You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+13-1Lines changed: 13 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -72,6 +72,18 @@ Embed HTML docs like other Obsidian embeds. Embeds default to about 600px tall;
72
72
![[doc.html|600x400]]
73
73
```
74
74
75
+
Each iframe receives a one-way snapshot of Obsidian theme styles. HTML docs can use these CSS variables to match light/dark mode, theme colors, and fonts without giving the iframe permission to read Obsidian or the vault. Use fallbacks so files still work outside Obsidian:
@@ -85,7 +97,7 @@ That keeps HTML documents isolated from your notes and Obsidian internals, with
85
97
***Wikilinks to HTML docs need the explicit extension (`[[doc.html]]`).** Extensionless non-Markdown links are not first-class in Obsidian's link index, and click-only plugin handling would leave backlinks and unresolved-link state inconsistent.
86
98
***Links from HTML to Obsidian docs should use Obsidian URI links plus `target="_blank"`.** They hand off to Obsidian without letting the iframe navigate the parent window directly; direct same-tab navigation would require top-navigation sandbox permissions and weaken the boundary.
87
99
***Cookies, `localStorage`, `sessionStorage`, and `IndexedDB` are intentionally unavailable.** Enabling them would require same-origin privileges, which would also let HTML share origin with Obsidian instead of staying isolated.
88
-
***Context must be passed into the iframe, the iframe cannot reach out and pull in.** HTML can load browser-allowed network resources, but it cannot inspect Obsidian, other notes, or local vault files. So for example, the HTML page cannot access Obsidian themes, snippets, vault-relative asset paths, unless they are explicitly passed into the iframe context. Use inline CSS/assets, `data:` URLs, or browser-allowed HTTPS URLs instead.
100
+
***Context must be passed into the iframe, the iframe cannot reach out and pull in.** HTML receives curated theme tokens, but cannot inspect Obsidian, other notes, snippets, or local vault files. Use inline CSS/assets, `data:` URLs, or browser-allowed HTTPS URLs instead of vault-relative asset paths.
- Source values are read from Obsidian's computed styles and resolved through a temporary parent-side probe so iframe values do not depend on parent-only `var(...)` references.
12
+
- Open HTML tabs and embeds re-render when the parent `body` theme class changes or Obsidian emits `css-change`.
13
+
- Injection uses `DOMParser` instead of regex so `<head>` text inside comments/scripts is not treated as document structure.
14
+
15
+
Validation notes:
16
+
-`npm test` covers token injection in tab, markdown embed, and Canvas embed modes while preserving cross-origin iframe isolation.
17
+
-`npm test` also flips parent `theme-light`/`theme-dark` classes and verifies the open HTML tab re-renders with the opposite injected `color-scheme`.
18
+
- A live `obsidian-cli` probe also verified the real Obsidian theme toggle path: injected `color-scheme` changed from `light` to `dark`, then the original light theme was restored.
0 commit comments