mirror of
https://github.com/storytold/wordcraft.git
synced 2026-10-24 10:27:44 -06:00
85698c4d79
- `ui.render` and `ui.screenshot` without a `path` return the PNG as base64 `png` in the reply instead of writing a fixed name into the shared temporary folder, where another user could have planted a link to one of this user's files; the MCP bridge's `render_page` and `screenshot` use that and no longer round-trip through `temp_dir()/wordcraft-mcp-*.png`. A given `path` still works as before (#678). - One allow-list, `wordcraft_doc::link`: `is_web_or_mail_link` for Ctrl/⌘-click and `is_safe_href` (web, mail, `#bookmark`, relative path; schemes read the way browsers do, so `java\nscript:` is a script) for the HTML and Markdown exporters and the HTML importer. Scripts and other schemes export as plain text (#679). - Tests: the allow-list, exporters with hostile links, the MCP bridge against a fake app (no `path` ever asked for), the control channel's in-reply PNGs. Co-authored-by: petycomppety <30414255+petycomppety@users.noreply.github.com> Co-authored-by: Brandon Thomas <echelon@gmail.com>