feat(chrome): render agent replies as safe Markdown

AGENTS.md

@@ -154,6 +154,8 @@ No need to explicitly document the telemetry behaviors.
 - For text annotations, `prompt.selector` is the common ancestor/container selector, not the complete identity. Use the `target` range boundaries and snapshot context to locate the exact selected text.
 - For non-whiteboard Mermaid diagram nodes, a click annotates the whole rendered `<g>` node - not the sub-shape under the cursor - and hover highlights the same node. `SessionStore.normalizeTarget` routes these targets through `normalizeMermaidNodeTarget`, which strips them to the fixed `type`/`diagramId`/`nodeId`/`label`/`selector` shape, while text-range and other/legacy targets pass through unchanged.
 - `SessionStore` re-reads and re-writes the entire `state.json` on every operation. There's no in-memory cache and no locking - acceptable because writes are infrequent and serialized through the single server process.
+- Agent chat bubbles render Markdown at display time only (`src/chat-markdown.js` via `addChat` for `role === "agent"`). Storage and SSE stay raw text; never assign sanitizer HTML strings with `innerHTML` on the agent path — attach a `DocumentFragment` or fall back to `textContent`. User bubbles stay plain text. Policy (allowlist, http(s)-only links, heading tag strip) lives only in `chat-markdown.js`.
+- `src/chrome-client.js` is bundled by esbuild to `dist/chrome-client.js` (IIFE with marked + DOMPurify). Serve that built file with `Cache-Control: no-cache` via `defaultChromeClientPath` — never raw ESM source once it has npm imports. The chrome scenario harness builds the same IIFE in memory with `write: false`; the production-bundle smoke tests read `dist/chrome-client.js` and require `pnpm run build` / `prepare`.
 - The chrome and the sandboxed artifact document cannot see each other's keyboard events (no `allow-same-origin`), so any keyboard shortcut that must work regardless of focus needs its own capture-phase `document.addEventListener("keydown", ..., true)` in _both_ `src/chrome-client.js` and `src/artifact-sdk.js`, not just one.
   The annotate/explore mode toggle hotkey (`MODE_TOGGLE_HOTKEY_KEY`, Cmd/Ctrl+I) is the reference implementation: the chrome owns the mode state and toggles it directly; the SDK side has no mode state of its own, so on catching the hotkey it `postMessage`s `{ type: "lavish:toggleAnnotationMode" }` to the chrome, which drives the exact same `toggleAnnotationMode()` function the on-screen switch's `onclick` calls.
   Requiring a modifier (`metaKey || ctrlKey`) is what lets the listener safely call `preventDefault()` without breaking plain typing (including typing the bound letter itself) in the chat box or an annotation-card textarea.

README.md

@@ -156,6 +156,7 @@ pnpm link
   For reversible choices, let option clicks update local state, then queue exactly one final answer from a per-question submit or Queue answer button with `window.lavish.queuePrompt()`.
   Mark only custom (non-native) clickable elements with `data-lavish-action` so Lavish does not annotate them, and use `data-lavish-question` or `queueKey` when pre-send updates for the same question should replace each other.
   Queued annotation preview pills and chat history share a scrollable Conversation panel above a sticky composer, so long feedback queues do not push the text box or send controls off screen.
+  Agent replies sent with `--agent-reply` render safe Markdown for emphasis, code, paragraphs and breaks, lists, fenced code blocks, and absolute `http(s)` links; headings keep their text without heading styling, while user messages remain plain text.
   The browser chrome keeps editing actions in the overflow menu (copy path, reload artifact, copy DOM snapshot, export standalone HTML, publish link, end session), while the composer exposes **Send & End** beside **Send to Agent** to submit queued prompts and user-ended attribution together.
 - **Keyboard shortcuts** - In the chrome composer, Enter sends queued prompts and Shift+Enter inserts a newline.
   In the annotation card, Enter queues the annotation, Shift+Enter inserts a newline, and Ctrl+Enter (Cmd+Enter on macOS) queues it and sends all queued prompts immediately.

THIRD-PARTY-NOTICES.md

@@ -2,7 +2,53 @@
 
 The published `lavish-axi` package vendors the following third-party software into `dist/`.
 Each component remains under its own license; the notices below satisfy their attribution requirements.
-The whiteboard bundle (`dist/whiteboard/`) is built from these packages by `scripts/build.js`.
+The whiteboard bundle (`dist/whiteboard/`) and chrome client (`dist/chrome-client.js`) are built from these packages by `scripts/build.js`.
+
+## Bundled into `dist/chrome-client.js`
+
+| Package     | License               | Copyright                                       |
+| ----------- | --------------------- | ----------------------------------------------- |
+| `marked`    | MIT                   | MarkedJS contributors; Christopher Jeffrey      |
+| `dompurify` | Apache-2.0 or MPL-2.0 | Copyright 2025 Dr.-Ing. Mario Heiderich, Cure53 |
+
+`dompurify` is dual-licensed under Apache-2.0 or MPL-2.0; see the package for full license text.
+
+### Marked license notices
+
+```
+Copyright (c) 2018+, MarkedJS (https://github.com/markedjs/)
+Copyright (c) 2011-2018, Christopher Jeffrey (https://github.com/chjj/)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+Copyright © 2004, John Gruber
+http://daringfireball.net/
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* Neither the name “Markdown” nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+This software is provided by the copyright holders and contributors “as is” and any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall the copyright owner or contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.
+```
 
 ## Bundled into `dist/whiteboard/whiteboard.js` and `whiteboard.css`
 

package.json

@@ -33,7 +33,9 @@
     "axi-sdk-js": "^0.1.8",
     "chokidar": "^4.0.3",
     "daisyui": "^5.5.19",
+    "dompurify": "^3.4.12",
     "express": "^5.2.1",
+    "marked": "^18.0.6",
     "open": "^10.2.0",
     "parse5": "^8.0.1"
   },
@@ -46,6 +48,7 @@
     "eslint": "^10.3.0",
     "eslint-config-prettier": "^10.1.8",
     "globals": "^17.6.0",
+    "jsdom": "26.1.0",
     "mermaid": "11.12.1",
     "prettier": "^3.8.3",
     "react": "18.3.1",