amadan
Specify pasted link round-trip across readers and exports
1 file changed,
+51
−0
implementation/link-roundtrip.md+51 −0
CI passed — run details
diff --git a/implementation/link-roundtrip.md b/implementation/link-roundtrip.md| new file mode 100644 |
| index 0000000..41d087b |
| --- /dev/null |
| +++ b/implementation/link-roundtrip.md |
| @@ -0,0 +1,51 @@ |
| +# Link round-trip execution slice |
| + |
| +Agent implementation specification, based on origin/main 87662f5 and the existing |
| +Plan 7 D1/D3. The unmerged revision-3 plan at c1ac560 is supporting analysis, |
| +not a merged ruling. This slice implements pasted links end to end in the read |
| +view, Markdown and PDF exports; insertion/removal UI remains the next separate |
| +slice and its existing disabled commands must not be represented as complete. |
| + |
| +## Contract |
| + |
| +- ProseMirror basic schema already persists link marks with an attrs object. |
| + Keep that wire shape and existing documents. No migration or ABI change. |
| +- Replace the core's name-only mark collection with one normalized representation |
| + consumed by both HTML and JSON. Only link may carry a value; unknown mark |
| + names retain current escaped name-only behavior. Reject malformed/non-string |
| + href to unlinked text, preserving other marks and all text. |
| +- Adopt Plan 7 positive ASCII scheme grammar and case-insensitive http, https, |
| + mailto allowlist. No trimming/relative URL inference. Reject leading controls, |
| + embedded scheme controls, protocol-relative, data, blob and javascript forms. |
| + Preserve accepted href content and escape it appropriately at each output |
| + syntax boundary. HTML uses href plus rel=noreferrer, no target or title. |
| +- Exports consume only normalized core link attributes. Markdown destination |
| + encoding must preserve URL meaning while preventing delimiter/control injection; |
| + a dangerous URL must never become a mark again downstream. Preserve formatting |
| + and text escaping, including adjacent differently marked runs. |
| +- PDF emits actual URI annotations for every wrapped visible linked text segment, |
| + aligned to its page and drawn geometry, preserving baseline and line layout. |
| + URI PDF string/object encoding must resist parentheses, backslashes, line breaks |
| + and dictionary injection. Link styling uses existing document conventions. |
| +- Keep existing plain-text behavior unchanged; its separate disputed markup ruling |
| + is not resolved by this work. Preserve unknown nodes and all existing fonts, |
| + alignment, indentation, pagination and export behavior. |
| +- No new human-facing UI strings or prose in this implementation slice. Reuse |
| + existing design tokens/anchor semantics. UI dialog follows separately through |
| + copy review and shared Estilo conventions, not a native prompt workaround. |
| + |
| +## Evidence before merge |
| + |
| +Generate fixtures through actual y-prosemirror ProseMirror-to-Yjs encoding, |
| +including links nested with existing marks. Raw hostile updates cover non-string |
| +values, unknown valued marks, unsafe schemes and attribute/Markdown/PDF metacharacters. |
| +Tests must fail before implementation or through a meaningful restored mutation. |
| +Check HTML and JSON independently; exercise the actual Go wasm-to-export path. |
| +Parse or inspect rendered PDF annotations, including wrapping and page boundaries, |
| +not merely string presence anywhere in a file. Real-browser read view must have |
| +expected safe href/rel, no unexpected executable elements, and unlinked rejected |
| +URLs. Full repo gate, actual remote CI, complete-branch Fable review and isolated |
| +canary evidence are required. Shared hosts receive only merged verified main. |
| + |
| +Review question: identify any unsafe ambiguity or architectural mismatch before |
| +implementation, especially Markdown URL encoding and PDF annotation geometry. |