fix(renderer): escape [ in markdown text nodes to prevent link re-injection (#240)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Farnabaz <farnabaz@gmail.com>

Author: 3 people

packages/comark/SPEC/common-mark/link-text-with-closing-bracket.md

@@ -0,0 +1,39 @@
+## Input
+
+```md
+[foo\] bar](/url)
+```
+
+## AST
+
+```json
+{
+  "frontmatter": {},
+  "meta": {},
+  "nodes": [
+    [
+      "p",
+      {},
+      [
+        "a",
+        {
+          "href": "/url"
+        },
+        "foo] bar"
+      ]
+    ]
+  ]
+}
+```
+
+## HTML
+
+```html
+<p><a href="/url">foo] bar</a></p>
+```
+
+## Markdown
+
+```md
+[foo\] bar](/url)
+```

packages/comark/SPEC/common-mark/paragraph-escaped-bracket.md

@@ -0,0 +1,33 @@
+## Input
+
+```md
+Escaped \[text\] in a sentence.
+```
+
+## AST
+
+```json
+{
+  "frontmatter": {},
+  "meta": {},
+  "nodes": [
+    [
+      "p",
+      {},
+      "Escaped [text] in a sentence."
+    ]
+  ]
+}
+```
+
+## HTML
+
+```html
+<p>Escaped [text] in a sentence.</p>
+```
+
+## Markdown
+
+```md
+Escaped \[text\] in a sentence.
+```

packages/comark/SPEC/common-mark/paragraph-link-backslash-escaped.md

@@ -0,0 +1,33 @@
+## Input
+
+```md
+\[Animation Bug\]\(/bugs#section\)
+```
+
+## AST
+
+```json
+{
+  "frontmatter": {},
+  "meta": {},
+  "nodes": [
+    [
+      "p",
+      {},
+      "[Animation Bug](/bugs#section)"
+    ]
+  ]
+}
+```
+
+## HTML
+
+```html
+<p>[Animation Bug](/bugs#section)</p>
+```
+
+## Markdown
+
+```md
+\[Animation Bug\](/bugs#section)
+```

packages/comark/src/internal/stringify/state.ts

@@ -32,7 +32,7 @@ export async function one(node: ComarkNode, state: State, parent?: ComarkElement
     if (state.context.html) {
       return escapeHtml(node)
     }
-    return node
+    return escapeMarkdownText(node)
   }
 
   if (node[0] === null) {
@@ -201,3 +201,16 @@ function escapeHtml(text: string): string {
   }
   return text.replace(/[<>]/g, (char) => map[char])
 }
+
+/**
+ * Escape characters in a markdown text node that would otherwise be
+ * misinterpreted as markdown syntax on a subsequent parse.
+ *
+ * `[` opens link/image syntax; `]` closes it.  Both must be escaped so that
+ * a text node like `[foo](bar)` round-trips as plain text, and a text node
+ * containing `]` inside a link (e.g. `dsd]dsd`) doesn't prematurely close
+ * the surrounding `[…]` brackets.
+ */
+function escapeMarkdownText(text: string): string {
+  return text.replace(/[[\]]/g, (ch) => `\\${ch}`)
+}

test/bundle.test.ts

@@ -76,7 +76,7 @@ describe.skipIf(stubbed || process.env.SKIP_BUNDLE_SIZE === 'true')('package bun
         "@comark/react": "37.2k (56 files)",
         "@comark/svelte": "39.2k (66 files)",
         "@comark/vue": "54.8k (62 files)",
-        "comark": "344k (132 files)",
+        "comark": "345k (132 files)",
       }
     `)
   })