feat(export): export a session as one self-contained HTML file#227
Open
tridha643 wants to merge 2 commits into
Open
feat(export): export a session as one self-contained HTML file#227tridha643 wants to merge 2 commits into
tridha643 wants to merge 2 commits into
Conversation
GET /api/sessions/:id/export and the new `sideshow export` command render a whole session into a single shareable HTML file styled like the viewer's card column. Every surface that becomes HTML is embedded as a sandboxed srcdoc iframe via the same renderSurfaceDocument dispatch /s/:id uses, so the isolation rule holds inside the saved file. Image surfaces inline as data URIs (allowlisted raster types, 32 MB cap per export); sessions over 4 MB of surface text are rejected with a 413. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
npm audit's high gate started failing on GHSA-h67p-54hq-rp68 / GHSA-52cp-r559-cp3m (js-yaml merge-key DoS), pulled in transitively by @changesets/cli. Bump the in-range copy to the patched 4.3.0 and override read-yaml-file to ^2.1.0 (same API, depends on js-yaml ^4) since every 3.x js-yaml is vulnerable with no patched release. Also picks up the in-range hono and body-parser advisory fixes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A session can now be saved and shared as one self-contained HTML file:
GET /api/sessions/:id/exportand the newsideshow exportCLI command render every post into the viewer's card column, with each surface still embedded as a sandboxedsrcdociframe so the core isolation rule holds inside the saved file. The/s/:idrenderers and the export now share a singlerenderSurfaceDocumentdispatch, so the two paths can't drift when a surface kind or renderer option changes. Image surfaces are inlined as data URIs (allowlisted raster types only, 32 MB per export, shared viaINLINE_IMAGE_TYPESintypes.ts), sessions over 4 MB of surface text get a 413 instead of an unloadable file, and?theme=/?mode=/?download=1pin the look or force an attachment download. Export never creates a session, and there's deliberately no MCP tool — MCP agents use the HTTP route. Covered by unit tests (test/export.test.ts, CLI tests) and a new Playwright spec (e2e/export.spec.ts); the agent guide documents the workflow.