[ethicnology-agent]

Fixes the first defect reported in #1832.

Problem

MermaidRenderer.tsx:112 encodes the diagram body with JSON.stringify and line 157 interpolates the result into an inline <script> in the WebView document:

// Pass mermaid content via JSON to prevent XSS from HTML interpolation
const mermaidContent = JSON.stringify(props.content);
...
const content = ${mermaidContent};

JSON.stringify is a JavaScript-string encoder, not an HTML one. The HTML tokenizer ends a script element at the first case-insensitive </script, whatever JavaScript string state it appears in. A fence containing </script> therefore closes the element, and everything after it is parsed as markup and executed inside the WebView. The comment above the call states that this encoding prevents exactly that.

This content is not the user's own writing. It reaches the component from agent and tool output (MessageView.tsx:276), from artifacts, and from workstation files rendered in the app (FileViewPanel.tsx:419), via parseMarkdownBlock.ts:103. No CSP is set on the document.

What this changes

• scriptEncoding.ts (new) — jsonForScriptElement, which escapes < so the closing sequence can never be produced. Mermaid receives an identical string, because < is < inside a JavaScript string literal. U+2028 and U+2029 are escaped alongside it, since JSON permits them raw where JavaScript historically does not.
• MermaidRenderer.tsx — two lines: the import and the call.
• scriptEncoding.test.ts — the property, asserted directly.

The encoder is its own module because the app's vitest project only collects sources/**/*.{spec,test}.ts, so a .tsx component cannot be covered. linkUtils.ts + linkUtils.test.ts in the same folder already follow this shape.

One of the cases asserts the defect itself rather than only the fix, so the reason this module exists stays visible:

it('is exactly what JSON.stringify alone fails to provide', () => {
    expect(JSON.stringify('</script>').toLowerCase()).toContain('</script');
});

tsc --noEmit is clean and sources/components/markdown/ passes 15/15.

What this deliberately does not change

• The web and desktop path. It renders through dangerouslySetInnerHTML, but mermaid 11.12.2 defaults to securityLevel: "strict", which is in the non-overridable "secure" list, and render() runs DOMPurify before returning. I checked this before touching anything, and it is not affected.
• The CDN script tag. The same WebView loads mermaid@11 from jsDelivr on a mutable major-version tag with no integrity attribute and no CSP. That is a separate defect, reported in App: a mermaid code fence escapes its inline <script> in the mobile WebView; session file RPCs follow symlinks out of the workspace #1832, and it needs a decision about bundling rather than a patch here.
• The absent CSP on the WebView document. Worth adding, but it is a different change with its own blast radius.

[ethicnology-agent]

Rebased onto current main (4cf54d1). Clean rebase, diff unchanged.