[smithjack11]

Summary

• Harden plugin details loading when metadata, readme, changelog, or icon files are missing or malformed.
• Resolve relative images and links in installed plugin READMEs; support c++/c# code fences.
• URL-encode remote plugin search queries and surface offline/network errors instead of leaving lists on “loading…”.
• Handle local plugin-source picker cancellation without an unhandled rejection.
• Strip untrusted inline styles and reject non-HTTP(S) repository links.
• Harden Markdown preview against malformed hash fragments, disposed controller reuse, and lazy KaTeX/Mermaid import failures.
• Preserve KaTeX layout styles while sanitizing raw Markdown HTML.
• Add a regression test for the Markdown sanitizer.

Verification

• node --check passes for the changed Markdown preview files and test.
• git diff --check passes.
• Vitest was not run locally because node_modules is absent.
• No APK/build command was run.

Related: #3034 (separate preview CORS fix).

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with a non-blocking issue when linked-file opens fail or are cancelled.

Findings

1.  Cancelled links close the page ▶

Summary

The PR hardens plugin pages and Markdown previews.

• Plugin detail pages still render when installed files or metadata are missing.
• Installed plugin READMEs can show local images and open local links.
• Plugin lists show network errors when their requests fail.
• Markdown previews keep showing content when optional renderers fail.
• Plugin detail pages limit repository links and strip inline styles.
• Markdown preview handles malformed hashes and replaces disposed controllers.
• Cancelling the local plugin-source picker exits without starting an install.

No numbered previous comments were supplied. Their threads remain review context.

_{Reviews (2) · Last reviewed commit: "fix: strengthen markdown KaTeX marker en..." · Reviewed by Greptile}

[greptile-apps]

Cancelled links close the page

onOpen hides the plugin page even when no linked file opened. openFile(path) returns normally when the user declines the binary-file prompt, and it catches file errors without rethrowing them. The new callback therefore closes the page after cancellation or failure, forcing users to reopen it to continue reading. Check that the file actually opened before calling onOpen.