collavre 0.22.0 → 0.24.0

data/app/services/collavre/creatives/tree_builder.rb

@@ -12,85 +12,99 @@ module Creatives
       @max_level = max_level
       @allowed_creative_ids = allowed_creative_ids
       @progress_map = progress_map
-      @permission_cache = {}
+      @permission_rank = {}
     end
 
     def build(collection, level: 1)
       return [] if collection.blank?
 
-      creatives = Array(collection)
-      # Preload permissions for all creatives in this batch to avoid N+1
-      preload_permissions(creatives)
-
-      build_nodes(creatives, level: level)
+      build_nodes(Array(collection), level: level)
     end
 
     private
 
-    attr_reader :user, :view_context, :raw_params, :expanded_state_map, :select_mode, :max_level, :allowed_creative_ids, :progress_map, :permission_cache
+    attr_reader :user, :view_context, :raw_params, :expanded_state_map, :select_mode, :max_level, :allowed_creative_ids, :progress_map
 
-    def preload_permissions(creatives)
-      return unless user
+    def children_index
+      @children_index ||= ChildrenIndex.new(
+        user: user,
+        show_archived: raw_params["show_archived"].present?,
+        allowed_creative_ids: allowed_creative_ids
+      )
+    end
+
+    def comment_badge_index
+      @comment_badge_index ||= CommentBadgeIndex.new(user: user)
+    end
 
-      creative_ids = creatives.map(&:id)
-      return if creative_ids.empty?
+    # Everything a level of nodes needs, resolved in a fixed number of queries
+    # rather than a handful per node. The recursion re-enters here for each level,
+    # so total cost tracks tree *depth*, not node count.
+    def prepare_level(creatives)
+      ActiveRecord::Associations::Preloader.new(
+        records: creatives,
+        associations: [ :origin, { tags: :label } ]
+      ).call
 
-      # Skip if already cached
-      uncached_ids = creative_ids - @permission_cache.keys
-      return if uncached_ids.empty?
+      preload_permissions(creatives)
+      preload_comment_badges(creatives)
 
-      write_rank = CreativeShare.permissions[:write]
+      return if children_suppressed?
 
-      # Batch query for user-specific permissions
-      user_permissions = CreativeSharesCache
-        .where(creative_id: uncached_ids, user_id: user.id)
-        .pluck(:creative_id, :permission)
+      children_index.index(creatives)
+      expanding = creatives.select { |creative| load_children_now?(creative) }
+      children_index.load(expanding) if expanding.any?
+    end
 
-      user_permissions.each do |cid, perm|
-        perm_rank = CreativeSharesCache.permissions[perm]
-        @permission_cache[cid] = perm_rank && perm_rank >= write_rank && perm_rank != CreativeSharesCache.permissions[:no_access]
-      end
+    # Batch effective-origin permission ranks via the single PermissionFilter
+    # read path (owner wins, then the user's own cache entry incl. a no_access
+    # deny, then the public entry). Every pending creative gets an explicit
+    # entry — nil when no share resolves — so #allowed? can trust
+    # @permission_rank.key? and never falls back per-item for absent ids.
+    def preload_permissions(creatives)
+      pending = creatives.reject { |creative| @permission_rank.key?(creative.id) }
+      return if pending.empty?
 
-      # For remaining uncached, check public shares
-      still_uncached = uncached_ids - @permission_cache.keys
-      if still_uncached.any?
-        public_permissions = CreativeSharesCache
-          .where(creative_id: still_uncached, user_id: nil)
-          .pluck(:creative_id, :permission)
-
-        public_permissions.each do |cid, perm|
-          next if @permission_cache.key?(cid)
-          perm_rank = CreativeSharesCache.permissions[perm]
-          @permission_cache[cid] = perm_rank && perm_rank >= write_rank && perm_rank != CreativeSharesCache.permissions[:no_access]
-        end
-      end
+      ranks = PermissionFilter.new(user: user).ranks_for(pending.map(&:id))
+      pending.each { |creative| @permission_rank[creative.id] = ranks[creative.id] }
+    end
 
-      # Mark owned creatives as having write permission
-      owned_ids = creatives.select { |c| c.user_id == user.id }.map(&:id)
-      owned_ids.each { |cid| @permission_cache[cid] = true }
+    # Equivalent to `creative.has_permission?(user, permission)`, served from the
+    # level's batched ranks. Falls back for a creative the batch never saw.
+    def allowed?(creative, permission)
+      return creative.has_permission?(user, permission) unless @permission_rank.key?(creative.id)
 
-      # Default to false for any remaining uncached
-      uncached_ids.each { |cid| @permission_cache[cid] ||= false }
+      rank = @permission_rank[creative.id]
+      return false if rank.nil?
+
+      rank >= CreativeShare.permissions[permission.to_s]
     end
 
-    def cached_can_write?(creative)
+    def can_write?(creative)
       return false unless user
-      # GitHub-synced creatives are always read-only
-      return false if creative.github_markdown?
-
-      if @permission_cache.key?(creative.id)
-        @permission_cache[creative.id]
-      else
-        # Fallback to individual check if not cached
-        creative.has_permission?(user, :write)
-      end
+      # Read-only-source creatives are never writable
+      return false if creative.read_only_source?
+
+      allowed?(creative, :write)
+    end
+
+    def can_feedback?(creative)
+      allowed?(creative, :feedback)
+    end
+
+    # Only rows that will actually render a badge are worth batching.
+    def preload_comment_badges(creatives)
+      visible = creatives.reject(&:archived?).select { |creative| can_feedback?(creative) }
+      return if visible.empty?
+
+      comment_badge_index.index(visible.map(&:effective_origin))
     end
 
     def build_nodes(creatives, level:)
       return [] if level > max_level
+      return [] if creatives.empty?
 
-      # Preload permissions for this batch of creatives
-      preload_permissions(creatives) if creatives.any?
+      prepare_level(creatives)
 
       creatives.flat_map do |creative|
         build_nodes_for_creative(creative, level: level)
@@ -102,16 +116,18 @@ module Creatives
         creative.filtered_progress = progress_map[creative.id.to_s]
       end
 
-      filtered_children = filtered_children_for(creative)
       expanded = expanded?(creative.id)
       skip = skip_creative?(creative)
       child_level = level + 1
       child_render_level = skip ? level : child_level
-      load_children_now = filters_applied? || expanded || skip
-      children_nodes = load_children_now ? build_nodes(filtered_children, level: child_render_level) : []
+      load_children_now = load_children_now?(creative)
+      has_children = !children_suppressed? && children_index.has_children?(creative)
+      children_nodes = load_children_now ? build_nodes(children_index.children_for(creative), level: child_render_level) : []
 
       return children_nodes if skip
 
+      can_write = can_write?(creative)
+
       [
         {
           id: creative.id,
@@ -119,19 +135,22 @@ module Creatives
           parent_id: creative.parent_id,
           level: level,
           select_mode: !!select_mode,
-          can_write: cached_can_write?(creative),
-          has_children: filtered_children.any?,
+          can_write: can_write,
+          has_children: has_children,
           expanded: expanded,
-          is_root: creative.parent.nil?,
+          is_root: creative.parent_id.nil?,
           archived: creative.archived?,
-          github_source: creative.github_markdown?,
+          # `github_source` is the wire key the tree renderer JS reads; its value
+          # is now the neutral read-only-source flag (GitHub-synced content is one
+          # such source) so core names no vendor here.
+          github_source: creative.read_only_source?,
           sequence: creative.sequence,
           link_url: view_context.collavre.creative_path(creative),
-          templates: template_payload_for(creative, has_children: filtered_children.any?),
-          inline_editor_payload: inline_editor_payload_for(creative, can_write: cached_can_write?(creative)),
+          templates: template_payload_for(creative, has_children: has_children, can_write: can_write),
+          inline_editor_payload: inline_editor_payload_for(creative, can_write: can_write),
           children_container: children_container_payload(
             creative,
-            filtered_children,
+            has_children: has_children,
             child_level: child_level,
             children_nodes: children_nodes,
             expanded: expanded,
@@ -149,16 +168,17 @@ module Creatives
       false
     end
 
-    def filtered_children_for(creative)
-      return [] if raw_params["comment"] == "true" || (raw_params["search"].present? && raw_params["search_mode"] != "tree")
+    # The chats feed and flat search render rows, not a tree: no node has children
+    # there, so the whole child resolution is skipped.
+    def children_suppressed?
+      return @children_suppressed if defined?(@children_suppressed)
 
-      children = creative.children_with_permission(user)
-      children = children.select { |c| !c.archived? } unless raw_params["show_archived"]
-      if allowed_creative_ids
-        children.select { |c| allowed_creative_ids.include?(c.id.to_s) }
-      else
-        children
-      end
+      @children_suppressed = raw_params["comment"] == "true" ||
+        (raw_params["search"].present? && raw_params["search_mode"] != "tree")
+    end
+
+    def load_children_now?(creative)
+      filters_applied? || expanded?(creative.id) || skip_creative?(creative)
     end
 
     def expanded?(creative_id)
@@ -174,9 +194,17 @@ module Creatives
       end
     end
 
-    def template_payload_for(creative, has_children: nil)
+    def template_payload_for(creative, has_children: nil, can_write: nil)
       description_html = view_context.embed_youtube_iframe(creative.effective_description(raw_params["tags"]&.first))
-      progress_html = view_context.render_creative_progress(creative, select_mode: !!select_mode, has_children: has_children)
+      can_feedback = can_feedback?(creative)
+      progress_html = view_context.render_creative_progress(
+        creative,
+        select_mode: !!select_mode,
+        has_children: has_children,
+        can_write: can_write,
+        can_feedback: can_feedback,
+        unread_count: can_feedback ? comment_badge_index.unread_count_for(creative.effective_origin) : nil
+      )
 
       {
         description_html: description_html,
@@ -189,18 +217,19 @@ module Creatives
 
     def inline_editor_payload_for(creative, can_write:)
       effective = creative.effective_origin(Set.new)
-      origin_writable = effective.id == creative.id ? can_write : creative.has_permission?(user, :write)
+      origin_writable = effective.id == creative.id ? can_write : allowed?(creative, :write)
       {
         description_raw_html: creative.effective_description(nil, true),
         progress: creative.progress,
         origin_id: creative.origin_id,
         content_type: effective.data&.dig("content_type"),
-        markdown_source: origin_writable ? effective.data&.dig("markdown_source") : nil
+        markdown_source: origin_writable ? effective.data&.dig("markdown_source") : nil,
+        markdown_editor: effective.data&.dig("editor")
       }
     end
 
-    def children_container_payload(creative, filtered_children, child_level:, children_nodes:, expanded:, load_children_now:)
-      return nil unless filtered_children.any?
+    def children_container_payload(creative, has_children:, child_level:, children_nodes:, expanded:, load_children_now:)
+      return nil unless has_children
 
       {
         id: "creative-children-#{creative.id}",

data/app/services/collavre/gemini_parent_recommender.rb

@@ -55,7 +55,7 @@ module Collavre
     def default_client
       AiClient.new(
         vendor: "google",
-        model: "gemini-3-flash-preview",
+        model: "gemini-3.1-flash-lite",
         system_prompt: nil
       )
     end

data/app/services/collavre/http_client.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+require "json"
+
+module Collavre
+  # Thin, dependency-free HTTP wrapper over Net::HTTP shared across engines.
+  #
+  # It centralizes timeout configuration, TLS negotiation and transport-error
+  # handling so vendor engines no longer each hand-roll their own Net::HTTP /
+  # HTTParty / Faraday setup. Callers keep full ownership of their own response
+  # parsing and domain error mapping — this wrapper only performs the request and
+  # returns a small Response value object.
+  #
+  # Transport-layer failures (DNS, connection refused/reset, TLS handshake,
+  # open/read timeouts) are wrapped in Collavre::HttpClient::ConnectionError so a
+  # caller can rescue a single, stable error type regardless of the underlying
+  # exception class.
+  class HttpClient
+    class Error < StandardError; end
+    class ConnectionError < Error; end
+
+    DEFAULT_OPEN_TIMEOUT = 10
+    DEFAULT_READ_TIMEOUT = 30
+
+    # Transport-level exceptions that occur before any HTTP response exists.
+    TRANSPORT_ERRORS = [
+      SocketError, SystemCallError, Timeout::Error, IOError,
+      OpenSSL::SSL::SSLError, Net::OpenTimeout, Net::ReadTimeout
+    ].freeze
+
+    REQUEST_CLASSES = {
+      get: Net::HTTP::Get,
+      post: Net::HTTP::Post,
+      patch: Net::HTTP::Patch,
+      put: Net::HTTP::Put,
+      delete: Net::HTTP::Delete
+    }.freeze
+
+    # A minimal, read-only view over a Net::HTTP response.
+    class Response
+      attr_reader :code, :message, :body, :headers
+
+      def initialize(net_response)
+        @net_response = net_response
+        @code = net_response.code.to_i
+        @message = net_response.message
+        @body = net_response.body
+        @headers = net_response.to_hash
+      end
+
+      def success?
+        @net_response.is_a?(Net::HTTPSuccess)
+      end
+
+      # Parse the response body as JSON, or nil when the body is empty.
+      def json
+        return nil if body.nil? || body.empty?
+
+        JSON.parse(body)
+      end
+    end
+
+    def initialize(open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT, default_headers: {})
+      @open_timeout = open_timeout
+      @read_timeout = read_timeout
+      @default_headers = default_headers
+    end
+
+    def get(url, headers: {})
+      request(:get, url, headers: headers)
+    end
+
+    def post(url, body: nil, headers: {})
+      request(:post, url, body: body, headers: headers)
+    end
+
+    def patch(url, body: nil, headers: {})
+      request(:patch, url, body: body, headers: headers)
+    end
+
+    def put(url, body: nil, headers: {})
+      request(:put, url, body: body, headers: headers)
+    end
+
+    def delete(url, headers: {})
+      request(:delete, url, headers: headers)
+    end
+
+    private
+
+    def request(method, url, body: nil, headers: {})
+      uri = URI.parse(url)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      http.open_timeout = @open_timeout
+      http.read_timeout = @read_timeout
+
+      req = build_request(method, uri, body, headers)
+      Response.new(http.request(req))
+    rescue *TRANSPORT_ERRORS => e
+      raise ConnectionError, "#{e.class}: #{e.message}"
+    end
+
+    def build_request(method, uri, body, headers)
+      path = uri.path.presence || "/"
+      path = "#{path}?#{uri.query}" if uri.query.present?
+
+      request_class = REQUEST_CLASSES.fetch(method) do
+        raise ArgumentError, "Unsupported HTTP method: #{method}"
+      end
+      req = request_class.new(path)
+      @default_headers.merge(headers).each { |key, value| req[key] = value }
+      req.body = body unless body.nil?
+      req
+    end
+  end
+end

data/app/services/collavre/inbox_reply_service.rb

@@ -64,6 +64,11 @@ module Collavre
         content: @comment.content,
         user: @comment.user,
         quoted_comment: original,
+        # quoted_comment is set only for linkage to the message being answered.
+        # Mark it as a "question" so review_message? stays false — otherwise the
+        # agent's response would update the quoted comment in place (the review
+        # flow) instead of posting a new reply. See Comment#review_message?.
+        review_type: :question,
         private: false
       )
 

data/app/services/collavre/link_preview_fetcher.rb

@@ -1,5 +1,5 @@
 module Collavre
-  require "open-uri"
+  require "net/http"
   require "nokogiri"
   require "uri"
   require "ipaddr"
@@ -29,18 +29,22 @@ module Collavre
       IPAddr.new("ff00::/8")
     ].freeze
 
+    # Minimal HTTP result the fetcher reasons about. `body` is only populated for
+    # successful (2xx) responses; redirects carry a `location` instead.
+    Response = Struct.new(:code, :content_type, :body, :location, keyword_init: true)
+
     def self.fetch(url)
       new(url).fetch
     end
 
-    def initialize(url, io_opener: URI, logger: Rails.logger)
+    def initialize(url, http_client: nil, logger: Rails.logger)
       @url = url
-      @io_opener = io_opener
+      @http_client = http_client || PinnedHttpClient.new
       @logger = logger
     end
 
     def fetch
-      uri = safe_http_uri
+      uri = parse_http_uri(@url)
       return {} unless uri
 
       html, base_uri = read_html(uri)
@@ -56,47 +60,53 @@ module Collavre
     private
 
     def read_html(uri, redirect_limit = MAX_REDIRECTS)
-      html = nil
-      base_uri = nil
-      options = REQUEST_OPTIONS.merge(read_timeout: READ_TIMEOUT, open_timeout: OPEN_TIMEOUT, redirect: false)
-      @io_opener.open(uri.to_s, options) do |io|
-        content_type = io.respond_to?(:content_type) ? io.content_type : nil
-        if content_type && HTML_CONTENT_TYPES.none? { |type| content_type.include?(type) }
-          return [ nil, nil ]
-        end
-        base_uri = io.respond_to?(:base_uri) ? io.base_uri : uri
-        html = io.read(MAX_BYTES)
+      # Resolve+validate the host ONCE per hop and pin the request to that exact
+      # IP. This closes the DNS-rebinding TOCTOU gap: a hostname that validates
+      # as public here can no longer be re-resolved to a private/metadata IP at
+      # connect time, because the connection targets the pinned address (with the
+      # original hostname preserved for Host/SNI).
+      addresses = safe_addresses(uri)
+      return [ nil, nil ] if addresses.empty?
+
+      response = fetch_via_pinned_addresses(uri, addresses)
+      return [ nil, nil ] unless response
+
+      if redirect?(response.code)
+        return [ nil, nil ] if redirect_limit <= 0
+
+        redirected_uri = normalize_redirect_uri(uri, response.location)
+        return [ nil, nil ] unless redirected_uri
+
+        # Recurse so the new host is resolved+validated+pinned from scratch;
+        # never follow a hop to an internal address.
+        return read_html(redirected_uri, redirect_limit - 1)
       end
-      [ html, base_uri ]
-    rescue OpenURI::HTTPRedirect => e
-      return [ nil, nil ] if redirect_limit <= 0
 
-      redirected_uri = safe_redirect_uri(uri, e.uri)
-      return [ nil, nil ] unless redirected_uri
+      return [ nil, nil ] unless success?(response.code)
 
-      read_html(redirected_uri, redirect_limit - 1)
-    rescue OpenURI::HTTPError, SocketError, IOError, SystemCallError, URI::InvalidURIError => e
+      content_type = response.content_type
+      if content_type && HTML_CONTENT_TYPES.none? { |type| content_type.include?(type) }
+        return [ nil, nil ]
+      end
+
+      [ response.body, uri ]
+    rescue SocketError, IOError, SystemCallError, Net::OpenTimeout, Net::ReadTimeout,
+           OpenSSL::SSL::SSLError, URI::InvalidURIError => e
       @logger&.info("Link preview fetch skipped for #{@url}: #{e.class} #{e.message}")
       [ nil, nil ]
     end
 
-    def safe_http_uri
-      uri = parse_http_uri(@url)
-      return unless uri
-      return unless allowed_destination?(uri)
-
-      uri
+    def redirect?(code)
+      code.to_i.between?(300, 399)
     end
 
-    def safe_redirect_uri(current_uri, redirected)
-      new_uri = normalize_redirect_uri(current_uri, redirected)
-      return unless new_uri
-      return unless allowed_destination?(new_uri)
-
-      new_uri
+    def success?(code)
+      code.to_i.between?(200, 299)
     end
 
     def normalize_redirect_uri(current_uri, redirected)
+      return if redirected.blank?
+
       target_uri = redirected.is_a?(URI) ? redirected : URI.parse(redirected.to_s)
       target_uri = current_uri.merge(target_uri) if target_uri.relative?
       return unless %w[http https].include?(target_uri.scheme)
@@ -116,15 +126,45 @@ module Collavre
       nil
     end
 
-    def allowed_destination?(uri)
+    # Resolve the host, reject if it maps to ANY unsafe address, and return every
+    # validated public IP to pin against. Rejecting when any resolved address is
+    # unsafe (not just the one we pick) keeps defense-in-depth against
+    # split-horizon DNS returning a mix of public and private records. Returning
+    # all safe addresses lets the caller fall back to the next one when the first
+    # is unreachable (e.g. an AAAA record with no IPv6 egress).
+    def safe_addresses(uri)
       host = uri.hostname
-      return false if host.nil? || host.empty?
+      return [] if host.nil? || host.empty?
 
       addresses = resolve_addresses(host)
-      return false if addresses.empty?
-      return false if addresses.any? { |address| unsafe_ip?(address) }
+      return [] if addresses.empty?
+      return [] if addresses.any? { |address| unsafe_ip?(address) }
 
-      true
+      addresses
+    end
+
+    # Try each pre-validated address in turn, pinning the connection to it, and
+    # return the first response we can actually open. Connection-level failures
+    # fall through to the next candidate; if none connect, the caller treats it
+    # as an empty preview. Every address here already passed safe_addresses, so
+    # falling back never targets an unsafe IP.
+    def fetch_via_pinned_addresses(uri, addresses)
+      last_error = nil
+      addresses.each do |address|
+        return @http_client.get(
+          uri,
+          ip: address,
+          headers: REQUEST_OPTIONS,
+          open_timeout: OPEN_TIMEOUT,
+          read_timeout: READ_TIMEOUT,
+          max_bytes: MAX_BYTES
+        )
+      rescue SocketError, IOError, SystemCallError, Net::OpenTimeout, Net::ReadTimeout,
+             OpenSSL::SSL::SSLError => e
+        last_error = e
+      end
+      @logger&.info("Link preview fetch skipped for #{@url}: #{last_error.class} #{last_error.message}") if last_error
+      nil
     end
 
     def resolve_addresses(host)
@@ -226,5 +266,56 @@ module Collavre
 
       text.to_s.gsub(/\s+/, " ").strip
     end
+
+    # Performs a single (non-redirect-following) GET against a pre-resolved IP
+    # while keeping the original hostname for the Host header and TLS SNI/cert
+    # verification. Net::HTTP#ipaddr= pins the socket to `ip`, so no second DNS
+    # lookup happens between validation and connect. Enforces the caller's open/
+    # read timeouts and byte cap.
+    class PinnedHttpClient
+      def get(uri, ip:, headers:, open_timeout:, read_timeout:, max_bytes:)
+        # Pass an explicit nil proxy: Net::HTTP.new defaults p_addr to :ENV, so a
+        # set http_proxy/HTTP_PROXY would route through the proxy, which resolves
+        # the hostname itself and defeats `http.ipaddr = ip` pinning — reopening
+        # the DNS-rebinding/SSRF gap. nil forces a direct, pinned connection.
+        http = Net::HTTP.new(uri.hostname, uri.port, nil)
+        http.use_ssl = uri.scheme == "https"
+        http.ipaddr = ip
+        http.open_timeout = open_timeout
+        http.read_timeout = read_timeout
+
+        request = Net::HTTP::Get.new(uri, headers)
+        response_struct = nil
+
+        http.start do |conn|
+          conn.request(request) do |response|
+            body = read_capped_body(response, max_bytes)
+            response_struct = Response.new(
+              code: response.code.to_i,
+              content_type: response.content_type,
+              body: body,
+              location: response["location"]
+            )
+          end
+        end
+
+        response_struct
+      ensure
+        http&.finish if http&.started?
+      end
+
+      private
+
+      def read_capped_body(response, max_bytes)
+        return nil unless response.is_a?(Net::HTTPSuccess)
+
+        body = +""
+        response.read_body do |chunk|
+          body << chunk
+          break if body.bytesize >= max_bytes
+        end
+        body.byteslice(0, max_bytes)
+      end
+    end
   end
 end

data/app/services/collavre/markdown_converter.rb

@@ -48,12 +48,22 @@ module Collavre
           source
         end
 
-        # Render with commonmarker (GFM extensions: table, strikethrough, autolink, tasklist, tagfilter)
+        # Render with commonmarker (GFM extensions: table, strikethrough, autolink, tasklist, tagfilter).
+        # hardbreaks: a single newline becomes <br>, mirroring the JS renderer (marked breaks:true)
+        # and the canonical markdown_source, which stores consecutive rich-editor lines one-per-line
+        # rather than separated by a blank line.
+        #
+        # syntax_highlighter: nil disables comrak's built-in syntect highlighter, which otherwise
+        # bakes a fixed base16-ocean.dark theme into the stored HTML as inline `style=` attributes
+        # (e.g. `<pre style="background-color:#2b303b"><span style="color:#bf616a">`). Those inline
+        # styles override our theme-aware code_highlight.css palette and are blind to light/dark mode.
+        # Disabling it emits a plain `<pre lang="ruby"><code>…</code></pre>`; the client re-tokenizes
+        # with highlight.js so the rendered creative matches the editor (and respects the theme).
         html = Commonmarker.to_html(input, options: {
           parse: { smart: true },
-          render: { unsafe: true },
+          render: { unsafe: true, hardbreaks: true },
           extension: { table: true, strikethrough: true, autolink: true, tasklist: true, tagfilter: true }
-        })
+        }, plugins: { syntax_highlighter: nil })
 
         html.strip!
         html