mweinbach4/16/2026, 3:08:17 PM

- Sanitize docx (mammoth) and xlsx (SheetJS) HTML through DOMPurify
  before dangerouslySetInnerHTML. Crafted office files could otherwise
  inject script via inline event handlers or javascript: URLs.
- Replace ad-hoc cancelled flag with AbortController so a path-switch or
  unmount mid-read aborts cleanly. Blob URLs allocated after an abort
  are now revoked immediately so they cannot leak.
- Improve the truncation banner: explain it is a partial preview and
  surface a one-click "Open full file" CTA.
- Document the looksMostlyText 0.02 threshold so future maintainers do
  not change it blindly.
- Add a comment to .app-surface-opaque explaining why it must use
  --panel-bg (solid) rather than --surface-window (translucent on
  Windows) — the rule the last three opacity-fix commits oscillated on.
- Promote dompurify from a transitive (via mermaid) to a direct
  dependency.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Parent92ab4d0