Codex adversarial + structured review findings:
- Remote images are now BLOCKED with a visible placeholder instead of
warn-and-keep — leaving the tag meant Chromium fetched the URL at print
time anyway, so the offline posture was a lie (tracking pixels and
internal-URL probes ran without --allow-network).
- The out-of-tree read check compares REAL paths: a symlink inside the input
dir pointing at ~/.ssh/... passed the string-prefix check, including under
--strict. Ordered after the existence check (realpath of a missing file
false-positives on macOS /var → /private/var).
- Image reads are bounded BEFORE reading: statSync first, non-regular files
(fifo/device/dir) and >64MB files degrade to placeholders instead of
hanging or exhausting memory; malformed percent-encoding (foo%zz.png)
degrades to missing-image instead of crashing decodeURIComponent.
- browse shell-outs get a 120s timeout — a wedged daemon or hostile mermaid
source fails the run instead of hanging it.
- TOC entries link to the heading's ACTUAL id (pre-id'd raw-HTML headings
previously got dead #toc-N links); per-side margins compose into the CSS
@page shorthand so a landscape promotion flipping preferCSSPageSize no
longer silently reverts --margin-left/right to defaults (Codex P2).
- The image memo is a typed object — literal NUL-byte separators had made
diagram-prepass.ts register as binary to text tooling.
Codex structured review GATE: PASS (no P1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Local CLI semantics stay (absolute paths and ../ still inline, like pandoc),
but never silently: an agent PDF-ing untrusted markdown can't quietly embed a
file from outside the input directory into a shareable document without a
visible warning, and --strict pipelines hard-fail. Two unit tests. Also:
TODOS.md gains the deferred e2e-harness dedup entry (D8.2).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
34 unit tests (fence extraction incl. nested/tilde/unclosed/render=false,
info-string parsing, slot substitution, diagnostic/figure escaping + SVG
script strip, byte-level dimension probing across 5 formats, content-box
math, image inlining incl. strict/remote/missing/data-URI paths). E2E gate
proves through the compiled binary: both fences render as vector text
(id-collision check), raw mermaid ships only via render=false, broken fence
yields the diagnostic block, and the relative fixture image rasterizes to
colored pixels (CRITICAL regression for the about:blank image fix).
--strict exits non-zero on a missing image.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Garry Tan