feat(minimax-pet): 0.7.0 回复按 Markdown 渲染

- 新增 markdown.mjs：把任务最近回复的 mdast 转成 DOM 节点，覆盖标题、强调、
  行内代码、围栏代码块、列表与任务清单、表格、引用、分隔线、链接；
  通知卡片与提醒预览使用压平后的纯文本。
- 原始 HTML 只作为文本显示，链接只显示可读地址、不打开，图片不发起请求。
  渲染全程使用 createElement/createTextNode，不拼 HTML 字符串。
- vendor/markdown.mjs 由 tools/build-markdown.mjs 打包 unified 11.0.5 +
  remark-parse 11.0.0 + remark-gfm 4.0.1（esbuild 0.25.12），并生成
  markdown.LICENSE.txt（59 个 MIT 包）；npm run build:markdown 可逐字节重建。
- 面板详情、桌面卡片详情按同一套 --mcode-* 变量排版，窄卡片降一档字号。
- 新增 dev/markdown.test.mjs，补充桌面卡片与面板接线测试，更新 README（中英）、
  DEVELOPMENT、PROVENANCE 与根 README 表格。

Author: dazhi

README.md

@@ -84,7 +84,7 @@ The MiniMax Code Agent communicates through the host MCP client. Business reques
 | [AI Node Canvas](plugins/antianqi/ai-node-canvas/) | An infinite-canvas node graph for MiniMax Code: wire text, image, video and audio runs into a graph, let each result flow downstream, and run media tools on any result | [antianqi](https://github.com/antianqi) |
 | [Agent Flow](plugins/huixin615/agent-flow/) | Import this plugin's Hook event file to inspect native task calls and sub-agent lifecycles, with exact task-to-child links when IDs are available. Choose a recorded chat or the latest imported record; no Host session files are opened. Requires MiniMax Code 3.1.4 or later | [Huixin615](https://github.com/Huixin615) |
 | [蹬王之王 · Expiry Guardian](plugins/hylouis233/expiry-guardian/) | Track credit and reset-card expiry from a local ledger you maintain, and get a "spend the card or let the credits burn first" recommendation with the reasoning spelled out | [Hylouis](https://github.com/Hylouis233) |
-| [MiniMax Pet](plugins/minimax-ai/minimax-pet/) | A lightweight companion with appearance, task and settings tabs, visible-session activity, answer-needed reminders, a one-click jump to a task's conversation (3.1.11 or later) and a transparent desktop pet. Requires MiniMax Code 3.1.6 or later | [MiniMax](https://github.com/MiniMax-AI) |
+| [MiniMax Pet](plugins/minimax-ai/minimax-pet/) | A lightweight companion with appearance, task and settings tabs, visible-session activity, answer-needed reminders, Markdown-rendered replies, a one-click jump to a task's conversation (3.1.11 or later) and a transparent desktop pet. Requires MiniMax Code 3.1.6 or later | [MiniMax](https://github.com/MiniMax-AI) |
 | [MCP OAuth Console](plugins/microbiosis/mcp-oauth-console/) | Sign in to MCP servers that require OAuth: device-code or authorization-code + PKCE flow, the `Authorization` header written into the MCP configuration, and an opt-in refresh before expiry | [Microbiosis](https://github.com/Microbiosis) |
 | [本机大盘 · Local Market Board](plugins/jzlikewei/kurumi-monitor/) | Watch your own machine as a stock terminal: CPU, GPU, temperature, memory, disk, network and every running process become listed stocks with live candlesticks, moving averages, a watchlist, a leaderboard and a trade tape, on macOS and Windows. Requires minimax Code 3.1.2 or later | [jzlikewei](https://github.com/jzlikewei) |
 

README.zh-CN.md

@@ -84,7 +84,7 @@ MiniMax Code Agent 通过宿主 MCP 客户端与 MiniApp 协作。业务请求
 | [AI 节点画布](plugins/antianqi/ai-node-canvas/README.zh-CN.md) | MiniMax Code 里的无限画布节点图：把文本、图片、视频、音频的生成接成一张图，结果顺着连线往下传，任何一张结果都能直接做二次处理 | [antianqi](https://github.com/antianqi) |
 | [Agent 协作透视](plugins/huixin615/agent-flow/README.zh-CN.md) | 手动导入插件 Hook 记录，查看原生 task 调用与子 Agent 运行区间；有明确 ID 时关联父子任务。可选择记录会话或一键查看最近导入的记录，不读取宿主会话文件。需要 MiniMax Code 3.1.4 或更高版本 | [Huixin615](https://github.com/Huixin615) |
 | [蹬王之王](plugins/hylouis233/expiry-guardian/README.md) | 看你自己维护的本地账本，算出「该用卡还是该留积分」，并把理由说清楚 | [Hylouis](https://github.com/Hylouis233) |
-| [MiniMax Pet](plugins/minimax-ai/minimax-pet/README.zh-CN.md) | 提供外观／任务／设置、可见会话状态、需要回答提醒、一键打开任务对话（3.1.11 起）和透明桌宠；需要 MiniMax Code 3.1.6 或更高版本 | [MiniMax](https://github.com/MiniMax-AI) |
+| [MiniMax Pet](plugins/minimax-ai/minimax-pet/README.zh-CN.md) | 提供外观／任务／设置、可见会话状态、需要回答提醒、按 Markdown 渲染的回复、一键打开任务对话（3.1.11 起）和透明桌宠；需要 MiniMax Code 3.1.6 或更高版本 | [MiniMax](https://github.com/MiniMax-AI) |
 | [MCP OAuth 令牌台](plugins/microbiosis/mcp-oauth-console/README.zh-CN.md) | 给需要 OAuth 的 MCP 服务器完成登录：设备码或授权码 + PKCE 流程，把 `Authorization` 头写入 MCP 配置，并可选择在到期前自动续期 | [Microbiosis](https://github.com/Microbiosis) |
 | [本机大盘](plugins/jzlikewei/kurumi-monitor/README.zh-CN.md) | 把本机当成行情终端来看：CPU、GPU、温度、内存、磁盘、网络与每个运行中的进程都是一只个股，实时 K 线、均线、自选行情、主力动向与逐笔成交，支持 macOS 与 Windows。需要 minimax Code 3.1.2 或更高版本 | [jzlikewei](https://github.com/jzlikewei) |
 

plugins/minimax-ai/minimax-pet/.minimax-plugin/plugin.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "name": "minimax-pet",
   "displayName": "MiniMax Pet",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "轻量桌宠，聚合主窗口可见会话的任务状态、需要回答的提醒和最新结果，支持外观切换及图集导入。",
   "author": "MiniMax",
   "icon": "icon.png",

plugins/minimax-ai/minimax-pet/PROVENANCE.md

@@ -1,6 +1,6 @@
 # Source and distribution
 
-Author: MiniMax ([MiniMax-AI](https://github.com/MiniMax-AI)). This is the 0.6.0 open-source edition of the MiniMax Pet MiniApp. It uses public MiniApp page APIs and contains no Host implementation. Public documentation, dependency URLs, and license notices have been prepared for this repository; private development references and acceptance records are not part of the package.
+Author: MiniMax ([MiniMax-AI](https://github.com/MiniMax-AI)). This is the 0.7.0 open-source edition of the MiniMax Pet MiniApp. It uses public MiniApp page APIs and contains no Host implementation. Public documentation, dependency URLs, and license notices have been prepared for this repository; private development references and acceptance records are not part of the package.
 
 ## Layout
 
@@ -27,7 +27,7 @@ The root `npm run check` validates package contracts through the repository's ex
 
 ## Dependencies and artwork
 
-Production JavaScript uses relative modules and Node built-ins. `jsdom` 24.1.3 is used only for DOM tests; the lockfile pins public npm registry URLs and integrity values. No dependency install or build step is required by the installed plugin.
+Production JavaScript uses relative modules and Node built-ins, plus the vendored `miniapp/client/vendor/markdown.mjs` (unified 11.0.5, remark-parse 11.0.0, remark-gfm 4.0.1 and their MIT dependency tree, built with esbuild 0.25.12). `npm run build:markdown` reproduces it from the pinned dev dependencies; the output is byte-stable, so `npm run check:package` compares it like any other file. Its notices live in `miniapp/client/vendor/markdown.LICENSE.txt`, generated from the same build. `jsdom` 24.1.3 is used only for DOM tests; the lockfile pins public npm registry URLs and integrity values. No dependency install or build step is required by the installed plugin.
 
 The bundled mint robot atlas is original geometric artwork generated by `scripts/generate-pet-art.mjs` from Node built-ins. `npm run generate:art` reproduces the atlas without external images or fonts and preserves `icon.png`. The purple octopus icon is a separate transparent PNG generated with OpenAI imagegen from a user-provided visual reference; model generation is not deterministic, and that reference image is not bundled. The `minimax-tako` octopus girl atlas was generated with MiniMax image generation from user-provided visual references and assembled by a local script; it is not reproducible from a command, and the reference images are not bundled. These assets use the same MiniMax [MIT License](LICENSE) as the original code and documentation; see [ARTWORK.md](ARTWORK.md). The `mmx-octopus` MMX octopus girl atlas was generated with a locally hosted open-weight diffusion model and assembled by a local script from source videos that are not shipped; it is not reproducible from a command. Its character and artwork are contributed by antianqi under the [MIT License](LICENSE); see [ARTWORK.md](ARTWORK.md). No externally sourced pet spritesheet is bundled.
 

plugins/minimax-ai/minimax-pet/README.md

@@ -7,14 +7,16 @@ A lightweight desktop companion for MiniMax Code, by **MiniMax**. It shows visib
 ## Features
 
 - **Appearance:** preview and select pets, import compatible pet JSON and spritesheets, and remove imported pets.
-- **Tasks:** recent reminders, visible user conversations, and a scrollable latest reply. Desktop cards preview up to five lines. Clicking a card keeps the pet visible; observed `ask_user` calls show “需要你回答” (needs your answer).
+- **Tasks:** recent reminders, visible user conversations, and a scrollable latest reply rendered as Markdown. Desktop cards preview up to five lines. Clicking a card keeps the pet visible; observed `ask_user` calls show “需要你回答” (needs your answer).
 - **Open the conversation:** on MiniMax Code 3.1.11 or later, a task's detail, in the panel and on the desktop, has a **打开对话** (open conversation) button, labelled **去回答** (go answer) while the task needs an answer. It brings the MiniMax Code main window forward on that conversation. Older clients do not show the button.
 - **Settings:** pet size, page-local reminder dismissal and mute, connection status, and reconnect.
 - **Desktop window:** a draggable transparent pet with compact notification cards. Return it to the main panel to use the three tabs.
 - **Theme:** on MiniMax Code 3.1.11 or later the panel and desktop cards follow the client's light or dark theme; older clients follow the system setting.
 
 The pet does not run Agent turns, create independent chats, write to chat inputs, comment on every session, stop tasks, or answer questionnaires. Selecting a task only reads its details; the main window switches only when you click **打开对话** or **去回答**.
 
+Version **0.7.0** renders each task's latest reply as Markdown: headings, emphasis, lists, task lists, fenced code, tables, quotes and links, with raw HTML shown as inert text and images as a label instead of a remote request. Notification cards and reminder previews stay plain text. Parsing uses a vendored bundle of unified, remark-parse and remark-gfm (MIT) built by `npm run build:markdown`; the page never builds an HTML string from model output. The bundle makes no network request and runs entirely in the page.
+
 Version **0.6.0** removes the **打招呼** (wave) and **跳一下** (jump) actions from the menu and the appearance page, and removes the original-chat draft with its voice input; the package no longer requests the microphone. It adds **打开对话** / **去回答** and the client theme. The supported baseline stays MiniMax Code 3.1.6: both additions are feature-detected and need no new access.
 
 ## Install and open
@@ -43,6 +45,7 @@ Earlier local prototypes use a different plugin ID. The Host gives `minimax-pet`
 - **Observations:** one global observer aggregates visible task lifecycle events. Up to three detailed observers follow active tasks and detect new ask tool events. A completed/removed task releases its detailed slot; another task enters only after the previous subscription settles. The initial snapshot contains up to 50 recent visible conversations; observed tasks remain while the Host confirms visibility.
 - **Coverage limits:** observers are tail-only. They cannot reconstruct questionnaires opened before subscribing or during a disconnect. More than three active tasks means only three receive detailed ask coverage. No observed ask does not prove no pending question. Historical idle tasks are not presented as newly completed.
 - **Local files:** the Node service serves packaged assets and stores preferences and user-imported JSON/WebP/PNG spritesheets under opaque `context.dataDir`. Imports, replacement recovery and deletion are limited to that plugin data. Browser storage is used only to migrate old view preferences.
+- **Rendered replies:** the latest reply is parsed as Markdown by the vendored parser and rebuilt as DOM nodes under the page's own stylesheet. Raw HTML in a reply is displayed as literal text, never executed or inserted as markup; links show their target on hover and are not opened; images are not fetched and appear as a text label.
 - **Host navigation:** only when you click **打开对话** or **去回答**, the page calls `host.navigation.open({ id: 'session', sessionId, source: 'local' })` for a conversation it already lists through `session.read`. It does not declare `hostAccess` and never reads which page of MiniMax Code you are on. It writes nothing to chat inputs and sends no message.
 - **Display preferences:** `host.ui.subscribe` reports the client theme, which the page applies; the reported language is ignored. No grant is involved.
 - **Network:** the plugin has no hard-coded external runtime endpoint; its own HTTP requests use its assigned loopback origin.
@@ -66,3 +69,5 @@ The complete editable source is at `sources/minimax-ai/minimax-pet/`. The instal
 ## License
 
 Original code, documentation, the robot, minimax-tako pet and icon: [MIT](LICENSE), Copyright 2026 MiniMax. Maiyatang artwork: MIT, Copyright 2026 Fectivnfy112357. The minimax-tako atlas was generated with MiniMax image generation. The default atlas is generated from editable geometric drawing code; the octopus icon and Maiyatang were generated with imagegen from supplied visual references. See [ARTWORK.md](ARTWORK.md). No externally sourced pet spritesheet is bundled. User-imported artwork keeps its own license.
+
+`miniapp/client/vendor/markdown.mjs` bundles 59 MIT-licensed packages from the unified, remark-parse and remark-gfm dependency trees. Each package keeps its own copyright notice in `miniapp/client/vendor/markdown.LICENSE.txt`, which `npm run build:markdown` regenerates from the packages esbuild actually includes.

plugins/minimax-ai/minimax-pet/README.zh-CN.md

@@ -8,14 +8,16 @@
 
 将仓库 `plugins/minimax-ai/minimax-pet/` 完整复制到 `<dataDir>/plugins/minimax-pet/`，包括隐藏的 `.minimax-plugin`；默认 `<dataDir>` 为 `~/.minimax`，自定义数据目录时采用实际配置。不要复制外层作者目录。重启 MiniMax Code、确认插件启用后，从 MiniApp 列表打开“MiniMax Pet”，或对 Agent 说“打开 MiniMax Pet”。点击“放到桌面”显示透明桌宠窗口。
 
-外观页支持选择、导入预览和删除已导入宠物；任务页显示提醒、全部可见任务和最近回复；设置页提供大小、提醒管理和重连。桌面通知最多预览五行，点击后可滚动读完整内容，桌宠保持可见。观察到 ask 时显示“需要你回答”。
+外观页支持选择、导入预览和删除已导入宠物；任务页显示提醒、全部可见任务和按 Markdown 渲染的最近回复；设置页提供大小、提醒管理和重连。桌面通知最多预览五行，点击后可滚动读完整内容，桌宠保持可见。观察到 ask 时显示“需要你回答”。
 
 在 MiniMax Code 3.1.11 及以上版本，面板和桌面上的任务详情都有“打开对话”按钮，任务需要回答时显示为“去回答”；点一下会把 MiniMax Code 主窗口切到这个对话。面板和桌面卡片的明暗也跟随 MiniMax Code 的主题。旧版本客户端不显示该按钮，明暗跟随系统设置。
 
 **0.5.10** 新增可选内置宠物 **麦芽糖**，是一位珊瑚粉触手长发的 Q 版全身章鱼娘。在“外观 → 选择宠物”中选择她，预览下方会显示她的自述；薄荷色机器人仍为默认宠物。麦芽糖采用现有 v2 图集，包含九种动作和十六个视线方向，沿用六帧、6.6 秒一轮的慢速待机，不新增权限或改变播放器。图集已通过校验，并在 Linux 的本地插件界面完成导入和选择；这不代表正式客户端的 bundled 安装或透明桌面窗口已验收。AI 创作流程和贡献者许可见[素材说明](ARTWORK.md)。
 
 **0.5.11** 新增可选内置宠物 **MMX 章鱼娘**，是一位橙发、白背心、棕格纹短裙的 Q 版全身章鱼娘。在“外观 → 选择宠物”中选择她即可；薄荷色机器人仍为默认宠物。她采用 v1 图集，包含九种动作，不含十六个视线方向，因此鼠标跟随对她不生效；沿用六帧、6.6 秒一轮的慢速待机，不新增权限或改变播放器。图集已通过校验。创作流程和贡献者许可见[素材说明](ARTWORK.md)。
 
+**0.7.0** 把任务最近回复按 Markdown 渲染：标题、强调、列表、任务清单、代码块、表格、引用和链接；回复里的原始 HTML 只作为文本显示，图片显示为文字标签而不发起网络请求。通知卡片和提醒预览仍为纯文本。解析使用 `npm run build:markdown` 打包的 unified + remark-parse + remark-gfm（MIT）；页面不会把模型输出拼成 HTML 字符串。
+
 **0.6.0** 删除了菜单和外观页里的“打招呼”“跳一下”，删除了原属聊天草稿及其语音输入，不再申请麦克风权限；新增“打开对话／去回答”和主题跟随。支持基线仍为 MiniMax Code 3.1.6：两项新功能都先检测客户端能力，不需要新增权限。
 
 旧的本地原型使用不同插件 ID。`minimax-pet` 会有独立的 Host 数据目录，安装本包不会自动搬迁旧插件的宠物和偏好；需要的素材先导出，保留旧安装和数据。
@@ -36,6 +38,8 @@
 
 偏好和用户导入素材写入独立的 `context.dataDir`；导入替换有中断恢复，删除限于本插件数据。不创建独立聊天、不写入聊天输入框、不逐会话点评、不自动调用模型、不发送或停止用户会话、不代答问卷。
 
+回复由随包 vendor 的解析器转为 Markdown 结构，再在页面里用 DOM 节点重建：原始 HTML 只按文本显示，不会插入页面或执行；链接只显示地址不打开；图片不请求，只显示文字标签。
+
 只有在你点击“打开对话”或“去回答”时，页面才调用 `host.navigation.open({ id: 'session', sessionId, source: 'local' })`，目标是已通过 `session.read` 列出的会话。未声明 `hostAccess`，不读取你在 MiniMax Code 里停留的页面。`host.ui.subscribe` 只用来读取并应用主题，返回的语言不使用，无需授权。不使用也不声明麦克风、摄像头或系统通知。插件本身没有硬编码的外部服务地址，只使用分配的 loopback 源，不启动额外子进程或 shell。
 
 ## Agent Skill
@@ -46,6 +50,8 @@
 
 保留源码／分发双目录，构建与完整字节对比步骤见 [PROVENANCE.md](PROVENANCE.md)。原创代码、文档、两只内置宠物和图标均按 [MIT](LICENSE) 开源，作者为 MiniMax。默认的薄荷色机器人图集由可编辑的几何绘图代码生成；第二只内置宠物“MiniMax Code 章鱼娘”（`minimax-tako`）粉发、戴眼镜、酒红触手，由 MiniMax 图像生成根据用户提供的参考图绘制后拼成 v2 图集，无法用命令重新生成；紫色章鱼图标由 imagegen 根据用户提供的视觉参考生成，重新生成图集不会覆盖图标。详见[素材说明](ARTWORK.md)；参考图和外部宠物图集不随包分发，用户自行导入的素材保留其各自许可。
 
+`miniapp/client/vendor/markdown.mjs` 打包了 unified、remark-parse、remark-gfm 依赖树里 59 个 MIT 许可的包，各自的版权声明保留在 `miniapp/client/vendor/markdown.LICENSE.txt`，该文件由 `npm run build:markdown` 按 esbuild 实际打包的包清单生成。
+
 麦芽糖素材由 Fectivnfy112357 贡献，同样采用 MIT 许可。麦芽糖通过 MiniMax 章鱼娘工坊工作流创作，使用 OpenAI imagegen 生成，再裁切、等比缩放和组装为透明图集；重新生成默认图集不会覆盖她。
 
 MMX 章鱼娘素材由 antianqi 贡献，同样采用 MIT 许可。她通过本机部署的开源扩散模型出图与出视频，再由本地脚本抽帧、抠透明、落格拼成 v1 图集，无法用命令重新生成；重新生成默认图集不会覆盖她。