feat(markdown): shared Markdown renderer

[camielvs]

Why

AiChat had built a full markdown renderer for itself. The notices feature later in this stack needs to render markdown too — and from a source outside the app, so it needs stricter handling. Rather than keep a second copy, this lifts AiChat's renderer into a shared component.

What you get

Two entry points:

• Markdown — for text the app authored. The same styling AiChat had, now in one place.
• UntrustedMarkdown — for text the app did not author. Raw HTML never renders, links are narrowed to absolute http(s) URLs (so nothing can point into our own routes or run javascript:), and images degrade to their alt text instead of fetching a remote file.

AiChat keeps only its own overrides: entity and component chips, and syntax-highlighted fenced code blocks.

Links render through the Link primitive rather than a raw anchor, so an internal href stays in the same tab and only absolute http(s) gets target="_blank" and the external icon. That needed one fix in the primitive: it wrapped its children in a div, which is invalid inside a <p> and which React flagged on every render — AiChat already renders Link inside markdown today. A span fixes it with no visual change.

Reviewer notes

This is the one PR in the stack that changes something you can already see. AiChat's markdown picks up the shared styling, which differs slightly from what it had:

element	before	after
h1	medium	large, slightly tighter top margin
h2	small bold	medium semibold
h3	small semibold	marginally more space below
h4	small semibold	small semibold, dimmed
h5 h6	unstyled	small, dimmed
bullet / number markers	default colour	dimmed
task lists (- [ ])	rendered with a bullet	bullet removed, checkbox spaced
table cells	vertically centred	top-aligned
images	unstyled	rounded, capped at container width

These are the shared component's choices; worth a glance to confirm they're an improvement and not a surprise. An earlier revision of this PR also dropped last:border-b-0 from table rows — that was an accident in the extraction and is restored.

Tests: both entry points, with the untrusted path's escapes (script tags, javascript: links, relative URLs, remote images) asserted directly, plus unit tests for the URL guard.

Where this sits

	PR
1	#2664	shared Markdown renderer (you are here)
2	#2666	validated host contract
3	#2667	notice banners on the dashboard home — announcement parity
4	#2668	notices button in the header
5	#2681	hide a banner without retiring it

This one stands alone: it is useful as a de-duplication whether or not anything above it lands.

[camielvs]

• feat(markdown): shared Markdown renderer #2664 : 2 dependent PRs (#2665 , #2666 ) 👈 (View in Graphite)
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

🎩 Preview

A preview build has been created at: banners-01-markdown/adef9bb

[morgan-wowk]

🤖 Automated review

Approving. This is an exemplary trust boundary. Verified against the code and tests:

• Neither entry point loads rehype-raw, so raw HTML never renders — the "does not render raw HTML" test confirms a <script> body doesn't execute and <b> doesn't render.
• UntrustedMarkdown locks urlTransform to toAbsoluteHttpUrl, so javascript:/data:/relative hrefs collapse to "" and render as plain text (not a dead anchor); img is forced to alt-text-only and can't be re-enabled by a caller (tested).
• URL.ts's toAbsoluteHttpUrl rejects non-string host input, non-http(s) protocols, and protocol-relative/relative/anchor URLs — all directly unit-tested.
• The link.tsx div→span fix is correct (a div is invalid inside <p>), and the new dir is added to the react-compiler allowlist alongside its peers.

Clean.

[Mbeaulne]

Reviewed the shared renderer and its trusted/untrusted URL handling. No additional findings.