diff --git a/.gitignore b/.gitignore index dd3e8e8..1d90c34 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,13 @@ records/** # Documentation CLAUDE.md + +# Environment variables +.env + +# Logs +*.log +npm-debug.log* +yarn-debug.log* +yarn-error.log* +dev-debug.log diff --git a/package.json b/package.json index c9d14c8..7cc57e2 100644 --- a/package.json +++ b/package.json @@ -133,7 +133,8 @@ "fuse.js": "^7.1.0", "lexical": "^0.38.2", "lexical-vue": "^0.14.1", - "marked": "^17.0.1", + "markstream-vue": "^0.0.4", + "mermaid": "^11.6.0", "motion-v": "^1.7.4", "path-browserify-esm": "^1.0.6", "pinia": "^3.0.4", diff --git a/src/services/webViewService.ts b/src/services/webViewService.ts index c19dc93..4c34eba 100644 --- a/src/services/webViewService.ts +++ b/src/services/webViewService.ts @@ -259,12 +259,15 @@ export class WebViewService implements IWebViewService { vscode.Uri.joinPath(extensionUri, 'dist', 'media', 'style.css') ); + // CSP: 'unsafe-eval' and 'blob:' required for mermaid diagram rendering + // Mermaid v10+ uses dynamic ESM imports and eval for diagram parsing + // See: https://github.com/mermaid-js/mermaid/issues/5453 const csp = [ `default-src 'none';`, `img-src ${webview.cspSource} https: data:;`, `style-src ${webview.cspSource} 'unsafe-inline' https://*.vscode-cdn.net;`, `font-src ${webview.cspSource} data:;`, - `script-src ${webview.cspSource} 'nonce-${nonce}';`, + `script-src ${webview.cspSource} 'nonce-${nonce}' 'unsafe-eval' blob:;`, `connect-src ${webview.cspSource} https:;`, `worker-src ${webview.cspSource} blob:;`, ].join(' '); @@ -309,13 +312,14 @@ export class WebViewService implements IWebViewService { wsUrl = 'ws://localhost:5173'; } - // Vite 开发场景的 CSP:允许连接 devServer 与 HMR 的 ws + // Dev CSP: allows devServer + HMR websocket + // 'unsafe-eval' and 'blob:' required for mermaid (see production CSP comment) const csp = [ `default-src 'none';`, `img-src ${webview.cspSource} https: data:;`, `style-src ${webview.cspSource} 'unsafe-inline' ${origin} https://*.vscode-cdn.net;`, `font-src ${webview.cspSource} data: ${origin};`, - `script-src ${webview.cspSource} 'nonce-${nonce}' 'unsafe-eval' ${origin};`, + `script-src ${webview.cspSource} 'nonce-${nonce}' 'unsafe-eval' ${origin} blob:;`, `connect-src ${webview.cspSource} ${origin} ${wsUrl} https:;`, `worker-src ${webview.cspSource} blob:;`, ].join(' '); diff --git a/src/webview/src/components/Messages/AssistantMessage.vue b/src/webview/src/components/Messages/AssistantMessage.vue index a8c7166..e99fd41 100644 --- a/src/webview/src/components/Messages/AssistantMessage.vue +++ b/src/webview/src/components/Messages/AssistantMessage.vue @@ -1,5 +1,11 @@