[malibio]

Mermaid v11 ignores nested flowchart/class htmlLabels for the shared layout, so labels landed in foreignObject and DOMPurify stripped them. Sets htmlLabels: false at the root; browser tests render a real flowchart (light and dark) and assert visible labels with no foreignObject.

🤖 Generated with Claude Code

[malibio]

Code Review: PR #3700 (issue #3698), initial review

Review Type: Initial (no prior reviews or comments)

Requirements Check

• ✅ mermaid.initialize() includes htmlLabels: false at root (mermaid-render.ts)
• ✅ Flowchart emits native <text>, no <foreignObject> (asserted on real mermaid output)
• ✅ Labels survive sanitization, light and dark (it.each over both themes, real renderMermaid + sanitizer)
• ✅ Browser tests assert visible text labels and no foreignObject

Findings

🟡 Improvement - 📁 packages/desktop-app/src/tests/browser/__screenshots__/mermaid-sanitize.test.ts/*.png (3 files)
All three PNGs are the same blob (47767d2f3, 2082 bytes), including one for the pre-existing "initializes mermaid" test. They look like Vitest browser-mode artifacts committed by accident (a git add .). No other __screenshots__ is tracked on main. They carry no meaning, add binary churn, and become stale. Remove them (or gitignore the directory). Principle: atomic change, no unrelated artifacts.

🟢 Nit - 📁 mermaid-sanitize.test.ts (new it.each)
The _n parameter is named as unused but is used in the diagram id. Rename it to label.

🟢 Nit - 📁 mermaid-sanitize.test.ts
mockReset() in finally clears the delegating implementations. This is fine if the file's beforeEach re-installs mocks, which it appears to. Worth confirming that test order cannot leak real-mermaid state.

Production change: a minimal one-line fix with an accurate "why" comment, no lint suppression, no any. No security regression: this keeps DOMPurify's svg profile strict rather than loosening it. No performance impact. No docs changes needed.

Recommendation

APPROVE (conditional on removing the stray screenshot PNGs, which is non-functional).

[malibio]

Automated pragmatic-code-review: APPROVE (posted as a comment — GitHub blocks self-approval). Full findings in the review comment above.

[malibio]

Addressed review: removed the 3 stray screenshots PNGs (failure artifacts from my without-fix verification run) and gitignored the directory; renamed _n to label. Skipped the mockReset nit: the test is last in the file and earlier tests install their own mocks; revisit if tests are added after it.

Re-Review Decision: NO RE-REVIEW NEEDED. Changes are artifact removal and a param rename, no logic changes; lint and the 18 browser tests pass.