fix(ui): replace marked.js with markdown-it to fix ReDoS UI freeze (openclaw#46707) thanks @zhangfnf

Replace marked.js with markdown-it for the control UI chat markdown renderer
to eliminate a ReDoS vulnerability that could freeze the browser tab.

- Configure markdown-it with custom renderers matching marked.js output
- Add GFM www-autolink with trailing punctuation stripping per spec
- Escape raw HTML via html_block/html_inline overrides
- Flatten remote images to alt text, preserve base64 data URI images
- Add task list support via markdown-it-task-lists plugin
- Trim trailing CJK characters from auto-linked URLs (RFC 3986)
- Keep marked dependency for agents-panels-status-files.ts usage

Co-authored-by: zhangfan49 <zhangfan49@baidu.com>
Co-authored-by: Nova <nova@openknot.ai>

Author: 3 people

CHANGELOG.md

@@ -4,6 +4,8 @@ Docs: https://docs.openclaw.ai
 
 ## Unreleased
 
+- fix(ui): replace marked.js with markdown-it to fix ReDoS UI freeze (#46707) thanks @zhangfnf
+
 ### Changes
 
 - Telegram/forum topics: surface human topic names in agent context, prompt metadata, and plugin hook metadata by learning names from Telegram forum service messages. (#65973) Thanks @ptahdunbar.

pnpm-lock.yaml

@@ -13,9 +13,12 @@
     "@noble/ed25519": "3.0.1",
     "dompurify": "^3.3.3",
     "lit": "^3.3.2",
+    "markdown-it": "^14.1.1",
+    "markdown-it-task-lists": "^2.1.1",
     "marked": "^18.0.0"
   },
   "devDependencies": {
+    "@types/markdown-it": "^14.1.2",
     "@vitest/browser-playwright": "4.1.4",
     "jsdom": "^29.0.2",
     "playwright": "^1.59.1",

ui/package.json

@@ -0,0 +1,10 @@
+declare module "markdown-it-task-lists" {
+  import type MarkdownIt from "markdown-it";
+  interface TaskListsOptions {
+    enabled?: boolean;
+    label?: boolean;
+    labelAfter?: boolean;
+  }
+  const plugin: (md: MarkdownIt, options?: TaskListsOptions) => void;
+  export default plugin;
+}

ui/src/markdown-it-task-lists.d.ts

@@ -41,6 +41,20 @@
   margin-top: 0.25em;
 }
 
+/* Hide default marker only for unordered task lists; ordered lists keep numbers */
+.chat-text :where(ul > .task-list-item),
+.sidebar-markdown :where(ul > .task-list-item),
+.chat-thinking :where(ul > .task-list-item) {
+  list-style: none;
+}
+
+.chat-text :where(.task-list-item-checkbox),
+.sidebar-markdown :where(.task-list-item-checkbox),
+.chat-thinking :where(.task-list-item-checkbox) {
+  margin-right: 0.4em;
+  vertical-align: middle;
+}
+
 .chat-text :where(a) {
   color: var(--accent);
   text-decoration: underline;