2 Commits

Author	SHA1	Message	Date
Claude Fable 5	cc9c70287c	Ship third-party license texts in plugin ZIPs (#345) ... The drawio, excalidraw, and mermaid plugin packages redistribute third-party material (the draw.io webapp, the Excalidraw editor and its fonts, mermaid and its dependency tree) without the license texts their licenses require. Every affected ZIP now carries a licenses/ directory: - licenses/THIRD-PARTY-NOTICES.txt is generated from the esbuild metafile (packages/plugins/third-party-licenses.mjs), so the notice list is derived from what actually lands in plugin.js and cannot drift the way a hand-maintained list would. - drawio additionally extracts the upstream LICENSE from the pinned release tarball (Apache-2.0 requires the text with redistribution); the extraction guard also heals vendor/ caches from before this change. The CI fast path (no vendor fetch, no ZIP) is unchanged. - excalidraw additionally commits curated texts (MIT for Excalidraw, per-font OFL-1.1/MIT with each font's own copyright statement, plus a FONT-NOTICES.md attribution table), because neither the npm package nor upstream ships any license files for them. The api-side package validator accepts additional ZIP entries, so installed plugins are unaffected beyond the new files. Closes #345 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aoPvnakfBP28nAfijgUY9	2026-08-16 19:00:26 +02:00
Claude Fable 5	97f94f247b	draw.io reference plugin: fullscreen editing, inline SVG rendering ... A new block plugin bundling the OFFICIAL draw.io editor — nothing ever loads from diagrams.net; the sandbox CSP pins every request to the plugin's own version-pinned asset path (zero-external-network verified live via a request-capture run). Plugin (packages/plugins/drawio): - block data { xml, svg }: xml is the draw.io source (document of record), svg the rendered snapshot as raw markup — render mode, office/PDF exports (the existing fallback renderer already inlines data.svg) and the public view all show the diagram without running diagram code - edit mode: snapshot + "edit in fullscreen" (an empty block opens the editor immediately); the bundled editor runs in a child iframe of the plugin's own assets and speaks draw.io's JSON embed protocol — Save & Exit exports xmlsvg, persists { xml, svg } via blockData, and drops back to the inline size - build.mjs fetches the pinned release (v30.3.6) into a gitignored vendor/ cache (fonts-build pattern; skipped in CI — plugin.js still bundles, the installable ZIP needs a dev machine) and packs a trimmed webapp subset: no dev sources, no embed.diagrams.net integrations bundle, no standalone viewers, no MathJax/templates/PWA — 27 MiB ZIP, 85 MiB unpacked, de+en editor languages Host/SDK extensions (generic, not drawio-specific): - new ui.enterFullscreen()/exitFullscreen(): the surface's frame becomes a viewport-covering overlay — same sandboxed iframe, only geometry changes; destroy removes the frame, so a vanished plugin can never leave the app covered - sandbox CSP: connect-src/frame-src now allow the plugin's OWN asset path (was 'none') — bundled apps lazy-load their resources and run in a child frame, but the api and external hosts stay unreachable; HTML assets are served with the same CSP so a packaged page cannot widen the rules, and child frames inherit the sandbox attribute - plugin size limits raised (ZIP 5→64 MiB, unpacked 20→256 MiB) for bundled-app plugins; content types for xml/txt/ico assets Verified end to end against a local stack (9/9): install via dropzone (85 MiB validation), block insert, fullscreen entry, bundled editor boots inside the double sandbox (German UI), shape drawn, Save & Exit persists, snapshot renders inline, survives reload, zero off-origin requests throughout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 14:15:30 +02:00