[August-At-Play]

What this is

Fix local video and audio playback in the Markdown preview, including raw HTML players with document-relative paths and nested <source> elements.

Related to #33 and #46. The earlier fix turns Markdown image syntax pointing at media into a player; raw HTML media sources still need local-path rewriting, and media requests need their own CSP allowance.

For example, place a supported MP4 at clips/demo.mp4 relative to a saved Markdown file and open either embed:

<video controls playsinline src="clips/demo.mp4"></video>
<video controls>
  <source src="clips/demo.mp4" type="video/mp4">
</video>

Before this change the player appears but cannot load the local clip. Afterward its source resolves against the Markdown file and uses Tauri's asset protocol.

Mechanism

processBlockMarkup rewrote local <img> sources, but not video[src], audio[src], or their nested <source> elements. Relative raw HTML sources therefore resolved against the webview instead of the document.

The CSP also had no media-src, so media fell back to default-src 'self'. On Windows, converted file sources use http://asset.localhost, which that fallback does not permit.

This extracts a shared source resolver, reuses it for images and media, and adds media-src 'self' asset: http://asset.localhost. Local file: URLs are normalized before preview sanitization. The merged branch preserves the current upstream image-reload generation handling.

Scope

Five files: the path resolver, CSP configuration, two existing test files, and README documentation.

No sanitizer weakening, asset-scope expansion, dependency changes, updater changes, or Rust implementation changes. The existing different-host UNC guard remains in place and is checked before and after resolution. Already-converted asset URLs are not converted again. Existing iframe, embed, object, event-handler, and script-URL restrictions remain intact.

No private documents or media are included.

Tests

Six real-DOM regression tests exercise the incremental preview's rewrite-and-sanitize path, covering direct and nested video/audio sources, image-syntax media, parent-directory references, encoded filenames, Windows paths and file: URLs, retained player attributes, asset URL idempotence, UNC host checks, and sanitizer restrictions.

A separate regression checks the parsed CSP configuration for both asset-protocol spellings without a wildcard allowance.

The raw-media path and CSP regressions were confirmed failing on the original v2.9.2 baseline before the implementation. After integrating current master, the existing image-reload tests also pass.

Verification

On the current merged branch, using Node 24 on Windows ARM64:

• npm run check: 0 errors, 0 warnings.
• npm run lint: passed.
• npm test: 952 passed, 3 skipped, 0 failed.
• npm run test:vitest: 776 passed across 36 files.
• npm run build: passed.
• cargo fmt --check: passed.
• cargo test --locked: 244 passed; generated bindings remain unchanged.

The original patch was also built as Windows ARM64 and x64 portable executables. Windows ARM64 playback was checked with relative raw video, nested source, local file URL, and Markdown image-syntax embeds. Playback and seeking in a larger H.264/AAC clip were confirmed during local use.

The current upstream-merged revision has the automated verification above; native playback was not repeated after the merge. The x64 build was produced, but x64 runtime playback and macOS/Linux playback were not independently verified.

npm audit --audit-level=moderate reports 13 existing dependency findings: 4 low and 9 moderate. package.json and package-lock.json are unchanged from current master; dependency remediation is outside this media fix.