markdownToHtml } from "@docmost/editor-ext";
|
|
import DOMPurify from "dompurify";
|
|
|
|
/**
|
|
* Render AI markdown to sanitized HTML for read-only display. We reuse the
|
|
* app's `markdownToHtml` (the same `marked` pipeline used for paste/import) so
|
|
* chat output matches the editor's markdown flavor, then sanitize with
|
|
* DOMPurify — LLM output is untrusted, so it must never reach the DOM unsanitized.
|
|
*
|
|
* `markdownToHtml` can return `string | Promise<string>` (it has async marked
|
|
* extensions registered). In practice plain chat markdown resolves
|
|
* synchronously, but we guard the Promise case by returning a safe empty string
|
|
* for that branch (the caller renders the raw text fallback instead).
|
|
*/
|
|
export function renderChatMarkdown(markdown: string): string {
|
|
if (!markdown) return "";
|
|
const html = markdownToHtml(markdown);
|
|
if (typeof html !== "string") return "";
|
|
return DOMPurify.sanitize(html);
|
|
}
|