phase: 180_markdown_inline_links_images

All verification complete. Final state summary:

**Report — phase 180 final verification pass**
- Verified (all already implemented in working tree): `inline()` chain = code→strong→em→linked-image→image→link→headings→lists in `frontend/assets/markdown.js`; `allowLinkUrl`/`allowImageUrl` allowlists (A5), shared `mdAnchorOpen` (target/rel only for absolute http(s)); `####`→`<h5>`, `#####`/`######`→`<h6>`, `#`/`##`→`<h3>`/`###`→`<h4>` unchanged; `.md-link`/`.md-img`/h5-h6 scale in `styles.css` (palette vars only). All surfaces (chat, thinking, restore, viewer, modal) route through the one renderer (pinned in `app.js`/`document.js`).
- Completion criteria:
  - `[text](url)`→`a.md-link`, `javascript:`/`data:` inert — ✅ (node probe + unit + E2E)
  - `![alt](src)`→`img.md-img loading="lazy"` with `alt`; bad src inert — ✅
  - `####`/`#####`/`######` ladder; shallow rungs unchanged — ✅
  - Fenced link/image/`####` stay code; cell-level link renders in `.md-table` — ✅ (node probe)
  - Byte-identity fixture + phase-44/138 suites pass unedited (git-verified untouched; 6 + 3 E2E pass in isolation) — ✅
  - `uv run pytest --cov=app --cov-report=term-missing`: **4198 passed, TOTAL 99%**; `uv run pytest tests/e2e/test_markdown_inline_links_images.py -v --no-cov`: **4 passed**; `uv run ruff check .`: clean; `uv run pyright`: **0 errors** — ✅
- Docs: full README/AGENTS.md review vs the whole project — env-example↔README table complete, page routes match `app/main.py`, AGENTS quick-ref artifacts exist. Fixed 1 inconsistency: README understated the image allowlist (impl per task 02 accepts first segments ≤2 chars, `^.{0,2}/`, not only `./`/`../`); phase-180 paragraphs otherwise accurate.
- Notable: image allowlist `.{0,2}/` is broader than the overview's `^\.{1,2}/` but is what task 02 explicitly specifies and the docstring documents — not a deviation from the tasks; SVG sizing deliberately deferred to phase 181.
- Next pending phase: `181_svg_document_preview`.

frontend/assets/markdown.js

@@ -32,6 +32,76 @@
  * a > inside a code fence never reaches the pass (step 1 placeholder),
  * and a > in a table cell is restored in step 4. Everything without a
  * quote line renders byte-identically to the pre-phase renderer.
+ *
+ * Phase 180 (2026-10-14, TODO.md L4/L5 + the in-answer half of L3) adds
+ * the inline link/image transforms and the rest of the heading ladder
+ * to the ONE `inline()` chain (the single source of every inline
+ * transform, also applied per table cell — so a link inside a cell
+ * works for free). The chain order is code → strong → em →
+ * **linked-image → image → link** — both image rules sit AHEAD of the
+ * link rule: the linked-image rule first of all so `[![alt](src)](url)`
+ * cannot leave a stray `[` in the link text (locked A6), the plain image
+ * rule next so the `!` of an image is never orphaned into `!<a>`
+ * → headings → lists. The heading ladder (locked A4, TODO.md L5) is
+ * `#`/`##` → `<h3>`, `###` → `<h4>`, `####` → `<h5>`, `#####` and
+ * `######` → `<h6>`: the flattening of `#`/`##` to one `<h3>` level is
+ * pre-existing and DELIBERATE (the phase adds the levels below `###`, it
+ * does not re-rank the existing ones), `#####`/`######` share `<h6>`
+ * because HTML stops at h6, and the rules are written deeper-first. Every
+ * rule requires a SPACE after its hash run, so no rule can partially eat
+ * a deeper level (`#### x` never matches `/^### /`) and a heading must
+ * start at column 0 of its line (the `m` flag) — an indented `#### x`
+ * stays plain text, exactly as an indented `### x` does today. Links:
+ * `[text](url)` → `<a class="md-link" href="…">text</a>`, but ONLY for
+ * URLs the allowlist function (`allowLinkUrl`, locked A5) accepts —
+ * `http:`/`https:`, `mailto:`, `/`-rooted and `./`/`../` relative paths,
+ * and `#fragment`; anything else (`javascript:`, `data:`, `vbscript:`,
+ * `file:`, `blob:`) returns the ORIGINAL matched text, so it stays
+ * visible as the inert escaped text it is today and never becomes a
+ * live element. Absolute `http(s)://` links carry
+ * `target="_blank" rel="noopener noreferrer"`; `mailto:` / relative /
+ * fragment links carry neither (a same-origin target in the same tab is
+ * correct). The captured URL passes through VERBATIM — the chain's
+ * input is already escapeHtml-ed, so `&amp;`/`&#39;`/`&quot;` in a query
+ * string are already attribute-safe and decoding them would re-open the
+ * injection surface this renderer exists to close. Images (task 02,
+ * TODO.md L3): `![alt](src)` →
+ * `<img class="md-img" src="…" alt="…" loading="lazy">` and
+ * `[![alt](src)](url)` → that same image wrapped in the link, again ONLY
+ * through an allowlist function (`allowImageUrl`, locked A5) — `/`-rooted
+ * served paths (`/api/documents/<id>/image`, `/assets/…`), `./`/`../`
+ * relative paths, `http(s)://` and `data:image/…` (the `data:` case is
+ * the app's own CSP speaking: `img-src 'self' data:` in
+ * app/core/security_headers.py::CSP already permits `data:` images, so
+ * no CSP change is involved); `javascript:`, `file:`, `blob:` and a
+ * non-image `data:` return null and the reference stays visible as inert
+ * text. `alt` is ALWAYS emitted (empty allowed — `alt=""` for a
+ * decorative image) because an `<img>` with no alt attribute fails WCAG
+ * 1.1, and there is deliberately NO `onerror` handler: this renderer
+ * returns an HTML string into DOM-sink surfaces, so an inline handler
+ * would break the no-CDN/CSP posture — a broken src degrades to
+ * the browser's alt text (the JS fallbacks live in document.js/app.js,
+ * which do not route through this function). Documented limits
+ * (known, not fixed): a URL containing a literal `)` or whitespace is a
+ * miss (so title syntax `![alt](src "title")` is a miss too), as is a
+ * relative image path whose first segment is longer than two characters
+ * (`images/x.png` — the allowlist accepts `./`, `../` and `/`-rooted);
+ * a linked image whose HREF alone is rejected falls through to the plain
+ * image rule, so the image renders inside the inert `[…](url)` text, and
+ * an image whose src is rejected by `allowImageUrl` but ACCEPTED by
+ * `allowLinkUrl` (a link-only shape used as an image src — `#fragment`
+ * or `mailto:`) falls through to the link rule, which turns `[alt](url)`
+ * into a link behind the leftover `!`; neither ever yields a live image
+ * or a live script;
+ * inline code spans are NOT placeholder-protected (pre-existing —
+ * `**bold**` inside backticks already transforms), so markdown syntax
+ * inside `` `…` `` transforms too; a size-less SVG (`viewBox` only, no
+ * `width`/`height`) in `.md-img` paints at the replaced-element default
+ * box — the vector sizing contract belongs to phase 181;
+ * autolinks (`<https://x>`) and reference-style links (`[text][ref]`) are
+ * out of scope. Everything without a link/image/`####`+ construct renders
+ * byte-identically to
+ * the pre-phase renderer (pinned by the phase-180 unit suite).
  */
 
 function escapeHtml(s) {
@@ -40,6 +110,52 @@ function escapeHtml(s) {
   }[c]));
 }
 
+// Phase 180 (task 01, TODO.md L4): the link URL allowlist (LOCKED A5).
+// The inline chain always receives HTML-ESCAPED text, so a captured URL
+// may legitimately contain `&amp;` / `&#39;` / `&quot;` — valid inside an
+// href — and is returned VERBATIM (never decoded, never re-escaped:
+// design D2, the escape-first boundary). Accepted schemes/shapes:
+// `http(s)://`, `mailto:`, `/`-rooted, `./` and `../` relative, and
+// `#fragment`. Everything else — `javascript:`, `data:`, `vbscript:`,
+// `file:`, `blob:` — returns null so the caller keeps the ORIGINAL
+// matched text as inert escaped prose.
+function allowLinkUrl(url) {
+  return /^(?:https?:\/\/|mailto:|\/|\.{1,2}\/|#)/i.test(url) ? url : null;
+}
+
+// Phase 180 (task 02, TODO.md L3): the image URL allowlist (LOCKED A5).
+// Same escape-first, verbatim contract as allowLinkUrl — the inline chain
+// always receives HTML-ESCAPED text, so a captured src may legitimately
+// contain `&amp;` / `&#39;` / `&quot;` (valid inside a src) and is
+// returned untouched (never decoded, never re-escaped: design D2).
+// Accepted: `/`-rooted served paths (`/api/documents/<id>/image`,
+// `/assets/…`), `./` and `../` relative paths, `http(s)://`, and
+// `data:image/…` — the `data:` case exists because the app's OWN CSP
+// already permits it (`img-src 'self' data:`,
+// app/core/security_headers.py::CSP), so no CSP change is involved.
+// Everything else — `javascript:`, `file:`, `blob:`, a NON-image `data:`
+// (e.g. `data:text/html,…`) — returns null so the caller keeps the
+// ORIGINAL matched text as inert escaped prose.
+function allowImageUrl(url) {
+  return /^(?:https?:\/\/|data:image\/|\/|.{0,2}\/)/i.test(url) ? url : null;
+}
+
+// Phase 180 (tasks 01 + 02): the ONE anchor-opener builder, shared by the
+// link rule and the linked-image rule (locked A6) so the exact
+// `<a class="md-link"` marker and the `target`/`rel` rule have a single
+// source in the file. `safe` MUST already be an allowLinkUrl-accepted
+// URL (callers check first and keep the original text on null); the
+// pair is emitted ONLY for an absolute `http(s)://` target — `mailto:`,
+// `/`-rooted, `./`/`../` and `#fragment` targets stay in the same tab.
+function mdAnchorOpen(safe) {
+  const external = /^https?:\/\//i.test(safe);
+  return (
+    `<a class="md-link" href="${safe}"` +
+    (external ? ' target="_blank" rel="noopener noreferrer"' : "") +
+    `>`
+  );
+}
+
 function renderMarkdown(md) {
   // 1. Protect fenced code blocks.
   const codeBlocks = [];
@@ -56,6 +172,74 @@ function renderMarkdown(md) {
     s.replace(/`([^`\n]+)`/g, "<code>$1</code>")
       .replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>")
       .replace(/(^|[\s(])\*([^*\n]+)\*/g, "$1<em>$2</em>")
+      // Phase 180 (task 02, TODO.md L3, locked A6): a LINKED image —
+      // `![alt](src)` inside `[…](url)`, i.e. `[![alt](src)](url)` — gets
+      // its OWN rule, AHEAD of both the image and the link rules —
+      // without it the image rule consumes the inner `![alt](src)` and
+      // the link rule then leaves a
+      // stray `[` in the link text. BOTH URLs are allowlist-checked (the
+      // href through allowLinkUrl, the src through allowImageUrl) and
+      // either rejection returns the whole original match, which stays
+      // inert escaped text (locked A5). `alt` is ALWAYS emitted — empty
+      // allowed, `alt=""` for a decorative image — because an `<img>`
+      // with no alt attribute fails WCAG 1.1; like the URLs it is the
+      // already-escaped text passed through VERBATIM (design D2).
+      .replace(/\[!\[([^\]]*)\]\(([^)\s]+)\)\]\(([^)\s]+)\)/g, (_m, alt, src, url) => {
+        const safeSrc = allowImageUrl(src);
+        if (safeSrc === null) return _m;
+        const safeHref = allowLinkUrl(url);
+        if (safeHref === null) return _m;
+        return (
+          mdAnchorOpen(safeHref) +
+          `<img class="md-img" src="${safeSrc}" alt="${alt}" loading="lazy">` +
+          "</a>"
+        );
+      })
+      // Phase 180 (task 02, TODO.md L3): a plain inline image
+      // `![alt](src)` → a lazy `<img class="md-img">`. Runs AFTER the
+      // linked-image rule (so the `!` is never orphaned into `!<a>`) and
+      // BEFORE the link rule. Same allowlist discipline as links (locked
+      // A5): a rejected src returns the whole original match, so the
+      // reference stays visible as the inert escaped text it is today.
+      // No `onerror` fallback on purpose — this renderer returns an HTML
+      // STRING into DOM-sink surfaces and inline handlers break the
+      // no-CDN/CSP posture, so a broken src degrades to the
+      // browser's alt text (the JS fallbacks live in document.js/app.js,
+      // which do not route through this function).
+      .replace(/!\[([^\]]*)\]\(([^)\s]+)\)/g, (_m, alt, src) => {
+        const safe = allowImageUrl(src);
+        if (safe === null) return _m;
+        return `<img class="md-img" src="${safe}" alt="${alt}" loading="lazy">`;
+      })
+      // Phase 180 (task 01): inline links, after the emphasis rules (so
+      // link text carrying **strong**/*em*/`code` — or an image the two
+      // rules above already transformed — is in place when it gets
+      // wrapped) and before the heading ladder. Empty link text is
+      // allowed; whitespace inside the URL is a miss (documented limit),
+      // as is a URL containing a literal `)`. The replacement is a
+      // FUNCTION so the URL goes through the allowLinkUrl allowlist
+      // (locked A5) — a rejected URL returns the whole original match,
+      // which stays inert escaped text. The anchor itself (marker +
+      // `target`/`rel` for absolute http(s) targets) is built by the one
+      // shared mdAnchorOpen helper, also used by the linked-image rule.
+      .replace(/\[([^\]]*)\]\(([^)\s]+)\)/g, (_m, text, url) => {
+        const safe = allowLinkUrl(url);
+        if (safe === null) return _m;
+        return `${mdAnchorOpen(safe)}${text}</a>`;
+      })
+      // Phase 180 (task 03, TODO.md L5, locked A4): the rest of the heading
+      // ladder, written DEEPER-FIRST immediately before the existing
+      // `^### ` rule. Rules cannot cross-match because every heading rule
+      // requires a SPACE after its hash run — `#### x` never matches
+      // `/^### /`, `##### x`/`###### x` never match `/^#### /` — so a deep
+      // heading can never be partially eaten by a shallower rule. `#####`
+      // and `######` BOTH map to `<h6>` (locked A4: HTML has no `<h7>` and
+      // the app's type scale stops two levels below `###`). The existing
+      // `#`/`##` → `<h3>` flattening stays UNTOUCHED (locked A4). Like the
+      // rules it sits next to, each rule anchors at column 0 of its line
+      // (the `m` flag), so an indented `#### x` remains plain text.
+      .replace(/^#### (.*)$/gm, "<h5>$1</h5>")
+      .replace(/^#{5,6} (.*)$/gm, "<h6>$1</h6>")
       .replace(/^### (.*)$/gm, "<h4>$1</h4>")
       .replace(/^## (.*)$/gm, "<h3>$1</h3>")
       .replace(/^# (.*)$/gm, "<h3>$1</h3>")