fix(md): require 4+ spaces for indented code blocks (CommonMark)

src/md.ts

@@ -17,7 +17,7 @@ import { bufToString } from './util.ts'
 
 export function transformMarkdown(buf: Buffer | string): string {
   const out: string[] = []
-  const tabRe = /^(  +|\t)/
+  const tabRe = /^( {4,}|\t)/
   const fenceRe =
     /^(?<indent> {0,3})(?<fence>(`{3,20}|~{3,20}))(?:(?<js>js|javascript|ts|typescript)|(?<bash>sh|shell|bash)|.*)$/
 

test/md.test.ts

@@ -22,8 +22,21 @@ describe('transformMarkdown()', () => {
       assert.equal(transformMarkdown('\n'), '// \n// ')
     })
 
-    test('preserves tab-indented blocks after a blank line (legacy behavior)', () => {
-      assert.equal(transformMarkdown('  \n    '), '  \n    ')
+    test('preserves 4+ space indented blocks after a blank line (CommonMark)', () => {
+      assert.equal(transformMarkdown('    \n    '), '    \n    ')
+    })
+
+    test('does NOT treat 2-space indented list-item continuation as code (#1388)', () => {
+      // CommonMark: indented code blocks require 4+ spaces. A 2-space-indented
+      // line after a blank line under a list item is list continuation prose,
+      // not code. Treating it as code throws SyntaxError on the next eval.
+      const input = `- on localhost
+
+  This assumes you have a local node running
+`
+      const result = transformMarkdown(input)
+      // Prose line must be commented, not left as raw code.
+      assert.ok(!/^  This assumes/m.test(result), 'expected prose line to not be left as raw code')
     })
 
     test('does not treat a mid-paragraph fence as a fenced block (legacy behavior)', () => {