Render the assistant's replies as Markdown (#118)

Render assistant chat output as GFM Markdown (tables, lists, code, headings), lazy-loaded so the ~150 KB renderer only ships when an assistant message shows. Hardened per review: no <img> (exfiltration-beacon guard), no raw HTML, error-boundary + stale-chunk recovery around the lazy chunk, GFM column alignment, and memoized parsing.

Co-authored-by: Steve Dudenhoeffer <[email protected]>

web/vite.config.ts

@@ -31,22 +31,25 @@ export default defineConfig(({ mode }) => {
       sourcemap: true,
       rollupOptions: {
         output: {
-          // One vendor chunk for ALL node_modules: it's rarely-changing, so it
-          // caches across app deploys while the tiny app chunk churns. Kept as a
-          // SINGLE chunk on purpose — splitting react-dom/scheduler into their own
-          // chunk reorders their module init across chunk boundaries and breaks
-          // React 19 at load ("Cannot set 'Activity' of undefined"). The heavy
-          // routes are code-split separately via React.lazy (router.tsx), which is
-          // where the real first-paint win is.
+          // The app-wide core goes in ONE cached vendor chunk (rarely changes, so
+          // it survives deploys while the tiny app chunk churns). react + react-dom
+          // + scheduler MUST stay together — splitting react-dom into its own chunk
+          // reorders module init across chunk boundaries and breaks React 19 at
+          // load ("Cannot set 'Activity' of undefined"). Everything else — the
+          // gesture engine, the assistant's markdown renderer + its ecosystem —
+          // rides with whatever imports it, so a lazily-loaded route/feature keeps
+          // it out of the eager first paint. The routes are code-split via
+          // React.lazy (router.tsx), where the real first-paint win is.
           manualChunks(id) {
             if (!id.includes('node_modules')) return undefined
-            // Editor-only libs (the gesture engine) ride with the lazy editor
-            // chunk instead of the eager vendor one, so the first paint doesn't
-            // pay for code only the canvas needs. Everything else — react, tanstack
-            // and the rest — stays in ONE vendor chunk; splitting react-dom out
-            // reorders its init across chunks and breaks React 19 at load.
-            if (id.includes('@use-gesture')) return undefined
-            return 'vendor'
+            if (
+              /[/\\]node_modules[/\\](react|react-dom|scheduler|@tanstack|zustand|zod|clsx|tailwind-merge)[/\\]/.test(
+                id,
+              )
+            ) {
+              return 'vendor'
+            }
+            return undefined
           },
         },
       },