fraim-hub 2.0.233 → 2.0.234

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-hub",
-  "version": "2.0.233",
+  "version": "2.0.234",
   "description": "FRAIM Hub local companion package.",
   "bin": {
     "fraim-hub": "bin/fraim-hub.js"
@@ -158,7 +158,7 @@
     "electron": "^41.2.2",
     "electron-updater": "^6.8.9",
     "express": "^5.2.1",
-    "fraim": "2.0.233",
+    "fraim": "2.0.234",
     "mongodb": "^7.0.0",
     "node-cron": "4.2.1",
     "node-edge-tts": "^1.2.10",

package/public/ai-hub/script.js

@@ -1311,6 +1311,19 @@ function stripHubInjectedPromptBlocks(text) {
     .trim();
 }
 
+// Returns a validated http/https URL string suitable for use in an href, or null if unsafe.
+function _safeHref(raw) {
+  try {
+    const url = new URL(raw);
+    return (url.protocol === 'https:' || url.protocol === 'http:') ? url.href : null;
+  } catch (_) { return null; }
+}
+
+// Escape & and " in a URL for safe insertion into an href="..." attribute.
+function _escapeHref(href) {
+  return href.replace(/&/g, '&').replace(/"/g, '"');
+}
+
 // R8: render markdown subset safely. HTML is escaped first.
 function formatEmployeeText(text) {
   if (!text) return '';
@@ -1326,6 +1339,27 @@ function formatEmployeeText(text) {
   s = s.replace(/```[\w]*\n?([\s\S]*?)```/g, (_, code) => `<pre><code>${code.trimEnd()}</code></pre>`);
   // 3. Inline code (single backtick, non-greedy, no newlines).
   s = s.replace(/`([^`\n]+)`/g, '<code>$1</code>');
+  // 3.5. Markdown links [text](url) — only http/https hrefs allowed; link text is already HTML-escaped.
+  // Empty-text links and non-absolute URLs fall back to plain text.
+  s = s.replace(/\[([^\]]*)\]\(([^)]*)\)/g, (match, linkText, rawUrl) => {
+    const trimmed = linkText.trim();
+    // Empty link text: render as plain text; sentinel prevents step 3.6 auto-linkify.
+    if (!trimmed) return `\x00NOLINK\x00${rawUrl.trim()}\x00ENDNOLINK\x00`;
+    // Reverse HTML entities step 1 introduced inside the URL before structural validation.
+    const decodedUrl = rawUrl.trim().replace(/&amp;/g, '&').replace(/&quot;/g, '"').replace(/&lt;/g, '<').replace(/&gt;/g, '>');
+    const href = _safeHref(decodedUrl);
+    if (!href) return trimmed;
+    return `<a href="${_escapeHref(href)}" target="_blank" rel="noopener noreferrer">${trimmed}</a>`;
+  });
+  // 3.6. Auto-linkify bare https:// / http:// URLs not already inside href="...".
+  // Sentinel prefix prevents double-linkifying empty-text [](url) patterns.
+  s = s.replace(/(?<!href=")(?<!href=')(?<!\x00NOLINK\x00)(https?:\/\/[^\s<>"'\x00]+)/g, (url) => {
+    const href = _safeHref(url);
+    if (!href) return url;
+    return `<a href="${_escapeHref(href)}" target="_blank" rel="noopener noreferrer">${_escapeHref(href)}</a>`;
+  });
+  // Strip sentinels: emit the URL as plain text (no anchor).
+  s = s.replace(/\x00NOLINK\x00(.*?)\x00ENDNOLINK\x00/g, (_, url) => url);
   // 4. Bold (**text**).
   s = s.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>');
   // 5–7. Process line by line for lists and paragraphs.

package/public/ai-hub/styles.css

@@ -1669,6 +1669,15 @@ img.coach-employee-avatar { object-fit: cover; border-radius: 4px; }
   border: 1px solid var(--line);
   color: var(--text);
 }
+.message.employee .bubble a {
+  color: var(--accent);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+  word-break: break-all;
+}
+.message.employee .bubble a:hover {
+  color: var(--accent-strong);
+}
 .typing-indicator {
   animation: none;
   justify-items: start;