The login entry no longer ships KaTeX. Chat bubbles and document text render formulas after a dynamic import, and rich-text copy does the same.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Escape KaTeX fallback HTML and salt math/code placeholders per render
- Roll back optimistic unread marks when POST /chat/read fails
- Reset MessageStream scroll baseline when the session changes
- Preview only the first 1000 Excel rows and say so in the sheet header
Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent self-XSS when chat bubbles render user/LLM markdown via
dangerouslySetInnerHTML by escaping raw HTML after math/code
extraction and sanitizing link href schemes.
Co-authored-by: Cursor <cursoragent@cursor.com>
