fix(markdown): open local file links

packages/ui/src/components/chat/markdown/markdownCore.test.ts

@@ -11,7 +11,7 @@ mock.module('./markdown-worker', () => ({
   highlightCodeInWorker: async () => null,
 }));
 
-import { escapeRawMarkdownHtml, MARKDOWN_FORBIDDEN_TAGS } from './markdownSecurity';
+import { escapeRawMarkdownHtml, isLocalFileUrl, MARKDOWN_FORBIDDEN_TAGS } from './markdownSecurity';
 
 const { extractMarkdownImageCandidates, renderMarkdownSync } = await import('./markdownCore');
 const { resolveMarkdownImageSource } = await import('./markdownImageAssets');
@@ -29,6 +29,13 @@ describe('markdown sanitization', () => {
     expect(MARKDOWN_FORBIDDEN_TAGS).toContain('script');
     expect(MARKDOWN_FORBIDDEN_TAGS).toContain('style');
   });
+
+  test('allows only local file URLs through the sanitizer policy', () => {
+    expect(isLocalFileUrl('file:///private/tmp/report%20viewer.html')).toBe(true);
+    expect(isLocalFileUrl('file://localhost/private/tmp/REPORT.md')).toBe(true);
+    expect(isLocalFileUrl('file://remote-host/share/report.html')).toBe(false);
+    expect(isLocalFileUrl('javascript:alert(1)')).toBe(false);
+  });
 });
 
 describe('Markdown images', () => {

packages/ui/src/components/chat/markdown/markdownCore.ts

@@ -5,7 +5,7 @@ import DOMPurify from 'dompurify';
 import { buildAgentMentionUrl, parseAgentHref, parseSkillHref } from '@/lib/messages/inlineMessageLinks';
 import { isVSCodeRuntime } from '@/lib/desktop';
 import { highlightCodeInWorker } from './markdown-worker';
-import { escapeRawMarkdownHtml, MARKDOWN_FORBIDDEN_TAGS } from './markdownSecurity';
+import { escapeRawMarkdownHtml, isLocalFileUrl, MARKDOWN_FORBIDDEN_TAGS } from './markdownSecurity';
 
 const escapeAttr = (value: string): string =>
   value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
@@ -400,6 +400,10 @@ const ensureSanitizeHook = (): void => {
   if (sanitizeHookInstalled) return;
   if (typeof window === 'undefined' || !DOMPurify.isSupported) return;
   sanitizeHookInstalled = true;
+  DOMPurify.addHook('uponSanitizeAttribute', (node, data) => {
+    if (!(node instanceof HTMLAnchorElement) || data.attrName !== 'href') return;
+    if (isLocalFileUrl(data.attrValue)) data.forceKeepAttr = true;
+  });
   DOMPurify.addHook('afterSanitizeAttributes', (node) => {
     if (!(node instanceof HTMLAnchorElement)) return;
     if (node.target !== '_blank') return;

packages/ui/src/components/chat/markdown/markdownSecurity.ts

@@ -4,3 +4,12 @@ export const escapeRawMarkdownHtml = (value: string): string =>
 
 /** Active elements forbidden again at the final DOMPurify boundary. */
 export const MARKDOWN_FORBIDDEN_TAGS = ['script', 'style'] as const;
+
+export const isLocalFileUrl = (value: string): boolean => {
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === 'file:' && (!parsed.hostname || parsed.hostname === 'localhost');
+  } catch {
+    return false;
+  }
+};