345-plugin-zip-license-texts
2 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| cc9c70287c |
Ship third-party license texts in plugin ZIPs (#345)
Some checks failed
CI / Lint, typecheck, test (pull_request) Successful in 6m51s
CI / Build container images (pull_request) Successful in 1m13s
CI / Auth e2e pack (pull_request) Successful in 9m28s
CI / Import/export fidelity gate (pull_request) Successful in 54s
CD / Build and push images (push) Successful in 15s
CD / Deploy to Test (push) Successful in 16s
CD / Smoke tests against Test (push) Successful in 1m18s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 6m57s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 9m7s
CI / Import/export fidelity gate (push) Successful in 57s
Restore drill / Restore the latest backup into a scratch stack (push) Failing after 17s
The drawio, excalidraw, and mermaid plugin packages redistribute third-party material (the draw.io webapp, the Excalidraw editor and its fonts, mermaid and its dependency tree) without the license texts their licenses require. Every affected ZIP now carries a licenses/ directory: - licenses/THIRD-PARTY-NOTICES.txt is generated from the esbuild metafile (packages/plugins/third-party-licenses.mjs), so the notice list is derived from what actually lands in plugin.js and cannot drift the way a hand-maintained list would. - drawio additionally extracts the upstream LICENSE from the pinned release tarball (Apache-2.0 requires the text with redistribution); the extraction guard also heals vendor/ caches from before this change. The CI fast path (no vendor fetch, no ZIP) is unchanged. - excalidraw additionally commits curated texts (MIT for Excalidraw, per-font OFL-1.1/MIT with each font's own copyright statement, plus a FONT-NOTICES.md attribution table), because neither the npm package nor upstream ships any license files for them. The api-side package validator accepts additional ZIP entries, so installed plugins are unaffected beyond the new files. Closes #345 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aoPvnakfBP28nAfijgUY9 |
|||
| c164a031e4 |
#136 Excalidraw-Block-Plugin
Neues Referenz-Block-Plugin „Excalidraw" (handgezeichnete Whiteboard-
Skizzen), analog zum draw.io-Plugin. Anders als draw.io (vendored Webapp)
ist Excalidraw eine React-npm-Lib: esbuild bündelt Controller + React +
Excalidraw in plugin.js, die Font-/Locale-/Data-Assets werden aus
node_modules in den ZIP-Root kopiert und zur Laufzeit über
EXCALIDRAW_ASSET_PATH (Plugin-Asset-Basis) geladen — nichts spricht mit
excalidraw.com, die Sandbox-CSP pinnt jede Anfrage auf self.
- manifest.json: kind=code, Block-Extension-Point diagram,
permissions blockData+ui, fallback "[Excalidraw]".
- src/plugin.tsx: Render-Modus zeigt gespeichertes SVG; Edit-Modus zeigt
Snapshot + Bearbeiten-Knopf (leerer Block öffnet direkt); Vollbild via
host.ui.enterFullscreen mountet <Excalidraw> (React), „Speichern &
Beenden" exportiert per exportToSvg, persistiert {scene, svg} über
host.blockData.setData → Fallback-Renderer bedient Lese-/Public-Ansicht
+ Exporte ohne Backend-Änderung.
- build.mjs: esbuild (jsx automatic, css→text, production-conditions) +
fflate-ZIP. Build erzeugt excalidraw-1.0.0.zip: 15,5 MiB zip /
22,3 MiB unpacked (Limits 64/256 MiB — passt).
- i18n de+en, globals.d.ts (CSS-Modul-Deklaration).
pnpm-Override @floating-ui/react-dom@2.1.2: Excalidraw 0.18.1 zieht sonst
@floating-ui/dom@^1.8.0, das (noch) nicht im Registry ist und `pnpm
install` repo-weit bricht (dokumentiert in pnpm-workspace.yaml).
VERIFIZIERT: typecheck/lint, Manifest-Validierung (SDK), Build+ZIP-Größe.
NICHT lokal verifiziert (braucht Preview/Test-Stage): Laufzeit —
Excalidraw-Rendering + Speichern unter Sandbox-CSP, Font-Laden vom
Asset-Pfad. Prod-Installation macht Stefan als Site-Admin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC
|
