Draft: add safe class-based syntax highlighting

[maphew]

Checkpoint summary

[maphew]

Blocker research update: syntect's parsing feature itself forces dump-create and dump-load, so feature selection cannot remove bincode while retaining the default syntax set. syntect 5.3.0 and current master still use bincode 1.3.3. Upstream PR trishume/syntect#694 replaces it with serde-wincode; that PR is open, non-draft, mergeable, and all five upstream checks are green, but it is not merged/released. The conservative path is to wait for an upstream release; using the unmerged fork/revision or an audit exemption requires explicit owner approval.

codex-gpt-5.2-high on behalf of Matt Wilkie

[maphew]

Pushed baf5d12 addressing the review punch list:

1. Infinite-loop DoS (high). The render/sanitize retry loops in safe_markdown_body and convert_with_diagnostics treated every placeholder mismatch as a collision and retried forever. RenderedMarkdown::finish now distinguishes destroyed placeholders (count 0 — e.g. swallowed as rawtext when a user-authored unclosed <style>/<script> precedes a highlighted fence; no discriminator can ever survive that) from collisions (count >1). Both call sites now share a single spliced_markdown_body loop: destroyed fences are re-rendered as plain escaped code blocks via a strictly growing plain_fences set, and collision retries are capped at MAX_PLACEHOLDER_RETRIES = 16 before highlighting is disabled entirely — so termination is guaranteed. Regression tests cover unclosed <style> and <script> before a fence, plus a mixed case asserting only the affected fence is downgraded.

2. Theme CSS scoping (medium). scope_theme_css only prefixed the first selector of syntect's comma-joined selector lists, leaving every subsequent selector unscoped (dark colors leaking into light mode). Each comma-separated selector is now individually prefixed with the theme scope, and generated_theme_css_is_scoped_to_both_manual_palettes now asserts every .mdo-syntect- selector in every rule carries a scope.

3. Size cap (medium). Fenced blocks larger than MAX_HIGHLIGHT_BYTES (200 KB) skip syntect — whose fancy-regex grammars have superlinear worst cases — and render as plain escaped code. Covered by a new unit test.

4. Audit exemption. CI fails on RUSTSEC-2025-0141: bincode 1.3.3 is unmaintained and pulled in transitively via syntect's dump-load feature; syntect offers no feature-flag remedy today. Added .cargo/audit.toml ignoring exactly that advisory with a comment noting it should be removed once syntect drops bincode. Note: cargo-audit reads its config from .cargo/audit.toml, not a repo-root audit.toml, hence the location. Verified locally with cargo-audit 0.22.2: cargo audit --deny warnings fails without the config and passes with it.

5. Language aliases (low). Added an alias map consulted before find_syntax_by_token: sh/shell/zsh→bash, yml→yaml, csharp/cs→C#, c++→cpp, jsonc→json. The bundled syntax set contains no TypeScript grammar, so ts/tsx/typescript map to JavaScript instead (per-alias resolution is asserted by a test; unknown languages still fall back to plain).

6. Documented at the add_generic_attributes(["class", "id"]) site that the global class allowance is intentional and that highlight safety comes from post-sanitize splicing, not the allowlist.

Also gated the Duration/Instant imports in tests/cli.rs behind cfg(unix) — they are only used by unix-gated helpers, so cargo clippy --all-targets -- -D warnings previously failed on Windows hosts.

Quality gates: cargo fmt, cargo clippy --all-targets -- -D warnings, and cargo test (76 tests) all green locally; cargo audit --deny warnings passes with the exemption. PR left in draft.

claude-code-fable-5 on behalf of maphew

[maphew]

PR sweep update: pushed repaired, current-main candidate through ab1b5c1 and kept the PR in draft.

Addressed code blockers:

1. Integrated Add GFM alerts and front-matter support #37 and current main, preserving conservative front-matter stripping, visible mid-document --- content, and no-JavaScript alert palettes.
2. Moved generated highlight splicing before the single ammonia sanitizer pass. This closes the combined entity-normalized spoof plus destroyed-real-placeholder case because no attacker-positioned string insertion occurs after sanitization. Added the combined regression and retained bounded collision/plain-fence termination behavior.
3. Added no-JavaScript syntax-color defaults: light base palette, OS-dark media palette, then higher-specificity manual theme overrides. Added selector-scoping and palette tests.
4. Removed the unverified claim that a Beads follow-up already exists.

Independent review found no remaining functional or security blocker. Local validation passed: formatting, clippy with warnings denied, 90 Rust tests, cargo audit --deny warnings, git diff --check, plus the newly merged orb-skill tests and setup shell syntax.

Human decision required before ready/merge: accept or reject the narrow RUSTSEC-2025-0141 audit exemption for bincode 1.x. RustSec classifies it as unmaintained rather than a known vulnerability; it is transitive through syntect's trusted bundled dumps, no feature-flag remedy exists, and syntect's maintained replacement remains unreleased. If accepted, create/link durable follow-up work to remove the exemption when syntect drops bincode. If not accepted, this PR should wait for upstream or use an explicitly approved maintained fork.

codex-gpt-5.6-sol-medium on behalf of maphew