OIA-241: bundle omnia-tinymce 0.3.0 from npm instead of git submodule

[duchenean]

Companion to IMIO/imio.omnia.core#2 (OIA-241).

• Switch the TinyMCE plugin bundle from git-submodule vendoring to the published npm package @imiobe/omnia-tinymce 0.3.0 (browser/resources/package.json + lockfile; make build-js copies the npm dist into browser/static/).
• Same static filenames — no GenericSetup changes needed.

Tests: 247, 0 failures.

Summary by CodeRabbit

• New Features
  • Updated the TinyMCE integration to use the published Omnia TinyMCE package.
  • Added refreshed plugin assets, localization data, configuration handling, and AI service connectivity.
• Bug Fixes
  • Improved streaming response processing and error handling.
• Chores
  • Simplified plugin asset installation and removed the previous submodule-based setup.
  • Updated build instructions and release documentation.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR replaces the TinyMCE git submodule with the pinned @imiobe/omnia-tinymce npm package, updates the build process and documentation, and regenerates the bundled JavaScript and CSS assets.

Changes

TinyMCE npm bundle

Layer / File(s)	Summary
Bundle source and build wiring src/imio/omnia/tinymce/browser/resources/package.json, Makefile, CLAUDE.md, .gitignore, CHANGES.rst	Pins @imiobe/omnia-tinymce to 0.3.0, copies its distribution files into browser/static/, updates rebuild instructions, ignores installed npm dependencies, and records the change in the changelog.
Bundled plugin update src/imio/omnia/tinymce/browser/static/omnia-tinymce.js, src/imio/omnia/tinymce/browser/static/omnia-tinymce.css	Regenerates the plugin bundle with updated API streaming, agent endpoints, localization, options, menu wiring, embedded icons, and CSS utility definitions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant TinyMCE
  participant OmniaPlugin as omnia-tinymce.js
  participant OmniaAPI as Omnia agent API
  TinyMCE->>OmniaPlugin: invoke configured feature
  OmniaPlugin->>OmniaAPI: request /v1/agents/* endpoint
  OmniaAPI-->>OmniaPlugin: stream response chunks
  OmniaPlugin-->>TinyMCE: parse response and update UI

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: replacing the git submodule with the npm-bundled omnia-tinymce package.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch OIA-241-oauth2-sso-apps

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ast-grep (0.44.1)

src/imio/omnia/tinymce/browser/static/omnia-tinymce.js

ast-grep timed out on this file

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/imio/omnia/tinymce/browser/static/omnia-tinymce.css`:
- Line 1: Update the upstream source defining the omnia-blink and omnia-typing
keyframes to use 100% instead of to for the final keyframe selector, then
regenerate the committed omnia-tinymce.css artifact. Do not edit the minified
CSS directly, and preserve all other generated styles unchanged.
- Line 1: Regenerate the built stylesheet so every Omnia plugin rule is scoped
beneath [data-omnia], including :root/:host variables, all .om utility
selectors, animation-related rules, and TinyMCE selectors such as
.tox-editor-container and .tox-collection__item--active. Preserve the existing
scoped reset while ensuring no plugin styles can affect unrelated page markup or
TinyMCE instances.

In `@src/imio/omnia/tinymce/browser/static/omnia-tinymce.js`:
- Line 14: Sanitize all API-provided HTML before it reaches any
dangerouslySetInnerHTML usage in the floating panel, streaming preview, and side
panel. Apply a strict HTML allowlist, or convert the content to plain text, in
the shared rendering path so both preview and final insertion receive sanitized
content; do not render raw API output.
- Line 14: Move authToken handling from Ha.#c URL construction into Ha.#u
request headers using the X-CSRF-TOKEN header. Remove the _authenticator
query-parameter logic so both `#e` and `#f` POST requests keep the token out of URLs
while preserving existing headers.
- Around line 11-14: Update the async generator $a to normalize SSE lines by
removing trailing carriage returns before evaluating event data, ensuring [DONE]
is recognized for CRLF responses. When the reader reports done, process the
remaining buffered content once before exiting so the final event is yielded
instead of discarded.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 631d220f-9858-4ff4-a773-6a83ad84eb5e

📥 Commits

Reviewing files that changed from the base of the PR and between 564ee10 and 9969ee4.

⛔ Files ignored due to path filters (1)

• src/imio/omnia/tinymce/browser/resources/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (9)

• .gitignore
• .gitmodules
• CHANGES.rst
• CLAUDE.md
• Makefile
• src/imio/omnia/tinymce/browser/resources
• src/imio/omnia/tinymce/browser/resources/package.json
• src/imio/omnia/tinymce/browser/static/omnia-tinymce.css
• src/imio/omnia/tinymce/browser/static/omnia-tinymce.js

💤 Files with no reviewable changes (2)

• .gitmodules
• src/imio/omnia/tinymce/browser/resources

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Regenerate CSS with valid keyframe notation.

The generated stylesheet uses to instead of 100% in two keyframes, matching the reported Stylelint errors. Update the upstream source and regenerate the committed artifact rather than editing the minified output manually.

🧰 Tools

🪛 Stylelint (17.14.0)

[error] 1-1: Expected "to" to be "100%" (keyframe-selector-notation)

(keyframe-selector-notation)

---

[error] 1-1: Expected "to" to be "100%" (keyframe-selector-notation)

(keyframe-selector-notation)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/imio/omnia/tinymce/browser/static/omnia-tinymce.css` at line 1, Update
the upstream source defining the omnia-blink and omnia-typing keyframes to use
100% instead of to for the final keyframe selector, then regenerate the
committed omnia-tinymce.css artifact. Do not edit the minified CSS directly, and
preserve all other generated styles unchanged.

Source: Linters/SAST tools

---

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Scope every plugin rule under [data-omnia].

Line 1 emits global selectors such as :root, .omnia-stream-preview__new, .tox-editor-container .tox-promotion, .tox-collection__item--active svg, and all .om: utilities. Only the reset is scoped, allowing unrelated page markup and TinyMCE instances to be affected. Regenerate the package output with the required scoping.

As per coding guidelines, built CSS must remain scoped to [data-omnia].

🧰 Tools

🪛 Stylelint (17.14.0)

[error] 1-1: Expected "to" to be "100%" (keyframe-selector-notation)

(keyframe-selector-notation)

---

[error] 1-1: Expected "to" to be "100%" (keyframe-selector-notation)

(keyframe-selector-notation)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/imio/omnia/tinymce/browser/static/omnia-tinymce.css` at line 1,
Regenerate the built stylesheet so every Omnia plugin rule is scoped beneath
[data-omnia], including :root/:host variables, all .om utility selectors,
animation-related rules, and TinyMCE selectors such as .tox-editor-container and
.tox-collection__item--active. Preserve the existing scoped reset while ensuring
no plugin styles can affect unrelated page markup or TinyMCE instances.

Source: Coding guidelines

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

python3 - <<'PY'
from pathlib import Path
import re

path = Path("src/imio/omnia/tinymce/browser/static/omnia-tinymce.js")
text = path.read_text(encoding="utf-8")
m = re.search(r"async function\*\$a\(t,e\)\{(.+?)\}class ve extends Error", text, re.S)
print("found", bool(m))
if m:
    body = m.group(1)
    print(body[:1200])
PY

Repository: IMIO/imio.omnia.tinymce

Length of output: 585

---

Handle CRLF SSE lines and the final buffered event.
Trim trailing \r before checking for [DONE], and drain the leftover buffer after read() returns done so the last chunk isn't dropped.

🧰 Tools

🪛 OpenGrep (1.25.0)

[ERROR] 14-14: Dynamic command passed to child_process.exec/execSync. Use child_process.execFile or spawn with an argument array instead.

(coderabbit.command-injection.exec-js)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/imio/omnia/tinymce/browser/static/omnia-tinymce.js` around lines 11 - 14,
Update the async generator $a to normalize SSE lines by removing trailing
carriage returns before evaluating event data, ensuring [DONE] is recognized for
CRLF responses. When the reader reports done, process the remaining buffered
content once before exiting so the final event is yielded instead of discarded.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Sanitize API HTML before rendering it.

The API output is inserted directly with dangerouslySetInnerHTML in the floating panel, streaming preview, and side panel. A compromised or misconfigured API can inject executable markup into the host page. Sanitize with a strict allowlist, or render plain text, before both preview and insertion.

🧰 Tools

🪛 OpenGrep (1.25.0)

[ERROR] 14-14: Dynamic command passed to child_process.exec/execSync. Use child_process.execFile or spawn with an argument array instead.

(coderabbit.command-injection.exec-js)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/imio/omnia/tinymce/browser/static/omnia-tinymce.js` at line 14, Sanitize
all API-provided HTML before it reaches any dangerouslySetInnerHTML usage in the
floating panel, streaming preview, and side panel. Apply a strict HTML
allowlist, or convert the content to plain text, in the shared rendering path so
both preview and final insertion receive sanitized content; do not render raw
API output.

---

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- relevant source files ---\n'
git ls-files | rg 'src/imio/omnia|test_viewlet|omnia-tinymce|viewlet' || true

printf '\n--- token/url references ---\n'
rg -n --hidden --glob '!**/node_modules/**' --glob '!**/dist/**' --glob '!**/build/**' \
  'omnia_auth_token|_authenticator|authenticator|Authorization|x-imio|csrf|CSRF|token' \
  src tests .

printf '\n--- file sizes ---\n'
for f in src/imio/omnia/tinymce/browser/static/omnia-tinymce.js src/imio/omnia/tinymce/tests/test_viewlet.py; do
  if [ -f "$f" ]; then wc -l "$f"; fi
done

Repository: IMIO/imio.omnia.tinymce

Length of output: 252

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Narrow inspection of the JS URL builder and configuration tests.
sed -n '1,120p' src/imio/omnia/tinymce/browser/static/omnia-tinymce.js
printf '\n---\n'
sed -n '1,180p' src/imio/omnia/tinymce/tests/test_viewlet.py

Repository: IMIO/imio.omnia.tinymce

Length of output: 50380

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Search for the backend auth/CSRF contract and the test configuration.
rg -n --hidden --glob '!**/node_modules/**' --glob '!**/dist/**' --glob '!**/build/**' \
  '_authenticator|X-CSRF|CSRF|authenticator|omnia_auth_token|omnia_base_url|omnia_endpoints' \
  src tests .

printf '\n--- test_viewlet excerpt ---\n'
sed -n '1,220p' src/imio/omnia/tinymce/tests/test_viewlet.py

printf '\n--- js constructor excerpt ---\n'
python3 - <<'PY'
from pathlib import Path
p = Path('src/imio/omnia/tinymce/browser/static/omnia-tinymce.js')
text = p.read_text(encoding='utf-8', errors='replace')
for needle in ['class Ha', '`#c`(e)', '`#u`(e)', 'omnia_auth_token']:
    idx = text.find(needle)
    print(f'\n### {needle} @ {idx}')
    if idx != -1:
        start = max(0, idx - 200)
        end = min(len(text), idx + 700)
        print(text[start:end])
PY

Repository: IMIO/imio.omnia.tinymce

Length of output: 50380

---

🌐 Web query:

Plone _authenticator header CSRF token request header support

💡 Result:

Plone supports CSRF protection via an authenticator token that can be passed in several ways, including through a specific HTTP request header [1]. To perform CSRF-protected requests in Plone—particularly for AJAX requests—you can include the token in an HTTP header named X-CSRF-TOKEN [2][1][3]. Plone recognizes the CSRF token from the following sources: 1. HTTP Header: X-CSRF-TOKEN (recommended for AJAX) [1][3]. 2. Form Field: A form input field named _authenticator [2][1]. 3. GET Parameter: A URL query parameter named _authenticator [1]. The token itself can be generated programmatically using the createToken function from the plone.protect.authenticator module [2][1]. For many internal forms, Plone's plone.protect package provides automatic protection by including the token when a user is logged in [2]. For custom views or client-side code, you must retrieve the token (often via the authenticator view) and include it in your request as described above [1][4].

Citations:

• 1: https://github.com/plone/documentation/blob/12e708f1/docs/classic-ui/csrf.md
• 2: https://github.com/plone/plone.protect/blob/master/README.rst
• 3: https://pypi.org/project/plone.protect/
• 4: https://github.com/plone/plone.protect/

---

Keep the CSRF token out of the URL. Plone accepts X-CSRF-TOKEN for these POSTs, so authToken can be sent in a header instead of _authenticator, avoiding leaks through logs and referrers.

🧰 Tools

🪛 OpenGrep (1.25.0)

[ERROR] 14-14: Dynamic command passed to child_process.exec/execSync. Use child_process.execFile or spawn with an argument array instead.

(coderabbit.command-injection.exec-js)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/imio/omnia/tinymce/browser/static/omnia-tinymce.js` at line 14, Move
authToken handling from Ha.#c URL construction into Ha.#u request headers using
the X-CSRF-TOKEN header. Remove the _authenticator query-parameter logic so both
`#e` and `#f` POST requests keep the token out of URLs while preserving existing
headers.