Ticket 01KYJXSMV02C0PP9H8BKE1PNEZ

sanitizeSvg strips Mermaid's HTML-based node labels (foreignObject), leaving diagrams with empty shapes and no text

01KYJXSMV02C0PP9H8BKE1PNEZ · task/bug · done

DOMPurify's svg-only sanitize profile in src/lib/sanitize.ts hard-excludes the foreignObject tag (a known SVG XSS vector), which is how Mermaid renders flowchart/state-diagram node labels (HTML span/p inside foreignObject, not plain SVG ).

Hierarchy

• task: Ticket-01KYFZ6RBJ5718M3GQPAB76RHS Real diagram generation, and scope a real ImageGen backend — DiagramGenExtension and ImageGenExtension both fully mock generation with a setTimeout and keyword-matched fake output; no backend exists for either.
• epic: Ticket-01KYFZ6RBHABFSC9K9NJ90168Q Motion next development phase — Close the gap between Motion's stated vision (organize/edit/visualize documentation, local-first) and what a user can actually reach today: several real, working modules (enrichment pipeline, editor extensions) have no UI entry point, plus a pre-existing editor mode-desync data-loss bug.