Mermaid diagrams in Markdown reviews
Tunelito now renders fenced mermaid blocks automatically in Markdown review pages, including Markdown files inside folder sessions. Ordinary code fences are unchanged, and the original Markdown stays untouched.
Diagram rendering is local-first: Mermaid ships with the npm package and is served from Tunelito's authenticated same-origin routes rather than a CDN. Tunelito uses Mermaid's strict security mode, disables HTML labels and click actions, bounds diagram text/edge complexity, and initializes each diagram once after page load or live reload.
If syntax is invalid, the diagram is oversized, or the runtime cannot load, reviewers see a readable error and the escaped Mermaid source instead of a blank region. Valid diagrams keep their source available under View Mermaid source and support Mermaid's accTitle / accDescr SVG accessibility metadata.
Verification
- CI passed on Node.js 22, 24, and 26.
- The package smoke confirms the installed package contains the Mermaid runtime.
- Browser validation covered valid rendering, invalid-syntax fallback, ordinary code blocks, and re-rendering after a source edit.
What's changed
Full changelog: v0.17.0...v0.18.0