[ooiyeefei]

HTML Drop edit mode can now open native Excalidraw diagrams, attach comments to stable shapes, review proposed revisions, and give local MCP agents the same scene operations. Accepted diagrams remain portable HTML: each contains editable native scene data and a readable SVG preview, without loading the editor when published.

• Add lazy packaged Excalidraw and local fonts, native JSON and Mermaid import, selected-shape comments/replies, proposal accept/reject, revision preview/export and conflict recovery. Published feedback pages can select and comment on shapes without React or the editor.
• Add one shared diagram service with source-preserving atomic writes, revision/source compare checks, encrypted local revision/proposal archives and crash-journal recovery. Reviewer links expose current revision/current-source proposals; older local history stays owner-only.
• Add htmldrop mcp --artifact <registered HTML> --role reviewer|owner over stdio. The default reviewer can read/propose/comment/export; explicit owner adds create/save/accept/reject. No arbitrary file paths or public remote MCP.
• Preserve default publication history, source hand-off and private encryption. Diagram saves never publish. Multiplayer and lossless canvas-to-Mermaid conversion remain outside scope.

Validation:

• Full npm test: 67 feature checks + 3 encryption + 10 access-token checks pass; independent actual-browser UAT9/9 passes, including native canvas/text/font export, Mermaid import, review proposals, stale409 draft retention and mobile hosted shape comments.
• Actual MCP SDK Client/StdioClientTransport integration calls all tools and resources, including role/artifact isolation, source conflicts and older-history denial for reviewers.
• Independent high-reasoning core/security and incremental frontend review; Worker typecheck and dry deployment passed.
• Clean production-only tarball install and package asset/font/license checks. The installed package passed actual private HTTPS canvas/proposal review, owner acceptance through the SDK MCP client, and shape comments, with zero external request attempts.
• Remove the pinned upstream CDN font fallback during bundling with version/exact-match guards; browser regressions observe CSP-blocked attempts as well as routed requests.
• Registry publication and deployed Worker/hosted verification follow separately.

Dependency note: production Node dependency audit reports zero advisories. Browser-build dependencies still report advisories; bundled reachability was reviewed independently, affected NanoID/lodash dependencies were pinned to patched versions, and remaining build-only or conditional advisory paths have no demonstrated exploitable entrypoint in the shipped editor. This is not a claim that all development dependencies are advisory-free.

Release 1.17.0. No blog post.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f2842dfa-c3b4-4b14-91c7-b60388cb2ee3

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}