feat: render structured responses as markdown

web/src/structuredRender.test.ts

@@ -5,6 +5,7 @@ import {
   buildToolGroup,
   buildTranscriptRow,
   renderInlineMarkdown,
+  renderMarkdown,
 } from "./structuredRender.js";
 import type { TranscriptRow } from "./types.js";
 
@@ -82,6 +83,24 @@ describe("renderInlineMarkdown", () => {
   });
 });
 
+describe("renderMarkdown", () => {
+  it("renders GFM tables as semantic table markup", () => {
+    const html = renderMarkdown("| Model | State |\n| --- | --- |\n| Opus | ready |");
+    expect(html).toContain("<table>");
+    expect(html).toContain("<th>Model</th>");
+    expect(html).toContain("<td>Opus</td>");
+  });
+
+  it("removes executable HTML and unsafe URLs", () => {
+    const html = renderMarkdown(
+      '<img src=x onerror="alert(1)"><script>alert(2)</script>[bad](javascript:alert(3))',
+    );
+    expect(html).not.toContain("<img");
+    expect(html).not.toContain("<script");
+    expect(html).not.toContain('href="javascript:');
+  });
+});
+
 describe("buildTranscriptRow: tool calls", () => {
   it("shows glyph, name, argument and no meta for a completed non-diff call", () => {
     const el = buildTranscriptRow(