From 0ecaf1f761a682b36c8519d041552069366661a3 Mon Sep 17 00:00:00 2001
From: chen <clean6378@gmail.com>
Date: Tue, 21 Jul 2026 05:21:49 +0800
Subject: [PATCH 1/3] fix: pin highlight.js script and theme with SRI

---
 templates/base.html | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/templates/base.html b/templates/base.html
index 5643385..01408fe 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -16,8 +16,12 @@
   </script>
   <link rel="stylesheet" href="/static/css/style.css">
   <!-- Highlight.js for code syntax highlighting -->
-  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/vs2015.min.css" id="hljs-theme">
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>
+  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/vs2015.min.css" id="hljs-theme"
+    integrity="sha512-mtXspRdOWHCYp+f4c7CkWGYPPRAhq9X+xCvJMUBVAb6pqA4U8pxhT3RWT3LP3bKbiolYL2CkL1bSKZZO4eeTew=="
+    crossorigin="anonymous">
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"
+    integrity="sha512-D9gUyxqja7hBtkWpPWGt9gfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ=="
+    crossorigin="anonymous"></script>
   <!-- Marked.js for Markdown rendering -->
   <script src="https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.1/marked.min.js"
     integrity="sha384-3zf4Pen4fXU90jGg3cxmo7BF4dq8HMtF2s07c/Hhd1Fh+Encm6ApPvNm8vrMJbWu"

From 81a19abe3d938ab901fceaf6dc553d6f5c168691 Mon Sep 17 00:00:00 2001
From: chen <clean6378@gmail.com>
Date: Tue, 21 Jul 2026 05:34:43 +0800
Subject: [PATCH 2/3] fix: don't crash workspace when highlight.js fails to
 load

---
 templates/workspace.html | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/templates/workspace.html b/templates/workspace.html
index fa759a5..2099aef 100644
--- a/templates/workspace.html
+++ b/templates/workspace.html
@@ -296,9 +296,11 @@ <h2>${escapeHtml(tab.title)}</h2>
 
   main.innerHTML = html;
 
-  main.querySelectorAll('pre code').forEach(block => {
-    hljs.highlightElement(block);
-  });
+  if (typeof hljs !== 'undefined') {
+    main.querySelectorAll('pre code').forEach(block => {
+      hljs.highlightElement(block);
+    });
+  }
 }
 
 function renderToolCall(tc) {

From ed8b280952edfb4eaf17d0c5580c76578bed4b08 Mon Sep 17 00:00:00 2001
From: chen <clean6378@gmail.com>
Date: Tue, 21 Jul 2026 19:54:44 +0800
Subject: [PATCH 3/3] address Will's feedback

---
 templates/base.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/base.html b/templates/base.html
index 01408fe..37d1abd 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -20,7 +20,7 @@
     integrity="sha512-mtXspRdOWHCYp+f4c7CkWGYPPRAhq9X+xCvJMUBVAb6pqA4U8pxhT3RWT3LP3bKbiolYL2CkL1bSKZZO4eeTew=="
     crossorigin="anonymous">
   <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"
-    integrity="sha512-D9gUyxqja7hBtkWpPWGt9gfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ=="
+    integrity="sha512-D9gUyxqja7hBtkWpPWGt9wfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ=="
     crossorigin="anonymous"></script>
   <!-- Marked.js for Markdown rendering -->
   <script src="https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.1/marked.min.js"