skyloom 1.14.8 → 1.15.0

package/src/tools/guards.ts

@@ -0,0 +1,82 @@
+/**
+ * Shared safety guards for tool handlers: SSRF protection for outbound fetches
+ * and the optional workspace fence for filesystem tools. Kept in their own
+ * module so both builtin.ts and extra.ts can use them without a circular import.
+ */
+
+import * as os from 'os';
+import * as path from 'path';
+import { lookup } from 'dns/promises';
+
+/* ── SSRF guard for outbound fetches ──────────────────────────────────────
+   Auto-approved/low-danger fetch tools must not be able to pivot to internal
+   services / cloud metadata (169.254.169.254). We block private, loopback and
+   link-local targets — both when the URL is an IP literal and after DNS
+   resolution. Operators who need internal hosts set SKYLOOM_ALLOW_PRIVATE_FETCH=1.
+   ────────────────────────────────────────────────────────────────────────── */
+export function isPrivateIPv4(ip: string): boolean {
+  const p = ip.split('.').map(Number);
+  if (p.length !== 4 || p.some((n) => Number.isNaN(n) || n < 0 || n > 255)) return false;
+  const [a, b] = p;
+  if (a === 0 || a === 127) return true;                 // this-host / loopback
+  if (a === 10) return true;                             // private
+  if (a === 172 && b >= 16 && b <= 31) return true;      // private
+  if (a === 192 && b === 168) return true;               // private
+  if (a === 169 && b === 254) return true;               // link-local + cloud metadata
+  if (a === 100 && b >= 64 && b <= 127) return true;     // CGNAT
+  return false;
+}
+
+export function isPrivateIp(ip: string): boolean {
+  const v = ip.toLowerCase();
+  if (v === '::1' || v === '::') return true;
+  if (v.startsWith('::ffff:')) {                         // IPv4-mapped IPv6
+    const mapped = v.slice(7);
+    if (mapped.includes('.')) return isPrivateIPv4(mapped);
+  }
+  if (/^f[cd]/.test(v)) return true;                     // fc00::/7 unique-local
+  if (/^fe[89ab]/.test(v)) return true;                  // fe80::/10 link-local
+  if (v.includes('.') && !v.includes(':')) return isPrivateIPv4(v);
+  return false;
+}
+
+export async function assertFetchAllowed(rawUrl: string): Promise<void> {
+  let u: URL;
+  try { u = new URL(rawUrl); } catch { throw new Error(`invalid URL: ${rawUrl}`); }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+    throw new Error(`blocked URL scheme '${u.protocol}' — only http/https are allowed`);
+  }
+  if (process.env.SKYLOOM_ALLOW_PRIVATE_FETCH === '1') return;
+  const host = u.hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
+  if (isPrivateIp(host)) {
+    throw new Error(`blocked request to private/loopback address ${host} (set SKYLOOM_ALLOW_PRIVATE_FETCH=1 to allow)`);
+  }
+  let addrs: Array<{ address: string }> = [];
+  try { addrs = await lookup(host, { all: true }); } catch { return; /* let fetch surface DNS errors */ }
+  for (const a of addrs) {
+    if (isPrivateIp(a.address)) {
+      throw new Error(`blocked request: ${host} resolves to private address ${a.address} (set SKYLOOM_ALLOW_PRIVATE_FETCH=1 to allow)`);
+    }
+  }
+}
+
+/* ── Optional workspace fence for file tools ──────────────────────────────
+   Off by default (the agent is a Claude-Code-style assistant that legitimately
+   works across a repo). Set SKYLOOM_WORKSPACE_FENCE=1 to confine file tools to
+   a root directory (SKYLOOM_WORKSPACE_ROOT, or the process cwd), blocking
+   traversal to ~/.ssh, /etc, etc.
+   ────────────────────────────────────────────────────────────────────────── */
+export function fenceRoot(): string | null {
+  if (process.env.SKYLOOM_WORKSPACE_FENCE !== '1') return null;
+  const raw = process.env.SKYLOOM_WORKSPACE_ROOT;
+  return raw ? path.resolve(raw.replace(/^~(?=$|\/|\\)/, os.homedir())) : process.cwd();
+}
+
+/** Returns an error string if `resolvedPath` is outside the fence, else null. */
+export function fenceCheck(resolvedPath: string): string | null {
+  const root = fenceRoot();
+  if (!root) return null;
+  const rel = path.relative(root, resolvedPath);
+  if (rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel))) return null;
+  return `Error: 路径越界 — 工作区围栏已启用 (SKYLOOM_WORKSPACE_FENCE=1)，'${resolvedPath}' 在根目录 '${root}' 之外。`;
+}

package/src/tools/model_tool.ts

@@ -1,74 +1,93 @@
-/**
- * Model self-service tools — let an agent inspect and switch its own LLM.
- *
- * Registered per-agent (same pattern as delegate_to), so the closure knows
- * which agent is asking. The runtime config object is shared by reference
- * with LLMClient, so a switch takes effect on the very next LLM call and is
- * persisted to ~/.skyloom/config.yaml.
- */
-
-import type { ToolDefinition } from '../core/tool';
-import { listProviders, modelsFor, providerLabel } from '../core/catalog';
-import { setAgentModel, clearAgentModel, describeAgentLLM } from '../core/model_config';
-
-export function createModelTools(agentName: string, runtimeConfig: any): ToolDefinition[] {
-  const listModels: ToolDefinition = {
-    name: 'list_models',
-    description:
-      'List every model available in the catalog (grouped by provider) plus your current model. ' +
-      'Call this before set_my_model to pick a valid id.',
-    parameters: [],
-    handler: async () => {
-      const me = describeAgentLLM(runtimeConfig, agentName);
-      const lines: string[] = [
-        `Current: ${me.model} (${me.source === 'agent' ? 'per-agent override' : 'unified default'})`,
-        '',
-      ];
-      for (const p of listProviders()) {
-        const models = modelsFor(p);
-        if (!models.length) continue;
-        lines.push(`${providerLabel(p)}: ${models.map(m => m.id).join(', ')}`);
-      }
-      return lines.join('\n');
-    },
-  };
-
-  const setMyModel: ToolDefinition = {
-    name: 'set_my_model',
-    description:
-      'Switch the LLM model YOU run on, effective from your next reply and persisted to config. ' +
-      'Use when the user asks you to change/upgrade/downgrade your model. ' +
-      "Pass model='default' to drop your override and follow the unified default again. " +
-      'Call list_models first if unsure of valid ids.',
-    parameters: [
-      {
-        name: 'model',
-        type: 'string',
-        description: "Catalog model id (e.g. 'deepseek-chat'), or 'default' to clear the override",
-        required: true,
-      },
-    ],
-    handler: async (kwargs: Record<string, any>) => {
-      const modelId = String(kwargs.model || '').trim();
-      if (!modelId) return '✗ model is required';
-
-      const before = describeAgentLLM(runtimeConfig, agentName);
-      if (modelId === 'default' || modelId === 'unified') {
-        clearAgentModel(runtimeConfig, agentName);
-        const after = describeAgentLLM(runtimeConfig, agentName);
-        return `✓ ${agentName} 已回到统一配置: ${before.model} → ${after.model} (default)`;
-      }
-
-      const r = setAgentModel(runtimeConfig, agentName, modelId);
-      if (!r.ok) {
-        return `✗ '${modelId}' 不在模型目录中。${r.suggestions.length ? '可选: ' + r.suggestions.join(', ') : '先调 list_models 查看可用模型。'}`;
-      }
-      const keyNote = describeAgentLLM(runtimeConfig, agentName).keySource === 'missing'
-        ? `\n⚠ 该 provider (${r.provider}) 尚无可用 API key — 提醒用户运行 /apikey set ${r.provider} <key>`
-        : '';
-      return `✓ ${agentName} 的模型已切换: ${before.model} → ${modelId}${r.provider ? ` (${r.provider})` : ''}，下一次回复即生效${keyNote}`;
-    },
-  };
-
-  return [listModels, setMyModel];
-}
+/**
+ * Model self-service tools — let an agent inspect and switch its own LLM.
+ *
+ * Registered per-agent (same pattern as delegate_to), so the closure knows
+ * which agent is asking. The runtime config object is shared by reference
+ * with LLMClient, so a switch takes effect on the very next LLM call and is
+ * persisted to ~/.skyloom/config.yaml.
+ */
+
+import type { ToolDefinition } from '../core/tool';
+import { listProviders, modelsFor, providerLabel } from '../core/catalog';
+import { setAgentModel, clearAgentModel, describeAgentLLM } from '../core/model_config';
+
+export function createModelTools(agentName: string, runtimeConfig: any): ToolDefinition[] {
+  const listModels: ToolDefinition = {
+    name: 'list_models',
+    description:
+      'List every model available in the catalog (grouped by provider) plus your current model. ' +
+      'Call this before set_my_model to pick a valid id. ' +
+      'Shows model id, context window, cost per 1M tokens, and description.',
+    parameters: [
+      {
+        name: 'provider',
+        type: 'string',
+        description: 'Optional: filter by provider name (e.g. "openai", "deepseek", "qwen")',
+        required: false,
+      },
+    ],
+    handler: async (kwargs: Record<string, any>) => {
+      const me = describeAgentLLM(runtimeConfig, agentName);
+      const filter = String(kwargs.provider || '').toLowerCase();
+      const lines: string[] = [
+        `Current: ${me.model} (${me.source === 'agent' ? 'per-agent override' : 'unified default'})`,
+        '',
+      ];
+      let totalModels = 0;
+      for (const p of listProviders()) {
+        const models = modelsFor(p);
+        if (!models.length) continue;
+        if (filter && !p.toLowerCase().includes(filter) && !providerLabel(p).toLowerCase().includes(filter)) continue;
+        lines.push(`${providerLabel(p)}:`);
+        for (const m of models) {
+          totalModels++;
+          const costStr = m.costIn === 0 && m.costOut === 0 ? 'FREE' : `$${m.costIn.toFixed(2)}/$${m.costOut.toFixed(2)}`;
+          const ctxStr = m.context >= 1000000 ? `${(m.context / 1000000).toFixed(0)}M` : m.context >= 1000 ? `${(m.context / 1000).toFixed(0)}K` : `${m.context}`;
+          lines.push(`  · ${m.id.padEnd(42)} ${ctxStr.padStart(5)}  ${costStr.padStart(14)}  ${m.desc}`);
+        }
+        lines.push('');
+      }
+      lines.push(`Total: ${listProviders().length} providers · ${totalModels} models`);
+      return lines.join('\n');
+    },
+  };
+
+  const setMyModel: ToolDefinition = {
+    name: 'set_my_model',
+    description:
+      'Switch the LLM model YOU run on, effective from your next reply and persisted to config. ' +
+      'Use when the user asks you to change/upgrade/downgrade your model. ' +
+      "Pass model='default' to drop your override and follow the unified default again. " +
+      'Call list_models first if unsure of valid ids.',
+    parameters: [
+      {
+        name: 'model',
+        type: 'string',
+        description: "Catalog model id (e.g. 'deepseek-chat'), or 'default' to clear the override",
+        required: true,
+      },
+    ],
+    handler: async (kwargs: Record<string, any>) => {
+      const modelId = String(kwargs.model || '').trim();
+      if (!modelId) return '✗ model is required';
+
+      const before = describeAgentLLM(runtimeConfig, agentName);
+      if (modelId === 'default' || modelId === 'unified') {
+        clearAgentModel(runtimeConfig, agentName);
+        const after = describeAgentLLM(runtimeConfig, agentName);
+        return `✓ ${agentName} 已回到统一配置: ${before.model} → ${after.model} (default)`;
+      }
+
+      const r = setAgentModel(runtimeConfig, agentName, modelId);
+      if (!r.ok) {
+        return `✗ '${modelId}' 不在模型目录中。${r.suggestions.length ? '可选: ' + r.suggestions.join(', ') : '先调 list_models 查看可用模型。'}`;
+      }
+      const keyNote = describeAgentLLM(runtimeConfig, agentName).keySource === 'missing'
+        ? `\n⚠ 该 provider (${r.provider}) 尚无可用 API key — 提醒用户运行 /apikey set ${r.provider} <key>`
+        : '';
+      return `✓ ${agentName} 的模型已切换: ${before.model} → ${modelId}${r.provider ? ` (${r.provider})` : ''}，下一次回复即生效${keyNote}`;
+    },
+  };
+
+  return [listModels, setMyModel];
+}

package/src/tools/todo.ts

@@ -1,76 +1,76 @@
-/**
- * todo_write — agents externalize multi-step task state (Claude Code 式).
- *
- * The agent maintains a checklist in working memory: plan it up front, mark
- * items active/done as it works. The list survives compaction (working
- * memory, not chat history), the CLI renders it live, and the tool's return
- * value keeps the current state visible to the model itself.
- *
- * Whole-list replace semantics: every call passes the complete list. That
- * keeps the tool idempotent and trivially recoverable after a bad call.
- */
-
-import type { ToolDefinition } from '../core/tool';
-
-export type TodoStatus = 'pending' | 'active' | 'done';
-export interface TodoItem {
-  text: string;
-  status: TodoStatus;
-}
-
-const MAX_ITEMS = 20;
-const STATUSES = new Set<string>(['pending', 'active', 'done']);
-
-export const TODO_WORKING_KEY = 'todos';
-
-/** Parse + validate the items argument (JSON array). */
-export function parseTodoItems(raw: any): { items: TodoItem[] | null; error: string } {
-  let parsed: any = raw;
-  if (typeof raw === 'string') {
-    try { parsed = JSON.parse(raw); } catch { return { items: null, error: 'items 必须是合法 JSON 数组' }; }
-  }
-  if (!Array.isArray(parsed)) return { items: null, error: 'items 必须是数组' };
-  if (parsed.length > MAX_ITEMS) return { items: null, error: `最多 ${MAX_ITEMS} 项 — 合并粒度` };
-  const items: TodoItem[] = [];
-  for (const it of parsed) {
-    const text = typeof it === 'string' ? it : String(it?.text ?? '').trim();
-    const status = typeof it === 'object' && it !== null && STATUSES.has(String(it.status)) ? String(it.status) : 'pending';
-    if (!text) return { items: null, error: '存在空的任务项' };
-    items.push({ text: text.slice(0, 120), status: status as TodoStatus });
-  }
-  return { items, error: '' };
-}
-
-export function renderTodoList(items: TodoItem[]): string {
-  const done = items.filter(i => i.status === 'done').length;
-  const lines = items.map(i => {
-    const mark = i.status === 'done' ? '✓' : i.status === 'active' ? '◐' : '·';
-    return `${mark} ${i.text}`;
-  });
-  return `任务清单 ${done}/${items.length}\n${lines.join('\n')}`;
-}
-
-export function createTodoTool(agent: { memory: { setWorking(k: string, v: any): void } }): ToolDefinition {
-  return {
-    name: 'todo_write',
-    description:
-      'Maintain your task checklist for multi-step work. Call it FIRST to plan (all pending), ' +
-      'then again whenever an item starts (active) or finishes (done) — pass the COMPLETE list each time. ' +
-      'items is a JSON array: [{"text":"...","status":"pending|active|done"}, ...]. ' +
-      'Use for any task with 3+ steps; skip for trivial one-shot answers.',
-    parameters: [
-      {
-        name: 'items',
-        type: 'string',
-        description: 'The complete checklist as a JSON array of {text, status} (status: pending/active/done)',
-        required: true,
-      },
-    ],
-    handler: async (kwargs: Record<string, any>) => {
-      const { items, error } = parseTodoItems(kwargs.items);
-      if (!items) return `✗ ${error}`;
-      agent.memory.setWorking(TODO_WORKING_KEY, items);
-      return `✓ ${renderTodoList(items)}`;
-    },
-  };
-}
+/**
+ * todo_write — agents externalize multi-step task state (Claude Code 式).
+ *
+ * The agent maintains a checklist in working memory: plan it up front, mark
+ * items active/done as it works. The list survives compaction (working
+ * memory, not chat history), the CLI renders it live, and the tool's return
+ * value keeps the current state visible to the model itself.
+ *
+ * Whole-list replace semantics: every call passes the complete list. That
+ * keeps the tool idempotent and trivially recoverable after a bad call.
+ */
+
+import type { ToolDefinition } from '../core/tool';
+
+export type TodoStatus = 'pending' | 'active' | 'done';
+export interface TodoItem {
+  text: string;
+  status: TodoStatus;
+}
+
+const MAX_ITEMS = 20;
+const STATUSES = new Set<string>(['pending', 'active', 'done']);
+
+export const TODO_WORKING_KEY = 'todos';
+
+/** Parse + validate the items argument (JSON array). */
+export function parseTodoItems(raw: any): { items: TodoItem[] | null; error: string } {
+  let parsed: any = raw;
+  if (typeof raw === 'string') {
+    try { parsed = JSON.parse(raw); } catch { return { items: null, error: 'items 必须是合法 JSON 数组' }; }
+  }
+  if (!Array.isArray(parsed)) return { items: null, error: 'items 必须是数组' };
+  if (parsed.length > MAX_ITEMS) return { items: null, error: `最多 ${MAX_ITEMS} 项 — 合并粒度` };
+  const items: TodoItem[] = [];
+  for (const it of parsed) {
+    const text = typeof it === 'string' ? it : String(it?.text ?? '').trim();
+    const status = typeof it === 'object' && it !== null && STATUSES.has(String(it.status)) ? String(it.status) : 'pending';
+    if (!text) return { items: null, error: '存在空的任务项' };
+    items.push({ text: text.slice(0, 120), status: status as TodoStatus });
+  }
+  return { items, error: '' };
+}
+
+export function renderTodoList(items: TodoItem[]): string {
+  const done = items.filter(i => i.status === 'done').length;
+  const lines = items.map(i => {
+    const mark = i.status === 'done' ? '✓' : i.status === 'active' ? '◐' : '·';
+    return `${mark} ${i.text}`;
+  });
+  return `任务清单 ${done}/${items.length}\n${lines.join('\n')}`;
+}
+
+export function createTodoTool(agent: { memory: { setWorking(k: string, v: any): void } }): ToolDefinition {
+  return {
+    name: 'todo_write',
+    description:
+      'Maintain your task checklist for multi-step work. Call it FIRST to plan (all pending), ' +
+      'then again whenever an item starts (active) or finishes (done) — pass the COMPLETE list each time. ' +
+      'items is a JSON array: [{"text":"...","status":"pending|active|done"}, ...]. ' +
+      'Use for any task with 3+ steps; skip for trivial one-shot answers.',
+    parameters: [
+      {
+        name: 'items',
+        type: 'string',
+        description: 'The complete checklist as a JSON array of {text, status} (status: pending/active/done)',
+        required: true,
+      },
+    ],
+    handler: async (kwargs: Record<string, any>) => {
+      const { items, error } = parseTodoItems(kwargs.items);
+      if (!items) return `✗ ${error}`;
+      agent.memory.setWorking(TODO_WORKING_KEY, items);
+      return `✓ ${renderTodoList(items)}`;
+    },
+  };
+}

package/src/web/markdown.ts

@@ -0,0 +1,193 @@
+/**
+ * 水墨气象台 · Markdown 渲染器 — dependency-free, isomorphic.
+ *
+ * These functions run in BOTH worlds:
+ *  - in Node, imported normally (unit-testable);
+ *  - in the browser, injected into the page via `fn.toString()` (see ui.ts).
+ *
+ * Constraints that follow from the injection trick:
+ *  - every function must be a top-level `function` declaration;
+ *  - they may only call each other by bare name (no imports, no module-scope
+ *    state) — tsc's CommonJS emit keeps such cross-calls as plain identifiers,
+ *    so the stringified source stays valid in a browser.
+ */
+
+/** HTML-escape text content. */
+export function escapeHtml(s: string): string {
+  return String(s)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
+
+/**
+ * Minimal one-pass syntax highlighter. Tokenizes comments, strings, keywords
+ * and numbers with a single alternation so already-emitted HTML is never
+ * re-matched. Good-enough coverage for the common languages an agent emits
+ * (ts/js/py/sh/go/rust/sql/json); everything unrecognized is just escaped.
+ */
+export function highlightCode(code: string, lang: string): string {
+  if (code.length > 30000) return escapeHtml(code); // don't jank on huge blocks
+  const l = (lang || '').toLowerCase();
+  const hashComments = /^(py|python|sh|bash|zsh|shell|rb|ruby|yaml|yml|toml|make|makefile|r)$/.test(l);
+  const kw = '\\b(?:function|return|if|else|elif|for|while|do|const|let|var|class|import|export|from|async|await|new|try|catch|finally|throw|switch|case|default|break|continue|typeof|instanceof|in|of|def|lambda|pass|yield|with|as|is|not|and|or|None|True|False|self|this|fn|pub|impl|struct|enum|match|use|mod|trait|interface|type|extends|implements|public|private|protected|static|void|null|undefined|true|false|SELECT|FROM|WHERE|INSERT|UPDATE|DELETE|JOIN|GROUP|ORDER|BY|LIMIT)\\b';
+  const comment = hashComments
+    ? '#[^\\n]*'
+    : '\\/\\/[^\\n]*|\\/\\*[\\s\\S]*?\\*\\/|--[^\\n]*';
+  const re = new RegExp(
+    '(' + comment + ')' +
+    '|("(?:[^"\\\\\\n]|\\\\.)*"|\'(?:[^\'\\\\\\n]|\\\\.)*\'|`(?:[^`\\\\]|\\\\.)*`)' +
+    '|(' + kw + ')' +
+    '|(\\b\\d+(?:\\.\\d+)?\\b)',
+    'g'
+  );
+  let out = '';
+  let last = 0;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(code))) {
+    out += escapeHtml(code.slice(last, m.index));
+    if (m[1]) out += '<span class="tk-c">' + escapeHtml(m[1]) + '</span>';
+    else if (m[2]) out += '<span class="tk-s">' + escapeHtml(m[2]) + '</span>';
+    else if (m[3]) out += '<span class="tk-k">' + escapeHtml(m[3]) + '</span>';
+    else out += '<span class="tk-n">' + escapeHtml(m[4]) + '</span>';
+    last = m.index + m[0].length;
+  }
+  return out + escapeHtml(code.slice(last));
+}
+
+/** Inline markdown: code spans, bold, italic, strikethrough, safe links. */
+export function mdInline(s: string): string {
+  const parts = String(s).split(/(`[^`\n]*`)/);
+  let out = '';
+  for (let i = 0; i < parts.length; i++) {
+    const p = parts[i];
+    if (p.length > 1 && p.charAt(0) === '`' && p.charAt(p.length - 1) === '`') {
+      out += '<code>' + escapeHtml(p.slice(1, -1)) + '</code>';
+      continue;
+    }
+    let t = escapeHtml(p);
+    t = t.replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>');
+    t = t.replace(/(^|[^*\w])\*([^*\n]+)\*(?!\*)/g, '$1<em>$2</em>');
+    t = t.replace(/~~([^~\n]+)~~/g, '<del>$1</del>');
+    // Only http(s) links; URL was escaped above so quotes can't break out.
+    t = t.replace(/\[([^\]\n]+)\]\((https?:\/\/[^)\s]+)\)/g,
+      '<a href="$2" target="_blank" rel="noopener noreferrer">$1</a>');
+    out += t;
+  }
+  return out;
+}
+
+/**
+ * Block-level markdown → HTML. Supports: fenced code (with language tag,
+ * tolerant of an unclosed fence mid-stream), #–#### headings, hr, blockquote,
+ * ul/ol, tables, paragraphs. Unknown constructs degrade to escaped text —
+ * never to broken markup.
+ */
+export function mdToHtml(src: string): string {
+  const lines = String(src).replace(/\r\n?/g, '\n').split('\n');
+  let html = '';
+  let i = 0;
+  let para: string[] = [];
+
+  function flushPara() {
+    if (para.length) {
+      html += '<p>' + para.map(mdInline).join('<br>') + '</p>';
+      para = [];
+    }
+  }
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    // fenced code — tolerate a missing closing fence (streaming)
+    const fence = line.match(/^\s*```\s*([\w+#-]*)\s*$/);
+    if (fence) {
+      flushPara();
+      const lang = fence[1] || '';
+      const buf: string[] = [];
+      i++;
+      while (i < lines.length && !/^\s*```\s*$/.test(lines[i])) { buf.push(lines[i]); i++; }
+      i++; // skip closing fence (or run off the end mid-stream)
+      const code = buf.join('\n');
+      html += '<div class="codeblock"><div class="cb-head"><span class="cb-lang">' +
+        escapeHtml(lang || 'text') +
+        '</span><button class="cb-copy" type="button">复制</button></div>' +
+        '<pre><code>' + highlightCode(code, lang) + '</code></pre></div>';
+      continue;
+    }
+
+    // blank line → paragraph break
+    if (/^\s*$/.test(line)) { flushPara(); i++; continue; }
+
+    // heading
+    const h = line.match(/^(#{1,4})\s+(.*)$/);
+    if (h) {
+      flushPara();
+      const lvl = h[1].length;
+      html += '<h' + (lvl + 1) + ' class="md-h md-h' + lvl + '">' + mdInline(h[2]) + '</h' + (lvl + 1) + '>';
+      i++; continue;
+    }
+
+    // horizontal rule
+    if (/^\s*(?:-{3,}|\*{3,})\s*$/.test(line)) { flushPara(); html += '<hr>'; i++; continue; }
+
+    // blockquote
+    if (/^\s*>\s?/.test(line)) {
+      flushPara();
+      const buf: string[] = [];
+      while (i < lines.length && /^\s*>\s?/.test(lines[i])) { buf.push(lines[i].replace(/^\s*>\s?/, '')); i++; }
+      html += '<blockquote>' + buf.map(mdInline).join('<br>') + '</blockquote>';
+      continue;
+    }
+
+    // table: header row | separator row | body rows
+    if (line.indexOf('|') >= 0 && i + 1 < lines.length &&
+        /^\s*\|?[\s:|-]+\|?\s*$/.test(lines[i + 1]) && lines[i + 1].indexOf('-') >= 0) {
+      flushPara();
+      const splitRow = function (r: string): string[] {
+        return r.replace(/^\s*\|/, '').replace(/\|\s*$/, '').split('|').map(function (c) { return c.trim(); });
+      };
+      const head = splitRow(line);
+      i += 2;
+      let body = '';
+      while (i < lines.length && lines[i].indexOf('|') >= 0 && !/^\s*$/.test(lines[i])) {
+        body += '<tr>' + splitRow(lines[i]).map(function (c) { return '<td>' + mdInline(c) + '</td>'; }).join('') + '</tr>';
+        i++;
+      }
+      html += '<div class="md-table"><table><thead><tr>' +
+        head.map(function (c) { return '<th>' + mdInline(c) + '</th>'; }).join('') +
+        '</tr></thead><tbody>' + body + '</tbody></table></div>';
+      continue;
+    }
+
+    // unordered list
+    if (/^\s*[-*+]\s+/.test(line)) {
+      flushPara();
+      let items = '';
+      while (i < lines.length && /^\s*[-*+]\s+/.test(lines[i])) {
+        items += '<li>' + mdInline(lines[i].replace(/^\s*[-*+]\s+/, '')) + '</li>';
+        i++;
+      }
+      html += '<ul>' + items + '</ul>';
+      continue;
+    }
+
+    // ordered list
+    if (/^\s*\d+[.)]\s+/.test(line)) {
+      flushPara();
+      let items = '';
+      while (i < lines.length && /^\s*\d+[.)]\s+/.test(lines[i])) {
+        items += '<li>' + mdInline(lines[i].replace(/^\s*\d+[.)]\s+/, '')) + '</li>';
+        i++;
+      }
+      html += '<ol>' + items + '</ol>';
+      continue;
+    }
+
+    para.push(line);
+    i++;
+  }
+  flushPara();
+  return html;
+}