feat(gates): markdown rendering and auto-linkification in human gate prompts

[PolyphonyRequiem]

Summary

Adds full Markdown rendering support to human gate prompts in both the terminal CLI and the web dashboard.

Changes

Rich Terminal Rendering

• Gate prompts are now rendered through Rich Markdown in the terminal, supporting headings, bold, lists, code blocks, and tables

Auto-Linkification (\linkify.py)

• New markdown-aware post-processor that converts bare file paths and URLs in rendered gate prompts into clickable links
• File paths are validated against the workflow root (path traversal blocked)
• Skips fenced code blocks, inline code, and existing markdown links
• Applied to both terminal (Rich) and web dashboard rendering

Web Dashboard: File Viewing

• \GET /api/files/{path}\ endpoint serves local files relative to the workflow root with security guards (path traversal protection, extension allowlist, 1MB size limit)
• \FileViewer\ modal component renders linked files with Markdown support
• Relative links in gate prompts open in the FileViewer; external URLs open in new tabs

Web Dashboard: GFM Table Support

• Added
  emark-gfm\ plugin for GitHub Flavored Markdown table parsing
• Added table/th/td component overrides to both GateDetail and FileViewer

Documentation

• Added 'Markdown in Gate Prompts' section to \docs/workflow-syntax.md\ documenting all supported features with examples

Tests

• 13 file API security tests (path traversal, extension allowlist, size limits)
• 3 gate Markdown rendering tests
• Auto-linkify unit tests (213 lines covering URLs, file paths, code block skipping, edge cases)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 90.69767% with 4 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@1c620f0). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
src/conductor/web/server.py	86.20%	4 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #131   +/-   ##
=======================================
  Coverage        ?   85.73%           
=======================================
  Files           ?       56           
  Lines           ?     8144           
  Branches        ?        0           
=======================================
  Hits            ?     6982           
  Misses          ?     1162           
  Partials        ?        0           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jrob5756]

A few comments before we merge.

[jrob5756]

Important — fragile string-prefix containment check.

if not str(candidate).startswith(str(base_dir.resolve())):

This has the classic prefix-confusion bug: /foo/bar is a string prefix of /foo/bar2. The new server.py (line ~290) correctly uses target.relative_to(self._workflow_root) in a try/except ValueError — please apply the same pattern here, or use candidate.is_relative_to(base_dir.resolve()) (stdlib since 3.9; project requires 3.12+).

Not exploitable in practice today because candidate is also resolved and gate roots don't usually have sibling-prefix names, but it's a footgun worth removing.

[jrob5756]

Important — extension allowlist already drifting between modules.

This LINKABLE_EXTENSIONS (21 entries, includes .plan.md) and web/server.py's _FILE_ALLOWED_EXTENSIONS (20 entries, missing .plan.md) are intended to stay in sync — the docstring above even says so. They've already drifted on this very PR.

Suggest: have server.py import this constant directly, e.g. from conductor.executor.linkify import LINKABLE_EXTENSIONS.

Side note: the .plan.md entry here is dead anyway — Path.suffix returns only .md for foo.plan.md, so it's already covered by the .md entry in server.py. Consolidating to one source of truth makes this kind of confusion go away.

[jrob5756]

Suggestion — dead regex.

_FILE_PATH_RE is defined here but never referenced (grep -rn _FILE_PATH_RE src/ tests/ returns only this definition). The actual file-path linkification uses re.split(r"(\s+)", segment) token-by-token in _try_linkify_path. Safe to delete (along with the explanatory comment block immediately above).

[jrob5756]

Nit — str.endswith accepts a tuple natively.

def _has_linkable_extension(path: str) -> bool:
    lower = path.lower()
    return any(lower.endswith(ext) for ext in LINKABLE_EXTENSIONS)

Can be:

_LINKABLE_SUFFIXES = tuple(LINKABLE_EXTENSIONS)
...
def _has_linkable_extension(path: str) -> bool:
    return path.lower().endswith(_LINKABLE_SUFFIXES)

No Python-level loop, slightly faster, more idiomatic.

[jrob5756]

Nit — dead local.

link_target = normalized
return f"{prefix}[{stripped}]({link_target}){suffix}"

Inline normalized directly into the f-string and drop the link_target line.

[jrob5756]

Nit — hand-rolled absolute-path detection.

The combined absolute / UNC / drive-letter check could be PurePosixPath(file_path).is_absolute() or PureWindowsPath(file_path).is_absolute() (or PurePath). Keep the "://" scheme check separate. Reduces a brittle hand-rolled check to a documented stdlib call.

[jrob5756]

Suggestion — triplicated gate_base derivation.

The same expression appears at lines 834, 843, and 1433-1436 (and a similar pattern at line 583 for workflow_dir):

gate_base = Path(self.workflow_path).resolve().parent if self.workflow_path else None

Extract a cached property:

@property
def _workflow_dir(self) -> Path | None:
    return Path(self.workflow_path).resolve().parent if self.workflow_path else None

and reuse at all four call sites.

[PolyphonyRequiem]

Addressed all 7 review comments in commit 6c37af1:

1. Path containment (Important) - Resolved via upstream merge; now uses is_relative_to() instead of the fragile string-prefix comparison.

2. Extension allowlist drift (Important) - server.py now imports LINKABLE_EXTENSIONS directly from linkify.py (single source of truth). Removed the dead .plan.md entry (Path.suffix returns .md anyway).

3. Dead regex - Removed _FILE_PATH_RE (defined but never referenced).

4. endswith tuple idiom (Nit) - _has_linkable_extension now uses path.lower().endswith(_LINKABLE_SUFFIXES) with a pre-computed tuple. No Python-level loop.

5. Dead local (Nit) - Inlined normalized directly into the f-string, removed link_target.

6. Absolute-path detection (Nit) - Replaced hand-rolled check with PurePosixPath(file_path).is_absolute() or PureWindowsPath(file_path).is_absolute(). Kept the :// scheme check separate as suggested.

7. Triplicated gate_base derivation (Suggestion) - Extracted a _workflow_dir property on WorkflowEngine and replaced all three call sites.

All 87 linkify+server tests and 517 engine tests pass.