- Replace ReDoS-vulnerable regex in canvas-log diff parser with
lastIndexOf-based parsing. CodeQL js/redos flagged the polynomial
backtracking on inputs like "diff --git a/a b/a b/a b/a...".
- Flatten components/canvas/ into components/ per CLAUDE.md C-04
(no nested component directories). Renamed for clarity:
MarkdownCanvas → CanvasMarkdown, DiffCanvas → CanvasDiff,
TableCanvas → CanvasTable, StatsCanvas → CanvasStats.
- Add shrink-0 + explicit width to the collapsed rail wrapper so
the toggle can't be compressed to zero width by a flex sibling.
- Replace the markdown renderer's <pre> stub with a minimal safe
parser. Handles ATX headings, **bold**, *italic*, `code`, fenced
code blocks, unordered lists, and paragraphs. No HTML pass-through;
user content can't inject markup. Tables / links / images stay out
of scope (use the table or diff canvas types instead).
- Treat bare-empty hunk lines as empty context rather than dropping
so non-standard diff generators don't misalign surrounding lines.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
6c3e2daac8