@marimo-team/islands 0.25.3-dev232 → 0.25.3-dev233

package/dist/{number-overlay-editor-Dq9rh69H.js → number-overlay-editor-DvLSuv8j.js}

@@ -1,6 +1,6 @@
 import { a as e } from "./rolldown-runtime-Cb76FRpK.js";
 import { t } from "./react-sHtZdjeP.js";
-import { a as n } from "./glide-data-editor-DpC5t4zI.js";
+import { a as n } from "./glide-data-editor-DyC7T9ey.js";
 //#region ../node_modules/.pnpm/@glideapps+glide-data-grid@6.0.4-alpha24_lodash@4.17.21_marked@15.0.12_react-dom@19.3.0_27cffe7f1bc30287d59ac27db3240c5b/node_modules/@glideapps/glide-data-grid/dist/esm/internal/data-grid-overlay-editor/private/number-overlay-editor-style.js
 var r = /* @__PURE__ */ e(t()), i = /*#__PURE__*/ n("div")({
 	name: "NumberOverlayEditorStyle",

package/dist/{process-output-BOvkTEDt.js → process-output-D2ISIyIs.js}

@@ -1,4 +1,4 @@
-import { k as e } from "./html-to-image-0FooaKop.js";
+import { k as e } from "./html-to-image-Gx4q3ZoD.js";
 import { m as t } from "./tooltip-C3UnvsRe.js";
 import { $ as n, et as r } from "./error-entries-CRPfxMqm.js";
 import { t as i } from "./strings-BGW-fXVJ.js";

package/dist/{reveal-component-UGpuydpR.js → reveal-component-BM4snSvm.js}

@@ -3,7 +3,7 @@ import { c as t, g as n, h as r, m as i, t as a } from "./button-B6RjDKJx.js";
 import { t as o } from "./react-sHtZdjeP.js";
 import { t as s } from "./compiler-runtime-CldRdSsv.js";
 import { m as c, t as l } from "./tooltip-C3UnvsRe.js";
-import { $ as u, Q as d, Z as f, an as p, i as m, l as h, ln as g, n as _, on as v, r as y, t as b, u as x } from "./common-B85jDHUj.js";
+import { $ as u, Q as d, Z as f, an as p, i as m, l as h, ln as g, n as _, on as v, r as y, t as b, u as x } from "./common-D4YIvHFJ.js";
 import { M as S } from "./select-BSxlITBo.js";
 import { Y as ee } from "./dropdown-menu-BRiE7Vnp.js";
 import { Pt as C } from "./error-entries-CRPfxMqm.js";
@@ -11,7 +11,7 @@ import { t as w } from "./jsx-runtime-3BD1kT0s.js";
 import { r as T } from "./use-restore-focus-BWO0z1lo.js";
 import { D as E, t as D, x as O } from "./utils-DXkj82sK.js";
 import { o as k } from "./static-state-BldGd99T.js";
-import { a as A, n as te, t as ne } from "./code-visibility-BFAMp8wF.js";
+import { a as A, n as te, t as ne } from "./code-visibility-Dqc_vlop.js";
 /* empty css                */
 var j = c("sticky-note", [["path", {
 	d: "M21 9a2.4 2.4 0 0 0-.706-1.706l-3.588-3.588A2.4 2.4 0 0 0 15 3H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2z",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marimo-team/islands",
-  "version": "0.25.3-dev232",
+  "version": "0.25.3-dev233",
   "main": "dist/main.js",
   "types": "dist/index.d.ts",
   "type": "module",

package/src/components/editor/actions/useNotebookActions.tsx

@@ -349,7 +349,7 @@ export function useNotebookActions({
               code: code.contents,
               baseUrl: `${Constants.molab}/new`,
             });
-            window.open(url, "_blank");
+            window.open(url, "_blank", "noopener");
           },
         },
       ],
@@ -662,35 +662,35 @@ export function useNotebookActions({
           icon: <BookMarkedIcon size={14} strokeWidth={1.5} />,
           label: "Documentation",
           handle: () => {
-            window.open(Constants.docsPage, "_blank");
+            window.open(Constants.docsPage, "_blank", "noopener");
           },
         },
         {
           icon: <GitHubIcon className="h-3.5 w-3.5" />,
           label: "GitHub",
           handle: () => {
-            window.open(Constants.githubPage, "_blank");
+            window.open(Constants.githubPage, "_blank", "noopener");
           },
         },
         {
           icon: <MessagesSquareIcon size={14} strokeWidth={1.5} />,
           label: "Discord Community",
           handle: () => {
-            window.open(Constants.discordLink, "_blank");
+            window.open(Constants.discordLink, "_blank", "noopener");
           },
         },
         {
           icon: <YouTubeIcon className="h-3.5 w-3.5" />,
           label: "YouTube",
           handle: () => {
-            window.open(Constants.youtube, "_blank");
+            window.open(Constants.youtube, "_blank", "noopener");
           },
         },
         {
           icon: <FileTextIcon size={14} strokeWidth={1.5} />,
           label: "Changelog",
           handle: () => {
-            window.open(Constants.releasesPage, "_blank");
+            window.open(Constants.releasesPage, "_blank", "noopener");
           },
         },
       ],

package/src/components/editor/output/VideoOutput.tsx

@@ -1,5 +1,6 @@
 /* Copyright 2026 Marimo. All rights reserved. */
 import type { JSX } from "react";
+import { useSanitizeHtml } from "@/plugins/core/sanitize";
 
 interface Props {
   src: string;
@@ -7,5 +8,10 @@ interface Props {
 }
 
 export const VideoOutput = ({ src, className }: Props): JSX.Element => {
+  const shouldSanitize = useSanitizeHtml();
+  if (shouldSanitize) {
+    return <video className={className} src={src} controls={true} />;
+  }
+  // oxlint-disable-next-line react/iframe-missing-sandbox, react-doctor/iframe-missing-sandbox -- Trusted notebook output can include active documents.
   return <iframe className={className} src={src} title="Video output" />;
 };

package/src/components/editor/output/__tests__/VideoOutput.test.tsx

@@ -0,0 +1,131 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+import { act, render } from "@testing-library/react";
+import { Provider } from "jotai";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { hasRunAnyCellAtom } from "@/components/editor/cell/useRunCells";
+import { OutputRenderer } from "@/components/editor/Output";
+import { configOverridesAtom } from "@/core/config/config";
+import { initialModeAtom } from "@/core/mode";
+import { store } from "@/core/state/jotai";
+import { VideoOutput } from "../VideoOutput";
+
+function snapshotTrustState() {
+  return {
+    hasRunAnyCell: store.get(hasRunAnyCellAtom),
+    overrides: store.get(configOverridesAtom),
+    mode: store.get(initialModeAtom),
+    exportContext: window.__MARIMO_EXPORT_CONTEXT__,
+  };
+}
+
+describe("VideoOutput", () => {
+  let previous: ReturnType<typeof snapshotTrustState>;
+
+  beforeEach(() => {
+    previous = snapshotTrustState();
+    store.set(hasRunAnyCellAtom, false);
+    store.set(configOverridesAtom, { runtime: { auto_instantiate: false } });
+    store.set(initialModeAtom, "edit");
+    delete window.__MARIMO_EXPORT_CONTEXT__;
+  });
+
+  afterEach(() => {
+    store.set(hasRunAnyCellAtom, previous.hasRunAnyCell);
+    store.set(configOverridesAtom, previous.overrides);
+    store.set(initialModeAtom, previous.mode);
+    if (previous.exportContext) {
+      window.__MARIMO_EXPORT_CONTEXT__ = previous.exportContext;
+    } else {
+      delete window.__MARIMO_EXPORT_CONTEXT__;
+    }
+  });
+
+  function renderVideo(src = "https://example.com/video.mp4") {
+    return render(
+      <Provider store={store}>
+        <VideoOutput src={src} className="output" />
+      </Provider>,
+    );
+  }
+
+  it.each([
+    "https://example.com/video.mp4",
+    "data:video/mp4;base64,AAAA",
+    "./@file/123-video.mp4",
+  ])("preserves the media source and controls before execution: %s", (src) => {
+    const { container } = renderVideo(src);
+    const video = container.querySelector("video");
+    expect(video).toHaveAttribute("src", src);
+    expect(video).toHaveAttribute("controls");
+    expect(video).toHaveClass("output");
+    expect(container.querySelector("iframe")).toBeNull();
+  });
+
+  it("keeps direct and JSON video outputs out of frames before execution", () => {
+    const src = `data:text/html,${encodeURIComponent("<script>parent.postMessage('cached-video', '*')</script>")}`;
+    const { container } = render(
+      <Provider store={store}>
+        <OutputRenderer
+          message={{ channel: "output", mimetype: "video/mp4", data: src }}
+        />
+        <OutputRenderer
+          message={{
+            channel: "output",
+            mimetype: "application/json",
+            data: { video: `video/mp4:${src}` },
+          }}
+        />
+      </Provider>,
+    );
+    expect(container.querySelector("iframe")).toBeNull();
+    const videos = container.querySelectorAll("video");
+    expect(videos).toHaveLength(2);
+    for (const video of videos) {
+      expect(video).toHaveAttribute("src", src);
+    }
+  });
+
+  it("updates an existing output after the user runs a cell", () => {
+    const { container } = renderVideo();
+    expect(container.querySelector("video")).not.toBeNull();
+    act(() => store.set(hasRunAnyCellAtom, true));
+    expect(container.querySelector("video")).toBeNull();
+    expect(container.querySelector("iframe")).toHaveAttribute(
+      "src",
+      "https://example.com/video.mp4",
+    );
+  });
+
+  it.each(["app", "auto-instantiate", "export"] as const)(
+    "preserves iframe output in a trusted %s context",
+    (context) => {
+      switch (context) {
+        case "app":
+          store.set(initialModeAtom, "read");
+          break;
+        case "auto-instantiate":
+          store.set(configOverridesAtom, {
+            runtime: { auto_instantiate: true },
+          });
+          break;
+        case "export":
+          window.__MARIMO_EXPORT_CONTEXT__ = { trusted: true };
+          break;
+      }
+      const { container } = renderVideo();
+      expect(container.querySelector("video")).toBeNull();
+      expect(container.querySelector("iframe")).toHaveAttribute(
+        "title",
+        "Video output",
+      );
+      expect(container.querySelector("iframe")).toHaveClass("output");
+    },
+  );
+
+  it("uses native video before the app mode is initialized", () => {
+    store.set(initialModeAtom, undefined);
+    const { container } = renderVideo();
+    expect(container.querySelector("video")).not.toBeNull();
+    expect(container.querySelector("iframe")).toBeNull();
+  });
+});

package/src/core/vscode/__tests__/vscode-bindings.test.ts

@@ -0,0 +1,125 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const logger = vi.hoisted(() => ({
+  log: vi.fn(),
+  warn: vi.fn(),
+  error: vi.fn(),
+}));
+vi.mock("@/utils/Logger", () => ({ Logger: logger }));
+vi.mock("@/core/hotkeys/shortcuts", () => ({ isPlatformMac: () => true }));
+
+describe("VS Code paste messages", () => {
+  const originalUrl = window.location.href;
+  const setData = vi.fn();
+  let parent: Window;
+  let child: Window;
+  let input: HTMLTextAreaElement;
+  let cleanupListeners: () => void;
+  const onPaste = vi.fn();
+
+  beforeEach(async () => {
+    vi.resetModules();
+    const parentFrame = document.createElement("iframe");
+    const childFrame = document.createElement("iframe");
+    input = document.createElement("textarea");
+    document.body.append(parentFrame, childFrame, input);
+    if (!parentFrame.contentWindow || !childFrame.contentWindow) {
+      throw new Error("Test frames need windows");
+    }
+    parent = parentFrame.contentWindow;
+    child = childFrame.contentWindow;
+    vi.stubGlobal("parent", parent);
+    vi.stubGlobal(
+      "DataTransfer",
+      class {
+        public setData = setData;
+      },
+    );
+    vi.stubGlobal(
+      "ClipboardEvent",
+      class extends Event {
+        public clipboardData: DataTransfer | undefined;
+        public constructor(type: string, init: ClipboardEventInit) {
+          super(type);
+          this.clipboardData = init.clipboardData ?? undefined;
+        }
+      },
+    );
+    window.history.replaceState(null, "", "?vscode=true");
+    input.addEventListener("paste", onPaste);
+    input.focus();
+    const windowListeners = vi.spyOn(window, "addEventListener");
+    const documentListeners = vi.spyOn(document, "addEventListener");
+    cleanupListeners = () => {
+      for (const [type, listener, options] of windowListeners.mock.calls) {
+        window.removeEventListener(type, listener, options);
+      }
+      for (const [type, listener, options] of documentListeners.mock.calls) {
+        document.removeEventListener(type, listener, options);
+      }
+    };
+    const { maybeRegisterVSCodeBindings } = await import("../vscode-bindings");
+    maybeRegisterVSCodeBindings();
+  });
+
+  afterEach(() => {
+    cleanupListeners();
+    vi.restoreAllMocks();
+    vi.unstubAllGlobals();
+    document.body.replaceChildren();
+    window.history.replaceState(null, "", originalUrl);
+  });
+
+  function send(data: unknown, source: Window | null = parent) {
+    window.dispatchEvent(
+      new MessageEvent("message", {
+        data,
+        source,
+        origin: "vscode-webview://dynamic-parent",
+      }),
+    );
+  }
+
+  it.each(["clipboard text", ""])(
+    "accepts parent paste with text %j",
+    (text) => {
+      send({ command: "paste", text });
+      expect(setData).toHaveBeenCalledWith("text/plain", text);
+      expect(onPaste).toHaveBeenCalledOnce();
+      expect(logger.error).not.toHaveBeenCalled();
+    },
+  );
+
+  it("rejects a child frame even when its reported origin matches", () => {
+    send({ command: "paste", text: "unsolicited" }, child);
+    expect(onPaste).not.toHaveBeenCalled();
+    expect(setData).not.toHaveBeenCalled();
+  });
+
+  it("rejects a message without a source window", () => {
+    send({ command: "paste", text: "unsolicited" }, null);
+    expect(onPaste).not.toHaveBeenCalled();
+  });
+
+  it.each(
+    [
+      null,
+      [],
+      {},
+      "paste",
+      1,
+      true,
+      { command: "paste" },
+      { command: "paste", text: {} },
+      { command: "paste", text: 12 },
+      { command: "paste", text: null },
+      { command: "execute", text: "unexpected" },
+    ].map((data) => ({ data })),
+  )("ignores malformed parent messages without errors: %j", ({ data }) => {
+    send(data);
+    expect(onPaste).not.toHaveBeenCalled();
+    expect(setData).not.toHaveBeenCalled();
+    expect(logger.error).not.toHaveBeenCalled();
+  });
+});

package/src/core/vscode/vscode-bindings.ts

@@ -1,6 +1,7 @@
 /* Copyright 2026 Marimo. All rights reserved. */
 
 import { Logger } from "@/utils/Logger";
+import { isRecord } from "@/utils/records";
 import { KnownQueryParams } from "../constants";
 import { isPlatformMac } from "../hotkeys/shortcuts";
 import { isWasm } from "../wasm/utils";
@@ -53,9 +54,20 @@ function registerCopyPaste() {
     });
   });
 
-  window.addEventListener("message", async (event) => {
+  window.addEventListener("message", async (event: MessageEvent<unknown>) => {
+    // VS Code assigns each parent webview a different origin.
+    if (event.source !== window.parent) {
+      return;
+    }
+    const message = event.data;
+    if (
+      !isRecord(message) ||
+      message.command !== "paste" ||
+      typeof message.text !== "string"
+    ) {
+      return;
+    }
     try {
-      const message = event.data;
       const isMac = isPlatformMac();
       switch (message.command) {
         case "paste":

package/src/plugins/impl/data-frames/panel.tsx

@@ -397,6 +397,7 @@ const AddTransformDropdown: React.FC<
               window.open(
                 "https://github.com/marimo-team/marimo/issues/new?title=New%20dataframe%20transform:&labels=enhancement&template=feature_request.yaml",
                 "_blank",
+                "noopener",
               );
             }}
           >