collabmd 0.1.47 → 0.1.48

package/README.md

@@ -65,7 +65,8 @@ Prefer video? [Open the WebM demo](https://raw.githubusercontent.com/andes90/col
 - **Local-files-first** — your filesystem remains the source of truth
 - **Realtime collaboration** — multiple people can edit the same file at the same time via Yjs
 - **External edit sync** — changes made from tools like Obsidian or direct file writes are reflected back into open documents and the file explorer
-- **File upload** — import multiple supported Markdown, Base, diagram, image, and PDF files into the vault from the file explorer
+- **Git review** — review an open file's changes, include them in the next commit, and commit with a message from the browser
+- **File upload** — import multiple supported Markdown, HTML, Base, diagram, image, and PDF files into the vault from the file explorer
 - **Markdown with context** — live preview, wiki-links, backlinks, outline, quick switcher, and scroll sync
 - **Global text search** — search text across supported vault files with ripgrep-backed results grouped by file
 - **Source-anchored comments** — comment on lines or selected text with inline markers and preview bubbles, or pin threads to Excalidraw elements
@@ -180,15 +181,15 @@ collabmd ~/my-vault --no-tunnel
 
 CollabMD starts a local server, scans the vault, and opens a browser-based editor with:
 
-- **File explorer sidebar** — upload, browse, create, rename, and delete `.md`, `.markdown`, `.mdx`, `.base`, `.mmd`, `.mermaid`, `.puml`, `.plantuml`, `.dsl`, `.excalidraw`, `.drawio`, `.pdf`, and supported image files plus folders
-- **Live preview** — rendered as you type, with syntax-highlighted code blocks, public video embeds, plus Mermaid, PlantUML, and Structurizr diagrams
+- **File explorer sidebar** — upload, browse, create, rename, and delete `.md`, `.markdown`, `.mdx`, `.html`, `.htm`, `.base`, `.mmd`, `.mermaid`, `.puml`, `.plantuml`, `.dsl`, `.excalidraw`, `.drawio`, `.pdf`, and supported image files plus folders
+- **Live preview** — rendered as you type, with sandboxed static HTML, syntax-highlighted code blocks, public video embeds, plus Mermaid, PlantUML, and Structurizr diagrams
 - **Anchored comments** — add comments from the editor or selected Excalidraw elements, reopen threads in context, and review them from the comments drawer
 - **`[[wiki-links]]` + backlinks** — jump between notes and inspect linked mentions
 - **Room chat** — discuss changes without leaving the workspace
 - **Presence + follow mode** — see who is online and follow another collaborator's active cursor
 - **Quick switcher, global text search, and outline** — move around large vaults and long documents faster
-- **Document export** — download Markdown notes as self-contained HTML or DOCX, or print/save them as PDF; rendered diagrams and images are included
-- **Standalone diagram files** — open `.mmd` / `.mermaid`, `.puml` / `.plantuml`, or `.dsl` files in side-by-side editor + preview; Structurizr workspaces provide context → container → component navigation; `.excalidraw` files use direct preview mode, `.drawio` files use an embedded diagrams.net editor/viewer, and `.pdf` files use a readonly browser preview
+- **Document export** — download individual Markdown notes as self-contained HTML or DOCX, print/save notes or whole folders as PDF, export folders as one offline HTML document, or download their source files and assets as ZIP
+- **Standalone diagram files** — open `.mmd` / `.mermaid`, `.puml` / `.plantuml`, or `.dsl` files in side-by-side editor + preview; Structurizr workspaces provide context → container → component navigation; `.excalidraw` files support frame-based presentations with arrow-key navigation and `Escape` to exit, `.drawio` files use an embedded diagrams.net editor/viewer, and `.pdf` files use a readonly browser preview
 
 Text comment threads are source-anchored for markdown, Mermaid, PlantUML, and Structurizr DSL files. You can comment on a whole line or a text selection, then reopen the thread from either the editor marker or preview bubble. Excalidraw threads attach to selected canvas elements and also appear in the workspace overview. Draw.io comments are not supported.
 
@@ -196,6 +197,8 @@ Draw.io files use the diagrams.net embed/runtime. Opening a `.drawio` file direc
 
 Draw.io collaboration is intentionally conservative in this release: one connected client holds the edit lease for a `.drawio` file, while other viewers open it read-only and refresh after saves land. This avoids silent overwrite races without claiming true realtime canvas co-editing.
 
+HTML files open in preview mode by default, with split view still available from the view toggle and a preview-header action for maximizing the iframe. Scripts are disabled until each viewer explicitly runs the current version; any content change resets that consent. Enabled scripts run inside an opaque-origin sandbox without same-origin access, while a restrictive CSP blocks API connections, forms, workers, nested frames, external subresources, popups, and top-level navigation. Inline CSS, fragment links, and self-contained `data:`/`blob:` images, fonts, and media remain supported.
+
 Markdown video embeds are opt-in and use standard image syntax such as `![Video](https://www.youtube.com/watch?v=...)` or `![Video](https://cdn.example.com/demo.webm)`. The preview currently supports public YouTube URLs plus direct public `https` video files ending in `.mp4`, `.webm`, or `.ogg`. The editor toolbar also includes a `Video` action that inserts the same Markdown syntax for you.
 
 Your filesystem is the source of truth. CollabMD reads files from disk, uses Yjs for realtime collaboration, and continuously writes plain text back to disk as you type. External changes from tools like Obsidian, direct file writes, or git-driven file updates are watched and reconciled back into live rooms and the explorer. The file explorer can import multiple supported vault files at once; uploads preserve their names and bytes, reject duplicates, and include PDF files for readonly preview.
@@ -738,7 +741,7 @@ cp .env.example .env
 - If `COLLABMD_GIT_SSH_KNOWN_HOSTS_FILE` is not set, SSH falls back to `StrictHostKeyChecking=accept-new`.
 - External filesystem edits are reconciled back into active rooms and the explorer. Ambiguous watcher bursts still fall back to batched workspace reconciliation.
 - `.obsidian`, `.git`, `.trash`, and `node_modules` directories are ignored.
-- Markdown, Base, Mermaid, PlantUML, Structurizr DSL, draw.io, Excalidraw, PDF, and image files are tracked by the vault tree; global text search indexes supported text formats.
+- Markdown, HTML, Base, Mermaid, PlantUML, Structurizr DSL, draw.io, Excalidraw, PDF, and image files are tracked by the vault tree; global text search indexes supported text formats.
 - PlantUML preview rendering is server-side and uses `PLANTUML_SERVER_URL`; point it at a self-hosted renderer if you do not want to use the public PlantUML service.
 - Structurizr previews use a read-only official Local sidecar and a disposable `.collabmd/structurizr` mirror; the authoritative vault is never mounted into the renderer as its data directory.
 - `docker compose up` uses the included local PlantUML and Structurizr services and avoids public diagram renderers by default. The initial git clone may also require a longer health-check grace period than a purely local vault.