BACK-208-Add-paste-as-markdown-support-in-Web-UI

[kuwork]

Summary

Implements automatic conversion of rich text content to Markdown when pasting into task and document editors in the Web UI. Users can now seamlessly paste content from Word, Google Docs, web pages, and other sources while maintaining proper Markdown formatting. The feature is delivered in two phases:

Phase 1 — Text, Tables, Lists, Formatting: A new PasteAwareMDEditor wrapper intercepts onPaste events, detects rich-text HTML on the clipboard, cleans Word-specific garbage, and converts to Markdown via Turndown with GFM support.

Phase 2 — Images: Pasted images (screenshots, HTML <img> tags, data URIs) are extracted, uploaded to backlog/assets/.temp/, and promoted to permanent storage on save. This avoids orphaned images and base64 bloat that would cause textarea lag.

Also includes three bugfixes (2026-05-09) for Excel table paste not converting to Markdown, Excel paste losing screenshot images, and Word file:// image references.

Related Tasks

closes BACK-208

📋 Important: All PRs must have an associated task in the backlog.

• If no task exists, create one first using: backlog task create "Your task title"
• Follow the task guidelines when creating tasks
• Tasks should be atomic, testable, and well-defined with clear acceptance criteria

Task Checklist

• I have created a corresponding task in backlog/tasks/
• The task has clear acceptance criteria
• I have added an implementation plan to the task
• All acceptance criteria in the task are marked as completed

Testing

Phase 1 — Rich text conversion:

• Pasted rich text from Word, Google Docs, and web pages into task Description, Plan, Implementation Notes, Final Summary fields, and document editors — verified correct Markdown output
• Tested tables, ordered/unordered lists, bold/italic/underline/strikethrough, links, and code blocks
• Confirmed plain text pastes bypass conversion (smart detection)
• Verified cross-browser behavior (Chrome, Firefox, Safari, Edge)
• Excel paste: confirmed <colgroup>/col stripping allows Turndown GFM table rule to recognise tables
• Excel paste with screenshot: confirmed both table Markdown and image are inserted together

Phase 2 — Image handling:

• Pasted screenshots (Win+Shift+S) directly into editors — images uploaded to .temp/, preview works, promoted on save
• Pasted Word/web content with <img src="data:..."> — base64 extracted and uploaded
• Pasted content with remote HTTP(S) images — backend downloads safely, replaces with local asset URL
• Confirmed file:// images are silently removed (browser cannot read them)
• Verified temp cleanup: server startup deletes .temp/ files older than 30 minutes

Backend & security:

• SSRF protection tested: localhost, 127.0.0.1, ::1, private IP ranges (10.x, 172.16-31.x, 192.168.x) are rejected
• Redirect chains capped at 3 hops
• Non-image/* content types rejected
• Downloads >20 MB abort
• ClientError correctly mapped to HTTP 400

Automated tests:

• bun test src/test/assets.test.ts — 113 lines covering AssetManager upload, promote, cleanup, and downloadImage security rules
• bun test src/test/server-upload-promote.test.ts — 245 lines covering upload handlers, promotion edge cases, URL mapping, and error responses