build(release): dynamic builder config + fix bundled-tool lookup in packages

- electron-builder config moves to electron-builder.config.js so markitdown
  bundling is conditional per platform (PyInstaller only builds for the host
  OS; a missing binary now logs a warning and ships without it instead of
  failing the build); package.json static build section removed, all npm
  scripts pointed at the config; third-party-licenses/ added to packaged files
- FIX (pre-existing): packaged apps looked for bundled pandoc in
  resources/bin, but extraFiles land next to the executable (Contents/ on
  macOS) — packaged builds silently fell back to system pandoc since 4.5.
  New bundledToolDir() resolves the real location for pandoc + markitdown
- download-tools.js pins the win32 pandoc.exe SHA-256 (fetched + verified)
- sharp packaging test accepts sharp 0.35's versioned binding filename
- release.yml: bundle-markitdown step (best-effort) on every OS and a new
  macOS job; release aggregates linux+windows+macos artifacts

Local release artifacts built and verified (dist/):
- MarkdownConverter-4.7.0.AppImage (363MB, pandoc+markitdown bundled,
  packaged app boots clean, tools resolve at the fixed path)
- markdown-converter_4.7.0_amd64.deb (293MB)
- MarkdownConverter-Setup-4.7.0.exe (223MB), portable exe (223MB), zip
  (305MB) — pandoc bundled; markitdown omitted (cannot cross-build),
  legal docs verified inside app.asar

637/637 tests green; lint clean.

.github/workflows/release.yml

@@ -25,6 +25,13 @@ jobs:
       - name: Download external tools (pandoc)
         run: node scripts/download-tools.js
 
+      - name: Bundle MarkItDown (optional, best effort)
+        # Freezes markitdown + Python into bin/linux/markitdown; failure is
+        # non-fatal — the build then ships without it and the app falls back
+        # to a system markitdown at runtime.
+        run: npm run bundle:markitdown
+        continue-on-error: true
+
       - name: Run tests
         run: npm test
 
@@ -59,6 +66,12 @@ jobs:
       - name: Download external tools (pandoc)
         run: node scripts/download-tools.js
 
+      - name: Bundle MarkItDown (optional, best effort)
+        # Windows runners ship python + venv; non-fatal on failure — the
+        # package then omits the bundled binary by design
+        run: npm run bundle:markitdown
+        continue-on-error: true
+
       - name: Run tests
         run: npm test
 
@@ -94,8 +107,44 @@ jobs:
             dist/*.zip
           retention-days: 5
 
+  build-macos:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Download external tools (pandoc)
+        run: node scripts/download-tools.js
+
+      - name: Bundle MarkItDown (optional, best effort)
+        run: npm run bundle:markitdown
+        continue-on-error: true
+
+      - name: Run tests
+        run: npm test
+
+      - name: Build macOS packages
+        run: npm run build:mac -- --publish=never
+
+      - name: Upload macOS artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-artifacts
+          path: |
+            dist/*.dmg
+            dist/*.zip
+          retention-days: 5
+
   release:
-    needs: [build-linux, build-windows]
+    needs: [build-linux, build-windows, build-macos]
     if: always()
     runs-on: ubuntu-latest
     steps:
@@ -115,6 +164,13 @@ jobs:
           name: windows-artifacts
           path: dist
 
+      - name: Download macOS artifacts
+        uses: actions/download-artifact@v4
+        continue-on-error: true
+        with:
+          name: macos-artifacts
+          path: dist
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:

CLAUDE.md

@@ -0,0 +1,103 @@
+# CLAUDE.md — MarkdownConverter (master)
+
+> General code-quality, JavaScript, git, security, and testing standards are in the **global CLAUDE.md**. This file holds project- and branch-specific notes.
+
+## Project Overview
+
+Electron desktop app for Markdown editing and universal file conversion powered by Pandoc. Cross-platform (Win/macOS/Linux). Features: multi-tab editor with live preview, 25+ themes, PDF viewer/editor (merge/split/compress/rotate/watermark/password), export to 20+ formats (PDF/DOCX/ODT/EPUB/HTML/LaTeX/RTF/PPTX), batch conversion, syntax highlighting, diagram support (Mermaid), Git integration, and a plugin system.
+
+- **Version:** 4.4.5
+- **License:** MIT
+- **App ID:** `com.concreteinfo.markdownconverter`
+
+## Branch Specifics
+
+This is the **primary/release branch** — a vanilla JavaScript Electron app with no bundler or framework in the renderer. The renderer is a single large `renderer.js` (5,300+ lines) loaded directly via `src/index.html`. All UI is hand-rolled DOM manipulation.
+
+## Architecture
+
+### Main Process (`src/main.js` — 4,260 lines)
+Monolithic main process file. Contains all IPC handlers, Pandoc invocation, file operations, menu definitions (600+ lines), and window lifecycle. Key modules extracted:
+- `src/main/PDFOperations.js` — PDF manipulation via `pdf-lib` (merge, split, compress, rotate, delete, reorder, watermark, encrypt, decrypt, permissions)
+- `src/main/GitOperations.js` — Git status/stage/commit/log via `simple-git`
+
+### Renderer (`src/renderer.js` — 5,361 lines)
+Vanilla JS, no framework. Directly manipulates DOM. Loads CodeMirror 6 via `src/editor/codemirror-setup.js`. Uses `marked` + `highlight.js` + `DOMPurify` + `mermaid` for rendering. Lazy-loads sidebar panels, REPL, command palette, zen mode.
+
+### Preload (`src/preload.js` — 448 lines)
+Exists as IPC bridge, but **`contextIsolation: false` and `nodeIntegration: true`** — the renderer has full Node access. Preload is effectively a thin passthrough.
+
+### Security Model
+- `contextIsolation: false` + `nodeIntegration: true` (legacy; the react-electron branch fixes this)
+- Pandoc invoked via `execFile` (not `exec`) to prevent shell injection
+- Path traversal protection: `validatePath()`, `resolveWritablePath()`, blocks sensitive system dirs
+- Permission handler only allows `clipboard-read`/`clipboard-write`
+- Rate limiter on conversions (2-second minimum interval)
+- File size limit: 50MB
+- Error message sanitization strips absolute paths
+
+### Plugin System (`src/plugins/`)
+Manifest-based discovery (`manifest.json`). Built-in `writing-studio` plugin with sprint/goal/snapshot management. Plugin API exposed via `src/plugins/plugin-api.js`.
+
+### Settings
+Custom JSON file store at `<userData>/settings.json` (NOT `electron-store` despite the dependency). Recent files at `<userData>/recent-files.json`.
+
+## System Dependencies
+
+| Dependency | Required | Notes |
+|---|---|---|
+| **Node.js** | >= 20 | Electron 41 bundles Node 20.x |
+| **Pandoc** | Yes (for exports) | Downloaded to `bin/<platform>/pandoc` via `scripts/download-tools.js` (v3.9.0.2). Falls back to system PATH. Must be present for DOCX/ODT/EPUB/LaTeX/PPTX export. |
+| **FFmpeg** | Bundled | `ffmpeg-static` npm package; `asarUnpacked` for packaged builds |
+| **MiKTeX / TeX Live** | Optional | For LaTeX PDF export; MiKTeX PATH injected on Windows automatically |
+| **ImageMagick** | Optional | Linux image conversion; listed as deb dependency |
+| **LibreOffice** | Optional | Enhanced document conversion; listed as deb dependency |
+
+## Development Commands
+
+```bash
+npm start                  # Launch Electron app (dev mode)
+npm test                   # Jest test suite
+npm test:watch             # Jest in watch mode
+npm test:coverage          # Jest with coverage report
+npm run lint               # ESLint check (src + tests)
+npm run lint:fix           # ESLint auto-fix
+npm run format             # Prettier write
+npm run format:check       # Prettier check only
+npm run download-tools     # Download Pandoc binaries to bin/
+npm run generate-icons     # Generate app icons via sharp
+```
+
+## Build & Package
+
+**Tool:** `electron-builder` (v26.0.12), config inline in `package.json` (no separate config file).
+
+| Target | Platforms |
+|---|---|
+| `npm run build` | electron-builder (default platform) |
+| `npm run build:win` | Windows: NSIS installer + portable + zip (x64) |
+| `npm run build:mac` | macOS: default dmg |
+| `npm run build:linux` | Linux: deb + AppImage + snap |
+| `npm run dist` | Build without publish |
+| `npm run dist:all` | Build for all platforms |
+
+**Bundled with builds:** Pandoc binary per platform. FFmpeg via `ffmpeg-static` (asarUnpacked). NSIS installer uses custom script at `scripts/nsis-installer.nsh`.
+
+**Output:** `dist/` directory.
+
+**CI:** GitHub Actions workflows in `.github/workflows/` (ci.yml, release.yml).
+
+## Project Conventions / Gotchas
+
+- **No bundler/transpilation.** The app uses vanilla CommonJS JavaScript. `src/main.js` is loaded directly by Electron. No webpack, no Vite, no TypeScript, no Babel.
+- **Monolithic files.** `main.js` (4,260 lines) and `renderer.js` (5,361 lines) contain most logic. Not ideal but is the current state of this branch.
+- **CodeMirror 6** for the editor, configured in `src/editor/codemirror-setup.js`.
+- **PDF rendering** uses `pdfjs-dist`; **PDF manipulation** uses `pdf-lib` in the main process.
+- **Renderer security is weak** — full Node access in renderer. Do NOT introduce new privileged renderer code without understanding this.
+- **Pandoc is external.** Must be installed separately or downloaded via `npm run download-tools`. HTML and built-in PDF export work without Pandoc; other formats require it.
+- **PDF export fallback chain:** xelatex -> pdflatex -> lualatex -> Electron built-in `printToPDF()`.
+- **ESLint flat config** (`eslint.config.js`) with ECMAScript 2022. Prettier with 2-space indent, single quotes, semicolons, 100-char width.
+- **Tests:** Jest with jsdom environment, 15% coverage threshold. 24 test files in `tests/`.
+- **File associations:** `.md`, `.markdown`, `.pdf` registered at install.
+- **Single instance lock** enforced via `app.requestSingleInstanceLock()`.
+- **Adapters layer** (`src/adapters/`) abstracts file system operations for potential future non-Electron targets.

README.md

@@ -51,12 +51,24 @@ A powerful cross-platform Markdown editor and document converter powered by Pand
 - **ASCII Art Generator** - Create text banners and diagrams
 - **Word templates** - Use custom Word templates for enhanced exports
 - **Import documents** - Import from 30+ formats (DOCX, PDF, HTML, etc.)
+- **MarkItDown import** - Any file → Markdown via [Microsoft MarkItDown](https://github.com/microsoft/markitdown): PDF, DOCX, PPTX, XLSX, Outlook .msg, EPUB, images, ZIP (audio/OCR with the `[all]` extras)
+- **Excel export** - Markdown tables to native .xlsx workbooks (one sheet per table)
+- **AI Assistant** - Multi-provider AI help (OpenAI/Anthropic/Ollama/LM Studio): chat panel, summarize/improve/translate commands, grammar proofreading
+- **Inline comments** - Anchor-based document comments in `.comments/` sidecars with F8 navigation
+- **Wiki-links & Backlinks** - `[[Note]]` links with click-to-create and a "what links here?" panel (local knowledge base)
+- **Crash recovery** - Session restore of open tabs and unsaved buffers after a crash
+- **Version history** - Automatic pre-save snapshots with restore/diff/delete from the History panel
+- **Vim mode & snippet expansion** - Vim keybindings toggle; Tab expands saved snippets
+- **Quick Note** - Global scratchpad (Ctrl+Alt+Q) that appends to `notes/quick-notes.md`
+- **Real PDF encryption** - Password protection, removal, and permissions actually work
+- **Offline math & diagrams** - KaTeX bundled locally; PlantUML renders locally when the CLI is installed
 
 ## Installation
 
 ### Prerequisites
 - [Node.js](https://nodejs.org/) (v16 or later)
 - [Pandoc](https://pandoc.org/installing.html) (required for export functionality)
+- Optional: [MarkItDown](https://github.com/microsoft/markitdown) (`pip install "markitdown[all]"`) for any-file → Markdown import
 
 ### Install Dependencies
 ```bash
@@ -96,9 +108,18 @@ npm run build:linux
 | Redo | Ctrl+Shift+Z |
 | New Tab | Ctrl+T |
 | Close Tab | Ctrl+W |
-| Toggle Preview | Ctrl+Shift+P |
+| Toggle Preview | Ctrl+Shift+V |
 | Zoom In | Ctrl+Shift++ |
 | Zoom Out | Ctrl+Shift+- |
+| Command Palette | Ctrl+Shift+P |
+| Zen Mode | F11 |
+| Writing Analytics | Ctrl+Shift+A |
+| Quick Note | Ctrl+Alt+Q |
+| Universal Converter | Ctrl+Shift+C |
+| Table Generator | Ctrl+Shift+T |
+| ASCII Art Generator | Ctrl+Shift+A |
+| Next Comment | F8 |
+| Add Comment at Cursor | Ctrl+Alt+M |
 
 ## Themes
 
@@ -140,6 +161,43 @@ Open PDF files directly in MarkdownConverter:
 - Rotate pages left or right
 - Close PDF to return to editor
 
+## Bundled Dependencies, Legal Notices & Credits
+
+MarkdownConverter ships as a self-contained package. Everything needed for the
+core workflows is **bundled**; a few large optional tools are detected from
+the system when present.
+
+### Bundled with the app
+
+| Component | License | Role |
+|---|---|---|
+| [Pandoc](https://pandoc.org) 3.9 | GPL-2.0+ (separate process) | 25+ export/import formats |
+| [FFmpeg](https://ffmpeg.org) (via ffmpeg-static) | GPL-3.0+ build (separate process) | audio/video tools |
+| [MarkItDown](https://github.com/microsoft/markitdown) (MIT) + embedded Python runtime (PSF) | MIT / PSF | any-file → Markdown import (PDF/DOCX/PPTX/XLSX/Outlook/EPUB/images/ZIP) |
+| [sharp](https://sharp.pixelplumbing.com) + libvips | Apache-2.0 / LGPL-2.1+ (dynamic) | image tools |
+| [KaTeX](https://katex.org), [marked](https://marked.js.org), [highlight.js], [DOMPurify], [mermaid], [CodeMirror 6], pdf-lib (@cantoo fork), pdfjs-dist, JSZip, simple-git | MIT / Apache-2.0 / BSD-3 / MPL-2.0 | editor, preview, PDF, Git |
+| JetBrains Mono & Fira Code fonts | SIL OFL 1.1 | editor typography |
+
+GPL-licensed tools run as **separate processes** (never linked into the app)
+and their complete corresponding sources are offered in
+[SOURCES.md](SOURCES.md). Full details: [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md),
+also available inside the app under **Help → Third-Party Notices & Licenses**.
+
+### Not bundled (used when installed)
+
+LibreOffice (Office conversion), MiKTeX/TeX Live (LaTeX PDF), ImageMagick
+(extra image formats), PlantUML + Java (local diagrams), Calibre (MOBI),
+MarkItDown `[all]` extras (audio transcription / OCR).
+
+### Credits
+
+Built on open source: [Electron], [CodeMirror], [marked], [KaTeX],
+[highlight.js], [DOMPurify](https://github.com/cure53/DOMPurify),
+[mermaid](https://mermaid.js.org), [pdf-lib], [pdf.js](https://mozilla.github.io/pdf.js/),
+[sharp]/libvips, [Pandoc], [FFmpeg], [MarkItDown] by Microsoft,
+[simple-git], [JSZip], [JetBrains Mono], [Fira Code]. Thank you to all their
+authors and maintainers.
+
 ## Open Source
 
 MarkdownConverter is 100% open-source. All dependencies are permissively licensed:
@@ -162,4 +220,4 @@ Amit Haridas (amit.wh@gmail.com)
 
 ## Version
 
-v4.1.0
+v4.7.0

SOURCES.md

@@ -0,0 +1,55 @@
+# Source Code Availability (GPL / LGPL Written Offer)
+
+MarkdownConverter distributes the following binaries built from GPL-licensed
+software. Per GPL §3(b), this document is the written offer: **corresponding
+source code for the exact versions listed below is available on request for
+at least three years from each release**, and permanently at the referenced
+public locations. Write to: amit.wh@gmail.com (or open a GitHub issue at
+https://github.com/amitwh/markdown-converter/issues).
+
+## Pandoc — GPL-2.0-or-later
+
+- Binary shipped: `bin/pandoc` (v3.9.0.2, official upstream release, unmodified)
+- SHA-256 (linux): `7d124235998ecd3cdd9a463b1e5f6691a178b6461824c29a36170a0882f05597`
+- Source: <https://github.com/jgm/pandoc/archive/refs/tags/3.9.0.2.tar.gz>
+- Pandoc statically links Haskell libraries (GHC ecosystem, mostly BSD-3);
+  their sources are included in the upstream release tarball's dependency set.
+
+## FFmpeg — GPL-3.0-or-later (build configuration)
+
+- Binary shipped: `ffmpeg` provided by the npm package `ffmpeg-static@5.3.0`
+  (Linux: johnvansickle.com build; Windows: gyan.dev; macOS: evermeet.cx —
+  all `--enable-gpl` builds including x264/x265, per the build banner)
+- Source:
+  - FFmpeg: <https://ffmpeg.org/releases/> (use the release matching
+    `ffmpeg -version` of the shipped binary)
+  - Build scripts & pinned versions: <https://github.com/eugeneware/ffmpeg-static>
+  - x264: <https://code.videolan.org/videolan/x264> ·
+    x265: <https://bitbucket.org/multicoreware/x265_git/> ·
+    other `--enable-lib*` components: their upstream sources (all free/open)
+
+## PyInstaller bootloader (inside the bundled MarkItDown binary) — GPL-2.0 with boot-exception
+
+- Binary shipped: `bin/markitdown` (MarkItDown 0.1.7 frozen with PyInstaller 6.x)
+- PyInstaller grants a special exception allowing the bootloader to be
+  embedded in non-GPL frozen applications; source anyway:
+  <https://github.com/pyinstaller/pyinstaller>
+- Everything frozen above the bootloader (markitdown + Python packages +
+  CPython runtime) is permissively licensed (MIT/Apache/BSD/PSF/MPL);
+  see THIRD-PARTY-NOTICES.md §2 for the list.
+- CPython runtime source: <https://www.python.org/downloads/source/>
+  (PSF License — not GPL, listed here for completeness).
+
+## libvips (via sharp prebuilt binaries) — LGPL-2.1-or-later
+
+- Shipped as dynamically-loaded libraries from `@img/*` prebuilts for sharp 0.35.4
+- Source: <https://github.com/libvips/libvips> · prebuilt bundle sources:
+  <https://github.com/lovell/sharp-builds>
+- LGPL compliance: the app's own source is public (MIT) and the libraries
+  remain separately replaceable files in the installation directory
+  (`node_modules/@img/`), satisfying the relinking requirement.
+
+---
+
+_Versions and hashes above correspond to the release this file ships with;
+update them when bumping bundled tool versions._

THIRD-PARTY-NOTICES.md

@@ -0,0 +1,108 @@
+# Third-Party Notices & Licenses
+
+MarkdownConverter (this app) is MIT-licensed. This document lists the
+third-party components that are **distributed with** the application, their
+licenses, and where to obtain source code. Full license texts for the
+copyleft and font licenses referenced here are in the `third-party-licenses/`
+folder shipped alongside this file (and in the source repository).
+
+This product includes software developed by third parties under the licenses
+below. Copyright and license notices are reproduced verbatim or referenced
+per each license's terms.
+
+---
+
+## 1. This application
+
+**MarkdownConverter** — Copyright (C) 2024-2025 ConcreteInfo (Amit Haridas) —
+MIT License. See the repository `LICENSE` file.
+
+---
+
+## 2. Bundled external binaries
+
+These run as separate operating-system processes, launched via `execFile`
+with literal argv (never a shell, never linked into the app).
+
+| Component | Version | License | Notes |
+|---|---|---|---|
+| Pandoc | 3.9.0.2 | GPL-2.0-or-later | Downloaded at build time by `scripts/download-tools.js` (SHA-256 pinned); license: [GPL-2.0](third-party-licenses/GPL-2.0.txt) |
+| FFmpeg | bundled by `ffmpeg-static` 5.3.0 | **GPL-3.0-or-later build** (`--enable-gpl --enable-libx264/x265`) | License text: <https://ffmpeg.org/legal.html>; source offer below |
+| MarkItDown | 0.1.7 (+ Python deps) | MIT | Microsoft's any-file→Markdown importer, frozen with PyInstaller by `scripts/bundle-markitdown.js`; includes an embedded CPython runtime (PSF license) |
+| sharp / libvips prebuilt binaries | 0.35.4 | Apache-2.0 / **LGPL-2.1-or-later** (libvips) | Dynamically loaded native addon; LGPL compliance: this app's full MIT source is public, enabling relinking; license: [LGPL-2.1](third-party-licenses/LGPL-2.1.txt) |
+| KaTeX (CSS + fonts) | 0.18.5 | MIT | `assets/katex/` |
+| JetBrains Mono, Fira Code fonts | — | SIL OFL 1.1 | `assets/fonts/`; license: [OFL-1.1](third-party-licenses/OFL-1.1.txt) |
+| Electron | 41.x | MIT | and its bundled Chromium (BSD-style licenses) / Node.js (MIT) / OpenSSL (Apache-2.0) — see <https://www.electronjs.org/blog/electron-licensing> |
+
+### GPL source availability (GPL §3 offer)
+
+Corresponding source for every GPL-licensed binary distributed with this app
+is available on written request and from these permanent locations — see
+**[SOURCES.md](SOURCES.md)** for exact versions and URLs.
+
+### Python packages inside the bundled MarkItDown binary
+
+The frozen MarkItDown binary embeds CPython and (each MIT/Apache-2.0/BSD-3/
+PSF/MPL-2.0 licensed unless noted): markitdown, onnxruntime (MIT), numpy
+(BSD-3), magika (Apache-2.0), beautifulsoup4 / soupsieve (MIT), requests
+(Apache-2.0) + urllib3/idna/charset-normalizer, certifi (MPL-2.0),
+markdownify, defusedxml (PSF), protobuf (BSD-3), flatbuffers (Apache-2.0),
+pdfminer.six (MIT), python-docx, python-pptx, openpyxl, extract-msg,
+markdown-it-py / mdurl, pyinstaller (GPL-2.0-with-exception — build tool
+only; its bootloader is embedded, source offer included in SOURCES.md),
+Packaging, six, click, chardet (LGPL — dynamically loadable Python module).
+
+---
+
+## 3. npm dependencies shipped in the app (runtime)
+
+| Package | Version | License |
+|---|---|---|
+| @cantoo/pdf-lib | 2.9.1 | MIT |
+| @codemirror/* (autocomplete, commands, lang-*, language, lint, search, state, theme-one-dark, view), codemirror | 6.x | MIT |
+| @replit/codemirror-vim | 6.4.0 | MIT |
+| core-util-is | 1.0.3 | MIT |
+| docx | 9.6.1 | MIT |
+| dompurify | 3.4.14 | (MPL-2.0 OR Apache-2.0) |
+| electron-store | 10.1.0 | MIT |
+| ffmpeg-static | 5.3.0 | GPL-3.0-or-later (binary; see §2) |
+| highlight.js | 11.11.1 | BSD-3-Clause |
+| html2pdf.js | 0.14.0 | MIT |
+| jszip | 3.10.1 | (MIT OR GPL-3.0-or-later) |
+| katex | 0.18.5 | MIT |
+| marked, marked-footnote, marked-highlight | 17.x / 1.4 / 2.2 | MIT |
+| mermaid | 11.17.2 | MIT |
+| pdfjs-dist | 5.5.207 | Apache-2.0 |
+| pdfkit | 0.17.2 | MIT |
+| pizzip | 3.2.0 | (MIT OR GPL-3.0) |
+| sharp | 0.35.4 | Apache-2.0 (+ LGPL libvips binaries; see §2) |
+| simple-git | 3.36.0 | MIT |
+| tslib | 2.8.1 | 0BSD |
+
+(Development-only dependencies — electron-builder, eslint, prettier, jest,
+cross-env, @testing-library/dom — are not distributed with the application.)
+
+## 4. Optional external tools (NOT bundled)
+
+These are detected and used when the user installs them; no copy is
+distributed with this app, so no redistribution obligations arise:
+
+- **LibreOffice** (MPL-2.0) — enhanced Office-format conversion
+- **MiKTeX / TeX Live** (LPPL/GPL per component) — LaTeX PDF export
+- **ImageMagick** (Apache-2.0-style) — extra image formats in the universal converter
+- **PlantUML** (GPL-3.0) + a Java runtime — local diagram rendering
+- **Calibre** (`ebook-convert`) — MOBI export
+- **System MarkItDown with `[all]` extras** — audio transcription / OCR
+
+## 5. Trademarks
+
+Product names used to describe compatibility (Pandoc, FFmpeg, LibreOffice,
+MarkItDown, Microsoft, Excel, Word, PowerPoint…) are trademarks of their
+respective owners and are not affiliated with this project.
+
+## 6. License texts
+
+See the `third-party-licenses/` directory: `GPL-2.0.txt`, `LGPL-2.1.txt`,
+`MPL-2.0.txt`, `Apache-2.0.txt`, `OFL-1.1.txt`, `PSF-Python.txt`. MIT and
+BSD-3-Clause texts are short and reproduced in each package's own repository;
+per-package LICENSE files also ship inside `node_modules/` in source form.

UPDATES.md

@@ -1,5 +1,127 @@
 # PanConverter - Updates & Changelog
 
+## Version 4.7.0 (2026-09-05)
+
+### Bundling & Legal Compliance
+- **MarkItDown is now bundled**: `npm run bundle:markitdown` freezes Microsoft's
+  markitdown (MIT) + embedded Python runtime into a single ~75MB per-platform
+  binary (`bin/<platform>/markitdown`) via PyInstaller (ML extras excluded);
+  the app prefers the bundled binary and falls back to system installs
+- Packaging copies the bundled markitdown for Windows/macOS/Linux alongside Pandoc
+- **THIRD-PARTY-NOTICES.md** — full license inventory of everything distributed
+  (bundled binaries, npm runtime deps, fonts, embedded Python packages)
+- **SOURCES.md** — GPL §3(b) written source offer for Pandoc / FFmpeg (GPL build) /
+  PyInstaller bootloader, with pinned versions + SHA-256; LGPL relinking note for libvips
+- **third-party-licenses/** — canonical texts: GPL-2.0, LGPL-2.1, MPL-2.0,
+  Apache-2.0, OFL-1.1, PSF-Python
+- **Help → Third-Party Notices & Licenses** — in-app viewer for both documents
+- **download-tools.js** now SHA-256 pins and verifies every downloaded artifact
+  (post-download and against the cache on every run; hard-fails on mismatch)
+- README gains a "Bundled Dependencies, Legal Notices & Credits" section
+- Large optional tools intentionally NOT bundled (documented): LibreOffice,
+  MiKTeX/TeX Live, ImageMagick, PlantUML+JRE, Calibre
+
+---
+
+## Version 4.6.1 (2026-09-05)
+
+### New Features
+- **MarkItDown import** — "File → Import with MarkItDown (Any Format)…" embeds
+  Microsoft's [markitdown](https://github.com/microsoft/markitdown) (MIT) as an
+  any-file → Markdown path: PDF, DOCX, PPTX, XLSX, Outlook .msg/.eml, EPUB,
+  images, CSV/JSON/XML, ZIP; audio transcription and OCR with the `[all]` extras
+  - Command auto-resolution: `markitdown` binary, then `python -m markitdown` /
+    `python3 -m markitdown` (probed once, cached)
+  - Same SEC-1 argv discipline as Pandoc (execFile only, paths never through a shell),
+    50MB input cap, 120s timeout, path-sanitized errors that surface markitdown's
+    actionable `pip install 'markitdown[...]'` hints
+  - Output written next to the source as `<name>.md` (numeric suffix instead of
+    overwriting) and opened in a new tab; `markitdown:available` / `markitdown:convert`
+    IPC for future renderer flows
+- **AI Assistant: Anthropic-compatible provider** — any base URL speaking the
+  Anthropic messages schema (LiteLLM proxies, Bedrock gateways, local servers);
+  x-api-key + Bearer auth, keyless proxies supported, tolerates bases with or
+  without a trailing `/v1`
+
+### Bug Fixes
+- File → Open PDF crashed the PDF editor (null operation matched no section; now
+  defaults to Merge)
+- Backlinks panel required the wrong module path (failed at registration)
+- writing-studio engines/panels now await their IPC-backed settings/file backends
+  (eliminates `JSON.parse("[object Promise]")` crashes)
+- Manuscript panel's window.prompt (unsupported in Electron) replaced with an
+  inline dialog; collaboration comment store made async to match its IO
+
+---
+
+## Version 4.6.0 (2026-09-05)
+
+### New Features
+
+#### AI Assistant Plugin (multi-provider)
+- Chat sidebar panel with rolling conversation history and insert-reply-into-document
+- Providers: OpenAI, Anthropic, Ollama, LM Studio, and any OpenAI-compatible endpoint
+- All provider traffic proxied through the main process — API keys never enter the renderer and the CSP stays closed to AI endpoints
+- Commands: AI Summarize / Improve / Explain / Translate selection
+- Answers the writing-studio `ai:analyze` contract, finally enabling the Proofread panel
+
+#### Collaboration Plugin (inline comments)
+- Anchor-based comments stored in `.comments/` sidecar files (never exported, never committed)
+- Comments sidebar panel: add at cursor, list, resolve, delete, jump to anchor
+- Drift detection flags moved/edited anchors; F8 navigates to the next open comment
+
+#### Local Knowledge Base (wiki-links + backlinks)
+- `[[Note]]`, `[[Note|alias]]`, `[[Note#section]]` render as links in the preview (code blocks excluded)
+- Clicking a wiki-link opens the note or offers to create it
+- Backlinks sidebar panel scans the folder (bounded BFS) for documents linking to the current one
+
+#### Crash Recovery / Session Restore
+- Open tabs (paths + unsaved buffer content) snapshotted to localStorage, debounced on edits, on tab changes, on unload, and once a minute
+- Restore prompt on launch with per-tab restore, clean-fresh option, and 2MB content budget
+
+#### Document Version History
+- Every save snapshots the previous on-disk content to `<userData>/versions/`
+- History sidebar panel: list, restore (with safety snapshot), unified diff vs. current, delete, manual "save version now"
+- Per-document pruning (20 versions), path-hash storage, id-validated reads
+
+#### Editor
+- Vim keybindings (View → Vim Mode, persisted, live toggle via CodeMirror Compartment)
+- Snippet Tab-expansion: type a snippet name and press Tab to insert it
+- Zen Mode word-goal setter (the HUD progress bar finally has UI)
+
+#### Export / Conversion
+- **Real PDF encryption**: pdf-lib swapped for @cantoo/pdf-lib — encrypt/decrypt/permissions now actually work (UI auto-enables via the capability probe)
+- **XLSX export**: markdown tables → native Excel workbook, one sheet per table (no Pandoc needed)
+- **ODT headers/footers + page size**: real ODF styles.xml patching replaces the empty stub
+- **Local PlantUML rendering**: diagrams render on-machine via the `plantuml` CLI when installed; plantuml.com stays as fallback
+- **KaTeX bundled locally** (CSS + fonts): math renders offline, no CDN calls
+- Writing heatmap (GitHub-style 30-day grid) in the writing-studio Goals panel
+
+#### Platform
+- Quick Note global scratchpad (Ctrl+Alt+Q, works when unfocused; appends to `notes/quick-notes.md`)
+- Deep link protocol `markdownconverter://open?path=…`
+- REPL confirmation dialog before first code execution per language per session (unsandboxed-execution guard rail)
+- Writing-studio's four sidebar panels (Manuscript/Goals/Snapshots/Proofread) are now actually wired with rail icons
+- Plugin sidebar panels get automatic rail icons via `registerPanel({icon})`
+
+### Bug Fixes
+- `Ctrl+Shift+P` collision: PDF (Enhanced) export now `Ctrl+Alt+Shift+P`; Command Palette keeps `Ctrl+Shift+P`
+- Universal Converter's Pandoc tool no longer always reports "not installed" (`checkConverterAvailable` gained a pandoc case with bundled-binary check)
+- CLI headless export: removed dangling `--css` / `--reference-doc` flags that made pandoc exit with an error; `--self-contained` replaced with `--standalone` (Pandoc 3.x)
+- Removed dead "Open Export Options Dialog…" button from the converter dialog
+- Removed duplicate `styles-zen.css` include
+
+### Security
+- AI provider requests carry size caps (200KB prompt), timeouts (120s), and user-safe error surfaces
+- Version-history reads validate ids against traversal; history listing requires a valid document path
+- PlantUML local rendering removes the diagram-text exfiltration path when a local CLI exists (CVE-MC-007 follow-up)
+
+### Tests
+- New suites: OdtStyling, AiProviders, ai-assistant prompts, collaboration comment-store, wiki-links/backlinks, session-store, XlsxExporter, VersionHistory
+- PDFOperations encryption tests rewritten for the real-encryption reality
+
+---
+
 ## Version 4.0.0 (2026-03-04)
 
 ### Major Changes

assets/fonts/FiraCode-LICENSE.txt

@@ -0,0 +1,93 @@
+Copyright (c) 2014, The Fira Code Project Authors (https://github.com/tonsky/FiraCode)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

assets/fonts/JetBrainsMono-LICENSE.txt

@@ -0,0 +1,93 @@
+Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

docs/superpowers/plans/2026-08-23-feature-audit-and-hardening.md

@@ -0,0 +1,759 @@
+# Feature Audit, Bug Fixes, New Features & Security Hardening Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Fix every verified non-working feature in MarkdownConverter, build out the orphaned image/audio/video converter subsystem, add 9 new features extending existing architecture, remediate a critical Pandoc argument-injection vulnerability plus other security findings, then produce a clean local release build.
+
+**Architecture:** Vanilla JS Electron app (`contextIsolation: false`, `nodeIntegration: true`). Main process (`src/main.js`, ~5000 lines) owns all IPC handlers, dialogs, and external-tool invocation (Pandoc, ffmpeg, ImageMagick, LibreOffice) via `execFile`. Renderer (`src/renderer.js`, ~6150 lines) is vanilla DOM manipulation; it uses `ipcRenderer` both directly (legacy) and via the whitelisted `window.electronAPI` bridge (`src/preload.js`). Feature modules live under `src/main/*.js` (PDF, Git, font embedding) and `src/plugins/*.js` (plugin system). Follow this existing pattern for all new code — do not introduce a bundler, framework, or TypeScript.
+
+**Tech Stack:** Electron 41, Node 20, Pandoc (external binary via `getPandocPath()`), ffmpeg-static (bundled, via `getFFmpegPath()`), `sharp` (image ops, currently a devDependency — must move to `dependencies`), `pdf-lib` (`src/main/PDFOperations.js`), `simple-git` (`src/main/GitOperations.js`), Jest for tests, ESLint flat config + Prettier.
+
+**Spec:** This plan is self-originated from a live codebase audit (two parallel research passes + manual verification of every finding against `src/main.js`, `src/preload.js`, `src/renderer.js`, `src/main/GitOperations.js`, `src/main/PDFOperations.js`, `src/plugins/plugin-context.js`). No separate spec doc exists; each task below states the verified current behavior and the required end behavior.
+
+## Global Constraints
+
+- `contextIsolation: false` / `nodeIntegration: true` is the existing (weak) security model for this branch — do not attempt to flip it as part of this plan; that is a separate, much larger migration tracked elsewhere. Do not make the security posture worse than it already is.
+- All new external-process invocation MUST use `execFile` with an explicit argument array — **never** build a shell-style command string and re-tokenize it. This is the root cause of Finding SEC-1 below; do not repeat the pattern anywhere new.
+- All new/changed IPC channels must be added to the correct whitelist array in `src/preload.js` (`ALLOWED_SEND_CHANNELS` for renderer→main, `ALLOWED_RECEIVE_CHANNELS` for main→renderer) — an unlisted channel is silently blocked (see `preload.js:261-282`).
+- 2-space indent, single quotes, semicolons, 100-char width (Prettier). Run `npm run lint` and `npm run format:check` before every commit; both must pass.
+- `npm test` (Jest, jsdom) must stay green (247 tests / 32 suites passing at plan start) after every task.
+- File size limit for user-opened files is `MAX_FILE_SIZE_MB = 50` (`main.js:57-58`) — reuse this constant for any new file-accepting handler, don't invent a new limit.
+- Error messages shown to the user must go through `sanitizeErrorMessage()` (`main.js:61-70`) if they might contain absolute paths.
+- No forbidden markers (`TODO`, `FIXME`, `stub`, `placeholder`, `coming soon`, etc.) in any changed file.
+
+---
+
+## Phase A — Fix Verified Non-Working Features
+
+### Task 1: Fix "Open PDF File..." menu item (wrong IPC channel)
+
+**Files:**
+- Modify: `src/main.js:1666-1684` (`openPDFFile()`)
+
+**Verified current behavior:** `openPDFFile()` sends `mainWindow.webContents.send('open-pdf-viewer', files[0])` (line 1682). No listener for `'open-pdf-viewer'` exists anywhere in the repo. The working PDF-editor open path is `show-pdf-editor-dialog`, whose renderer listener is `ipcRenderer.on('show-pdf-editor-dialog', (event, operation, openedFilePath) => {...})` (`renderer.js:3685`).
+
+- [ ] **Step 1:** In `openPDFFile()`, replace the send call:
+```javascript
+mainWindow.webContents.send('show-pdf-editor-dialog', null, files[0]);
+```
+- [ ] **Step 2:** Manually verify: `npm start`, open a PDF via File → Open PDF File (or the equivalent menu entry), confirm the PDF editor dialog opens with the file loaded (same result as opening it via the PDF toolbar button).
+- [ ] **Step 3:** `npm run lint && npm test`
+- [ ] **Step 4:** Commit: `git add src/main.js && git commit -m "fix(pdf): route Open PDF File menu item to the working editor dialog channel"`
+
+### Task 2: Fix "Clear Recent Files" silent no-op
+
+**Files:**
+- Modify: `src/main.js:731-736` (menu click handler), `src/main.js:4480-4491` (`ipcMain.on('clear-recent-files', ...)`)
+
+**Verified current behavior:** The menu click handler does `mainWindow.webContents.send('clear-recent-files')` (main→renderer), but nothing in the renderer listens for that channel. The actual deletion logic lives in `ipcMain.on('clear-recent-files', (event) => {...})`, which only fires on a renderer→main `.send`/`.invoke` that never happens from this menu path. `preload.js:342` exposes a separate `clearRecent: () => ipcRenderer.send('clear-recent-files')` helper that IS the correct renderer→main direction, but the menu item bypasses it entirely by sending the same channel name in the wrong direction.
+
+- [ ] **Step 1:** Extract the deletion logic into a standalone function above the `ipcMain.on` registration:
+```javascript
+function clearRecentFilesOnDisk() {
+  const userDataPath = app.getPath('userData');
+  const recentFilesPath = path.join(userDataPath, 'recent-files.json');
+  fs.writeFileSync(recentFilesPath, JSON.stringify([], null, 2));
+  createMenu();
+}
+```
+- [ ] **Step 2:** Update the `ipcMain.on` handler to use it:
+```javascript
+ipcMain.on('clear-recent-files', (event) => {
+  try {
+    clearRecentFilesOnDisk();
+    event.reply('recent-files-cleared');
+  } catch (error) {
+    console.error('Error clearing recent files:', error);
+  }
+});
+```
+- [ ] **Step 3:** Update the menu click handler (`main.js:731-736`) to call the main-process function directly and notify the renderer the same way the working path does:
+```javascript
+{
+  label: 'Clear Recent Files',
+  click: () => {
+    try {
+      clearRecentFilesOnDisk();
+      mainWindow.webContents.send('recent-files-cleared');
+    } catch (error) {
+      console.error('Error clearing recent files:', error);
+    }
+  },
+},
+```
+- [ ] **Step 4:** Manually verify: open a few recent files, use File menu → Clear Recent Files, confirm the Recent Files submenu is empty afterward.
+- [ ] **Step 5:** `npm run lint && npm test`
+- [ ] **Step 6:** Commit: `git add src/main.js && git commit -m "fix(menu): make Clear Recent Files actually clear the list"`
+
+### Task 3: Wire "Insert Template" submenu (content already exists, just needs a listener)
+
+**Files:**
+- Modify: `src/renderer.js` (near the existing `templates` sidebar-panel registration, ~line 1744-1758)
+
+**Verified current behavior:** `main.js:811-847` sends `mainWindow.webContents.send('load-template-menu', '<file>.md')` for 10 menu items. `'load-template-menu'` IS already in `ALLOWED_RECEIVE_CHANNELS` (`preload.js:241`) but nothing in the renderer listens for it — **however** the underlying feature is fully implemented already: `src/templates/*.md` contains real content for all 10 templates, `ipcMain.handle('load-template', ...)` (`main.js:4641-4649`) reads them, and the sidebar Templates panel (`renderer.js:1744-1758`) already does exactly the load-into-new-tab flow needed. Do not author new template content — reuse the existing flow.
+
+- [ ] **Step 1:** Extract the existing inline callback at `renderer.js:1746-1757` into a shared named function so both the sidebar panel and the new menu listener use it:
+```javascript
+async function loadTemplateIntoNewTab(file) {
+  const templateContent = await ipcRenderer.invoke('load-template', file);
+  if (templateContent) {
+    const content = templateContent.replace(/\{\{DATE\}\}/g, new Date().toISOString().split('T')[0]);
+    tabManager.createNewTab();
+    const tab = tabManager.tabs.get(tabManager.activeTabId);
+    tabManager.setEditorContent(tab.id, content);
+  }
+}
+```
+Place this near the top of the sidebar-initialization block (wherever `tabManager` is already in scope at that point), then replace the sidebar panel's inline callback with `render: (container) => getRenderTemplatesPanel()(container, loadTemplateIntoNewTab)`.
+- [ ] **Step 2:** Add a listener for the menu channel, near the other `ipcRenderer.on(...)` registrations in the same initialization area:
+```javascript
+ipcRenderer.on('load-template-menu', (event, file) => {
+  loadTemplateIntoNewTab(file);
+});
+```
+- [ ] **Step 3:** Manually verify: File → New from Template → Blog Post (and 2-3 others), confirm a new tab opens with the real template content, `{{DATE}}` replaced with today's date.
+- [ ] **Step 4:** `npm run lint && npm test`
+- [ ] **Step 5:** Commit: `git add src/renderer.js && git commit -m "fix(templates): wire New from Template menu to existing template-loading flow"`
+
+### Task 4: Wire Command Palette / Sidebar / Bottom Panel menu toggles
+
+**Files:**
+- Modify: `src/renderer.js` (near command palette init ~line 2045, sidebar manager init ~line 1703, bottom/REPL panel init ~line 1007)
+
+**Verified current behavior:** `main.js:1047,1057-1069,1075` send `toggle-command-palette`, `toggle-sidebar-panel` (with a panel-id arg: `explorer`/`git`/`snippets`/`templates`), and `toggle-bottom-panel`. All three channels are already whitelisted in `ALLOWED_RECEIVE_CHANNELS` (`preload.js:242-244`). None have a renderer listener — the Command Palette currently only opens via its own `Ctrl+Shift+P` keydown handler (`renderer.js:2045-2049`), sidebar panels only toggle via their own buttons, and the bottom/REPL panel only auto-shows when a code block runs (`renderer.js:1007`).
+
+- [ ] **Step 1:** Find the existing function/method that the `Ctrl+Shift+P` keydown handler calls to open the command palette (read `renderer.js:2040-2060` to get its exact name), then add:
+```javascript
+ipcRenderer.on('toggle-command-palette', () => {
+  /* call the same open/toggle function the Ctrl+Shift+P handler uses */
+});
+```
+- [ ] **Step 2:** Find the existing method on `sidebarManager` used to show/activate a panel by id (read the `SidebarManager` class, likely in `src/sidebar/` — grep `class SidebarManager`), then add:
+```javascript
+ipcRenderer.on('toggle-sidebar-panel', (event, panelId) => {
+  /* call sidebarManager's existing toggle/show method with panelId */
+});
+```
+- [ ] **Step 3:** Find the existing function that shows/hides the bottom REPL panel (read `renderer.js` around line 997-1012), then add:
+```javascript
+ipcRenderer.on('toggle-bottom-panel', () => {
+  /* call the same show/hide function used when a code block runs, but toggle rather than force-show */
+});
+```
+- [ ] **Step 4:** Manually verify each of the three View-menu items now actually opens/toggles its target.
+- [ ] **Step 5:** `npm run lint && npm test`
+- [ ] **Step 6:** Commit: `git add src/renderer.js && git commit -m "fix(menu): wire Command Palette / Sidebar / Bottom Panel View-menu toggles"`
+
+### Task 5: Fix broken `git-diff` IPC call (renderer invokes a channel main never handles)
+
+**Files:**
+- Modify: `src/main/GitOperations.js`, `src/main.js` (near the other `git-*` handlers, ~line 4889-4904)
+- Modify: `src/sidebar/git-panel.js`, `src/renderer.js:1714-1731`
+
+**Verified current behavior:** `renderer.js:1718-1721` passes `gitDiff: (file) => ipcRenderer.invoke('git-diff', { file })` into the Git sidebar panel, but `src/main.js` has **no** `ipcMain.handle('git-diff', ...)` registered anywhere (only `git-status`, `git-stage`, `git-commit`, `git-log` exist at lines 4889-4904), and `GitOperations.js` exports no `diff` function. Additionally, `src/sidebar/git-panel.js:1` receives this callback as a parameter literally named `_gitDiff` (underscore-prefixed = intentionally unused) — the panel never even calls it. This is dead on both ends. Fold the real fix into Task 14 (Phase C, new git features) rather than doing a throwaway partial fix here.
+
+- [ ] **Step 1:** No action in this task — cross-reference only. Mark this task done once Task 14 lands, since it fully supersedes it.
+
+### Task 6: Whitelist and wire "Document Compare" menu item
+
+**Files:**
+- Modify: `src/preload.js` (`ALLOWED_RECEIVE_CHANNELS`)
+
+**Verified current behavior:** `main.js:1411-1413` sends `mainWindow.webContents.send('show-document-compare')`, but `'show-document-compare'` is **not** in `ALLOWED_RECEIVE_CHANNELS` at all (unlike the other dead channels, which were at least whitelisted) — per `preload.js:288-...` the `on()` wrapper drops unlisted channels. Building the actual compare UI is Task 20 (Phase C) — this task only covers the whitelist fix; C8 covers the working listener + UI.
+
+- [ ] **Step 1:** Add `'show-document-compare'` to `ALLOWED_RECEIVE_CHANNELS` in `src/preload.js` (alongside the other `show-*-dialog`/`show-*-converter` entries for consistency).
+- [ ] **Step 2:** `npm run lint && npm test`
+- [ ] **Step 3:** Commit: `git add src/preload.js && git commit -m "fix(preload): whitelist show-document-compare channel"`
+- Do not close this task's manual-verification step until Task 20 lands (there is nothing to see until the listener exists).
+
+### Task 7: Reachable UI control for monospace font settings
+
+**Files:**
+- Modify: `src/renderer.js` (Settings panel/dialog — locate existing settings UI, e.g. grep `showSettingsDialog` or similar)
+
+**Verified current behavior:** `ipcMain.handle('set-monospace-settings', ...)` exists and works (`main.js:375` area) and the getter is used at `renderer.js:1857`, but no UI control anywhere calls the setter — a user cannot actually change the monospace font/ligature preference.
+
+- [ ] **Step 1:** Read `main.js` around the `get-monospace-settings`/`set-monospace-settings` handlers to learn the exact settings shape (property names, e.g. `{ enabled, fontFamily, ligatures }` — use whatever the real shape is, do not invent fields).
+- [ ] **Step 2:** Locate the app's existing Settings panel/dialog in `renderer.js` (grep for where `get-monospace-settings` is already invoked at line ~1857 to find the surrounding UI section) and add a toggle + font-family control there, following the existing settings-control markup/CSS pattern already used for other settings in that same dialog.
+- [ ] **Step 3:** Wire the control's change handler to `ipcRenderer.invoke('set-monospace-settings', {...})` and apply the returned/echoed setting immediately (toggle the body class the same way the existing `renderer.js:1857`-area code does on load).
+- [ ] **Step 4:** Manually verify: toggle monospace font in Settings, confirm the editor/preview font changes live, and confirm the preference persists across an app restart.
+- [ ] **Step 5:** `npm run lint && npm test`
+- [ ] **Step 6:** Commit: `git add src/renderer.js && git commit -m "feat(settings): expose monospace font toggle in Settings UI"`
+
+### Task 8: Dependency hygiene — `jszip` and `sharp`
+
+**Files:**
+- Modify: `package.json`
+
+**Verified current behavior:** `src/main/DocxFontEmbedder.js` and `src/main/EpubFontEmbedder.js` `require('jszip')` directly, but `jszip` is declared only under `overrides`, not `dependencies` — it currently resolves only via hoisting from a transitive dependency. `sharp` is declared under `devDependencies` (used today only by `scripts/generate-icons.js` at build time) but Phase B (media converter) will require it at **runtime** in the packaged app, where devDependencies are not installed/bundled.
+
+- [ ] **Step 1:** In `package.json`, add `"jszip": "^3.10.1"` to `dependencies` (matching the version already pinned in `overrides`; keep the `overrides` entry too — it still forces the version for transitive consumers).
+- [ ] **Step 2:** Move `"sharp": "^0.34.3"` from `devDependencies` to `dependencies`.
+- [ ] **Step 3:** Add `"node_modules/sharp/**"` to the `build.asarUnpack` array in `package.json` (alongside the existing `ffmpeg-static` and `assets/fonts` entries) — `sharp` ships native `.node` bindings that must not be packed into `app.asar`.
+- [ ] **Step 4:** Run `npm install` to regenerate the lockfile, then `npm test` to confirm nothing broke.
+- [ ] **Step 5:** Commit: `git add package.json package-lock.json && git commit -m "fix(deps): move jszip and sharp to runtime dependencies, unpack sharp from asar"`
+
+---
+
+## Phase B — Build Out Image/Audio/Video Converter (currently orphaned dead API)
+
+**Context:** `preload.js` whitelists 16 channels (`image-convert`, `image-batch-convert`, `image-resize`, `image-compress`, `image-rotate`, `audio-convert`, `audio-batch-convert`, `audio-extract`, `audio-trim`, `audio-merge`, `video-convert`, `video-batch-convert`, `video-compress`, `video-trim`, `video-frames`, `video-gif`) and 3 receive channels (`show-image-converter`, `show-audio-converter`, `show-video-converter`), but **zero** `ipcMain` handlers exist for any of them and no menu/UI ever triggers them. This is distinct from the already-working generic "Universal Converter" (`universal-convert`/`universal-convert-batch`, `main.js:2377-2622`) which does plain format-to-format conversion via bare `convertWithImageMagick`/`convertWithFFmpeg` calls with no operation-specific options. Phase B builds the **operation-specific** toolkit (resize/compress/rotate for images; trim/merge/extract for audio; compress/trim/frames/gif for video) as a new `src/main/MediaOperations.js` module, modeled directly on the existing `src/main/PDFOperations.js` pattern (single `executeOperation(operation, data)` dispatcher).
+
+### Task 9: Image operations backend (`sharp`-based)
+
+**Files:**
+- Create: `src/main/ImageOperations.js`
+- Create: `tests/main/ImageOperations.test.js`
+- Modify: `src/main.js` (register handlers near the PDF operation handlers, ~line 4535)
+
+**Interfaces:**
+- Produces: `module.exports = { executeOperation, imageConvert, imageResize, imageCompress, imageRotate }` — `executeOperation(operation, data)` where `operation` is one of `'convert' | 'resize' | 'compress' | 'rotate'` and `data` always includes `{ inputPath, outputPath }` plus operation-specific fields below.
+- `imageConvert(data)`: `data = { inputPath, outputPath, format }` (`format` is one of sharp's supported output formats: `jpeg|png|webp|avif|tiff|gif`) → uses `sharp(inputPath).toFormat(format).toFile(outputPath)`.
+- `imageResize(data)`: `data = { inputPath, outputPath, width, height, fit }` (`fit` one of `'cover'|'contain'|'fill'|'inside'|'outside'`, default `'inside'`) → `sharp(inputPath).resize({ width, height, fit }).toFile(outputPath)`. `width`/`height` may be `null` (sharp allows omitting one dimension to preserve aspect ratio) but not both.
+- `imageCompress(data)`: `data = { inputPath, outputPath, quality }` (`quality` integer 1-100, default 80) → route by output extension: jpeg/webp/avif use `{ quality }`, png uses `{ quality, compressionLevel: 9 }`.
+- `imageRotate(data)`: `data = { inputPath, outputPath, angle }` (`angle` integer degrees, any value — sharp's `.rotate(angle)` handles non-90 multiples by expanding canvas) → `sharp(inputPath).rotate(angle).toFile(outputPath)`.
+- All four validate `inputPath` exists and is ≤ `MAX_FILE_SIZE` (import the same 50MB constant convention used in `main.js` — pass it in as a parameter from `main.js`, do not redefine a second limit).
+- All four return `{ success: true, outputPath }` on success or throw an `Error` with a sanitized (no absolute-path leakage beyond what's already the app's convention) message on failure — `main.js` wraps calls in try/catch per the PDFOperations pattern.
+
+- [ ] **Step 1:** Write `tests/main/ImageOperations.test.js` covering all four operations against small fixture images (generate fixtures at test time with `sharp` itself — e.g. a 100x100 red PNG buffer — do not commit binary fixtures):
+```javascript
+const sharp = require('sharp');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const ImageOperations = require('../../src/main/ImageOperations');
+
+describe('ImageOperations', () => {
+  let tmpDir, inputPath;
+  beforeEach(async () => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'imgops_'));
+    inputPath = path.join(tmpDir, 'in.png');
+    await sharp({ create: { width: 100, height: 100, channels: 3, background: { r: 255, g: 0, b: 0 } } })
+      .png()
+      .toFile(inputPath);
+  });
+  afterEach(() => fs.rmSync(tmpDir, { recursive: true, force: true }));
+
+  test('imageConvert converts PNG to JPEG', async () => {
+    const outputPath = path.join(tmpDir, 'out.jpg');
+    const result = await ImageOperations.imageConvert({ inputPath, outputPath, format: 'jpeg' });
+    expect(result.success).toBe(true);
+    expect(fs.existsSync(outputPath)).toBe(true);
+    const meta = await sharp(outputPath).metadata();
+    expect(meta.format).toBe('jpeg');
+  });
+
+  test('imageResize resizes to given width preserving aspect', async () => {
+    const outputPath = path.join(tmpDir, 'out.png');
+    await ImageOperations.imageResize({ inputPath, outputPath, width: 50, height: null, fit: 'inside' });
+    const meta = await sharp(outputPath).metadata();
+    expect(meta.width).toBe(50);
+  });
+
+  test('imageRotate rotates by given angle', async () => {
+    const outputPath = path.join(tmpDir, 'out.png');
+    await ImageOperations.imageRotate({ inputPath, outputPath, angle: 90 });
+    const meta = await sharp(outputPath).metadata();
+    expect(meta.width).toBe(100); // 90deg on square stays square
+  });
+
+  test('imageCompress produces a smaller or equal-size JPEG at low quality', async () => {
+    const jpegPath = path.join(tmpDir, 'in.jpg');
+    await sharp(inputPath).jpeg({ quality: 100 }).toFile(jpegPath);
+    const outputPath = path.join(tmpDir, 'compressed.jpg');
+    await ImageOperations.imageCompress({ inputPath: jpegPath, outputPath, quality: 10 });
+    expect(fs.statSync(outputPath).size).toBeLessThanOrEqual(fs.statSync(jpegPath).size);
+  });
+
+  test('executeOperation dispatches to the correct function', async () => {
+    const outputPath = path.join(tmpDir, 'out.png');
+    const result = await ImageOperations.executeOperation('rotate', { inputPath, outputPath, angle: 180 });
+    expect(result.success).toBe(true);
+  });
+
+  test('unknown operation throws', async () => {
+    await expect(ImageOperations.executeOperation('bogus', {})).rejects.toThrow();
+  });
+});
+```
+- [ ] **Step 2:** Run `npx jest tests/main/ImageOperations.test.js` — expect FAIL (module doesn't exist).
+- [ ] **Step 3:** Implement `src/main/ImageOperations.js` per the interfaces above, using `sharp`. Model the file's shape (JSDoc header, `executeOperation` switch, `module.exports`) on `src/main/PDFOperations.js:404-436`.
+- [ ] **Step 4:** Run `npx jest tests/main/ImageOperations.test.js` — expect PASS.
+- [ ] **Step 5:** In `src/main.js`, add a single dispatcher handler near the PDF operation handler (`process-pdf-operation`, ~line 4535):
+```javascript
+const ImageOperations = require('./main/ImageOperations');
+// ...
+ipcMain.handle('process-image-operation', async (event, { operation, data }) => {
+  try {
+    return await ImageOperations.executeOperation(operation, data);
+  } catch (error) {
+    return { success: false, error: sanitizeErrorMessage(error.message) };
+  }
+});
+```
+Note: this collapses the originally-whitelisted 5 separate channel names (`image-convert`, `image-batch-convert`, `image-resize`, `image-compress`, `image-rotate`) into one operation-dispatch channel, matching the existing `process-pdf-operation` pattern — remove the 5 stale names from `ALLOWED_SEND_CHANNELS` in `src/preload.js` and add `'process-image-operation'` in their place (also add `'select-image-folder'` if batch needs folder selection — mirror `select-pdf-folder`). Batch (`image-batch-convert`) is handled in Task 12.
+- [ ] **Step 6:** `npm run lint && npm test`
+- [ ] **Step 7:** Commit: `git add src/main/ImageOperations.js tests/main/ImageOperations.test.js src/main.js src/preload.js && git commit -m "feat(image): implement sharp-based image operations backend"`
+
+### Task 10: Audio operations backend (`ffmpeg`-based)
+
+**Files:**
+- Create: `src/main/AudioOperations.js`
+- Create: `tests/main/AudioOperations.test.js`
+- Modify: `src/main.js`
+
+**Interfaces:**
+- `module.exports = { executeOperation, buildConvertArgs, buildTrimArgs, buildExtractArgs, buildMergeArgs }`. Because ffmpeg is an external binary, this module exposes **pure argument-builder functions** (easily unit-testable without invoking a real binary) plus `executeOperation`, which is the only piece that actually spawns ffmpeg via `execFile` — inject the ffmpeg path and an `execFileFn` (defaulting to Node's real `execFile`) as parameters so tests can stub it.
+- `buildConvertArgs({ inputPath, outputPath, format })` → returns `string[]` args, e.g. `['-i', inputPath, '-y', outputPath]` (format is implied by `outputPath`'s extension — ffmpeg infers it; do not pass a separate `-f` unless `format` is explicitly given and differs from the extension, in which case append `['-f', format]` before `outputPath`).
+- `buildTrimArgs({ inputPath, outputPath, startTime, duration })` → `['-i', inputPath, '-ss', String(startTime), '-t', String(duration), '-y', outputPath]`. `startTime`/`duration` are seconds (numbers), validate they are finite non-negative numbers before building args (throw `Error('Invalid trim range')` otherwise — this is the injection guard, since these become argv elements passed straight to execFile with no shell involved, but malformed values should still fail fast rather than reach ffmpeg).
+- `buildExtractArgs({ inputPath, outputPath })` → extracts the audio track from a video/audio file: `['-i', inputPath, '-vn', '-acodec', 'copy', '-y', outputPath]` (fallback if codec copy fails: caller retries without `-acodec copy`, letting ffmpeg transcode — implement this retry inside `executeOperation`'s `'extract'` case, not in the pure builder).
+- `buildMergeArgs({ inputPaths, outputPath })` → `inputPaths` is `string[]` (2+ files) → build a temp concat-list file is the safe approach; but since this module must stay pure/testable, `buildMergeArgs` returns `{ args, concatListContent }` where `concatListContent` is the `file '<path>'` lines the caller writes to a temp file, and `args = ['-f', 'concat', '-safe', '0', '-i', tempListPath, '-c', 'copy', '-y', outputPath]` (caller supplies `tempListPath` after writing the file — see `executeOperation`'s `'merge'` case).
+- `executeOperation(operation, data, { ffmpegPath, execFileFn } = {})` where `operation` is `'convert'|'trim'|'extract'|'merge'`, defaults `ffmpegPath` to the real `getFFmpegPath()`-resolved path (passed in from `main.js`, not re-implemented here) and `execFileFn` to `require('child_process').execFile`. Returns a Promise resolving `{ success: true, outputPath }`.
+
+- [ ] **Step 1:** Write `tests/main/AudioOperations.test.js` testing the pure builders directly (no real ffmpeg spawn needed for these) plus one `executeOperation` test with a stubbed `execFileFn`:
+```javascript
+const AudioOperations = require('../../src/main/AudioOperations');
+
+describe('AudioOperations argument builders', () => {
+  test('buildConvertArgs builds correct ffmpeg args', () => {
+    const args = AudioOperations.buildConvertArgs({ inputPath: '/a.wav', outputPath: '/b.mp3' });
+    expect(args).toEqual(['-i', '/a.wav', '-y', '/b.mp3']);
+  });
+
+  test('buildTrimArgs builds correct trim args', () => {
+    const args = AudioOperations.buildTrimArgs({ inputPath: '/a.mp3', outputPath: '/b.mp3', startTime: 5, duration: 10 });
+    expect(args).toEqual(['-i', '/a.mp3', '-ss', '5', '-t', '10', '-y', '/b.mp3']);
+  });
+
+  test('buildTrimArgs rejects non-finite startTime', () => {
+    expect(() =>
+      AudioOperations.buildTrimArgs({ inputPath: '/a.mp3', outputPath: '/b.mp3', startTime: NaN, duration: 10 })
+    ).toThrow('Invalid trim range');
+  });
+
+  test('buildMergeArgs builds concat-demuxer args and list content', () => {
+    const { args, concatListContent } = AudioOperations.buildMergeArgs({
+      inputPaths: ['/a.mp3', '/b.mp3'],
+      outputPath: '/out.mp3',
+    });
+    expect(concatListContent).toContain("file '/a.mp3'");
+    expect(concatListContent).toContain("file '/b.mp3'");
+    expect(args).toContain('-f');
+    expect(args).toContain('concat');
+  });
+});
+
+describe('AudioOperations.executeOperation', () => {
+  test('convert calls execFileFn with ffmpeg path and args, resolves success', async () => {
+    const execFileFn = (cmd, args, opts, cb) => cb(null, '', '');
+    const result = await AudioOperations.executeOperation(
+      'convert',
+      { inputPath: '/a.wav', outputPath: '/b.mp3' },
+      { ffmpegPath: '/usr/bin/ffmpeg', execFileFn }
+    );
+    expect(result.success).toBe(true);
+    expect(result.outputPath).toBe('/b.mp3');
+  });
+
+  test('unknown operation rejects', async () => {
+    await expect(
+      AudioOperations.executeOperation('bogus', {}, { ffmpegPath: '/usr/bin/ffmpeg', execFileFn: () => {} })
+    ).rejects.toThrow();
+  });
+});
+```
+- [ ] **Step 2:** Run `npx jest tests/main/AudioOperations.test.js` — expect FAIL.
+- [ ] **Step 3:** Implement `src/main/AudioOperations.js` per the interfaces above. Use `fs.writeFileSync`/`fs.mkdtempSync` (Node `os.tmpdir()`) inside `executeOperation`'s `'merge'` case to materialize the concat list file before invoking `execFileFn`.
+- [ ] **Step 4:** Run `npx jest tests/main/AudioOperations.test.js` — expect PASS.
+- [ ] **Step 5:** In `src/main.js`, add the dispatcher handler (mirrors Task 9 Step 5):
+```javascript
+const AudioOperations = require('./main/AudioOperations');
+// ...
+ipcMain.handle('process-audio-operation', async (event, { operation, data }) => {
+  try {
+    return await AudioOperations.executeOperation(operation, data, { ffmpegPath: getFFmpegPath() });
+  } catch (error) {
+    return { success: false, error: sanitizeErrorMessage(error.message) };
+  }
+});
+```
+Replace the 5 stale audio channel names in `ALLOWED_SEND_CHANNELS` (`preload.js`) with `'process-audio-operation'` (batch handled in Task 12).
+- [ ] **Step 6:** `npm run lint && npm test`
+- [ ] **Step 7:** Commit: `git add src/main/AudioOperations.js tests/main/AudioOperations.test.js src/main.js src/preload.js && git commit -m "feat(audio): implement ffmpeg-based audio operations backend"`
+
+### Task 11: Video operations backend (`ffmpeg`-based)
+
+**Files:**
+- Create: `src/main/VideoOperations.js`
+- Create: `tests/main/VideoOperations.test.js`
+- Modify: `src/main.js`
+
+**Interfaces:** Same shape as Task 10 (`executeOperation(operation, data, { ffmpegPath, execFileFn })`, pure arg builders for testability).
+- `buildConvertArgs({ inputPath, outputPath })` → `['-i', inputPath, '-y', outputPath]`.
+- `buildCompressArgs({ inputPath, outputPath, crf })` (`crf` 0-51, default 28 — lower is higher quality/larger file, matching libx264 convention) → `['-i', inputPath, '-vcodec', 'libx264', '-crf', String(crf), '-y', outputPath]`. Validate `crf` is an integer 0-51 (throw otherwise).
+- `buildTrimArgs({ inputPath, outputPath, startTime, duration })` → identical shape/validation to `AudioOperations.buildTrimArgs`.
+- `buildFramesArgs({ inputPath, outputDir, fps })` (`fps` frames-per-second to extract, default 1) → `['-i', inputPath, '-vf', `fps=${fps}`, path.join(outputDir, 'frame-%04d.png')]`. Validate `fps` is a positive finite number.
+- `buildGifArgs({ inputPath, outputPath, fps, width })` (`fps` default 10, `width` default 480, height auto via `-1`) → `['-i', inputPath, '-vf', `fps=${fps},scale=${width}:-1:flags=lanczos`, '-y', outputPath]`.
+- `operation` is `'convert'|'compress'|'trim'|'frames'|'gif'`.
+
+- [ ] **Step 1:** Write `tests/main/VideoOperations.test.js` mirroring Task 10's test structure — one test per builder function checking exact `args` array output plus validation-rejection tests for `compress` (bad `crf`) and `frames` (bad `fps`), plus one `executeOperation` test with a stubbed `execFileFn` for `'convert'` and one for `'frames'` that also verifies the output directory is created (`fs.mkdirSync(outputDir, { recursive: true })` inside `executeOperation`'s `'frames'` case before spawning ffmpeg).
+- [ ] **Step 2:** Run `npx jest tests/main/VideoOperations.test.js` — expect FAIL.
+- [ ] **Step 3:** Implement `src/main/VideoOperations.js` per the interfaces above.
+- [ ] **Step 4:** Run `npx jest tests/main/VideoOperations.test.js` — expect PASS.
+- [ ] **Step 5:** In `src/main.js`, add the dispatcher handler (mirrors B1/B2):
+```javascript
+const VideoOperations = require('./main/VideoOperations');
+// ...
+ipcMain.handle('process-video-operation', async (event, { operation, data }) => {
+  try {
+    return await VideoOperations.executeOperation(operation, data, { ffmpegPath: getFFmpegPath() });
+  } catch (error) {
+    return { success: false, error: sanitizeErrorMessage(error.message) };
+  }
+});
+```
+Replace the 6 stale video channel names in `ALLOWED_SEND_CHANNELS` with `'process-video-operation'`.
+- [ ] **Step 6:** `npm run lint && npm test`
+- [ ] **Step 7:** Commit: `git add src/main/VideoOperations.js tests/main/VideoOperations.test.js src/main.js src/preload.js && git commit -m "feat(video): implement ffmpeg-based video operations backend"`
+
+### Task 12: Media Operations UI (menu entries + dialog + batch)
+
+**Files:**
+- Create: `src/renderer/media-operations-dialog.js` (follow whatever module pattern `src/renderer.js` already uses for the PDF editor dialog — read `renderer.js:3685` onward to find that dialog's implementation file/pattern before creating this one)
+- Modify: `src/main.js` (menu — add "Image/Audio/Video Tools..." entries under the existing `Tools` submenu, next to Table Generator/ASCII Art Generator at `main.js:1395-1414`; also extend `universal-convert-batch`'s existing batch-folder flow OR add three new `process-*-operation` batch loops mirroring the pattern at `main.js:2454-2563`, whichever requires less duplication once B1-B3 exist — prefer reusing `executeOperation` in a loop over `fs.readdirSync` results, matching the existing batch style)
+- Modify: `src/preload.js` (add `'show-image-converter'`... already present; add `'process-image-operation'`/`'process-audio-operation'`/`'process-video-operation'` to `ALLOWED_SEND_CHANNELS` if not already added by B1-B3)
+
+**Verified current behavior:** `show-image-converter`/`show-audio-converter`/`show-video-converter` are whitelisted receive channels with no sender and no listener — Batch Image/Audio/Video Conversion menu items already exist and work via the generic Universal Converter (`main.js:1283-1291`, `2454-2563`) for plain format conversion; this task adds the **operation-specific** single-file dialogs (resize/compress/rotate/trim/merge/extract/frames/gif) that B1-B3 implemented.
+
+- [ ] **Step 1:** Add three menu items under `Tools` (`main.js`, after the "Document Compare" item added conceptually in Task 6/C8):
+```javascript
+{ label: 'Image Tools...', click: () => mainWindow.webContents.send('show-image-converter') },
+{ label: 'Audio Tools...', click: () => mainWindow.webContents.send('show-audio-converter') },
+{ label: 'Video Tools...', click: () => mainWindow.webContents.send('show-video-converter') },
+```
+- [ ] **Step 2:** Build the renderer-side dialog module. Read how the existing PDF Editor dialog (triggered by `show-pdf-editor-dialog`) is structured/rendered in `renderer.js` (search for its listener at line 3685 and follow into whatever function/file builds its DOM) and replicate that construction pattern for a single dialog that: (a) lets the user pick an operation from a dropdown scoped to the current media kind (image/audio/video), (b) shows the relevant operation-specific fields (e.g. width/height for resize, quality for compress, angle for rotate, startTime/duration for trim, fps/width for gif), (c) has an input-file picker (reuse the existing `dialog.showOpenDialogSync` pattern via a new small `ipcMain.handle('select-media-file', ...)` if no generic file-picker IPC already exists — check first; `select-pdf-folder` is folder-only, so a new single-file-picker handler is likely needed), (d) calls `ipcRenderer.invoke('process-image-operation', { operation, data })` (or audio/video) and shows success/error the same way `pdf-operation-complete`/`pdf-operation-error` are surfaced elsewhere.
+- [ ] **Step 3:** Wire the three `ipcRenderer.on('show-image-converter'|'show-audio-converter'|'show-video-converter', ...)` listeners in `renderer.js` to open the new dialog scoped to the right media kind.
+- [ ] **Step 4:** Manually verify with `npm start`: Tools → Image Tools → Resize a test PNG, confirm the output file is created at the chosen size; repeat once each for one audio op (trim) and one video op (compress) using any small local test media file.
+- [ ] **Step 5:** `npm run lint && npm test`
+- [ ] **Step 6:** Commit: `git add -A && git commit -m "feat(media): add Image/Audio/Video Tools dialogs wired to new operation backends"`
+
+---
+
+## Phase C — New Features (extending existing systems)
+
+### Task 13: Expose more Pandoc export/import formats already supported by the bundled Pandoc
+
+**Files:**
+- Modify: `src/main.js` (export submenu ~`main.js:864-959`; `exportFile()` at `main.js:1766`; the format switch inside `performExportWithOptions`/`buildPandocExportArgs` — see Task 23, which replaces string-building with an args-array builder; add cases there, not to the old string-concat code)
+
+**New formats to add** (all already importable per the existing import switch at `main.js:3507` — Pandoc supports both directions for each):
+- Export: AsciiDoc (`asciidoc`), reStructuredText (`rst`), MediaWiki (`mediawiki`), Org-mode (`org`), Textile (`textile`), man page (`man`), Jupyter Notebook (`ipynb`).
+
+- [ ] **Step 1:** Add 7 new menu entries to the Export submenu (`main.js:864-959`), grouped in a new labeled section, each calling `exportFile('<format>')` with the format id above.
+- [ ] **Step 2:** Add each format to the extension-mapping table used by the export path (the `formatExtMap` object at `main.js:2624-2629` — add `asciidoc: 'adoc', mediawiki: 'wiki'`; the rest already match their format id as extension).
+- [ ] **Step 3:** RULING (pre-flight scan, execution order is Phase A→B→C→D, so Task 23 has NOT run yet when this task executes): add each format as an additional `-t <format>` case to the **current** string-concatenation `pandocCmd` logic in `performExportWithOptions` (the same pattern already used for `'json'`, `'beamer'`, `'jira'` etc. around `main.js:2825-2965` — a simple `pandocCmd = \`${getPandocPath()} "${currentFile}" -t <format> -o "${outputFile}"\`; exportWithPandoc(pandocCmd, outputFile, format);` branch per new format is sufficient; do not introduce any new string-interpolated user-controlled fields — these 7 formats take no extra options beyond the standard ones already handled generically above the format switch). When Task 23 runs later (Phase D) it will read the current state of this function, per its own Step 3 instruction to "read every one of the sites... in full," and MUST carry these 7 new cases into its args-array rewrite — that responsibility already belongs to SEC-1's own scope and needs no separate action here.
+- [ ] **Step 4:** Manually verify: export the currently-open sample markdown file to each of the 7 new formats, confirm each produces a non-empty output file Pandoc itself can round-trip (`pandoc out.rst -o roundtrip.md` succeeds).
+- [ ] **Step 5:** `npm run lint && npm test`
+- [ ] **Step 6:** Commit: `git add src/main.js && git commit -m "feat(export): expose AsciiDoc, RST, MediaWiki, Org, Textile, man, ipynb export formats"`
+
+### Task 14: Git branch / diff / push / pull
+
+**Files:**
+- Modify: `src/main/GitOperations.js`
+- Modify: `tests/` (find and extend the existing GitOperations test file — grep `tests/**/GitOperations*`; if none exists, create `tests/main/GitOperations.test.js`)
+- Modify: `src/main.js` (register 4 new `ipcMain.handle` calls near the existing git handlers, `main.js:4889-4904`)
+- Modify: `src/preload.js` (add `'git-branch'`, `'git-diff'` is already listed but unhandled — see below, `'git-push'`, `'git-pull'` to `ALLOWED_SEND_CHANNELS`)
+- Modify: `src/sidebar/git-panel.js`, `src/renderer.js:1714-1731`
+
+**Interfaces (add to `GitOperations.js`, matching the existing `try { ... } catch (err) { return { error: err.message } }` pattern used by every existing function there):**
+```javascript
+async function diff(dir, file) { /* git.diff([file]) if file given, else git.diff() for full working-tree diff */ }
+async function branches(dir) { /* git.branchLocal() — returns { all, current, branches } */ }
+async function checkoutBranch(dir, name, isNew) { /* isNew=true: git.checkoutLocalBranch(name); else git.checkout(name) */ }
+async function push(dir) { /* git.push() */ }
+async function pull(dir) { /* git.pull() */ }
+module.exports = { getStatus, stage, commit, log, diff, branches, checkoutBranch, push, pull };
+```
+
+- [ ] **Step 1:** Write/extend the Jest test file covering `diff`, `branches`, `checkoutBranch`, `push`, `pull` against a real temp git repo (follow whatever fixture pattern the existing Git-related tests use — if this is the first GitOperations test file, initialize a repo with `simple-git` itself inside `beforeEach` using `fs.mkdtempSync` + `simpleGit(tmpDir).init()`, matching how `simple-git` is already used in the module under test).
+- [ ] **Step 2:** Run the new tests — expect FAIL (functions don't exist).
+- [ ] **Step 3:** Implement the 5 new functions in `GitOperations.js` per the interfaces above.
+- [ ] **Step 4:** Run the tests — expect PASS.
+- [ ] **Step 5:** In `main.js`, register handlers next to the existing 4:
+```javascript
+ipcMain.handle('git-diff', async (event, { file }) => {
+  const dir = path.dirname(currentFile || app.getPath('documents'));
+  return GitOperations.diff(dir, file);
+});
+ipcMain.handle('git-branches', async () => GitOperations.branches(path.dirname(currentFile || app.getPath('documents'))));
+ipcMain.handle('git-checkout', async (event, { name, isNew }) => GitOperations.checkoutBranch(path.dirname(currentFile || app.getPath('documents')), name, isNew));
+ipcMain.handle('git-push', async () => GitOperations.push(path.dirname(currentFile || app.getPath('documents'))));
+ipcMain.handle('git-pull', async () => GitOperations.pull(path.dirname(currentFile || app.getPath('documents'))));
+```
+(Match whatever `dir` resolution the existing `git-status` handler at `main.js:4889-4891` actually uses — read those 3 lines first and reuse the identical expression rather than inventing a new one.)
+- [ ] **Step 6:** Add `'git-branches'`, `'git-checkout'`, `'git-push'`, `'git-pull'` to `ALLOWED_SEND_CHANNELS` in `preload.js` (`'git-diff'` is already present).
+- [ ] **Step 7:** In `src/sidebar/git-panel.js`, rename the unused `_gitDiff` parameter to `gitDiff` and add UI to actually call it (a "diff" button/icon per changed file in the status list, rendering the returned diff text in a `<pre>` block or similar — follow the panel's existing rendering style for the status list). Add branch/push/pull UI following the same panel's existing button/section style.
+- [ ] **Step 8:** In `renderer.js:1714-1731`, pass the 4 new callbacks (`gitBranches`, `gitCheckout`, `gitPush`, `gitPull`) into `getRenderGitPanel()` alongside the existing ones.
+- [ ] **Step 9:** Manually verify in a real git-tracked test folder: view a file diff, list branches, create+checkout a new branch, (push/pull only if a real remote is available — otherwise verify the IPC round-trip returns a sane `{error: ...}` for a repo with no remote, not a crash).
+- [ ] **Step 10:** `npm run lint && npm test`
+- [ ] **Step 11:** Commit: `git add -A && git commit -m "feat(git): add diff, branch, checkout, push, pull to Git sidebar panel"`
+
+### Task 15: More PDF operations — extract text, page numbers, crop, extract images
+
+**Files:**
+- Modify: `src/main/PDFOperations.js`, its test file (grep `tests/**/PDFOperations*`)
+- Modify: `src/main.js` (`process-pdf-operation` already dispatches via `executeOperation` — no new handler needed, just new `case`s in `PDFOperations.js`'s existing switch at line 404)
+- Modify: renderer PDF editor dialog UI (wherever the existing operation list/buttons are — find via the `show-pdf-editor-dialog` listener at `renderer.js:3685`)
+
+**Interfaces (add to the existing `executeOperation` switch, `PDFOperations.js:404-430`):**
+```javascript
+async function pdfExtractText(data) { /* data: {inputPath}. Use pdf-lib's page.getTextContent() is NOT available in pdf-lib — pdf-lib has no text extraction. Use pdfjs-dist (already a dependency) instead: load with pdfjs-dist, iterate pages, getTextContent(), join strings. Return { success: true, text } */ }
+async function pdfAddPageNumbers(data) { /* data: {inputPath, outputPath, position, startNumber}. For each page, drawText via pdf-lib at the given corner (reuse the position-mapping switch already present in pdfWatermark, PDFOperations.js:258-287, for corner math). */ }
+async function pdfCrop(data) { /* data: {inputPath, outputPath, margins: {top,bottom,left,right}} in points. Use page.setCropBox(x, y, width, height) computed from the page's existing MediaBox minus margins. */ }
+async function pdfExtractImages(data) { /* data: {inputPath, outputDir}. pdf-lib doesn't expose embedded image extraction either — use pdfjs-dist's page.getOperatorList() + page.objs to pull OPS.paintImageXObject image data, write each as PNG via sharp (already a dependency after Task 8). Return { success: true, count, files: string[] } */ }
+```
+Add 4 new `case` branches to `executeOperation` (`'extractText'`, `'pageNumbers'`, `'crop'`, `'extractImages'`) and add all 4 to `module.exports`.
+
+- [ ] **Step 1:** Read `PDFOperations.js:233-317` (`pdfWatermark`) in full to reuse its exact position-to-coordinate mapping logic for `pdfAddPageNumbers` rather than re-deriving it.
+- [ ] **Step 2:** Write tests for all 4 new functions in the existing PDFOperations test file, generating a minimal test PDF at test time via `pdf-lib`'s `PDFDocument.create()` (mirror however the existing test file already builds its fixture PDFs — check its `beforeEach`).
+- [ ] **Step 3:** Run new tests — expect FAIL.
+- [ ] **Step 4:** Implement the 4 functions.
+- [ ] **Step 5:** Run new tests — expect PASS.
+- [ ] **Step 6:** Add 4 corresponding buttons/menu entries to the PDF editor dialog UI, following its existing per-operation button pattern exactly (find where 'Watermark' or 'Rotate' is wired in the renderer PDF dialog and copy that structure).
+- [ ] **Step 7:** Manually verify each of the 4 operations against a real PDF via the app UI.
+- [ ] **Step 8:** `npm run lint && npm test`
+- [ ] **Step 9:** Commit: `git add -A && git commit -m "feat(pdf): add extract text, page numbers, crop, extract images operations"`
+
+### Task 16: PDF form field fill/flatten
+
+**Files:**
+- Modify: `src/main/PDFOperations.js` (+ test file), PDF editor dialog UI
+
+**Interfaces:**
+```javascript
+async function pdfGetFormFields(data) { /* data: {inputPath}. PDFDocument.load(bytes) -> pdfDoc.getForm().getFields() -> map each to {name, type, value}. Return { success: true, fields } */ }
+async function pdfFillForm(data) { /* data: {inputPath, outputPath, values: Record<string,string>, flatten}. Load, getForm(), for each key in values call form.getTextField(key).setText(value) (wrap per-field in try/catch to skip fields that don't exist or aren't text fields — this app's convention per pdfWatermark is to fail loudly on real errors but this is a batch-of-independent-fields case, so log+skip per-field failures and continue). If flatten, call form.flatten() before saving. */ }
+```
+Add `'formFields'` (get) and `'fillForm'` cases to `executeOperation`, add both to exports.
+
+- [ ] **Step 1:** Write tests building a test PDF with an AcroForm text field via `pdf-lib`'s `form.createTextField()` API (check pdf-lib's docs/existing usage in the codebase for the exact field-creation calls — `PDFOperations.js` already imports `pdf-lib`, follow its existing import style).
+- [ ] **Step 2:** Run tests — expect FAIL.
+- [ ] **Step 3:** Implement both functions.
+- [ ] **Step 4:** Run tests — expect PASS.
+- [ ] **Step 5:** Add a "Fill Form" UI entry to the PDF editor dialog: on open, call `formFields` to list detected fields, render a text input per field, a "Flatten after fill" checkbox, then call `fillForm` on submit.
+- [ ] **Step 6:** Manually verify against a real fillable PDF (search for one under `tests/fixtures/` or create one with `pdf-lib` in a scratch script — do not commit the scratch script).
+- [ ] **Step 7:** `npm run lint && npm test`
+- [ ] **Step 8:** Commit: `git add -A && git commit -m "feat(pdf): add form field detection, fill, and flatten"`
+
+### Task 17: Plugin API — export-format and file-reader registration hooks
+
+**Files:**
+- Modify: `src/plugins/plugin-context.js`, `src/plugins/plugin-loader.js` (or wherever plugin manifests are validated/loaded — grep `plugin-loader.js`), `src/main.js` (export format switch — needs to consult plugin-registered formats)
+
+**Interfaces (extend `PluginContext`, `plugin-context.js:64-71`, alongside the existing `this.exports` block):**
+```javascript
+this.formats = {
+  registerExportFormat: (id, opts) => {
+    // opts: { label, extension, handler: async (markdownContent, outputPath, options) => void }
+    if (formatRegistry) formatRegistry.register(`${pluginId}:${id}`, opts);
+  },
+};
+```
+This requires a new small `FormatRegistry` (mirror the existing `plugin-registry.js` pattern — read it first to match its exact API shape, e.g. `register(id, opts)` / `getAll()` / `get(id)`) injected into `PluginContext`'s constructor `deps` alongside `sidebar`/`commands`/`statusBar`.
+
+- [ ] **Step 1:** Read `src/plugins/plugin-registry.js` in full to learn its exact class/function shape before adding a sibling `FormatRegistry` (or extending the existing registry with a new namespace if it's already generic enough — prefer extending over duplicating if the existing registry is namespace-agnostic).
+- [ ] **Step 2:** Add `registerExportFormat` to `PluginContext` per the interface above, wired to whatever registry mechanism Step 1 determined is the right fit.
+- [ ] **Step 3:** In `src/main.js`'s export dispatch path (wherever the Export submenu's dynamic entries would need to merge in plugin formats — likely requires the Export submenu to be rebuilt after plugin load, similar to how `createMenu()` is already called after recent-files change in Task 2; check if `createMenu()` is idempotent/safe to call after plugin loading completes), add plugin-registered formats as additional Export submenu entries whose `click` handler calls the plugin's registered `handler` function instead of Pandoc.
+- [ ] **Step 4:** Update the built-in `writing-studio` plugin's manifest/index (`src/plugins/built-in/`) with a trivial example usage of `registerExportFormat` (e.g. exporting sprint data as a `.txt` summary) — this both documents the new API and gives Step 5's manual test something concrete to click.
+- [ ] **Step 5:** Write a unit test in `tests/plugins/` (find the existing plugin test directory/pattern) verifying a plugin calling `context.formats.registerExportFormat(...)` results in the registry containing the namespaced entry.
+- [ ] **Step 6:** Manually verify: `npm start`, confirm the writing-studio example format appears in the Export menu and produces the expected output file when clicked.
+- [ ] **Step 7:** `npm run lint && npm test`
+- [ ] **Step 8:** Commit: `git add -A && git commit -m "feat(plugins): add export-format registration hook to plugin API"`
+
+### Task 18: DOCX/EPUB template gallery UI
+
+**Files:**
+- Modify: `src/renderer.js` (export dialog for DOCX/EPUB — find via `exportWordWithTemplate()` at `main.js:881` and follow into whatever renderer dialog it opens)
+- Modify: `src/main.js` (wherever the existing Word-template list is sourced from — grep `WordTemplateExporter` and `listTemplates`/`getTemplates`-style function)
+
+**Verified context:** `main.js` already has `exportWordWithTemplate()` and `WordTemplateExporter` (`src/wordTemplateExporter.js`) — a template mechanism for DOCX exists but per the feature-inventory research pass has "no discoverable UI" for browsing available templates; the user has to already know a template exists. Read `src/wordTemplateExporter.js` in full first to learn how templates are currently listed/selected (is there a folder of `.dotx`/`.docx` template files? A hardcoded list?) before designing the gallery.
+
+- [ ] **Step 1:** Read `src/wordTemplateExporter.js` and the renderer dialog `exportWordWithTemplate()` opens, to learn the exact current template-selection mechanism (function names, data shape).
+- [ ] **Step 2:** Add a visual gallery (grid of template name + thumbnail-if-available, or name + short description if no thumbnails exist) to that same dialog, replacing or augmenting whatever minimal selector currently exists, following the dialog's existing CSS/markup conventions (check `src/styles.css` for the dialog's existing classes before inventing new ones).
+- [ ] **Step 3:** Do the same for EPUB export if `main.js` has an equivalent EPUB-template mechanism (grep for `epub` + `template`); if none exists, skip EPUB (do not invent a template system that doesn't exist — note this explicitly as out of scope in the commit message rather than silently dropping it).
+- [ ] **Step 4:** Manually verify: open the DOCX export dialog, see the template gallery, pick one, confirm the exported DOCX uses it.
+- [ ] **Step 5:** `npm run lint && npm test`
+- [ ] **Step 6:** Commit: `git add -A && git commit -m "feat(export): add visual template gallery to DOCX export dialog"`
+
+### Task 19: CSV-to-markdown-table toolbar converter
+
+**Files:**
+- Modify: `src/renderer.js` (editor toolbar — find the existing toolbar button registration pattern, e.g. near table generator/ASCII generator toolbar buttons)
+
+**Verified context:** Pandoc already imports CSV (`main.js:3507` import switch includes `csv`). This task adds a quick in-editor action: paste/select CSV-like text, convert to a markdown table without leaving the editor (distinct from the full file-import path).
+
+- [ ] **Step 1:** Add a toolbar button "CSV → Table" (or a Command Palette entry, matching whichever pattern is more consistent with similar single-action editor tools already in the toolbar — check what's already there before choosing).
+- [ ] **Step 2:** Implement a pure client-side CSV→Markdown-table converter function in `renderer.js` (no need to round-trip through Pandoc for this simple case — parse the current selection's lines by comma, respecting basic double-quote-wrapped fields containing commas; build a `| a | b |` / `|---|---|` markdown table). Keep this function small and testable — extract it to `src/lib/csv-to-markdown-table.js` if `src/renderer.js` doesn't already have a `src/lib/`-style extraction pattern for similar pure functions (check first).
+- [ ] **Step 3:** Write a Jest unit test for the converter function covering: simple CSV, quoted fields containing commas, ragged rows (fewer columns in some rows — pad with empty cells), empty input.
+- [ ] **Step 4:** Wire the toolbar button to: read the editor selection, run the converter, replace the selection with the resulting markdown table.
+- [ ] **Step 5:** Manually verify: select a few lines of comma-separated text in the editor, click the button, confirm it becomes a proper markdown table.
+- [ ] **Step 6:** `npm run lint && npm test`
+- [ ] **Step 7:** Commit: `git add -A && git commit -m "feat(editor): add CSV-to-markdown-table toolbar converter"`
+
+### Task 20: Document Compare / diff view (completes Task 6)
+
+**Files:**
+- Modify: `src/renderer.js` (new listener for `show-document-compare`, whitelisted in Task 6)
+- Create: `src/renderer/document-compare-dialog.js` (or inline in `renderer.js` if that's the dominant pattern for similar dialogs — match Task 12's finding on dialog-module conventions)
+
+**Verified context:** `main.js:1411-1413` sends `show-document-compare`; Task 6 whitelisted the channel; nothing renders it yet. This task adds an actual two-pane diff: either two arbitrary local files, or (leveraging Task 14's new `GitOperations.diff`) the current file against its last-committed git revision.
+
+- [ ] **Step 1:** Build a simple two-file diff dialog: two "choose file" buttons (or one defaulting to the currently-open tab + one file picker for the comparison target), a line-by-line diff render. Do not add a new diff-algorithm dependency — write a minimal LCS-based line diff in a small pure function (`src/lib/line-diff.js`) since the app has no existing diff library; keep it under ~60 lines (standard textbook LCS-diff, not a full Myers-diff library port).
+- [ ] **Step 2:** Write a Jest unit test for the line-diff function: identical files (no diffs), pure additions, pure deletions, mixed changes.
+- [ ] **Step 3:** Add a "Compare with Git HEAD" option in the same dialog when the current file is inside a git repo, using `GitOperations.diff` from Task 14 (raw git diff text render, separate code path from the line-diff function — git's own diff output is already a diff, don't re-diff it).
+- [ ] **Step 4:** Wire `ipcRenderer.on('show-document-compare', () => { /* open the dialog */ })` in `renderer.js`.
+- [ ] **Step 5:** Manually verify: Tools → Document Compare, compare two local markdown files, confirm additions/deletions are visually distinguished (e.g. green/red line backgrounds, matching the app's existing theme CSS variables rather than hardcoded colors).
+- [ ] **Step 6:** `npm run lint && npm test`
+- [ ] **Step 7:** Commit: `git add -A && git commit -m "feat(compare): implement Document Compare dialog with local-diff and git-HEAD-diff modes"`
+
+### Task 21: Export presets/profiles
+
+**Files:**
+- Modify: `src/main.js` (near `get-header-footer-settings`/`save-header-footer-settings` handlers, `main.js:1857-1886`)
+- Modify: renderer export-options dialog (wherever `export-with-options` is invoked from — grep `export-with-options` in `renderer.js`)
+
+**Interfaces:**
+```javascript
+// main.js — new handlers, settings persisted the same way header/footer settings already are
+// (read main.js:1857-1886 first to copy its exact settings-file read/write pattern, e.g. settings.json path + key)
+ipcMain.handle('get-export-presets', async () => { /* returns array of {id, name, format, options} */ });
+ipcMain.handle('save-export-preset', async (event, preset) => { /* upsert by id, persist, return updated list */ });
+ipcMain.handle('delete-export-preset', async (event, presetId) => { /* remove by id, persist, return updated list */ });
+```
+
+- [ ] **Step 1:** Read `main.js:1857-1886` in full to learn the exact settings-persistence pattern already used (this app uses a custom JSON file store per `CLAUDE.md`, not `electron-store` — confirm the exact file/key convention and reuse it verbatim for presets, e.g. a new top-level `exportPresets` array in the same `settings.json`).
+- [ ] **Step 2:** Implement the 3 handlers per the interfaces above, add all 3 channel names to `ALLOWED_SEND_CHANNELS` in `preload.js`.
+- [ ] **Step 3:** In the renderer's export-options dialog, add a "Save as preset" button (captures the current dialog's option values, prompts for a name, calls `save-export-preset`) and a preset dropdown at the top of the dialog (populated via `get-export-presets` on open; selecting one pre-fills the dialog's fields) plus a delete icon per preset row.
+- [ ] **Step 4:** Manually verify: configure export options, save as a preset, close and reopen the dialog, confirm the preset is selectable and correctly restores all fields; delete it, confirm it's gone.
+- [ ] **Step 5:** `npm run lint && npm test`
+- [ ] **Step 6:** Commit: `git add -A && git commit -m "feat(export): add save/select/delete export presets"`
+
+### Task 22: Batch PDF operations UI (beyond format conversion)
+
+**Files:**
+- Modify: `src/renderer.js` (Batch menu handling — find the `show-batch-converter` listener with `'pdf'` type)
+- Modify: `src/main.js` (extend the batch loop to support PDFOperations, not just format conversion)
+
+**Verified context:** `main.js:1293-1296` already has a "Batch PDF Conversion..." menu item sending `show-batch-converter` with type `'pdf'`, but (per the existing batch conversion handlers at `main.js:2454-2563`) batch only does format conversion via `convertWithLibreOffice`/pandoc — it never calls into `PDFOperations.executeOperation` for bulk watermark/compress/rotate across many files.
+
+- [ ] **Step 1:** In the renderer's batch dialog (wherever the `'pdf'`-typed batch dialog renders), add an operation-type selector when the batch type is `'pdf'`: "Convert format" (existing behavior, keep as default) vs. "Bulk PDF Operation" (new: pick one of merge/split/compress/rotate/watermark/etc. plus that operation's fields, same fields as the single-file PDF editor dialog).
+- [ ] **Step 2:** Add a new `ipcMain.on('batch-pdf-operation', async (event, { operation, data, inputFolder, includeSubfolders }) => {...})` handler in `main.js` that collects matching `.pdf` files (reuse the exact `collectFiles` recursive helper already defined inside `universal-convert-batch`, `main.js:2472-2484` — extract it to a shared top-level function if it isn't already, since Task 22 needs the identical logic) and calls `PDFOperations.executeOperation(operation, {...data, inputPath: filePath, outputPath: ...})` per file in a loop, reporting progress via `mainWindow.webContents.send('batch-progress', ...)` matching the existing batch progress-reporting convention.
+- [ ] **Step 3:** Add `'batch-pdf-operation'` to `ALLOWED_SEND_CHANNELS`.
+- [ ] **Step 4:** Manually verify: batch-watermark a folder of 2-3 test PDFs, confirm each output file has the watermark applied.
+- [ ] **Step 5:** `npm run lint && npm test`
+- [ ] **Step 6:** Commit: `git add -A && git commit -m "feat(pdf): add bulk PDF operations (watermark/compress/rotate/etc.) to batch converter"`
+
+---
+
+## Phase D — Security Remediation
+
+### Task 23: Fix Pandoc argument-injection vulnerability (CRITICAL)
+
+**Files:**
+- Modify: `src/main.js` (every `pandocCmd` string-concatenation site: `performExportWithOptions` ~`2623-2965`, `exportPDFViaWordTemplate`-adjacent function ~`2980-3050`, `runPandocCmd`/`parseCommand` at `231-282`, the import-side builder at `~3501`, and the enhanced-export builder at `~3997-4097`)
+- Modify: `tests/` (new regression test)
+
+**Verified root cause:** `performExportWithOptions` and its siblings build a shell-style command **string** by concatenating user-influenced values (export dialog fields: `options.template`, `options.metadata` key/values, `options.variables` key/values, `options.bibliography` path, `options.csl` path, `options.geometry`, footer text, CSS file path) wrapped in double quotes, e.g. `` pandocCmd += ` --bibliography="${options.bibliography}"` ``. This string is later tokenized by `parseCommand()` (`main.js:253-282`) — a hand-rolled parser that toggles an `inQuotes` flag on any `"` or `'` character and has **no backslash-escape handling at all**. The `.replace(/"/g, '\\"')` escaping applied to `metadata`/`variables` values therefore does nothing protective: `parseCommand` sees the literal backslash as an ordinary character and the following `"` still toggles quote state exactly as an unescaped quote would. Any field that reaches `parseCommand` un-sanitized (which is most of them — `template`, `bibliography`, `csl`, `geometry`, footer text are never escaped at all) lets an attacker-controlled value containing a `"` character break out of its intended single argument and inject additional argv elements into the `execFile(pandocPath, args, ...)` call at the end of `runPandocCmd`. Because `execFile` (not `exec`) is used, this is **not** a shell-injection (no `;`, `|`, backticks interpreted) — it is **argument injection into pandoc itself**, which is still exploitable: Pandoc supports `--lua-filter=<path>` and `--filter=<path>` (arbitrary Lua/executable code execution), `-o <path>` (arbitrary file overwrite by injecting a second `-o`), and `--resource-path`/`--extract-media` (arbitrary-path writes). A malicious value in any of the un-escaped fields above is enough to reach that severity — no shell metacharacters are even needed, just a `"` followed by a new flag.
+
+**Fix approach:** Stop building command strings entirely for every one of these call sites. Replace with direct `execFile(pandocPath, argsArray, ...)` calls where `argsArray` is built as a real JS array (`push`, never string interpolation) — this is exactly what `PDFOperations.js`/`GitOperations.js` already do correctly, and what `AudioOperations.js`/`VideoOperations.js`/`ImageOperations.js` do from Phase B. `parseCommand`/`runPandocCmd`'s string-based indirection should be deleted once all call sites are converted — do not leave it in place as unused dead code (would violate the "no forbidden markers/half-finished" standard); if any call site turns out to be legitimately hard to convert in this task, that is a signal that call site needs its own careful sub-step, not a reason to keep the vulnerable helper around "just in case."
+
+- [ ] **Step 1:** Write a regression test proving the vulnerability exists in the *current* code, in a new file `tests/main/pandoc-arg-safety.test.js`, calling `parseCommand` directly (it will need to be exported from `main.js` for testing, or extracted first — see Step 2) with a crafted value and asserting it does NOT produce an injected extra argument:
+```javascript
+// This test is written to FAIL against the current parseCommand implementation,
+// proving the vulnerability, then PASS once Step 3+ removes the vulnerable path.
+const { buildPandocArgs } = require('../../src/main/PandocArgs'); // new module created in Step 3
+
+test('a bibliography path containing a double quote cannot inject extra pandoc flags', () => {
+  const malicious = '/tmp/x.bib" --lua-filter=/tmp/evil.lua -o "/tmp/x.bib';
+  const args = buildPandocArgs({
+    inputFile: '/in.md',
+    outputFile: '/out.pdf',
+    format: 'pdf',
+    options: { bibliography: malicious },
+  });
+  // The malicious string must appear as exactly ONE argv element (whatever
+  // value it ends up as), never split into multiple args, and
+  // '--lua-filter=/tmp/evil.lua' must not appear as its own array element.
+  expect(args).not.toContain('--lua-filter=/tmp/evil.lua');
+  expect(args.filter((a) => a.includes(malicious) || a === malicious).length).toBeLessThanOrEqual(1);
+});
+```
+- [ ] **Step 2:** Run the test — confirm it fails to even import (module doesn't exist yet) — this is expected; proceed to build the real module.
+- [ ] **Step 3:** Create `src/main/PandocArgs.js` — a pure module exporting `buildPandocArgs({ inputFile, outputFile, format, options })` that returns a plain `string[]` args array (no string concatenation of the whole command — only individual argv elements are ever created via `.push(...)`), reimplementing every option currently handled across the string-building sites (`toc`, `tocDepth`, `numberSections`, `citeproc`, `bibliography`, `csl`, `template`, `metadata` (loop → `push('-M', `${key}=${value}`)` — no manual quote-escaping needed at all, since array elements are passed to `execFile` as literal argv, never re-parsed), `variables` (same pattern with `-V`), `pdfEngine`, `geometry`, monospace font header include, footer text). Read every one of the sites listed in "Files" above in full before writing this, to ensure no option is silently dropped.
+- [ ] **Step 4:** Run the Step 1 test — expect PASS now.
+- [ ] **Step 5:** Replace every call site that currently builds a `pandocCmd` string and calls `runPandocCmd(pandocCmd, ...)` with: build args via `PandocArgs.buildPandocArgs(...)`, then `execFile(getPandocPath(), args, { maxBuffer: 10 * 1024 * 1024 }, callback)` directly — inline this or add a tiny `runPandocArgs(args, callback)` helper next to the deleted `runPandocCmd` to avoid repeating the `execFile` options object at every site.
+- [ ] **Step 6:** Delete `parseCommand` and the old `runPandocCmd` (`main.js:231-282`) once no call site references them (grep to confirm zero remaining references before deleting).
+- [ ] **Step 7:** Manually re-run every export format the app supports (or at minimum: PDF, DOCX, HTML, EPUB, LaTeX — the ones with the most option surface) via the UI, confirming exports still succeed with the new args-array path, including with TOC/metadata/bibliography options actually filled in (not just defaults) to catch any option silently dropped in Step 3.
+- [ ] **Step 8:** `npm run lint && npm test`
+- [ ] **Step 9:** Commit: `git add -A && git commit -m "fix(security): eliminate pandoc argument-injection vector by building execFile args arrays directly"`
+
+### Task 24: Formal security-review pass
+
+**Files:** N/A — process task.
+
+- [ ] **Step 1:** Invoke the `security-review` skill against the full working tree (post Phase A/B/C/SEC-1 changes) to catch anything beyond what this plan's manual audit already found — particularly re-check the new `AudioOperations`/`VideoOperations`/`ImageOperations` modules and the new file-picker/batch handlers added in Phase B/C for the same class of injection risk (all must use `execFile` with array args — verify none of them slipped into string-building), and check the new plugin `registerExportFormat` hook (Task 17) for arbitrary-code-execution risk if a malicious/compromised plugin could abuse it beyond what a plugin can already do.
+- [ ] **Step 2:** For every finding the skill reports, triage severity and either fix inline (Critical/High) or explicitly log as an accepted/deferred risk with reasoning (Medium/Low) — do not silently drop findings.
+- [ ] **Step 3:** Produce a short written security summary (what was found across both the manual audit and the formal pass, what was fixed, what if anything was deferred and why) and save it to `docs/superpowers/plans/2026-08-23-security-assessment-summary.md`.
+- [ ] **Step 4:** Commit any additional fixes with individual, scoped commit messages (do not batch unrelated security fixes into one commit).
+
+---
+
+## Phase E — Rebuild Local Release
+
+### Task 25: Full verification + local build
+
+**Files:** N/A — build/verification task.
+
+- [ ] **Step 1:** `npm run lint` — must pass clean.
+- [ ] **Step 2:** `npm run format:check` — must pass clean (run `npm run format` first if not).
+- [ ] **Step 3:** `npm test` — all suites must pass; confirm the total test count has grown from the 247-test baseline (new tests from Phase B/C tasks should be present).
+- [ ] **Step 4:** `npm run download-tools` (ensures bundled Pandoc/tool binaries are current for the build).
+- [ ] **Step 5:** `npm run build:local` (per `package.json` script — builds Linux + Windows targets; this matches "local release" for this dev machine's platform(s)). If this machine is Linux-only and Windows cross-build tooling (wine, etc.) isn't available, fall back to `npm run build:linux-ci` and note the Windows build was skipped and why.
+- [ ] **Step 6:** Verify the `dist/` output contains the expected artifacts (`.deb`, `.AppImage` at minimum) and that the packaged app launches (`./dist/*.AppImage` or the unpacked `dist/linux-unpacked/markdown-converter` binary) without immediate crash — smoke-test opening a markdown file and exporting to PDF from the packaged build specifically (not `npm start`), since `asarUnpack` behavior for `sharp`/`ffmpeg-static`/fonts only manifests in a packaged build.
+- [ ] **Step 7:** Report the final `dist/` artifact list and versions to the user; do not bump `package.json`'s version number as part of this task unless the user asks — that is a separate release-management decision.
+
+---
+
+### Task 26: Migrate `File.path` → `webUtils.getPathForFile` (Electron 41 fix) — appended by controller ruling 2026-08-23
+
+**Origin:** Task 20 review. `File.path` was removed in Electron 32; this app pins `electron ^41.1.1` and has no `webUtils` usage — every renderer file-picker reading `file.path` gets `undefined` at runtime (~15 sites: universal converter, PDF editor pickers, bibliography/CSL pickers, custom template, media merge lists, document-compare File B).
+
+**Files:**
+- Modify: `src/preload.js` (expose a `getFilePath(file)` helper via `webUtils.getPathForFile`)
+- Modify: `src/renderer.js`, `src/renderer/media-operations-dialog.js`, `src/renderer/document-compare-dialog.js` (migrate all `file.path` reads to the helper)
+
+**Steps:**
+1. In `src/preload.js`, expose `getFilePath: (file) => webUtils.getPathForFile(file)` on the existing `electronAPI` surface (webUtils is available in the preload/renderer context; it exists precisely to replace File.path). No new IPC channel needed — this is a synchronous in-process call.
+2. Grep-migrate every `file.path` / `files[i].path` read in the three renderer files to `window.electronAPI.getFilePath(file)` (falling back to `file.path` if the helper is absent, to keep jsdom tests runnable — verify which tests mock this surface and update them to mock the helper).
+3. Add a preload test asserting `getFilePath` is exposed (follow tests/preload.test.js conventions).
+4. `npm run lint && npm test`.
+5. Commit: `fix(renderer): migrate File.path reads to webUtils.getPathForFile for Electron 41`
+
+---
+
+### Task 27: PDF encrypt/decrypt/permissions — replace silent no-op with honest failure — appended by controller ruling 2026-08-23
+
+**Origin:** Task 22 review (empirically verified). pdf-lib 1.17.1 cannot encrypt: `save({userPassword, ownerPassword, permissions})` silently ignores these options, `PDFDocument.load({password})` is not a LoadOptions field. Current behavior: `pdfEncrypt`/`pdfSetPermissions` write unprotected files and report success; `pdfDecrypt` reports success on non-encrypted inputs (copy no-op) and always fails on genuinely encrypted ones.
+
+**Files:**
+- Modify: `src/main/PDFOperations.js` (pdfEncrypt, pdfDecrypt, pdfSetPermissions), their renderer call sites if messages surface there, and `src/main/PDFBatchOperations.js` exclusion register comment (already excludes these ops — keep excluded, update the comment to reference this task).
+
+**Steps:**
+1. Capability-detect once at module load (probe whether the installed pdf-lib honors encryption — e.g. build a tiny in-memory PDFDocument, save with a userPassword, check raw bytes for `/Encrypt`; or simply pin the known limitation with a constant + comment referencing pdf-lib 1.17.1) — prefer the empirical probe so a future library swap re-enables the ops automatically.
+2. When encryption is unsupported: pdfEncrypt/pdfSetPermissions return `{success: false, message: 'Password protection is not available in this build (pdf-lib lacks encryption support).'}`; pdfDecrypt returns an equivalent honest failure. Never write a file. Never report success.
+3. Update the PDF editor dialog so these three controls are disabled with explanatory hint text when unavailable (grep renderer call sites for the encrypt/permissions handlers).
+4. Update tests: existing encrypt/decrypt/permissions tests (they currently pin the broken behavior — rewrite to assert honest failure); keep any genuinely-passing load-with-password tests only if the probe says the library supports them.
+5. `npm run lint && npm test`.
+6. Commit: `fix(pdf): make encrypt/decrypt/permissions fail honestly instead of silent no-op`
+
+**Out of scope (user decision pending):** swapping pdf-lib for an encryption-capable fork (e.g. @cantoo/pdf-lib) to restore the feature for real — new dependency, needs sign-off.

docs/superpowers/plans/2026-08-23-security-assessment-summary.md

@@ -0,0 +1,44 @@
+# Security Assessment Summary — MarkdownConverter (master branch)
+
+**Date:** 2026-08-23 · **Scope:** full branch `6db54a5..HEAD` (feature-audit-and-hardening plan, 27 tasks) · **Method:** manual feature/security audit at plan time + formal review pass (Task 24: three-stage vulnerability scan — identify → false-positive filter at confidence ≥ 8 → inline fix of confirmed High findings)
+
+## 1. What the manual audit found (plan Phases A–D)
+
+| # | Finding | Severity | Resolution |
+|---|---------|----------|------------|
+| SEC-1 | Pandoc invocation built as shell-style string and re-tokenized — argument injection via crafted filenames/options/bibliography paths | **Critical** | Fixed — Task 23 (`d41b7df`): every invocation now `execFile(path, args[])` via pure builder `src/main/PandocArgs.js`; string tokenizer deleted; 21 injection-vector tests + differential exploit-split proof + 23 real-pandoc e2e checks |
+| UX-1..7 | Seven non-working features: PDF menu IPC misrouting, media converter with 16 IPC channels and 0 handlers, dead New-from-Template menu, dead View-menu toggles, Clear-Recent-Files no-op, unreachable font settings, jszip/sharp misplaced in devDependencies | High (functional) | Fixed — Tasks 1–14; media backends (sharp/ffmpeg) implemented execFile-array-first |
+| LAT-1 | `File.path` reads dead on Electron 41 (removed in v32; app pins ^41.1.1) — every renderer file-picker returned `undefined` | High (functional) | Found during Task 20 review; fixed — Task 26 (`32a5755`): `webUtils.getPathForFile` exposed in preload + main-window shim; all ~15 picker sites migrated |
+| LAT-2 | pdf-lib 1.17.1 silently ignores `userPassword`/`ownerPassword`/`permissions` — PDF encrypt/permissions wrote **unprotected** files while reporting success; decrypt was a copy no-op | High (integrity) | Found during Task 22 review; fixed — Task 27 (`78afccc`): empirical capability probe (fail-closed), honest unavailability errors, UI controls disabled with hint. Real encryption requires a library swap (see deferred #D1) |
+
+## 2. What the formal pass (Task 24) found
+
+**Confirmed (confidence 8/10, HIGH) — fixed inline:**
+
+- **Git sidebar XSS → code execution** (`src/sidebar/git-panel.js`): repo-derived branch names, git-status file names, commit messages/author names, and git stderr rendered into `innerHTML` unescaped in the `nodeIntegration:true` main window, whose CSP permits `'unsafe-inline'` handlers. A malicious repo (attacker-authored commit message or crafted branch name) cloned by the victim executes script with full Node access when the Git panel loads. Fixed — `eafaf6e`: `escapeHtml` (& < > " ') across all 13 sink sites; jsdom tests assert structural inertness (no `img`/`script` elements, no attribute breakout) and that `dataset` reads still return raw names for git operations.
+
+**Candidate assessed and dropped (with evidence):**
+
+- PowerShell BurntToast interpolation (`main.js` ~4344): pre-existing at origin/master in identical `execFile`-array form. The dialog path interpolates a `format` chosen from a hardcoded 12-entry list; the `--convert-to <format>` CLI path feeds raw argv into the same string — but argv is trusted local-user input (precedent: CLI flags are trusted), and no shell is involved. Not exploitable. (Evidence note: the "hardcoded list" rationale covers the dialog path only; the drop stands on the argv-trust precedent for the CLI path.)
+
+**Verified clean (14 areas):** media operation backends and all batch handlers (execFile arrays throughout, no string re-tokenization); plugin system (no escalation beyond the renderer's existing privileges; format metadata reaches main only as native menu labels and save-dialog filters); all new dialog renderers (`textContent`-only for dynamic content); PDFOperations new ops (pdfjs/sharp in-process, no shell); wordTemplateExporter (all `<w:t>` insertions escaped, no zip extraction → no zip-slip); GitOperations (simple-git array args); settings/presets stores (no deep merge → no prototype pollution); PandocArgs completeness (tree-wide grep: zero surviving string-built pandoc invocations); font embedders (fixed family→filename maps); generator windows (no untrusted prefill); print-preview (DOMPurify flow); no `eval`/`new Function`; no variable-URL `shell.openExternal`; no secrets in the diff.
+
+## 3. Deferred / accepted risks
+
+| ID | Risk | Disposition |
+|----|------|-------------|
+| D1 | **Real PDF encryption unavailable** (pdf-lib limitation) — feature now fails honestly rather than lying | Accepted for this release. Restoring it means swapping pdf-lib for an encryption-capable fork (e.g. `@cantoo/pdf-lib`, API-compatible) — **needs explicit sign-off on a new dependency** |
+| D2 | `nodeIntegration:true` + `contextIsolation:false` on mainWindow, pdfWindow, hiddenWindow; main window does not load `preload.js` (inline shim instead) — the IPC whitelist is a live control only on the two generator windows | Accepted legacy risk for this branch; owned by the react-electron migration (contextIsolation + preload-everywhere), tracked separately |
+| D3 | Generator-window preload whitelist is broad (`execute-code`, `read-file`, `write-file`, `delete-file` reachable from isolated windows) | No current content vector into those windows; flag for the migration to narrow per-window APIs |
+| D4 | CSP allows `'unsafe-inline'` / `'unsafe-eval'` (required by marked + Mermaid rendering model) | Accepted; revisit under the migration with a nonce-based CSP |
+| D5 | `outline-panel.js` / `repl-panel.js` / `analytics-panel.js` have local `escapeHtml` helpers that do not escape quotes | Deferred hardening: unsafe only if reused in attribute contexts; no such current use found |
+| D6 | `scripts/download-tools.js` downloads Pandoc/fonts without checksum pinning | Build-time supply-chain hardening; recommended follow-up (pin + verify SHA-256) |
+| D7 | Misc functional edge cases (batch same-folder overwrite, `pdfSplit` non-positive interval loop, rate-limiter dialog stall) | Deferred minors, logged in the plan ledger; none security-relevant |
+
+## 4. Verification state
+
+- Test suite: **49 suites / 512 tests passing**; ESLint and Prettier clean at every task boundary (enforced per-task during execution).
+- All new external-process code paths verified `execFile`-array by independent tree-wide grep (Task 23 review) and re-verified in the formal pass.
+- **Release blocker (human step):** this environment cannot launch the Electron GUI. A human pass in the running app — light + dark themes, file picking in the main dialogs (File B in Document Compare, bibliography/CSL, universal converter, PDF editor), Git sidebar on a real repo — is required before shipping.
+
+**Bottom line:** the one Critical (argument injection) and one confirmed High (Git panel XSS) are closed with tests; two latent silent-failure bugs (File.path, fake encryption) are fixed; the remaining exposure is the documented legacy trust model (D2–D4) owned by the planned Electron security migration plus one dependency decision (D1).

docs/superpowers/specs/2026-06-30-monospace-font-embedding-design.md

@@ -0,0 +1,216 @@
+# MarkdownConverter — Monospace Font Embedding Design
+
+**Date:** 2026-06-30
+**Status:** Approved
+**Author:** Amit Haridas
+
+## Overview
+
+Guarantee proper ASCII character alignment in MarkdownConverter's preview and every supported export format (PDF, DOCX, HTML, plus ODT/RTF/EPUB/LaTeX), with no OS-level font dependency. The user can pick between **JetBrains Mono** (default) and **Fira Code**, and toggle ligatures (default off). Both font families are bundled inside the app, so alignment holds on every supported platform (Windows/macOS/Linux) without an internet connection, without system-wide font installation, and without the user touching anything system-level.
+
+## Goals
+
+1. ASCII art and code-block tables (e.g. `+----+----+` column delimiters) render at identical advance widths in the live preview **and** in every exported file.
+2. No OS font dependency — TTFs ship inside the app.
+3. Per-user choice of monospace family + ligature behaviour.
+4. Self-contained exports: the exported PDF/DOCX/HTML file is portable to another machine and stays aligned.
+
+## Non-Goals (v1)
+
+- No font subsetting of TTFs (we ship the full file; xelatex subsets it into the PDF automatically; DOCX carriers get the full TTF in `word/fonts/`).
+- No support for the user adding a third bundled font family.
+- No PPTX or revealjs/Beamer ligature-toggle (PPTX is a slide format that rarely carries ASCII tables; revealjs/Beamer inherit HTML/LaTeX defaults).
+- No licensed/commercial fonts (Fira Code and JetBrains Mono are both SIL OFL — confirmed in `assets/fonts/JetBrainsMono-LICENSE.txt`).
+
+## Decisions Locked
+
+| Decision | Choice | Reason |
+|---|---|---|
+| Scope | All export formats | All-surfaces alignment |
+| DOCX strategy | Embed TTF into the DOCX zip | Truly portable; alignment holds even when the recipient lacks the font |
+| PDF strategy | Pass TTF path to xelatex via `fontspec` (`\setmonofont[Path=...]`) | xelatex subsets the font into the PDF; reproducible across machines |
+| Font choice | Both bundled; user-pickable in settings | Cover both preferences; default JetBrains Mono |
+| Ligatures | Off by default; user toggle | Ligatures change advance widths and break ASCII grid alignment |
+| License | SIL OFL (both families) | Embedding/bundling explicitly permitted when license travels with the binary (already present at `assets/fonts/JetBrainsMono-LICENSE.txt`) |
+
+## Architecture
+
+```
+settings.json
+    │
+    │ (renderer + main read on init)
+    ▼
+CSS body classes:  .mono-jetbrains / .mono-fira
+                   .mono-ligatures-on / .mono-ligatures-off
+--font-mono-active token
+   ▲                                  ▲
+   │ IPC                              │ IPC
+   │                                  │
+Preview pane              ┌───────────┴──────────┐
+ASCII Generator window    │  Export pipeline     │
+Print-preview iframe      │  (main process)      │
+                          │  uses MonospaceFontConfig
+                          └──────────────────────┘
+                                   │
+                                   ▼
+                       Bundle: assets/fonts/
+                         ├─ JetBrainsMono-Regular.ttf
+                         ├─ JetBrainsMono-Bold.ttf
+                         ├─ FiraCode-Regular.ttf
+                         ├─ FiraCode-Bold.ttf
+                         └─ (existing woff2 for renderer)
+```
+
+## New Modules
+
+| File | Role |
+|---|---|
+| `src/main/MonospaceFontConfig.js` | Single source of truth. Resolves the active monospace family + weight → absolute TTF path, with awareness of dev vs packaged (asar.unpacked) layout. Returns `null` + warns when a file is missing. |
+| `src/main/PdfFontHeader.js` | Builds the xelatex `header.tex` snippet with `\usepackage{fontspec}\setmonofont{...ttf}[Path=...,UprightFont=*-Regular,BoldFont=*-Bold,Ligatures=NoCommon/TeX]`. Also returns the lualatex equivalent. |
+| `src/main/DocxFontEmbedder.js` | Unzips a pandoc-produced DOCX with `jszip`, writes TTFs into `word/fonts/`, patches `[Content_Types].xml`, `_rels/document.xml.rels`, creates `word/fontTable.xml` with `<w:embedRegular/>` referencing the TTF, patches `word/styles.xml` so the `SourceCode`/`VerbatimChar` styles bind to the embedded font name, then rezips. Idempotent. |
+| `src/main/EpubFontEmbedder.js` | Wrapper around pandoc `--epub-embed-font` — verifies the chosen TTF is referenced in `OEBPS/content.opf`; patches the manifest if missing. |
+| `src/main/ExportCss.js` | Returns a self-contained CSS string with `@font-face { src: url(data:font/woff2;base64,...) }` for the chosen family. Used by HTML export `--css` and by print-preview iframe. |
+| `src/main/settings/SettingsUI.Monospace.js` | Two new controls in the in-app settings dialog: monospace font select + ligatures checkbox. Persists to `<userData>/settings.json`. |
+
+## Modified Modules
+
+| File | Change |
+|---|---|
+| `src/fonts.css` | Add `@font-face` entries for Fira Code Regular (400) and Bold (700), pointing to `assets/fonts/FiraCode-*.woff2` (downloaded via the extended `download-tools.js`). |
+| `src/styles/tokens.css` + `src/styles-concreteinfo.css` | Define new tokens `--font-mono-active` (resolves to `"JetBrains Mono"` or `"Fira Code"`) and `--font-mono-feature` (`"liga" 0, "calt" 0, "dlig" 0` for ligatures-off, else `normal`). Body classes flip these. |
+| `src/styles-modern.css` | `.editor-textarea`, `.preview-content code`, `.preview-content pre`, `.codemirror-container .cm-editor` reference `var(--font-mono-active)` and apply `font-feature-settings: var(--font-mono-feature)`. |
+| `src/ascii-generator.html` | Replace `<link href="https://fonts.googleapis.com/...">` with `<link rel="stylesheet" href="../styles/fonts.css">` plus inline `body` class defaulting. The window is plain HTML; the renderer script that opens it sets `body.classList` from settings. |
+| `src/print-preview.js` | Inject `<style>` with embedded woff2 base64 from `ExportCss.js` into the srcdoc iframe HTML; set `pre`/`code` font-family to `var(--font-mono-active)`. |
+| `src/main.js` | Five `--css/-V monofont=Consolas` lines and the export pipelines need surgery (table below). On successful DOCX export, pipeline the output through `DocxFontEmbedder`. On HTML export, pass `--css` referencing a temp file emitted by `ExportCss.js`. On EPUB, pass `--epub-embed-font` for both Regular and Bold. On LaTeX/PDF, pass `--include-in-header` referencing a temp `header.tex` emitted by `PdfFontHeader.js`. The Electron `printToPDF` fallback also consumes `ExportCss.js`. |
+| `src/renderer.js` | On `settings-changed`, toggle `document.body.classList` between `mono-jetbrains` / `mono-fira` and `mono-ligatures-on` / `mono-ligatures-off`. The active class is also written by the bit that initializes Monaco/CodeMirror when the editor is mounted. |
+| `scripts/download-tools.js` | Add `fira-code` task: downloads `FiraCode-Regular.ttf`, `FiraCode-Bold.ttf`, `FiraCode-LICENSE.txt` from the official `tonsky/FiraCode` GitHub release (version-pinned, mirrors how Pandoc is downloaded). |
+| `package.json` | `build.asarUnpack` extended to `"assets/fonts/**"` so xelatex/Pandoc can read TTFs at runtime in packaged builds. No new NPM dependencies — `jszip ^3.10.1` is already present. |
+
+## Per-Export Behaviour
+
+| Format | What changes | Post-processing | Resulting file shape |
+|---|---|---|---|
+| **PDF** (xelatex) | Replace `-V monofont="Consolas"` with `--include-in-header=<tmp>.tex` from `PdfFontHeader` (`\setmonofont{JetBrainsMono-Regular.ttf}[Path=…,Extension=.ttf,UprightFont=*-Regular,BoldFont=*-Bold,Ligatures=NoCommon]`). | none — xelatex subsets the font into the PDF. | Self-contained PDF; code-block columns align across pages. |
+| **PDF** (lualatex fallback) | Same header uses lualatex-compatible fontspec syntax (identical to xelatex in modern LuaTeX). | none | Same as above. |
+| **PDF** (pdflatex final fallback) | Revert to `-V monofont="Consolas"` + warn (Consolas not on all systems; document limitation). | none | Best-effort — relies on pdftex default monospace. |
+| **DOCX** | Existing pandoc invocation. After pandoc writes, hand to `DocxFontEmbedder`. | Embed Regular + Bold TTF into `word/fonts/`; patch `[Content_Types].xml` Default+Override; add `word/_rels` entry for `fontTable.xml.rels`; create `word/fontTable.xml` with `<w:embedRegular/>` for each font weight; patch `word/styles.xml` so `SourceCode` (or whatever style Pandoc wrote under) sets `w:rFonts ascii="JetBrains Mono" hAnsi="JetBrains Mono"`. | ~550 KB larger DOCX; fully portable. |
+| **HTML** (standalone) | Add `--css=<tmp>.css` (built by `ExportCss` with base64 woff2). | none | One self-contained `.html`; aligned anywhere, offline. |
+| **EPUB** | Add `--epub-embed-font=<bundleAbs>/<Family>-Regular.ttf` and same for Bold (Pandoc 2.11+ supports this natively). | `EpubFontEmbedder` patches `OEBPS/content.opf` if the font reference is missing. | Embedded font travels in the EPUB. |
+| **ODT** | `--variable=mainfont="JetBrains Mono"` (or Fira). | Before final write, show a non-blocking confirmation: "ODT embeds the font *name* — recipients must also have it installed to keep alignment. Continue?". | Light; portability caveat explicit to user. |
+| **RTF** | `\fonttbl` directive already injected by pandoc when `mainfont=` is set. | Same ODT confirmation. | Same caveat as ODT. |
+| **LaTeX (`.tex`)** | `--include-in-header=<tmp>.tex` identical to the PDF header. | none | Self-contained `.tex` for downstream compile. |
+| **PPTX** | unchanged | n/a | v1: don't try to enforce. |
+| **RevealJS** | behaves like HTML (uses `ExportCss`). | n/a | self-contained. |
+| **Beamer** | behaves like LaTeX (uses `PdfFontHeader` snippet). | n/a | downstream PDF compile respects font. |
+| **Print preview** | n/a | `ExportCss` injected into srcdoc iframe HTML. | Inside-app preview aligned. |
+| **ASCII Generator window** | Replace Google Fonts CDN link with local `fonts.css`. | n/a | Offline, aligned. |
+
+## Path Resolution
+
+`MonospaceFontConfig` exposes:
+
+```js
+exports.getActiveMonoFontPath = function getActiveMonoFontPath(weight = 400)
+exports.getActiveMonoFamily   = function getActiveMonoFamily()
+exports.ligaturesEnabled       = function ligaturesEnabled()
+```
+
+- Dev: `<repoRoot>/assets/fonts/<Family>-<Weight>.ttf`
+- Packaged: `<process.resourcesPath>/app.asar.unpacked/assets/fonts/<Family>-<Weight>.ttf`
+- If the file is missing, returns `null` and emits a `console.warn` + a single non-blocking toast: "Using system monospace — bundled font missing".
+
+## Settings Schema
+
+Extended `<userData>/settings.json`:
+
+```jsonc
+{
+  // ... existing keys ...
+  "monospaceFont": "jetbrains-mono",      // "jetbrains-mono" | "fira-code"
+  "monospaceLigatures": false             // bool
+}
+```
+
+Defaults: `monospaceFont: "jetbrains-mono"`, `monospaceLigatures: false`. Migration: if a settings file exists without these keys, fill with defaults silently on read.
+
+## Testing
+
+**New test files:**
+
+| File | Asserts |
+|---|---|
+| `tests/monospace-font-config.test.js` | Dev vs packaged path semantics; null-and-warn on missing TTF; settings-driven family selection. |
+| `tests/docx-font-embedder.test.js` | Produces a valid DOCX; `unzip -l` lists `word/fonts/JetBrainsMono-{Regular,Bold}.ttf`; `word/fontTable.xml` contains `<w:embedRegular r:id="…"/>` entries with correct names; `styles.xml` binds the monospace style to `"JetBrains Mono"`; idempotent (running twice doesn't double-embed). |
+| `tests/pdf-font-header.test.js` | Output contains `\setmonofont{JetBrainsMono-Regular.ttf}` with `Path=` matching the resolved absolute path; `Ligatures=NoCommon` when settings say off. |
+| `tests/export-css.test.js` | Output contains a `@font-face` block with `src: url('data:font/woff2;base64,<…>')`; the base64 string decodes to > 50 000 bytes; `pre`/`code`/`kbd` use `var(--font-mono-active)`. |
+| `tests/epub-font-embedder.test.js` | After embedding, `OEBPS/content.opf` references both Regular and Bold TTFs in `<manifest>`. |
+
+**Integration test (manual, repeatable):**
+
+1. Create a fixture markdown file with three ASCII grids (boxes, columns, arrows).
+2. Open the file in MarkdownConverter.
+3. Set monospace font = JetBrains Mono, ligatures off.
+4. Export to PDF / DOCX / HTML.
+5. Open each result; confirm the `+---+` column delimiters sit at identical X-positions across all three formats and across pages.
+6. Switch to Fira Code with ligatures on; export again; confirm round-trip works (no crashes) and ligature toggle affects preview.
+
+## Error Handling
+
+| Failure | Behaviour |
+|---|---|
+| Bundled TTF missing | `MonospaceFontConfig` returns `null`; renderer/main falls back to system monospace; non-blocking toast; never a silent drop. |
+| `DocxFontEmbedder` fails (zip corruption, insufficient permissions, missing required OOXML element) | Keep the un-embedded DOCX; show a dialog with the exact failure message and a "Report issue" link. Do **not** claim success. |
+| `PdfFontHeader` can't write temp tex (filesystem permission) | Show an error dialog naming the permission issue; abort the export. |
+| Pandoc `--epub-embed-font` not supported (Pandoc < 2.11) | Detect via `pandoc --version` at startup (cache `pandocAvailable` already exists). Skip embedding; warn user that the EPUB will degrade if their reader lacks the font. |
+| Pandoc `--css` flag missing (Pandoc < 2.0) | Detect via the same version check. Skip the `--css` injection; warn user that the exported HTML is not self-contained for the chosen font. |
+| xelatex fails after fontspec injection | Existing `tryPdfFallback` chain reorders to `lualatex → pdflatex` (Consolas). Already implemented; the reorder is a one-liner. |
+
+## Acceptance Criteria
+
+- [ ] All five rows of `Per-Export Behaviour` produce files where ASCII alignment is identical to the editor.
+- [ ] No new NPM dependencies added (use existing `jszip`, `fontkit`).
+- [ ] `asarUnpack` covers `assets/fonts/**`.
+- [ ] Bundle size increase ≤ 1.5 MB (TTFs + Fira TTF + extra metadata).
+- [ ] No `TODO`/`FIXME`/`HACK` markers in newly touched code.
+- [ ] Preview, ASCII Generator window, print-preview iframe, PDF, DOCX, HTML, EPUB, ODT all use the same active font + ligature setting (single source of truth).
+- [ ] On a clean machine with no JetBrains Mono / Fira Code installed system-wide, every export still produces correct alignment.
+- [ ] Switching between fonts in settings updates preview immediately and is honoured by all subsequent exports in the same session.
+- [ ] Both font files travel with the binary (`LICENSE.txt` present for both families).
+
+## File Inventory
+
+**New (10 files):**
+
+```
+src/main/MonospaceFontConfig.js
+src/main/PdfFontHeader.js
+src/main/DocxFontEmbedder.js
+src/main/EpubFontEmbedder.js
+src/main/ExportCss.js
+src/main/settings/SettingsUI.Monospace.js
+tests/monospace-font-config.test.js
+tests/docx-font-embedder.test.js
+tests/pdf-font-header.test.js
+tests/export-css.test.js
+tests/epub-font-embedder.test.js
+assets/fonts/FiraCode-Regular.ttf
+assets/fonts/FiraCode-Bold.ttf
+assets/fonts/FiraCode-LICENSE.txt
+```
+
+**Modified:**
+
+```
+src/fonts.css
+src/styles/tokens.css
+src/styles-concreteinfo.css
+src/styles-modern.css
+src/ascii-generator.html
+src/print-preview.js
+src/main.js
+src/renderer.js
+scripts/download-tools.js
+package.json
+```
+
+(3 added TTF files counted under "New"; OFL `LICENSE.txt` only required when bundling Fira Code.)

electron-builder.config.js

@@ -0,0 +1,124 @@
+/**
+ * electron-builder configuration (replaces the static package.json "build"
+ * section so it can be computed dynamically).
+ *
+ * Why a JS config: the bundled markitdown binary is OPTIONAL at build time —
+ * PyInstaller can only build for the host OS, so e.g. a Windows package
+ * built on a machine without bin/win32/markitdown.exe must simply omit it
+ * (the app falls back to system-installed markitdown at runtime) instead of
+ * failing on a missing extraFiles source.
+ *
+ * Everything else mirrors the previous static config verbatim.
+ */
+const fs = require('fs');
+const path = require('path');
+
+/** Common extraFiles for a platform: pandoc always, markitdown when built. */
+function toolExtraFiles(platform) {
+  const exe = platform === 'win32' ? '.exe' : '';
+  const files = [{ from: `bin/${platform}/pandoc${exe}`, to: `bin/pandoc${exe}` }];
+  const markitdown = `bin/${platform}/markitdown${exe}`;
+  if (fs.existsSync(path.join(__dirname, markitdown))) {
+    files.push({ from: markitdown, to: `bin/markitdown${exe}` });
+  } else {
+    console.warn(
+      `[electron-builder.config] ${markitdown} not found — building WITHOUT the ` +
+        'bundled markitdown (the app will use a system install if present). ' +
+        'Run "npm run bundle:markitdown" on this platform to bundle it.'
+    );
+  }
+  return files;
+}
+
+module.exports = {
+  appId: 'com.concreteinfo.markdownconverter',
+  productName: 'MarkdownConverter',
+  copyright: 'Copyright (C) 2024-2025 ConcreteInfo',
+  directories: { output: 'dist' },
+  icon: 'assets/icon',
+  files: [
+    'src/**/*',
+    'assets/**/*',
+    'scripts/**/*',
+    'node_modules/**/*',
+    'package.json',
+    'THIRD-PARTY-NOTICES.md',
+    'SOURCES.md',
+    'third-party-licenses/**/*',
+  ],
+  asarUnpack: [
+    'node_modules/ffmpeg-static/**',
+    'node_modules/sharp/**',
+    'node_modules/@img/**',
+    'node_modules/@napi-rs/**',
+    'assets/fonts/**',
+  ],
+  fileAssociations: [
+    {
+      ext: 'md',
+      name: 'Markdown Document',
+      description: 'Markdown Document',
+      mimeType: 'text/markdown',
+      role: 'Editor',
+    },
+    {
+      ext: 'markdown',
+      name: 'Markdown Document',
+      description: 'Markdown Document',
+      mimeType: 'text/markdown',
+      role: 'Editor',
+    },
+    {
+      ext: 'pdf',
+      name: 'PDF Document',
+      description: 'PDF Document',
+      mimeType: 'application/pdf',
+      role: 'Editor',
+    },
+  ],
+  mac: {
+    category: 'public.app-category.productivity',
+    identity: null,
+    extraFiles: toolExtraFiles('darwin'),
+  },
+  win: {
+    target: [
+      { target: 'nsis', arch: ['x64'] },
+      { target: 'portable', arch: ['x64'] },
+      { target: 'zip', arch: ['x64'] },
+    ],
+    artifactName: '${productName}-${version}-${arch}.${ext}',
+    requestedExecutionLevel: 'asInvoker',
+    legalTrademarks: 'Copyright (C) 2024-2025 ConcreteInfo',
+    verifyUpdateCodeSignature: false,
+    signAndEditExecutable: false,
+    extraFiles: toolExtraFiles('win32'),
+  },
+  nsis: {
+    oneClick: false,
+    perMachine: false,
+    allowToChangeInstallationDirectory: true,
+    displayLanguageSelector: true,
+    createDesktopShortcut: true,
+    createStartMenuShortcut: true,
+    shortcutName: 'MarkdownConverter',
+    runAfterFinish: true,
+    menuCategory: 'Productivity',
+    license: 'LICENSE',
+    warningsAsErrors: false,
+    artifactName: '${productName}-Setup-${version}.${ext}',
+    deleteAppDataOnUninstall: false,
+    differentialPackage: true,
+  },
+  linux: {
+    target: ['deb', 'AppImage', 'snap'],
+    category: 'Utility',
+    maintainer: 'ConcreteInfo <amit.wh@gmail.com>',
+    extraFiles: toolExtraFiles('linux'),
+  },
+  deb: {
+    depends: ['imagemagick', 'libreoffice-common'],
+    description: 'Professional Markdown editor and universal file converter',
+    maintainer: 'ConcreteInfo <amit.wh@gmail.com>',
+  },
+};

eslint.config.js

@@ -75,6 +75,7 @@ module.exports = [
         jest: 'readonly',
         describe: 'readonly',
         test: 'readonly',
+        it: 'readonly',
         expect: 'readonly',
         beforeEach: 'readonly',
         afterEach: 'readonly',

jest.config.js

@@ -11,10 +11,7 @@ module.exports = {
   rootDir: '.',
 
   // Test file patterns
-  testMatch: [
-    '**/tests/**/*.test.js',
-    '**/tests/**/*.spec.js'
-  ],
+  testMatch: ['**/tests/**/*.test.js', '**/tests/**/*.spec.js'],
 
   // Coverage configuration
   collectCoverageFrom: [
@@ -22,7 +19,7 @@ module.exports = {
     '!src/main.js', // Main process needs electron-mock
     '!src/renderer.js', // Large renderer file with duplicate declarations
     '!src/preload.js', // Electron preload requires contextBridge
-    '!**/node_modules/**'
+    '!**/node_modules/**',
   ],
 
   // Coverage thresholds (raised with expanded test suite)
@@ -31,8 +28,8 @@ module.exports = {
       branches: 10,
       functions: 15,
       lines: 15,
-      statements: 15
-    }
+      statements: 15,
+    },
   },
 
   // Transform settings (no transpilation needed for vanilla JS)
@@ -45,10 +42,11 @@ module.exports = {
   setupFilesAfterEnv: ['<rootDir>/tests/setup.js'],
 
   // Ignore patterns
-  testPathIgnorePatterns: [
-    '/node_modules/',
-    '/dist/'
-  ],
+  testPathIgnorePatterns: ['/node_modules/', '/dist/'],
+
+  // Keep the haste map / snapshot scanner out of build output — electron-builder's
+  // .snap (Squashfs) artifacts otherwise register as obsolete Jest snapshots.
+  modulePathIgnorePatterns: ['/dist/'],
 
   // Verbose output
   verbose: true,
@@ -57,5 +55,5 @@ module.exports = {
   clearMocks: true,
 
   // Reset modules between tests
-  resetModules: true
+  resetModules: true,
 };

package.json

@@ -1,29 +1,30 @@
 {
   "name": "markdown-converter",
-  "version": "4.3.0",
+  "version": "4.7.0",
   "description": "Professional Markdown editor and universal file converter with PDF editing, batch processing, and syntax highlighting",
   "main": "src/main.js",
   "scripts": {
     "start": "electron .",
-    "test": "jest",
-    "test:watch": "jest --watch",
-    "test:coverage": "jest --coverage",
+    "test": "cross-env NODE_OPTIONS=--experimental-vm-modules jest",
+    "test:watch": "cross-env NODE_OPTIONS=--experimental-vm-modules jest --watch",
+    "test:coverage": "cross-env NODE_OPTIONS=--experimental-vm-modules jest --coverage",
     "lint": "eslint src tests",
     "lint:fix": "eslint src tests --fix",
     "format": "prettier --write src tests",
     "format:check": "prettier --check src tests",
-    "build": "electron-builder",
-    "build:win": "electron-builder --win",
-    "build:win-signed": "cross-env CSC_LINK=code-signing-cert.pfx electron-builder --win",
-    "build:win-unsigned": "cross-env CSC_IDENTITY_AUTO_DISCOVERY=false electron-builder --win",
+    "build": "electron-builder --config electron-builder.config.js",
+    "build:win": "electron-builder --config electron-builder.config.js --win",
+    "build:win-signed": "cross-env CSC_LINK=code-signing-cert.pfx electron-builder --config electron-builder.config.js --win",
+    "build:win-unsigned": "cross-env CSC_IDENTITY_AUTO_DISCOVERY=false electron-builder --config electron-builder.config.js --win",
     "create-cert": "powershell -ExecutionPolicy Bypass -File scripts/create-selfsigned-cert.ps1",
-    "build:mac": "electron-builder --mac",
-    "build:linux": "electron-builder --linux",
-    "build:linux-ci": "electron-builder --linux deb AppImage",
-    "build:local": "electron-builder --linux --win",
-    "dist": "electron-builder --publish=never",
-    "dist:all": "electron-builder -mwl",
+    "build:mac": "electron-builder --config electron-builder.config.js --mac",
+    "build:linux": "electron-builder --config electron-builder.config.js --linux",
+    "build:linux-ci": "electron-builder --config electron-builder.config.js --linux deb AppImage",
+    "build:local": "electron-builder --config electron-builder.config.js --linux --win",
+    "dist": "electron-builder --config electron-builder.config.js --publish=never",
+    "dist:all": "electron-builder --config electron-builder.config.js -mwl",
     "download-tools": "node scripts/download-tools.js",
+    "bundle:markitdown": "node scripts/bundle-markitdown.js",
     "generate-icons": "node scripts/generate-icons.js"
   },
   "keywords": [
@@ -52,10 +53,10 @@
     "eslint-plugin-prettier": "^5.5.4",
     "jest": "^30.2.0",
     "jest-environment-jsdom": "^30.2.0",
-    "prettier": "^3.7.4",
-    "sharp": "^0.34.3"
+    "prettier": "^3.7.4"
   },
   "dependencies": {
+    "@cantoo/pdf-lib": "^2.9.1",
     "@codemirror/autocomplete": "^6.20.1",
     "@codemirror/commands": "^6.10.2",
     "@codemirror/lang-css": "^6.3.1",
@@ -70,23 +71,25 @@
     "@codemirror/state": "^6.5.4",
     "@codemirror/theme-one-dark": "^6.1.3",
     "@codemirror/view": "^6.39.16",
+    "@replit/codemirror-vim": "^6.4.0",
     "codemirror": "^6.0.2",
     "core-util-is": "^1.0.3",
     "docx": "^9.6.0",
-    "docx4js": "^3.3.0",
     "dompurify": "^3.3.1",
     "electron-store": "^10.1.0",
     "ffmpeg-static": "^5.3.0",
     "highlight.js": "^11.11.1",
     "html2pdf.js": "^0.14.0",
+    "jszip": "^3.10.1",
+    "katex": "^0.18.5",
     "marked": "^17.0.3",
     "marked-footnote": "^1.4.0",
     "marked-highlight": "^2.2.3",
     "mermaid": "^11.12.3",
-    "pdf-lib": "^1.17.1",
     "pdfjs-dist": "^5.5.207",
     "pdfkit": "^0.17.2",
     "pizzip": "^3.2.0",
+    "sharp": "^0.35.4",
     "simple-git": "^3.32.3",
     "tslib": "^2.8.1"
   },
@@ -96,118 +99,5 @@
     "lodash.pick": "npm:lodash@^4.17.21",
     "lodash-es": "^4.18.1",
     "lodash": "^4.17.21"
-  },
-  "build": {
-    "appId": "com.concreteinfo.markdownconverter",
-    "productName": "MarkdownConverter",
-    "copyright": "Copyright (C) 2024-2025 ConcreteInfo",
-    "directories": {
-      "output": "dist"
-    },
-    "icon": "assets/icon",
-    "files": [
-      "src/**/*",
-      "assets/**/*",
-      "scripts/**/*",
-      "node_modules/**/*",
-      "package.json"
-    ],
-    "asarUnpack": [
-      "node_modules/ffmpeg-static/**"
-    ],
-    "extraFiles": [],
-    "fileAssociations": [
-      {
-        "ext": "md",
-        "name": "Markdown Document",
-        "description": "Markdown Document",
-        "mimeType": "text/markdown",
-        "role": "Editor"
-      },
-      {
-        "ext": "markdown",
-        "name": "Markdown Document",
-        "description": "Markdown Document",
-        "mimeType": "text/markdown",
-        "role": "Editor"
-      },
-      {
-        "ext": "pdf",
-        "name": "PDF Document",
-        "description": "PDF Document",
-        "mimeType": "application/pdf",
-        "role": "Editor"
-      }
-    ],
-    "mac": {
-      "category": "public.app-category.productivity",
-      "identity": null
-    },
-    "win": {
-      "target": [
-        {
-          "target": "nsis",
-          "arch": [
-            "x64"
-          ]
-        },
-        {
-          "target": "portable",
-          "arch": [
-            "x64"
-          ]
-        },
-        {
-          "target": "zip",
-          "arch": [
-            "x64"
-          ]
-        }
-      ],
-      "artifactName": "${productName}-${version}-${arch}.${ext}",
-      "requestedExecutionLevel": "asInvoker",
-      "legalTrademarks": "Copyright (C) 2024-2025 ConcreteInfo",
-      "verifyUpdateCodeSignature": false,
-      "signAndEditExecutable": false,
-      "extraFiles": [
-        { "from": "bin/win32/pandoc.exe", "to": "bin/pandoc.exe" }
-      ]
-    },
-    "nsis": {
-      "oneClick": false,
-      "perMachine": false,
-      "allowToChangeInstallationDirectory": true,
-      "displayLanguageSelector": true,
-      "createDesktopShortcut": true,
-      "createStartMenuShortcut": true,
-      "shortcutName": "MarkdownConverter",
-      "runAfterFinish": true,
-      "menuCategory": "Productivity",
-      "license": "LICENSE",
-      "warningsAsErrors": false,
-      "artifactName": "${productName}-Setup-${version}.${ext}",
-      "deleteAppDataOnUninstall": false,
-      "differentialPackage": true
-    },
-    "linux": {
-      "target": [
-        "deb",
-        "AppImage",
-        "snap"
-      ],
-      "category": "Utility",
-      "maintainer": "ConcreteInfo <amit.wh@gmail.com>",
-      "extraFiles": [
-        { "from": "bin/linux/pandoc", "to": "bin/pandoc" }
-      ]
-    },
-    "deb": {
-      "depends": [
-        "imagemagick",
-        "libreoffice-common"
-      ],
-      "description": "Professional Markdown editor and universal file converter",
-      "maintainer": "ConcreteInfo <amit.wh@gmail.com>"
-    }
   }
 }

repo-map.md

@@ -0,0 +1,604 @@
+# Repository Structure Map
+
+Auto-generated by `~/.claude-shared/scripts/repo-map.sh` (universal-ctags).
+Signatures only — classes, functions, methods, interfaces, enums, types, namespaces, traits.
+Regenerate after structural changes. Languages: `JavaScript,Sh`.
+
+```
+scripts/download-tools.js:
+  L22  method  extract (PANDOC_CONFIG.linux)
+  L36  method  extract (PANDOC_CONFIG.win32)
+  L51  method  extract (PANDOC_CONFIG.darwin)
+  L63  function  download
+  L70  function  get (download)
+  L109  function  downloadPandoc
+
+scripts/generate-icons.js:
+  L17  function  generateIcons
+
+src/adapters/electron/fs.js:
+  L20  method  readFile (electronFsAdapter)
+  L30  method  writeFile (electronFsAdapter)
+  L39  method  deleteFile (electronFsAdapter)
+  L48  method  ensureDir (electronFsAdapter)
+  L57  method  listDirectory (electronFsAdapter)
+  L77  method  exists (electronFsAdapter)
+  L86  method  isDirectory (electronFsAdapter)
+  L96  method  copy (electronFsAdapter)
+  L106  method  move (electronFsAdapter)
+
+src/analytics/analytics-panel.js:
+  L7  function  showAnalyticsModal
+  L105  function  escHandler (showAnalyticsModal)
+  L116  function  escapeHtml
+
+src/analytics/writing-analytics.js:
+  L77  function  countSyllables
+  L83  function  extractWords
+  L87  function  getReadabilityLabel
+  L95  function  analyze
+
+src/command-palette.js:
+  L1  class  CommandPalette
+  L2  method  constructor (CommandPalette)
+  L12  method  register (CommandPalette)
+  L16  method  open (CommandPalette)
+  L24  method  close (CommandPalette)
+  L28  method  isOpen (CommandPalette)
+  L32  method  setupEventListeners (CommandPalette)
+  L61  method  renderResults (CommandPalette)
+  L90  method  highlightMatch (CommandPalette)
+  L96  method  updateSelection (CommandPalette)
+  L105  method  executeSelected (CommandPalette)
+
+src/editor/codemirror-setup.js:
+  L46  function  createEditor
+  L61  function  onChange (createEditor)
+  L118  function  getLanguageExtension
+  L120  method  javascript (getLanguageExtension.loaders)
+  L124  method  html (getLanguageExtension.loaders)
+  L128  method  css (getLanguageExtension.loaders)
+  L132  method  json (getLanguageExtension.loaders)
+  L136  method  python (getLanguageExtension.loaders)
+
+src/main.js:
+  L18  function  getPandocPath
+  L36  function  getFFmpegPath
+  L55  function  sanitizeErrorMessage
+  L64  function  createRateLimiter
+  L66  function  canProceed (createRateLimiter)
+  L83  function  validatePath
+  L136  function  resolveWritablePath
+  L181  function  isPathAccessible
+  L203  function  convertDataToMarkdown
+  L225  function  runPandocCmd
+  L247  function  parseCommand
+  L282  method  get (store)
+  L291  method  set (store)
+  L488  function  checkPandocAvailability
+  L500  function  createWindow
+  L586  function  buildRecentFilesMenu
+  L599  method  click (buildRecentFilesMenu.anonymousObjectc5643c890c05)
+  L637  function  getRecentFiles
+  L647  function  createMenu
+  L872  method  click (createMenu.anonymousObjectc5643c890e05.anonymousObjectc5643c894505)
+  L1118  method  click (createMenu.anonymousObjectc5643c895205.anonymousObjectc5643c897e05)
+  L1279  method  click (createMenu.anonymousObjectc5643c899305.anonymousObjectc5643c89a505)
+  L1351  function  showAboutDialog
+  L1452  function  showDependenciesDialog
+  L1564  function  openPDFFile
+  L1583  function  openFile
+  L1622  function  openPdfFile
+  L1645  function  saveAsFile
+  L1664  function  exportFile
+  L1673  function  showExportOptionsDialog
+  L1676  function  showBatchConversionDialog
+  L1681  function  selectWordTemplate
+  L1705  function  showTemplateSettings
+  L1902  function  processDynamicFields
+  L1921  function  setDocxPageSize
+  L1980  function  addHeaderFooterToDocx
+  L2111  function  exportWordWithTemplate
+  L2153  function  exportPDFViaWordTemplate
+  L2231  function  showUniversalConverterDialog
+  L2236  function  showPDFEditorDialog
+  L2246  function  checkConverterAvailable
+  L2370  function  collectFiles
+  L2464  function  convertWithLibreOffice
+  L2498  function  convertWithImageMagick
+  L2507  function  convertWithFFmpeg
+  L2515  function  convertWithPandoc
+  L2521  function  performExportWithOptions
+  L2805  function  tryPdfFallback
+  L2882  function  showExportSuccess
+  L2892  function  exportWithPandoc
+  L2964  function  exportToHTML
+  L3080  function  exportToPDFElectron
+  L3224  function  exportSpreadsheet
+  L3233  function  importDocument
+  L3355  function  setTheme
+  L3536  function  extractTablesFromMarkdown
+  L3574  function  performBatchConversion
+  L3597  function  findMarkdownFiles (performBatchConversion)
+  L3636  function  processNextFile (performBatchConversion)
+  L3970  function  handleCLIConversion
+  L3997  function  showConversionDialog
+  L4064  function  performCLIConversion
+  L4098  function  buildPandocCommand
+  L4319  function  openFileFromPath
+  L4394  function  openAsciiGenerator
+  L4426  function  openTableGenerator
+  L4724  function  loadSnippets
+  L4734  function  saveSnippetsFile
+
+src/main/GitOperations.js:
+  L3  function  getGitInstance
+  L7  function  getStatus
+  L16  function  stage
+  L26  function  commit
+  L35  function  log
+
+src/main/PDFOperations.js:
+  L5  function  parsePageRanges
+  L28  function  hexToRgb
+  L39  function  pdfMerge
+  L59  function  pdfSplit
+  L126  function  pdfCompress
+  L152  function  pdfRotate
+  L182  function  pdfDeletePages
+  L208  function  pdfReorder
+  L233  function  pdfWatermark
+  L319  function  pdfEncrypt
+  L353  function  pdfDecrypt
+  L370  function  pdfSetPermissions
+  L404  function  executeOperation
+  L431  function  getPageCount
+
+src/plugins/built-in/_sample/index.js:
+  L3  class  SamplePlugin
+  L4  method  init (SamplePlugin)
+
+src/plugins/built-in/writing-studio/goal-tracker.js:
+  L3  class  GoalTracker
+  L7  method  constructor (GoalTracker)
+  L11  method  _getHistory (GoalTracker)
+  L16  method  _setHistory (GoalTracker)
+  L20  method  _setHistoryDay (GoalTracker)
+  L26  method  addWords (GoalTracker)
+  L37  method  getDailyProgress (GoalTracker)
+  L44  method  getStreak (GoalTracker)
+  L61  method  getLast30Days (GoalTracker)
+  L74  method  getWeeklyTotal (GoalTracker)
+
+src/plugins/built-in/writing-studio/index.js:
+  L7  class  WritingStudioPlugin
+  L8  method  init (WritingStudioPlugin)
+  L34  method  _registerCommands (WritingStudioPlugin)
+  L112  method  _registerStatusBar (WritingStudioPlugin)
+  L123  method  deactivate (WritingStudioPlugin)
+  L127  method  getEngines (WritingStudioPlugin)
+
+src/plugins/built-in/writing-studio/panels/goals-panel.js:
+  L1  function  renderGoalsPanel
+
+src/plugins/built-in/writing-studio/panels/manuscript-panel.js:
+  L1  function  renderManuscriptPanel
+
+src/plugins/built-in/writing-studio/panels/proofread-panel.js:
+  L1  function  renderProofreadPanel
+  L41  method  callback (anonymousObject39a0f0110105)
+  L50  function  renderIssues
+
+src/plugins/built-in/writing-studio/panels/snapshots-panel.js:
+  L1  function  renderSnapshotsPanel
+
+src/plugins/built-in/writing-studio/project-manager.js:
+  L1  class  ProjectManager
+  L5  method  constructor (ProjectManager)
+  L9  method  createProject (ProjectManager)
+  L21  method  loadProject (ProjectManager)
+  L27  method  _saveProject (ProjectManager)
+  L31  method  addChapter (ProjectManager)
+  L38  method  updateChapter (ProjectManager)
+  L45  method  compileManuscript (ProjectManager)
+  L56  method  getStats (ProjectManager)
+
+src/plugins/built-in/writing-studio/snapshot-manager.js:
+  L1  class  SnapshotManager
+  L6  method  constructor (SnapshotManager)
+  L11  method  _getAll (SnapshotManager)
+  L16  method  _saveAll (SnapshotManager)
+  L20  method  create (SnapshotManager)
+  L34  method  list (SnapshotManager)
+  L38  method  getById (SnapshotManager)
+  L42  method  restore (SnapshotManager)
+  L48  method  delete (SnapshotManager)
+  L53  method  diff (SnapshotManager)
+  L71  method  prune (SnapshotManager)
+
+src/plugins/built-in/writing-studio/sprint-engine.js:
+  L1  class  SprintEngine
+  L6  method  constructor (SprintEngine)
+  L14  method  start (SprintEngine)
+  L22  method  stop (SprintEngine)
+  L33  method  tick (SprintEngine)
+  L43  method  isActive (SprintEngine)
+  L47  method  getRemaining (SprintEngine)
+
+src/plugins/event-bus.js:
+  L1  class  EventBus
+  L2  method  constructor (EventBus)
+  L6  method  on (EventBus)
+  L13  method  off (EventBus)
+  L25  method  emit (EventBus)
+  L37  method  hasHandler (EventBus)
+
+src/plugins/plugin-api.js:
+  L1  class  PluginAPI
+  L7  method  init (PluginAPI)
+  L12  method  activate (PluginAPI)
+  L15  method  deactivate (PluginAPI)
+  L18  method  getManifest (PluginAPI)
+
+src/plugins/plugin-context.js:
+  L1  class  PluginContext
+  L14  method  constructor (PluginContext)
+  L23  method  register (PluginContext.constructor.commands)
+  L24  function  safeHandler (PluginContext.constructor.commands.register)
+  L65  method  registerPreHook (PluginContext.constructor.exports)
+  L68  method  registerPostHook (PluginContext.constructor.exports)
+
+src/plugins/plugin-loader.js:
+  L4  class  PluginLoader
+  L8  method  constructor (PluginLoader)
+  L17  method  discoverPlugins (PluginLoader)
+  L66  method  validateManifest (PluginLoader)
+
+src/plugins/plugin-registry.js:
+  L4  class  PluginRegistry
+  L5  method  constructor (PluginRegistry)
+  L15  method  register (PluginRegistry)
+  L49  method  getPlugin (PluginRegistry)
+  L53  method  getAll (PluginRegistry)
+  L57  method  activate (PluginRegistry)
+  L68  method  deactivate (PluginRegistry)
+
+src/plugins/settings-store.js:
+  L1  class  SettingsStore
+  L5  method  constructor (SettingsStore)
+  L9  method  get (SettingsStore)
+  L13  method  set (SettingsStore)
+  L17  method  onChanged (SettingsStore)
+
+src/preload.js:
+  L257  method  send (anonymousObjectb0724fcb0105)
+  L271  method  invoke (anonymousObjectb0724fcb0105)
+  L290  method  on (anonymousObjectb0724fcb0105)
+  L292  function  subscription (anonymousObjectb0724fcb0105.on)
+  L310  method  once (anonymousObjectb0724fcb0105)
+  L322  method  removeAllListeners (anonymousObjectb0724fcb0105)
+
+src/print-preview.js:
+  L1  class  PrintPreview
+  L2  method  constructor (PrintPreview)
+  L9  method  open (PrintPreview)
+  L20  method  close (PrintPreview)
+  L28  method  setupEventListeners (PrintPreview)
+  L53  method  updateScaleLabel (PrintPreview)
+  L59  method  updatePreview (PrintPreview)
+  L111  method  refreshPreview (PrintPreview)
+  L117  method  getOptions (PrintPreview)
+  L130  method  executePrint (PrintPreview)
+
+src/renderer.js:
+  L19  method  send (window.electronAPI)
+  L22  method  invoke (window.electronAPI)
+  L25  method  on (window.electronAPI)
+  L26  function  subscription (window.electronAPI.on)
+  L32  method  once (window.electronAPI)
+  L35  method  removeAllListeners (window.electronAPI)
+  L81  function  getSidebarManager
+  L85  function  getRenderTemplatesPanel
+  L90  function  getRenderExplorerPanel
+  L95  function  getRenderGitPanel
+  L99  function  getRenderSnippetsPanel
+  L105  function  getRenderOutlinePanel
+  L110  function  getReplPanel
+  L114  function  getCommandPalette
+  L118  function  getPrintPreview
+  L122  function  getCreateWelcomeContent
+  L127  function  getZenMode
+  L132  function  getShowAnalyticsModal
+  L137  function  ensureToastContainer
+  L147  function  notifyUser
+  L159  function  dismiss (notifyUser)
+  L173  method  highlight (anonymousObject71555c7b0405)
+  L202  method  start (anonymousObject71555c7b0705.anonymousObject71555c7b0805)
+  L205  method  tokenizer (anonymousObject71555c7b0705.anonymousObject71555c7b0805)
+  L221  method  renderer (anonymousObject71555c7b0705.anonymousObject71555c7b0805)
+  L241  function  plantumlEncode (notifyUser)
+  L249  function  scopeCSS (notifyUser)
+  L271  class  TabManager (notifyUser)
+  L272  method  constructor (notifyUser.TabManager)
+  L306  method  setupEventListeners (notifyUser.TabManager)
+  L354  method  createNewTab (notifyUser.TabManager)
+  L379  method  createPdfTab (notifyUser.TabManager)
+  L405  method  createPdfTabElements (notifyUser.TabManager)
+  L436  method  setupPdfTabEvents (notifyUser.TabManager)
+  L503  method  loadPdfInTab (notifyUser.TabManager)
+  L528  method  renderPdfPageInTab (notifyUser.TabManager)
+  L555  method  createTabElements (notifyUser.TabManager)
+  L580  method  onChange (anonymousObject71555c7b0d05)
+  L602  method  onUpdate (anonymousObject71555c7b0d05)
+  L614  method  switchToTab (notifyUser.TabManager)
+  L641  method  switchToNextTab (notifyUser.TabManager)
+  L647  method  closeTab (notifyUser.TabManager)
+  L692  method  updateTabBar (notifyUser.TabManager)
+  L718  method  updateUI (notifyUser.TabManager)
+  L748  method  saveCurrentTabState (notifyUser.TabManager)
+  L756  method  restoreTabState (notifyUser.TabManager)
+  L765  method  focusActiveEditor (notifyUser.TabManager)
+  L771  method  updatePreview (notifyUser.TabManager)
+  L800  method  _hash (notifyUser.TabManager)
+  L809  method  _renderPreview (notifyUser.TabManager)
+  L963  function  onerror (img)
+  L997  method  updatePreviewVisibility (notifyUser.TabManager)
+  L1010  method  updateLineNumbers (notifyUser.TabManager)
+  L1015  method  updateWordCount (notifyUser.TabManager)
+  L1031  method  updateCursorPosition (notifyUser.TabManager)
+  L1038  method  updateFilePath (notifyUser.TabManager)
+  L1046  method  updateBreadcrumb (notifyUser.TabManager)
+  L1054  method  setupEditorEvents (notifyUser.TabManager)
+  L1058  method  handleEditorInput (notifyUser.TabManager)
+  L1073  method  startAutoSave (notifyUser.TabManager)
+  L1081  method  stopAutoSave (notifyUser.TabManager)
+  L1087  method  performAutoSave (notifyUser.TabManager)
+  L1103  method  showAutoSaveIndicator (notifyUser.TabManager)
+  L1119  method  addToRecentFiles (notifyUser.TabManager)
+  L1135  method  getRecentFiles (notifyUser.TabManager)
+  L1145  method  setupToolbarEvents (notifyUser.TabManager)
+  L1215  method  wrapSelection (notifyUser.TabManager)
+  L1233  method  insertAtLineStart (notifyUser.TabManager)
+  L1249  method  insertTable (notifyUser.TabManager)
+  L1259  method  insertCodeBlock (notifyUser.TabManager)
+  L1277  method  insertHorizontalRule (notifyUser.TabManager)
+  L1280  method  setupFindEvents (notifyUser.TabManager)
+  L1350  method  performFind (notifyUser.TabManager)
+  L1384  method  findNext (notifyUser.TabManager)
+  L1390  method  findPrevious (notifyUser.TabManager)
+  L1399  method  highlightMatch (notifyUser.TabManager)
+  L1430  method  replaceOne (notifyUser.TabManager)
+  L1454  method  replaceAll (notifyUser.TabManager)
+  L1485  method  clearFindHighlights (notifyUser.TabManager)
+  L1492  method  checkForLargeFile (notifyUser.TabManager)
+  L1508  method  openFile (notifyUser.TabManager)
+  L1555  method  getEditorContent (notifyUser.TabManager)
+  L1564  method  setEditorContent (notifyUser.TabManager)
+  L1579  method  insertAtCursor (notifyUser.TabManager)
+  L1594  method  getSelection (notifyUser.TabManager)
+  L1602  method  replaceSelection (notifyUser.TabManager)
+  L1616  method  getCurrentContent (notifyUser.TabManager)
+  L1620  method  getCurrentFilePath (notifyUser.TabManager)
+  L1735  method  render (anonymousObject71555c7b2d05)
+  L1788  method  registerIndicator (anonymousObject71555c7b3105.statusBar)
+  L1881  function  onload (reader)
+  L2032  method  onChange (anonymousObject71555c7b3405)
+  L2040  method  onUpdate (anonymousObject71555c7b3405)
+  L2164  function  applyCustomPreviewCSS (notifyUser)
+  L2174  function  triggerLoadCustomCSS (notifyUser)
+  L2188  function  triggerClearCustomCSS (notifyUser)
+  L2202  function  updateFontSizes (notifyUser)
+  L2234  function  openPrintPreviewDialog (notifyUser)
+  L2255  function  showExportDialog (notifyUser)
+  L2269  function  hideExportDialog (notifyUser)
+  L2273  function  initializeExportForm (notifyUser)
+  L2343  function  collectExportOptions (notifyUser)
+  L2444  function  loadExportProfiles (notifyUser)
+  L2456  function  saveExportProfiles (notifyUser)
+  L2459  function  populateProfileDropdown (notifyUser)
+  L2476  function  saveCurrentProfile (notifyUser)
+  L2511  function  loadProfile (notifyUser)
+  L2545  function  deleteSelectedProfile (notifyUser)
+  L2679  function  onchange (input)
+  L2776  function  showBatchDialog (notifyUser)
+  L2796  function  hideBatchDialog (notifyUser)
+  L2799  function  updateBatchProgress (notifyUser)
+  L2816  function  validateBatchForm (notifyUser)
+  L3375  function  showUniversalConverterDialog (notifyUser)
+  L3383  function  updateConverterFormats (notifyUser)
+  L3423  function  updateConverterAdvancedOptions (notifyUser)
+  L3434  function  collectConverterAdvancedOptions (notifyUser)
+  L3645  function  showPDFEditorDialog (notifyUser)
+  L3769  function  hidePDFEditorDialog (notifyUser)
+  L3780  function  updateMergeFilesList (notifyUser)
+  L4107  function  getPDFStatusElement (notifyUser)
+  L4110  function  showPDFStatus (notifyUser)
+  L4117  function  clearPDFStatus (notifyUser)
+  L4124  function  showPDFValidationMessage (notifyUser)
+  L4135  function  processPDFOperation (notifyUser)
+  L4379  function  initMathSupport (notifyUser)
+  L4391  function  onload (katexJS)
+  L4396  function  onload (autoRenderJS)
+  L4417  function  openHeaderFooterDialog (notifyUser)
+  L4425  function  closeHeaderFooterDialog (notifyUser)
+  L4430  function  openFieldPickerDialog (notifyUser)
+  L4436  function  closeFieldPickerDialog (notifyUser)
+  L4477  function  toggleConfigContent (notifyUser)
+  L4488  function  saveHeaderFooterSettings (notifyUser)
+  L4509  function  browseForLogo (notifyUser)
+  L4519  function  clearLogo (notifyUser)
+  L4528  function  insertDynamicField (notifyUser)
+  L4594  function  showTableGenerator (notifyUser)
+  L4605  function  hideTableGenerator (notifyUser)
+  L4608  function  generateTablePreview (notifyUser)
+  L4616  function  generateMarkdownTable (notifyUser)
+  L4685  function  insertGeneratedTable (notifyUser)
+  L4742  function  showASCIIGenerator (notifyUser)
+  L4753  function  hideASCIIGenerator (notifyUser)
+  L4756  function  switchASCIIMode (notifyUser)
+  L4784  function  generateASCIIPreview (notifyUser)
+  L4802  function  textToASCII (notifyUser)
+  L5238  function  createASCIIBox (notifyUser)
+  L5312  function  getASCIITemplate (notifyUser)
+  L5469  function  loadASCIITemplate (notifyUser)
+  L5473  function  insertASCIIArt (notifyUser)
+  L5523  function  anonymousFunction71555c7bd300
+  L5603  function  getPdfjsLib (notifyUser)
+  L5612  function  openPdfFile (notifyUser)
+  L5627  function  renderPdfPage (notifyUser)
+  L5733  function  closePdfViewer (notifyUser)
+  L5783  function  openPdfEditorDialog (notifyUser)
+  L5831  function  initPaneResizer (notifyUser)
+  L5920  function  onPDFFileSelected (notifyUser)
+  L5935  function  loadPDFThumbnails (notifyUser)
+  L5966  function  renderThumbnailGrid (notifyUser)
+  L6060  function  renderThumbnail (notifyUser)
+  L6085  function  syncRotateInput (notifyUser)
+  L6094  function  syncDeleteInput (notifyUser)
+  L6103  function  syncReorderInput (notifyUser)
+
+src/repl/repl-panel.js:
+  L1  class  ReplPanel
+  L2  method  constructor (ReplPanel)
+  L8  method  setupEventListeners (ReplPanel)
+  L13  method  toggle (ReplPanel)
+  L19  method  show (ReplPanel)
+  L25  method  clear (ReplPanel)
+  L29  method  appendOutput (ReplPanel)
+  L42  method  escapeHtml (ReplPanel)
+
+src/sidebar/explorer-panel.js:
+  L1  function  renderExplorerPanel
+  L40  function  renderTree
+  L79  function  getFileIcon
+
+src/sidebar/git-panel.js:
+  L1  function  renderGitPanel
+  L24  function  loadGitStatus (renderGitPanel)
+
+src/sidebar/outline-panel.js:
+  L6  function  renderOutlinePanel
+  L18  function  parseHeadings (renderOutlinePanel)
+  L36  function  findActiveHeading (renderOutlinePanel)
+  L48  function  renderHeadings (renderOutlinePanel)
+  L89  function  escapeHtml (renderOutlinePanel)
+  L95  function  refresh (renderOutlinePanel)
+  L100  function  setActiveHeading (renderOutlinePanel)
+
+src/sidebar/sidebar-manager.js:
+  L1  class  SidebarManager
+  L2  method  constructor (SidebarManager)
+  L11  method  setupEventListeners (SidebarManager)
+  L20  method  registerPanel (SidebarManager)
+  L24  method  togglePanel (SidebarManager)
+  L32  method  expand (SidebarManager)
+  L45  method  collapse (SidebarManager)
+
+src/sidebar/snippets-panel.js:
+  L1  function  renderSnippetsPanel
+  L14  function  loadSnippets (renderSnippetsPanel)
+  L19  function  renderList (renderSnippetsPanel)
+
+src/sidebar/templates-panel.js:
+  L18  function  renderTemplatesPanel
+
+src/utils/ModalManager.js:
+  L5  class  ModalManager
+  L16  method  constructor (ModalManager)
+  L31  method  init (ModalManager)
+  L47  method  setupCloseTriggers (ModalManager)
+  L51  function  handler (ModalManager.setupCloseTriggers)
+  L65  function  handler
+  L74  method  getFocusableElements (ModalManager)
+  L89  method  trapFocus (ModalManager)
+  L111  method  handleKeydown (ModalManager)
+  L119  method  open (ModalManager)
+  L141  function  keydownHandler (ModalManager.open)
+  L164  method  close (ModalManager)
+  L182  function  addHidden (ModalManager.close)
+  L188  function  onTransitionEnd (ModalManager.close)
+  L223  method  isOpen (ModalManager)
+  L227  method  destroy (ModalManager)
+
+src/welcome.js:
+  L1  function  createWelcomeContent
+
+src/wordTemplateExporter.js:
+  L11  class  WordTemplateExporter
+  L12  method  constructor (WordTemplateExporter)
+  L24  method  preprocessMarkdownForWordExport (WordTemplateExporter)
+  L33  function  flush (WordTemplateExporter.preprocessMarkdownForWordExport)
+  L59  function  stripArtifacts (WordTemplateExporter.preprocessMarkdownForWordExport)
+
+src/zen-mode.js:
+  L10  class  ZenMode
+  L14  method  constructor (ZenMode)
+  L23  method  activate (ZenMode)
+  L65  method  deactivate (ZenMode)
+  L101  method  toggle (ZenMode)
+  L109  method  _applyTypewriterBehavior (ZenMode)
+  L111  function  scrollFn (ZenMode._applyTypewriterBehavior)
+  L151  method  _createHUD (ZenMode)
+  L169  method  _updateHUD (ZenMode)
+  L220  method  constructor (anonymousObject3acf7ce30205)
+  L240  function  getOpacity
+  L250  method  constructor (anonymousObject3acf7ce30405)
+
+tests/git-operations.test.js:
+  L26  function  asyncFn
+  L35  function  asyncFnWithError
+
+tests/main-utils.test.js:
+  L7  function  sanitizeErrorMessage
+  L49  function  createRateLimiter
+  L51  function  canProceed (createRateLimiter)
+
+tests/markdown-extensions.test.js:
+  L83  method  start (extension)
+  L86  method  tokenizer (extension)
+  L102  method  renderer (extension)
+  L151  function  plantumlEncode
+  L176  function  slugify
+  L203  function  scopeCSS
+
+tests/modal-manager.test.js:
+  L11  function  createModalElement
+
+tests/plugin-api.test.js:
+  L18  class  MyPlugin
+  L19  method  init (MyPlugin)
+
+tests/plugin-context.test.js:
+  L39  function  badHandler
+
+tests/plugin-loader.test.js:
+  L17  function  writeManifest
+
+tests/plugin-registry.test.js:
+  L5  class  TestPlugin
+  L6  method  init (TestPlugin)
+  L10  method  activate (TestPlugin)
+  L13  method  deactivate (TestPlugin)
+  L69  class  BadPlugin
+  L70  method  init (BadPlugin)
+
+tests/setup.js:
+  L96  function  error (console)
+
+tests/sidebar.test.js:
+  L41  method  render (anonymousObjectfe2d35d70105)
+  L52  method  render (anonymousObjectfe2d35d70205)
+  L62  method  render (anonymousObjectfe2d35d70305)
+  L68  method  render (anonymousObjectfe2d35d70405)
+  L80  method  render (anonymousObjectfe2d35d70505)
+  L88  method  render (anonymousObjectfe2d35d70605)
+  L96  method  render (anonymousObjectfe2d35d70705)
+  L120  method  render (anonymousObjectfe2d35d70905)
+  L130  method  render (anonymousObjectfe2d35d70a05)
+
+tests/utils.test.js:
+  L9  function  parseCommand
+  L78  function  hexToRgb
+  L121  function  getExtension
+  L133  function  replaceExtension
+```

scripts/bundle-markitdown.js

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+/**
+ * Builds a self-contained MarkItDown binary into bin/<platform>/markitdown
+ * so the app can bundle Microsoft's markitdown (MIT) without requiring users
+ * to have Python installed. Run via `npm run bundle:markitdown` before
+ * packaging (skipped automatically when the binary already exists).
+ *
+ * How: creates a throwaway virtualenv, pip-installs markitdown (with the
+ * document extras) + PyInstaller, then freezes the CLI into a onefile
+ * executable. Heavy optional ML deps (torch/scipy/pandas/…) are excluded —
+ * the resulting ~75MB binary covers PDF/DOCX/PPTX/XLSX/Outlook/HTML/EPUB/
+ * images/CSV/JSON/XML/ZIP. Audio transcription and OCR intentionally stay
+ * unbundled (multi-GB); the app falls back to a system `markitdown[all]`
+ * install for those.
+ *
+ * Requires on the build machine: python3 (with venv + pip) — on Debian/
+ * Ubuntu that is `sudo apt install python3 python3-venv`.
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const platform = process.platform; // linux | win32 | darwin
+const exeName = platform === 'win32' ? 'markitdown.exe' : 'markitdown';
+const binDir = path.join(__dirname, '..', 'bin', platform);
+const destFile = path.join(binDir, exeName);
+const workDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mid-bundle-'));
+
+/** Run a command, inheriting stdout/stderr so build progress is visible. */
+function run(cmd, args, opts = {}) {
+  execFileSync(cmd, args, { stdio: 'inherit', ...opts });
+}
+
+function pythonBin(venvDir, name) {
+  return path.join(venvDir, platform === 'win32' ? 'Scripts' : 'bin', name);
+}
+
+function main() {
+  if (fs.existsSync(destFile)) {
+    console.log(`[bundle-markitdown] ${destFile} already present — skipping.`);
+    return;
+  }
+
+  const venvDir = path.join(workDir, 'venv');
+  console.log('[bundle-markitdown] Creating virtualenv...');
+  run('python3', ['-m', 'venv', venvDir]);
+
+  console.log('[bundle-markitdown] Installing markitdown + PyInstaller...');
+  run(pythonBin(venvDir, 'pip'), [
+    'install', '--quiet', '--upgrade', 'pip',
+  ]);
+  run(pythonBin(venvDir, 'pip'), [
+    'install', '--quiet',
+    // Document extras only — [all] would pull the ML stack (torch etc.)
+    'markitdown[pdf,docx,pptx,xlsx,outlook]',
+    'pyinstaller',
+  ]);
+
+  // PyInstaller entrypoint mirroring the markitdown CLI
+  const entry = path.join(workDir, 'entry.py');
+  fs.writeFileSync(
+    entry,
+    [
+      '# Generated by scripts/bundle-markitdown.js — frozen CLI entrypoint',
+      'from markitdown.__main__ import main',
+      "if __name__ == '__main__':",
+      '    main()',
+      '',
+    ].join('\n')
+  );
+
+  console.log('[bundle-markitdown] Freezing with PyInstaller (this takes a minute)...');
+  run(pythonBin(venvDir, platform === 'win32' ? 'pyinstaller.exe' : 'pyinstaller'), [
+    '--onefile',
+    '--name', 'markitdown',
+    '--strip',
+    '--clean',
+    // magika ships its ML model as data files — must be collected into the bundle
+    '--collect-data', 'magika',
+    // Heavy optional scientific/ML stacks markitdown never imports for
+    // document conversion — excluding them keeps the binary ~75MB
+    '--exclude-module', 'torch',
+    '--exclude-module', 'scipy',
+    '--exclude-module', 'pandas',
+    '--exclude-module', 'matplotlib',
+    '--exclude-module', 'tkinter',
+    '--exclude-module', 'IPython',
+    '--exclude-module', 'pytest',
+    '--distpath', path.join(workDir, 'dist'),
+    '--workpath', path.join(workDir, 'build'),
+    '--specpath', workDir,
+    entry,
+  ]);
+
+  fs.mkdirSync(binDir, { recursive: true });
+  fs.copyFileSync(path.join(workDir, 'dist', exeName), destFile);
+  if (platform !== 'win32') fs.chmodSync(destFile, 0o755);
+
+  // Smoke test before declaring success
+  const version = execFileSync(destFile, ['--version'], { encoding: 'utf-8' }).trim();
+  if (!version.toLowerCase().includes('markitdown')) {
+    throw new Error(`Unexpected --version output: ${version}`);
+  }
+  console.log(`[bundle-markitdown] Built ${destFile} (${version})`);
+}
+
+try {
+  main();
+} catch (err) {
+  console.error('[bundle-markitdown] FAILED:', err.message);
+  console.error(
+    '\nPrerequisites: python3 with venv+pip on the PATH.\n' +
+      '  Debian/Ubuntu: sudo apt install python3 python3-venv\n' +
+      '  macOS: brew install python\n' +
+      'The app still works without the bundled binary — it falls back to a\n' +
+      'system-installed markitdown or python -m markitdown at runtime.'
+  );
+  process.exit(1);
+} finally {
+  fs.rmSync(workDir, { recursive: true, force: true });
+}

scripts/download-tools.js

@@ -3,6 +3,11 @@
  * Downloads pandoc binary for the current build platform.
  * Run automatically via `npm run download-tools` before building.
  * Skips download if binary already exists (idempotent).
+ *
+ * Security: every artifact with a known hash is verified with SHA-256 after
+ * download AND on every run (defending the build against a tampered cache /
+ * compromised mirror). When a hash is missing for a platform, the computed
+ * hash is printed so CI can pin it — add it to KNOWN_SHA256 below.
  */
 
 const https = require('https');
@@ -10,10 +15,57 @@ const http = require('http');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const crypto = require('crypto');
 const { execSync } = require('child_process');
 
 const PANDOC_VERSION = '3.9.0.2';
 
+/**
+ * SHA-256 of each downloaded artifact, keyed "<platform>:<file>" or
+ * "fonts:<file>". Computed with `sha256sum` from the pristine upstream
+ * artifacts; keep in sync when bumping versions.
+ */
+const KNOWN_SHA256 = {
+  'linux:pandoc': '7d124235998ecd3cdd9a463b1e5f6691a178b6461824c29a36170a0882f05597',
+  'win32:pandoc.exe': 'e83f8354c0f507222b5684797b9c5ae766f03889785995d14aac27816ec456ba',
+  // Fill these from a trusted machine after the first download of each
+  // platform (the script prints the computed hash):
+  // 'darwin:pandoc': '…',
+  'fonts:FiraCode-Regular.ttf': '3c79d234a9161c790410ebb2a80de7efb7c15f581062c130e0fa78503ccdd0da',
+  'fonts:FiraCode-Bold.ttf': '975f26779fac1029c2cbdac1e9fac7e9ddeec05e064675e4aac63bffa121742f',
+  'fonts:FiraCode-LICENSE.txt': '1d41e10031ab125302780a05ec4c91d218e47db0c7e37cf315cce5e608cdc25c',
+};
+
+/** sha256 of a file's contents, hex-encoded. */
+function sha256File(filePath) {
+  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
+}
+
+/**
+ * Verify a file against KNOWN_SHA256. Throws on mismatch; prints the computed
+ * hash with a pin-me hint when no hash is recorded yet (soft-fail so new
+ * platforms bootstrap, hard-fail so tampering never passes silently).
+ */
+function verifyArtifact(key, filePath) {
+  const actual = sha256File(filePath);
+  const expected = KNOWN_SHA256[key];
+  if (!expected) {
+    console.warn(
+      `[download-tools] WARNING: no pinned SHA-256 for "${key}".\n` +
+        `  Computed: ${actual}\n` +
+        '  Verify it against the upstream artifact and add it to KNOWN_SHA256.'
+    );
+    return;
+  }
+  if (actual !== expected) {
+    throw new Error(
+      `SHA-256 mismatch for ${key}!\n  expected ${expected}\n  actual   ${actual}\n` +
+        'Delete the file and re-run; if the mismatch persists, do NOT ship it.'
+    );
+  }
+  console.log(`[download-tools] SHA-256 OK for ${key}`);
+}
+
 const PANDOC_CONFIG = {
   linux: {
     url: `https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/pandoc-${PANDOC_VERSION}-linux-amd64.tar.gz`,
@@ -106,6 +158,30 @@ function download(url, destPath) {
   });
 }
 
+async function downloadFiraCode() {
+  const destDir = path.join(__dirname, '..', 'assets', 'fonts');
+  fs.mkdirSync(destDir, { recursive: true });
+
+  const targets = [
+    { url: 'https://github.com/tonsky/FiraCode/raw/master/distr/ttf/FiraCode-Regular.ttf', out: 'FiraCode-Regular.ttf' },
+    { url: 'https://github.com/tonsky/FiraCode/raw/master/distr/ttf/FiraCode-Bold.ttf',    out: 'FiraCode-Bold.ttf' },
+    { url: 'https://raw.githubusercontent.com/tonsky/FiraCode/master/LICENSE',            out: 'FiraCode-LICENSE.txt' },
+  ];
+
+  for (const t of targets) {
+    const destFile = path.join(destDir, t.out);
+    if (fs.existsSync(destFile)) {
+      // Re-verify cached artifacts so a tampered cache never ships
+      verifyArtifact(`fonts:${t.out}`, destFile);
+      console.log(`[download-tools] ${t.out} already present — skipping.`);
+      continue;
+    }
+    console.log(`[download-tools] Downloading ${t.out}...`);
+    await download(t.url, destFile);
+    verifyArtifact(`fonts:${t.out}`, destFile);
+  }
+}
+
 async function downloadPandoc() {
   const platform = process.platform;
   const config = PANDOC_CONFIG[platform];
@@ -119,6 +195,7 @@ async function downloadPandoc() {
   const destFile = path.join(destDir, config.destFile);
 
   if (fs.existsSync(destFile)) {
+    verifyArtifact(`${platform}:${config.destFile}`, destFile);
     console.log(`[download-tools] pandoc already present at ${destFile} — skipping.`);
     return;
   }
@@ -132,6 +209,7 @@ async function downloadPandoc() {
 
   console.log(`[download-tools] Extracting to ${destDir}...`);
   config.extract(tmpArchive, destDir);
+  verifyArtifact(`${platform}:${config.destFile}`, destFile);
 
   try {
     fs.unlinkSync(tmpArchive);
@@ -142,7 +220,7 @@ async function downloadPandoc() {
   console.log(`[download-tools] pandoc ready: ${destFile}`);
 }
 
-downloadPandoc().catch((err) => {
+Promise.all([downloadPandoc(), downloadFiraCode()]).catch((err) => {
   console.error('[download-tools] FAILED:', err.message);
   process.exit(1);
 });

src/adapters/electron/fs.js

@@ -4,7 +4,7 @@
  * Implements file system operations for Electron using IPC.
  * This abstracts file operations to enable easier testing and migration.
  *
- * @version 4.3.0
+ * @version 4.4.1
  */
 
 /**
@@ -12,100 +12,100 @@
  * @type {import('../types').FileSystemAdapter}
  */
 const electronFsAdapter = {
-    /**
-     * Read file content
-     * @param {string} path - File path
-     * @returns {Promise<string>} File content
-     */
-    async readFile(path) {
-        return await window.electronAPI.file.read(path);
-    },
+  /**
+   * Read file content
+   * @param {string} path - File path
+   * @returns {Promise<string>} File content
+   */
+  async readFile(path) {
+    return await window.electronAPI.file.read(path);
+  },
 
-    /**
-     * Write content to file
-     * @param {string} path - File path
-     * @param {string} content - File content
-     * @returns {Promise<void>}
-     */
-    async writeFile(path, content) {
-        return await window.electronAPI.file.write(path, content);
-    },
+  /**
+   * Write content to file
+   * @param {string} path - File path
+   * @param {string} content - File content
+   * @returns {Promise<void>}
+   */
+  async writeFile(path, content) {
+    return await window.electronAPI.file.write(path, content);
+  },
 
-    /**
-     * Delete file
-     * @param {string} path - File path
-     * @returns {Promise<void>}
-     */
-    async deleteFile(path) {
-        return await window.electronAPI.file.delete(path);
-    },
+  /**
+   * Delete file
+   * @param {string} path - File path
+   * @returns {Promise<void>}
+   */
+  async deleteFile(path) {
+    return await window.electronAPI.file.delete(path);
+  },
 
-    /**
-     * Ensure directory exists
-     * @param {string} path - Directory path
-     * @returns {Promise<void>}
-     */
-    async ensureDir(path) {
-        return await window.electronAPI.file.ensureDir(path);
-    },
+  /**
+   * Ensure directory exists
+   * @param {string} path - Directory path
+   * @returns {Promise<void>}
+   */
+  async ensureDir(path) {
+    return await window.electronAPI.file.ensureDir(path);
+  },
 
-    /**
-     * List directory contents
-     * @param {string} path - Directory path
-     * @returns {Promise<Array<import('../types').FileInfo>>}
-     */
-    async listDirectory(path) {
-        const result = await window.electronAPI.invoke('list-directory', path);
-        if (!result?.entries) {
-            return [];
-        }
-
-        return result.entries.map((entry) => ({
-            name: entry.name,
-            isDir: entry.isDirectory,
-            size: entry.size ?? 0,
-            modified: entry.modified ?? 0,
-            path: entry.path
-        }));
-    },
-
-    /**
-     * Check if path exists
-     * @param {string} path - Path to check
-     * @returns {Promise<boolean>}
-     */
-    async exists(path) {
-        return await window.electronAPI.file.exists(path);
-    },
-
-    /**
-     * Check if path is a directory
-     * @param {string} path - Path to check
-     * @returns {Promise<boolean>}
-     */
-    async isDirectory(path) {
-        return await window.electronAPI.file.isDirectory(path);
-    },
-
-    /**
-     * Copy file or directory
-     * @param {string} source - Source path
-     * @param {string} dest - Destination path
-     * @returns {Promise<void>}
-     */
-    async copy(source, dest) {
-        return await window.electronAPI.file.copy(source, dest);
-    },
-
-    /**
-     * Move file or directory
-     * @param {string} source - Source path
-     * @param {string} dest - Destination path
-     * @returns {Promise<void>}
-     */
-    async move(source, dest) {
-        return await window.electronAPI.file.move(source, dest);
+  /**
+   * List directory contents
+   * @param {string} path - Directory path
+   * @returns {Promise<Array<import('../types').FileInfo>>}
+   */
+  async listDirectory(path) {
+    const result = await window.electronAPI.invoke('list-directory', path);
+    if (!result?.entries) {
+      return [];
     }
+
+    return result.entries.map((entry) => ({
+      name: entry.name,
+      isDir: entry.isDirectory,
+      size: entry.size ?? 0,
+      modified: entry.modified ?? 0,
+      path: entry.path,
+    }));
+  },
+
+  /**
+   * Check if path exists
+   * @param {string} path - Path to check
+   * @returns {Promise<boolean>}
+   */
+  async exists(path) {
+    return await window.electronAPI.file.exists(path);
+  },
+
+  /**
+   * Check if path is a directory
+   * @param {string} path - Path to check
+   * @returns {Promise<boolean>}
+   */
+  async isDirectory(path) {
+    return await window.electronAPI.file.isDirectory(path);
+  },
+
+  /**
+   * Copy file or directory
+   * @param {string} source - Source path
+   * @param {string} dest - Destination path
+   * @returns {Promise<void>}
+   */
+  async copy(source, dest) {
+    return await window.electronAPI.file.copy(source, dest);
+  },
+
+  /**
+   * Move file or directory
+   * @param {string} source - Source path
+   * @param {string} dest - Destination path
+   * @returns {Promise<void>}
+   */
+  async move(source, dest) {
+    return await window.electronAPI.file.move(source, dest);
+  },
 };
 
 module.exports = { electronFsAdapter };

src/adapters/types.js

@@ -5,7 +5,7 @@
  * Adapters abstract file system, conversion, and system operations
  * to enable easier testing and future platform migration.
  *
- * @version 4.3.0
+ * @version 4.4.1
  */
 
 /**
@@ -129,5 +129,5 @@
  */
 
 module.exports = {
-    // Type definitions are JSDoc only, no runtime exports needed
+  // Type definitions are JSDoc only, no runtime exports needed
 };

src/analytics/analytics-panel.js

@@ -5,19 +5,19 @@
 const { analyze } = require('./writing-analytics');
 
 function showAnalyticsModal(tabManager) {
-    const existing = document.getElementById('analytics-modal');
-    if (existing) existing.remove();
+  const existing = document.getElementById('analytics-modal');
+  if (existing) existing.remove();
 
-    const content = tabManager.getEditorContent();
-    const metrics = analyze(content);
+  const content = tabManager.getEditorContent();
+  const metrics = analyze(content);
 
-    const overlay = document.createElement('div');
-    overlay.id = 'analytics-modal';
-    overlay.className = 'analytics-overlay';
+  const overlay = document.createElement('div');
+  overlay.id = 'analytics-modal';
+  overlay.className = 'analytics-overlay';
 
-    const maxCount = metrics.topWords.length > 0 ? metrics.topWords[0].count : 1;
+  const maxCount = metrics.topWords.length > 0 ? metrics.topWords[0].count : 1;
 
-    overlay.innerHTML = `
+  overlay.innerHTML = `
         <div class="analytics-modal">
             <div class="analytics-header">
                 <h2>Writing Analytics</h2>
@@ -61,11 +61,15 @@ function showAnalyticsModal(tabManager) {
                         <span class="analytics-label">Avg Sentence</span>
                         <span class="analytics-value">${metrics.avgSentenceLength} words</span>
                     </div>
-                    ${metrics.longestSentenceLength > 0 ? `
+                    ${
+                      metrics.longestSentenceLength > 0
+                        ? `
                     <div class="analytics-row analytics-longest">
                         <span class="analytics-label">Longest (${metrics.longestSentenceLength} words)</span>
                         <span class="analytics-value analytics-sentence-preview">${escapeHtml(metrics.longestSentence)}</span>
-                    </div>` : ''}
+                    </div>`
+                        : ''
+                    }
                 </div>
 
                 <div class="analytics-section">
@@ -74,39 +78,45 @@ function showAnalyticsModal(tabManager) {
                         <span class="analytics-label">Unique</span>
                         <span class="analytics-value">${metrics.uniqueWordCount} / ${metrics.wordCount}<small>${metrics.lexicalDiversity}%</small></span>
                     </div>
-                    ${metrics.topWords.length > 0 ? `
+                    ${
+                      metrics.topWords.length > 0
+                        ? `
                     <div class="word-cloud">
-                        ${metrics.topWords.map(w => {
+                        ${metrics.topWords
+                          .map((w) => {
                             const scale = 13 + Math.round((w.count / maxCount) * 3);
                             return `<span class="word-tag" style="font-size:${scale}px">${escapeHtml(w.word)}<small>${w.count}</small></span>`;
-                        }).join('')}
-                    </div>` : ''}
+                          })
+                          .join('')}
+                    </div>`
+                        : ''
+                    }
                 </div>
             </div>
         </div>
     `;
 
-    const closeBtn = overlay.querySelector('.analytics-close');
-    closeBtn.addEventListener('click', () => overlay.remove());
-    overlay.addEventListener('click', (e) => {
-        if (e.target === overlay) overlay.remove();
-    });
+  const closeBtn = overlay.querySelector('.analytics-close');
+  closeBtn.addEventListener('click', () => overlay.remove());
+  overlay.addEventListener('click', (e) => {
+    if (e.target === overlay) overlay.remove();
+  });
 
-    const escHandler = (e) => {
-        if (e.key === 'Escape') {
-            overlay.remove();
-            document.removeEventListener('keydown', escHandler);
-        }
-    };
-    document.addEventListener('keydown', escHandler);
+  const escHandler = (e) => {
+    if (e.key === 'Escape') {
+      overlay.remove();
+      document.removeEventListener('keydown', escHandler);
+    }
+  };
+  document.addEventListener('keydown', escHandler);
 
-    document.body.appendChild(overlay);
+  document.body.appendChild(overlay);
 }
 
 function escapeHtml(str) {
-    const div = document.createElement('div');
-    div.textContent = str;
-    return div.innerHTML;
+  const div = document.createElement('div');
+  div.textContent = str;
+  return div.innerHTML;
 }
 
 module.exports = { showAnalyticsModal };

src/analytics/writing-analytics.js

@@ -4,124 +4,197 @@
  */
 
 const STOP_WORDS = new Set([
-    'the', 'a', 'an', 'is', 'are', 'was', 'were', 'be', 'been',
-    'have', 'has', 'had', 'do', 'does', 'did', 'will', 'would',
-    'could', 'should', 'to', 'of', 'in', 'for', 'on', 'with',
-    'at', 'by', 'from', 'as', 'and', 'or', 'but', 'if', 'it',
-    'its', 'this', 'that', 'these', 'those', 'i', 'me', 'my',
-    'we', 'our', 'you', 'your', 'he', 'him', 'his', 'she', 'her',
-    'they', 'them', 'their', 'not', 'no', 'so', 'than', 'too',
-    'very', 'also', 'just', 'about', 'up', 'out', 'what', 'which', 'who'
+  'the',
+  'a',
+  'an',
+  'is',
+  'are',
+  'was',
+  'were',
+  'be',
+  'been',
+  'have',
+  'has',
+  'had',
+  'do',
+  'does',
+  'did',
+  'will',
+  'would',
+  'could',
+  'should',
+  'to',
+  'of',
+  'in',
+  'for',
+  'on',
+  'with',
+  'at',
+  'by',
+  'from',
+  'as',
+  'and',
+  'or',
+  'but',
+  'if',
+  'it',
+  'its',
+  'this',
+  'that',
+  'these',
+  'those',
+  'i',
+  'me',
+  'my',
+  'we',
+  'our',
+  'you',
+  'your',
+  'he',
+  'him',
+  'his',
+  'she',
+  'her',
+  'they',
+  'them',
+  'their',
+  'not',
+  'no',
+  'so',
+  'than',
+  'too',
+  'very',
+  'also',
+  'just',
+  'about',
+  'up',
+  'out',
+  'what',
+  'which',
+  'who',
 ]);
 
 function countSyllables(word) {
-    word = word.toLowerCase().replace(/(?:[^laeiouy]es|ed|[^laeiouy]e)$/, '');
-    word = word.replace(/^y/, '');
-    return word.match(/[aeiouy]{1,2}/gi)?.length || 1;
+  word = word.toLowerCase().replace(/(?:[^laeiouy]es|ed|[^laeiouy]e)$/, '');
+  word = word.replace(/^y/, '');
+  return word.match(/[aeiouy]{1,2}/gi)?.length || 1;
 }
 
 function extractWords(text) {
-    return text.match(/[a-zA-Z]+(?:['-][a-zA-Z]+)*/g) || [];
+  return text.match(/[a-zA-Z]+(?:['-][a-zA-Z]+)*/g) || [];
 }
 
 function getReadabilityLabel(score) {
-    if (score >= 90) return 'Very Easy';
-    if (score >= 70) return 'Easy';
-    if (score >= 50) return 'Standard';
-    if (score >= 30) return 'Difficult';
-    return 'Very Difficult';
+  if (score >= 90) return 'Very Easy';
+  if (score >= 70) return 'Easy';
+  if (score >= 50) return 'Standard';
+  if (score >= 30) return 'Difficult';
+  return 'Very Difficult';
 }
 
 function analyze(text) {
-    if (!text || !text.trim()) {
-        return {
-            wordCount: 0,
-            sentenceCount: 0,
-            paragraphCount: 0,
-            fleschEase: 0,
-            fleschGrade: 0,
-            readabilityLabel: 'N/A',
-            readingTime: 0,
-            speakingTime: 0,
-            uniqueWordCount: 0,
-            lexicalDiversity: 0,
-            avgSentenceLength: 0,
-            longestSentence: '',
-            longestSentenceLength: 0,
-            topWords: []
-        };
-    }
-
-    const words = extractWords(text);
-    const wordCount = words.length;
-
-    const sentences = text.split(/[.!?]+/).map(s => s.trim()).filter(Boolean);
-    const sentenceCount = Math.max(sentences.length, 1);
-
-    const paragraphs = text.split(/\n\s*\n/).map(p => p.trim()).filter(Boolean);
-    const paragraphCount = Math.max(paragraphs.length, 1);
-
-    let totalSyllables = 0;
-    for (const w of words) {
-        totalSyllables += countSyllables(w);
-    }
-
-    const fleschEase = Math.round((206.835 - 1.015 * (wordCount / sentenceCount) - 84.6 * (totalSyllables / wordCount)) * 10) / 10;
-    const fleschGrade = Math.round((0.39 * (wordCount / sentenceCount) + 11.8 * (totalSyllables / wordCount) - 15.59) * 10) / 10;
-    const readabilityLabel = getReadabilityLabel(fleschEase);
-
-    const readingTime = Math.ceil(wordCount / 200);
-    const speakingTime = Math.ceil(wordCount / 130);
-
-    const uniqueWords = new Set(words.map(w => w.toLowerCase()));
-    const uniqueWordCount = uniqueWords.size;
-    const lexicalDiversity = wordCount > 0 ? Math.round((uniqueWordCount / wordCount) * 1000) / 10 : 0;
-
-    const avgSentenceLength = Math.round((wordCount / sentenceCount) * 10) / 10;
-
-    let longestSentence = '';
-    let longestSentenceLength = 0;
-    for (const s of sentences) {
-        const sWords = extractWords(s);
-        if (sWords.length > longestSentenceLength) {
-            longestSentenceLength = sWords.length;
-            longestSentence = s.trim();
-        }
-    }
-
-    if (longestSentence.length > 80) {
-        longestSentence = longestSentence.substring(0, 80) + '...';
-    }
-
-    const wordFreq = {};
-    for (const w of words) {
-        const lower = w.toLowerCase();
-        if (!STOP_WORDS.has(lower) && lower.length > 1) {
-            wordFreq[lower] = (wordFreq[lower] || 0) + 1;
-        }
-    }
-
-    const topWords = Object.entries(wordFreq)
-        .sort((a, b) => b[1] - a[1])
-        .slice(0, 10)
-        .map(([word, count]) => ({ word, count }));
-
+  if (!text || !text.trim()) {
     return {
-        wordCount,
-        sentenceCount,
-        paragraphCount,
-        fleschEase,
-        fleschGrade,
-        readabilityLabel,
-        readingTime,
-        speakingTime,
-        uniqueWordCount,
-        lexicalDiversity,
-        avgSentenceLength,
-        longestSentence,
-        longestSentenceLength,
-        topWords
+      wordCount: 0,
+      sentenceCount: 0,
+      paragraphCount: 0,
+      fleschEase: 0,
+      fleschGrade: 0,
+      readabilityLabel: 'N/A',
+      readingTime: 0,
+      speakingTime: 0,
+      uniqueWordCount: 0,
+      lexicalDiversity: 0,
+      avgSentenceLength: 0,
+      longestSentence: '',
+      longestSentenceLength: 0,
+      topWords: [],
     };
+  }
+
+  const words = extractWords(text);
+  const wordCount = words.length;
+
+  const sentences = text
+    .split(/[.!?]+/)
+    .map((s) => s.trim())
+    .filter(Boolean);
+  const sentenceCount = Math.max(sentences.length, 1);
+
+  const paragraphs = text
+    .split(/\n\s*\n/)
+    .map((p) => p.trim())
+    .filter(Boolean);
+  const paragraphCount = Math.max(paragraphs.length, 1);
+
+  let totalSyllables = 0;
+  for (const w of words) {
+    totalSyllables += countSyllables(w);
+  }
+
+  const fleschEase =
+    Math.round(
+      (206.835 - 1.015 * (wordCount / sentenceCount) - 84.6 * (totalSyllables / wordCount)) * 10
+    ) / 10;
+  const fleschGrade =
+    Math.round(
+      (0.39 * (wordCount / sentenceCount) + 11.8 * (totalSyllables / wordCount) - 15.59) * 10
+    ) / 10;
+  const readabilityLabel = getReadabilityLabel(fleschEase);
+
+  const readingTime = Math.ceil(wordCount / 200);
+  const speakingTime = Math.ceil(wordCount / 130);
+
+  const uniqueWords = new Set(words.map((w) => w.toLowerCase()));
+  const uniqueWordCount = uniqueWords.size;
+  const lexicalDiversity =
+    wordCount > 0 ? Math.round((uniqueWordCount / wordCount) * 1000) / 10 : 0;
+
+  const avgSentenceLength = Math.round((wordCount / sentenceCount) * 10) / 10;
+
+  let longestSentence = '';
+  let longestSentenceLength = 0;
+  for (const s of sentences) {
+    const sWords = extractWords(s);
+    if (sWords.length > longestSentenceLength) {
+      longestSentenceLength = sWords.length;
+      longestSentence = s.trim();
+    }
+  }
+
+  if (longestSentence.length > 80) {
+    longestSentence = longestSentence.substring(0, 80) + '...';
+  }
+
+  const wordFreq = {};
+  for (const w of words) {
+    const lower = w.toLowerCase();
+    if (!STOP_WORDS.has(lower) && lower.length > 1) {
+      wordFreq[lower] = (wordFreq[lower] || 0) + 1;
+    }
+  }
+
+  const topWords = Object.entries(wordFreq)
+    .sort((a, b) => b[1] - a[1])
+    .slice(0, 10)
+    .map(([word, count]) => ({ word, count }));
+
+  return {
+    wordCount,
+    sentenceCount,
+    paragraphCount,
+    fleschEase,
+    fleschGrade,
+    readabilityLabel,
+    readingTime,
+    speakingTime,
+    uniqueWordCount,
+    lexicalDiversity,
+    avgSentenceLength,
+    longestSentence,
+    longestSentenceLength,
+    topWords,
+  };
 }
 
 module.exports = { analyze };

src/command-palette.js

@@ -1,109 +1,113 @@
 class CommandPalette {
-    constructor() {
-        this.overlay = document.getElementById('command-palette-overlay');
-        this.input = document.getElementById('command-palette-input');
-        this.results = document.getElementById('command-palette-results');
-        this.commands = [];
-        this.selectedIndex = 0;
-        this.filteredCommands = [];
-        this.setupEventListeners();
-    }
+  constructor() {
+    this.overlay = document.getElementById('command-palette-overlay');
+    this.input = document.getElementById('command-palette-input');
+    this.results = document.getElementById('command-palette-results');
+    this.commands = [];
+    this.selectedIndex = 0;
+    this.filteredCommands = [];
+    this.setupEventListeners();
+  }
 
-    register(label, shortcut, action) {
-        this.commands.push({ label, shortcut, action });
-    }
+  register(label, shortcut, action) {
+    this.commands.push({ label, shortcut, action });
+  }
 
-    open() {
-        this.overlay.classList.remove('hidden');
-        this.input.value = '';
-        this.input.focus();
-        this.selectedIndex = 0;
-        this.renderResults('');
-    }
+  open() {
+    this.overlay.classList.remove('hidden');
+    this.input.value = '';
+    this.input.focus();
+    this.selectedIndex = 0;
+    this.renderResults('');
+  }
 
-    close() {
-        this.overlay.classList.add('hidden');
-    }
+  close() {
+    this.overlay.classList.add('hidden');
+  }
 
-    isOpen() {
-        return !this.overlay.classList.contains('hidden');
-    }
+  isOpen() {
+    return !this.overlay.classList.contains('hidden');
+  }
 
-    setupEventListeners() {
-        this.input.addEventListener('input', () => {
-            this.selectedIndex = 0;
-            this.renderResults(this.input.value);
-        });
+  setupEventListeners() {
+    this.input.addEventListener('input', () => {
+      this.selectedIndex = 0;
+      this.renderResults(this.input.value);
+    });
 
-        this.overlay.addEventListener('click', (e) => {
-            if (e.target === this.overlay) this.close();
-        });
+    this.overlay.addEventListener('click', (e) => {
+      if (e.target === this.overlay) this.close();
+    });
 
-        this.input.addEventListener('keydown', (e) => {
-            if (e.key === 'Escape') {
-                e.preventDefault();
-                this.close();
-            } else if (e.key === 'Enter') {
-                e.preventDefault();
-                this.executeSelected();
-            } else if (e.key === 'ArrowDown') {
-                e.preventDefault();
-                this.selectedIndex = Math.min(this.selectedIndex + 1, this.filteredCommands.length - 1);
-                this.updateSelection();
-            } else if (e.key === 'ArrowUp') {
-                e.preventDefault();
-                this.selectedIndex = Math.max(this.selectedIndex - 1, 0);
-                this.updateSelection();
-            }
-        });
-    }
+    this.input.addEventListener('keydown', (e) => {
+      if (e.key === 'Escape') {
+        e.preventDefault();
+        this.close();
+      } else if (e.key === 'Enter') {
+        e.preventDefault();
+        this.executeSelected();
+      } else if (e.key === 'ArrowDown') {
+        e.preventDefault();
+        this.selectedIndex = Math.min(this.selectedIndex + 1, this.filteredCommands.length - 1);
+        this.updateSelection();
+      } else if (e.key === 'ArrowUp') {
+        e.preventDefault();
+        this.selectedIndex = Math.max(this.selectedIndex - 1, 0);
+        this.updateSelection();
+      }
+    });
+  }
 
-    renderResults(query) {
-        this.filteredCommands = query
-            ? this.commands.filter(cmd => cmd.label.toLowerCase().includes(query.toLowerCase()))
-            : [...this.commands];
+  renderResults(query) {
+    this.filteredCommands = query
+      ? this.commands.filter((cmd) => cmd.label.toLowerCase().includes(query.toLowerCase()))
+      : [...this.commands];
 
-        this.results.innerHTML = this.filteredCommands.map((cmd, i) => `
+    this.results.innerHTML = this.filteredCommands
+      .map(
+        (cmd, i) => `
             <div class="command-item ${i === this.selectedIndex ? 'selected' : ''}" data-index="${i}">
                 <span class="command-label">${this.highlightMatch(cmd.label, query)}</span>
                 ${cmd.shortcut ? `<span class="command-shortcut">${cmd.shortcut}</span>` : ''}
             </div>
-        `).join('');
+        `
+      )
+      .join('');
 
-        this.results.querySelectorAll('.command-item').forEach((el) => {
-            el.addEventListener('click', () => {
-                const idx = parseInt(el.dataset.index);
-                this.filteredCommands[idx].action();
-                this.close();
-            });
-            el.addEventListener('mouseenter', () => {
-                this.selectedIndex = parseInt(el.dataset.index);
-                this.updateSelection();
-            });
-        });
-    }
+    this.results.querySelectorAll('.command-item').forEach((el) => {
+      el.addEventListener('click', () => {
+        const idx = parseInt(el.dataset.index);
+        this.filteredCommands[idx].action();
+        this.close();
+      });
+      el.addEventListener('mouseenter', () => {
+        this.selectedIndex = parseInt(el.dataset.index);
+        this.updateSelection();
+      });
+    });
+  }
 
-    highlightMatch(text, query) {
-        if (!query) return text;
-        const regex = new RegExp(`(${query.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')})`, 'gi');
-        return text.replace(regex, '<strong>$1</strong>');
-    }
+  highlightMatch(text, query) {
+    if (!query) return text;
+    const regex = new RegExp(`(${query.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')})`, 'gi');
+    return text.replace(regex, '<strong>$1</strong>');
+  }
 
-    updateSelection() {
-        this.results.querySelectorAll('.command-item').forEach((el, i) => {
-            el.classList.toggle('selected', i === this.selectedIndex);
-        });
-        // Scroll selected into view
-        const selected = this.results.querySelector('.command-item.selected');
-        if (selected) selected.scrollIntoView({ block: 'nearest' });
-    }
+  updateSelection() {
+    this.results.querySelectorAll('.command-item').forEach((el, i) => {
+      el.classList.toggle('selected', i === this.selectedIndex);
+    });
+    // Scroll selected into view
+    const selected = this.results.querySelector('.command-item.selected');
+    if (selected) selected.scrollIntoView({ block: 'nearest' });
+  }
 
-    executeSelected() {
-        if (this.filteredCommands[this.selectedIndex]) {
-            this.filteredCommands[this.selectedIndex].action();
-            this.close();
-        }
+  executeSelected() {
+    if (this.filteredCommands[this.selectedIndex]) {
+      this.filteredCommands[this.selectedIndex].action();
+      this.close();
     }
+  }
 }
 
 module.exports = { CommandPalette };

src/editor/codemirror-setup.js

@@ -8,44 +8,84 @@ const {
   highlightActiveLine,
   drawSelection,
 } = require('@codemirror/view');
-const { EditorState } = require('@codemirror/state');
+const { EditorState, Compartment } = require('@codemirror/state');
 const { markdown, markdownLanguage } = require('@codemirror/lang-markdown');
 // Language extensions loaded lazily on first use
 let _javascript, _html, _css, _json, _python;
-const {
-  defaultKeymap,
-  history,
-  historyKeymap,
-  indentWithTab,
-} = require('@codemirror/commands');
-const {
-  searchKeymap,
-  highlightSelectionMatches,
-} = require('@codemirror/search');
-const {
-  autocompletion,
-  completionKeymap,
-} = require('@codemirror/autocomplete');
-const {
-  bracketMatching,
-  foldGutter,
-  indentOnInput,
-} = require('@codemirror/language');
+const { defaultKeymap, history, historyKeymap, indentWithTab } = require('@codemirror/commands');
+const { searchKeymap, highlightSelectionMatches } = require('@codemirror/search');
+const { autocompletion, completionKeymap } = require('@codemirror/autocomplete');
+const { bracketMatching, foldGutter, indentOnInput } = require('@codemirror/language');
 const { oneDark } = require('@codemirror/theme-one-dark');
 
+// Compartments allow toggling features (vim mode) on a live editor without
+// recreating the view — CodeMirror 6's intended mechanism for reconfiguration.
+const vimCompartment = new Compartment();
+// Vim is loaded lazily: most users never enable it, and the module is heavy.
+let _vimExtension = null;
+function getVimExtension() {
+  if (!_vimExtension) {
+    _vimExtension = require('@replit/codemirror-vim').vim();
+  }
+  return _vimExtension;
+}
+
+/**
+ * Toggle vim keybindings on an editor created by createEditor.
+ * @param {EditorView} view
+ * @param {boolean} enabled
+ */
+function setVimMode(view, enabled) {
+  if (!view) return;
+  view.dispatch({
+    effects: vimCompartment.reconfigure(enabled ? getVimExtension() : []),
+  });
+}
+
 // Custom theme for JetBrains Mono font
 const jetBrainsMonoTheme = EditorView.theme({
   '&': {
-    fontFamily: "'JetBrains Mono', 'Fira Code', 'SF Mono', Monaco, 'Courier New', monospace"
+    fontFamily: "'JetBrains Mono', 'Fira Code', 'SF Mono', Monaco, 'Courier New', monospace",
   },
   '.cm-content': {
-    fontFamily: 'inherit'
+    fontFamily: 'inherit',
   },
   '.cm-scroller': {
-    fontFamily: 'inherit'
-  }
+    fontFamily: 'inherit',
+  },
 });
 
+/**
+ * Build the Tab keymap entry that expands snippets before falling through to
+ * indent. `getExpansion(prefix)` is synchronous and returns the replacement
+ * text (or null to decline), letting the host keep its snippets in a Map.
+ */
+function snippetTabKeymap(getExpansion) {
+  return {
+    key: 'Tab',
+    run: (view) => {
+      if (typeof getExpansion !== 'function') return false;
+      const { head } = view.state.selection.main;
+      const line = view.state.doc.lineAt(head);
+      // Word-before-cursor: letters, digits, underscore and hyphen
+      const before = line.text.slice(0, head - line.from);
+      const match = /[\w-]+$/.exec(before);
+      if (!match) return false;
+      const expansion = getExpansion(match[0].toLowerCase());
+      if (typeof expansion !== 'string') return false;
+      view.dispatch({
+        changes: {
+          from: head - match[0].length,
+          to: head,
+          insert: expansion,
+        },
+        selection: { anchor: head - match[0].length + expansion.length },
+      });
+      return true;
+    },
+  };
+}
+
 /**
  * Create a CodeMirror 6 editor instance.
  *
@@ -56,15 +96,31 @@ const jetBrainsMonoTheme = EditorView.theme({
  * @param {Function} options.onUpdate       - called with the EditorView on every update (selection, doc change, etc.)
  * @param {boolean} options.isDark           - apply oneDark theme when true (default false)
  * @param {boolean} options.showLineNumbers  - show line-number gutter (default true)
+ * @param {boolean} options.vimMode          - start with vim keybindings (default false; toggle later via setVimMode)
+ * @param {Function} options.getTabExpansion - (prefix)=>string|null; Tab expands a matching snippet (default null)
  * @returns {EditorView} the created editor view
  */
 function createEditor(parentElement, options = {}) {
+  console.log(
+    '[createEditor] Called with parentElement:',
+    parentElement?.id,
+    'dimensions:',
+    parentElement?.clientWidth,
+    'x',
+    parentElement?.clientHeight
+  );
+  if (!parentElement) {
+    console.error('[createEditor] ERROR: parentElement is null or undefined!');
+    return null;
+  }
   const {
     content = '',
     onChange = () => {},
     onUpdate = null,
     isDark = false,
     showLineNumbers = true,
+    vimMode = false,
+    getTabExpansion = null,
   } = options;
 
   const extensions = [
@@ -78,13 +134,16 @@ function createEditor(parentElement, options = {}) {
     autocompletion(),
     foldGutter(),
     jetBrainsMonoTheme,
+    // Snippet Tab expansion must precede indentWithTab so it wins when matched
     keymap.of([
+      ...(getTabExpansion ? [snippetTabKeymap(getTabExpansion)] : []),
       ...defaultKeymap,
       ...historyKeymap,
       ...searchKeymap,
       ...completionKeymap,
       indentWithTab,
     ]),
+    vimCompartment.of(vimMode ? getVimExtension() : []),
     EditorView.updateListener.of((update) => {
       if (update.docChanged) {
         onChange(update.state.doc.toString());
@@ -120,11 +179,26 @@ function createEditor(parentElement, options = {}) {
  */
 function getLanguageExtension(lang) {
   const loaders = {
-    javascript: () => { if (!_javascript) _javascript = require('@codemirror/lang-javascript').javascript; return _javascript(); },
-    html: () => { if (!_html) _html = require('@codemirror/lang-html').html; return _html(); },
-    css: () => { if (!_css) _css = require('@codemirror/lang-css').css; return _css(); },
-    json: () => { if (!_json) _json = require('@codemirror/lang-json').json; return _json(); },
-    python: () => { if (!_python) _python = require('@codemirror/lang-python').python; return _python(); },
+    javascript: () => {
+      if (!_javascript) _javascript = require('@codemirror/lang-javascript').javascript;
+      return _javascript();
+    },
+    html: () => {
+      if (!_html) _html = require('@codemirror/lang-html').html;
+      return _html();
+    },
+    css: () => {
+      if (!_css) _css = require('@codemirror/lang-css').css;
+      return _css();
+    },
+    json: () => {
+      if (!_json) _json = require('@codemirror/lang-json').json;
+      return _json();
+    },
+    python: () => {
+      if (!_python) _python = require('@codemirror/lang-python').python;
+      return _python();
+    },
     markdown: () => markdown({ base: markdownLanguage }),
   };
   loaders.js = loaders.javascript;
@@ -134,4 +208,4 @@ function getLanguageExtension(lang) {
   return loader ? loader() : markdown({ base: markdownLanguage });
 }
 
-module.exports = { createEditor, getLanguageExtension };
+module.exports = { createEditor, getLanguageExtension, setVimMode, snippetTabKeymap };

src/fonts.css

@@ -2,74 +2,91 @@
 
 /* Inter Font Family */
 @font-face {
-    font-family: 'Inter';
-    font-style: normal;
-    font-weight: 300;
-    font-display: swap;
-    src: url('../assets/fonts/Inter-Light.woff2') format('woff2');
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url('../assets/fonts/Inter-Light.woff2') format('woff2');
 }
 
 @font-face {
-    font-family: 'Inter';
-    font-style: normal;
-    font-weight: 400;
-    font-display: swap;
-    src: url('../assets/fonts/Inter-Regular.woff2') format('woff2');
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url('../assets/fonts/Inter-Regular.woff2') format('woff2');
 }
 
 @font-face {
-    font-family: 'Inter';
-    font-style: normal;
-    font-weight: 500;
-    font-display: swap;
-    src: url('../assets/fonts/Inter-Medium.woff2') format('woff2');
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url('../assets/fonts/Inter-Medium.woff2') format('woff2');
 }
 
 @font-face {
-    font-family: 'Inter';
-    font-style: normal;
-    font-weight: 600;
-    font-display: swap;
-    src: url('../assets/fonts/Inter-SemiBold.woff2') format('woff2');
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 600;
+  font-display: swap;
+  src: url('../assets/fonts/Inter-SemiBold.woff2') format('woff2');
 }
 
 @font-face {
-    font-family: 'Inter';
-    font-style: normal;
-    font-weight: 700;
-    font-display: swap;
-    src: url('../assets/fonts/Inter-Bold.woff2') format('woff2');
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url('../assets/fonts/Inter-Bold.woff2') format('woff2');
 }
 
 /* JetBrains Mono Font Family - For code, markdown editor, and ASCII art */
 @font-face {
-    font-family: 'JetBrains Mono';
-    font-style: normal;
-    font-weight: 400;
-    font-display: swap;
-    src: url('../assets/fonts/JetBrainsMono-Regular.woff2') format('woff2');
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url('../assets/fonts/JetBrainsMono-Regular.woff2') format('woff2');
 }
 
 @font-face {
-    font-family: 'JetBrains Mono';
-    font-style: normal;
-    font-weight: 500;
-    font-display: swap;
-    src: url('../assets/fonts/JetBrainsMono-Medium.woff2') format('woff2');
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url('../assets/fonts/JetBrainsMono-Medium.woff2') format('woff2');
 }
 
 @font-face {
-    font-family: 'JetBrains Mono';
-    font-style: normal;
-    font-weight: 600;
-    font-display: swap;
-    src: url('../assets/fonts/JetBrainsMono-SemiBold.woff2') format('woff2');
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 600;
+  font-display: swap;
+  src: url('../assets/fonts/JetBrainsMono-SemiBold.woff2') format('woff2');
 }
 
 @font-face {
-    font-family: 'JetBrains Mono';
-    font-style: normal;
-    font-weight: 700;
-    font-display: swap;
-    src: url('../assets/fonts/JetBrainsMono-Bold.woff2') format('woff2');
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url('../assets/fonts/JetBrainsMono-Bold.woff2') format('woff2');
+}
+
+/* Fira Code Font Family - bundled with the app */
+@font-face {
+  font-family: 'Fira Code';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url('../assets/fonts/FiraCode-Regular.ttf') format('truetype');
+}
+
+@font-face {
+  font-family: 'Fira Code';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url('../assets/fonts/FiraCode-Bold.ttf') format('truetype');
 }

src/main/AiProviders.js

@@ -0,0 +1,264 @@
+/**
+ * AI provider adapters for the AI Assistant plugin (main process side).
+ *
+ * All network calls happen here in the main process, never in the renderer:
+ *   - the renderer's CSP does not need to whitelist AI endpoints
+ *   - API keys never cross the IPC boundary into the renderer
+ *   - every provider gets the same timeout/size/error sanitization rules
+ *
+ * Supported providers:
+ *   - `openai`           → https://api.openai.com/v1 (chat completions)
+ *   - `anthropic`        → https://api.anthropic.com (messages API)
+ *   - `ollama`           → http://localhost:11434/v1 (OpenAI-compatible)
+ *   - `lmstudio`         → http://localhost:1234/v1 (OpenAI-compatible)
+ *   - `openai-compatible`→ any baseUrl speaking the OpenAI chat schema
+ *   - `anthropic-compatible` → any baseUrl speaking the Anthropic messages
+ *     schema (LiteLLM proxies, Bedrock gateways, local Claude-compatible
+ *     servers); baseUrl is required, the API key is optional because many
+ *     proxies are keyless or front their own auth
+ *
+ * The module takes an injectable `fetchImpl` (defaulting to global fetch) so
+ * tests can stub the network without monkey-patching.
+ *
+ * @module AiProviders
+ */
+
+/* global AbortController */
+
+// Hard caps shared by every provider: a runaway selection (or a hostile
+// plugin caller) must not be able to push a 50MB "prompt" at an API.
+const MAX_PROMPT_CHARS = 200 * 1024;
+const DEFAULT_TIMEOUT_MS = 120000;
+
+// Sensible defaults per provider; every field is overridable via settings.
+const PROVIDER_DEFAULTS = {
+  openai: { baseUrl: 'https://api.openai.com/v1', defaultModel: 'gpt-4o-mini' },
+  anthropic: { baseUrl: 'https://api.anthropic.com', defaultModel: 'claude-3-5-sonnet-latest' },
+  ollama: { baseUrl: 'http://localhost:11434/v1', defaultModel: 'llama3.1' },
+  lmstudio: { baseUrl: 'http://localhost:1234/v1', defaultModel: 'local-model' },
+  'openai-compatible': { baseUrl: '', defaultModel: '' },
+  'anthropic-compatible': { baseUrl: '', defaultModel: 'claude-3-5-sonnet-latest' },
+};
+
+/** Provider ids that speak the OpenAI chat-completions schema. */
+const OPENAI_STYLE = new Set(['openai', 'ollama', 'lmstudio', 'openai-compatible']);
+
+class AiProviderError extends Error {
+  /**
+   * @param {string} message User-safe message (never include keys or raw HTML)
+   * @param {string} code Machine-readable code for the renderer
+   */
+  constructor(message, code) {
+    super(message);
+    this.name = 'AiProviderError';
+    this.code = code;
+  }
+}
+
+/**
+ * Validate and normalize a completion request shared by all providers.
+ * @returns {{provider:string, baseUrl:string, apiKey:string, model:string,
+ *            temperature:number}} resolved settings
+ * @throws {AiProviderError} on unknown provider / missing key / bad URL
+ */
+function resolveSettings({
+  provider,
+  baseUrl,
+  apiKey,
+  model,
+  temperature,
+  requireKey = true,
+} = {}) {
+  const defaults = PROVIDER_DEFAULTS[provider];
+  if (!defaults) {
+    throw new AiProviderError(
+      `Unknown AI provider "${provider}". Configure the AI Assistant plugin first.`,
+      'not_configured'
+    );
+  }
+
+  // Local providers (ollama/lmstudio) and self-hosted *-compatible proxies
+  // don't need a key; branded cloud endpoints do.
+  const needsKey =
+    requireKey &&
+    provider !== 'ollama' &&
+    provider !== 'lmstudio' &&
+    provider !== 'anthropic-compatible';
+  if (needsKey && !apiKey) {
+    throw new AiProviderError(
+      `The "${provider}" provider needs an API key. Add one in AI Assistant settings.`,
+      'missing_key'
+    );
+  }
+
+  // Only allow http(s) base URLs to avoid file:// and other exotic schemes
+  const resolvedBase = (baseUrl || defaults.baseUrl || '').replace(/\/+$/, '');
+  if (!/^https?:\/\//.test(resolvedBase)) {
+    throw new AiProviderError(`Invalid API base URL for provider "${provider}".`, 'bad_base_url');
+  }
+
+  return {
+    provider,
+    baseUrl: resolvedBase,
+    apiKey: apiKey || '',
+    model: model || defaults.defaultModel,
+    temperature: typeof temperature === 'number' ? Math.max(0, Math.min(2, temperature)) : 0.7,
+  };
+}
+
+/**
+ * Call a chat-completion style provider (OpenAI schema).
+ * @returns {Promise<string>} assistant message text
+ */
+async function callOpenAiStyle(settings, { system, messages }, fetchImpl, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const body = {
+      model: settings.model,
+      temperature: settings.temperature,
+      messages: [
+        ...(system ? [{ role: 'system', content: system }] : []),
+        ...messages.map((m) => ({ role: m.role, content: m.content })),
+      ],
+    };
+    const headers = { 'Content-Type': 'application/json' };
+    // Local servers accept (and ignore) bearer keys; harmless to send always
+    if (settings.apiKey) headers.Authorization = `Bearer ${settings.apiKey}`;
+
+    const response = await fetchImpl(`${settings.baseUrl}/chat/completions`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(body),
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      throw new AiProviderError(
+        `AI request failed (HTTP ${response.status}). Check the model name, API key, and base URL.`,
+        `http_${response.status}`
+      );
+    }
+    const data = await response.json();
+    const text = data?.choices?.[0]?.message?.content;
+    if (typeof text !== 'string') {
+      throw new AiProviderError(
+        'AI provider returned an unexpected response shape.',
+        'bad_response'
+      );
+    }
+    return text;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Call Anthropic's messages API.
+ * @returns {Promise<string>} first text block of the reply
+ */
+async function callAnthropic(settings, { system, messages }, fetchImpl, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    // Anthropic splits system prompts out of the message list
+    const body = {
+      model: settings.model,
+      max_tokens: 4096,
+      temperature: settings.temperature,
+      system: system || undefined,
+      messages: messages.map((m) => ({ role: m.role, content: m.content })),
+    };
+    const headers = {
+      'Content-Type': 'application/json',
+      'anthropic-version': '2023-06-01',
+    };
+    if (settings.apiKey) {
+      // Official API keys travel via x-api-key; many compatible gateways
+      // (LiteLLM proxies, Bedrock fronts) expect a Bearer token instead.
+      // Sending both is harmless for the official endpoint and maximizes
+      // proxy compatibility.
+      headers['x-api-key'] = settings.apiKey;
+      headers.Authorization = `Bearer ${settings.apiKey}`;
+    }
+    // Bases may or may not already carry the /v1 prefix — handle both so a
+    // "http://host:4000" proxy base and an "http://host:4000/v1" style base
+    // both land on a single /v1/messages path.
+    const messagesUrl = settings.baseUrl.endsWith('/v1')
+      ? `${settings.baseUrl}/messages`
+      : `${settings.baseUrl}/v1/messages`;
+    const response = await fetchImpl(messagesUrl, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(body),
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      throw new AiProviderError(
+        `AI request failed (HTTP ${response.status}). Check the model name, API key, and base URL.`,
+        `http_${response.status}`
+      );
+    }
+    const data = await response.json();
+    const text = Array.isArray(data?.content)
+      ? data.content
+          .filter((b) => b.type === 'text')
+          .map((b) => b.text)
+          .join('')
+      : '';
+    if (!text) {
+      throw new AiProviderError(
+        'AI provider returned an unexpected response shape.',
+        'bad_response'
+      );
+    }
+    return text;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Run a chat completion against the configured provider.
+ *
+ * @param {object} request - { provider, baseUrl, apiKey, model, temperature,
+ *                            system, messages: [{role, content}] }
+ * @param {object} [options] - { fetchImpl, timeoutMs }
+ * @returns {Promise<{content: string}>}
+ * @throws {AiProviderError} with user-safe messages (code field for UI logic)
+ */
+async function complete(request, options = {}) {
+  const fetchImpl = options.fetchImpl || global.fetch;
+  if (typeof fetchImpl !== 'function') {
+    throw new AiProviderError('No fetch implementation available.', 'no_fetch');
+  }
+  const timeoutMs = options.timeoutMs || DEFAULT_TIMEOUT_MS;
+
+  if (!Array.isArray(request?.messages) || request.messages.length === 0) {
+    throw new AiProviderError('No messages provided.', 'no_messages');
+  }
+  const totalChars =
+    (request.system?.length || 0) +
+    request.messages.reduce((n, m) => n + (m?.content?.length || 0), 0);
+  if (totalChars > MAX_PROMPT_CHARS) {
+    throw new AiProviderError(
+      'Prompt is too large (over 200KB). Try a smaller selection.',
+      'prompt_too_large'
+    );
+  }
+
+  const settings = resolveSettings(request);
+  if (OPENAI_STYLE.has(settings.provider)) {
+    const content = await callOpenAiStyle(settings, request, fetchImpl, timeoutMs);
+    return { content };
+  }
+  const content = await callAnthropic(settings, request, fetchImpl, timeoutMs);
+  return { content };
+}
+
+module.exports = {
+  complete,
+  resolveSettings,
+  AiProviderError,
+  PROVIDER_DEFAULTS,
+  MAX_PROMPT_CHARS,
+};

src/main/AudioOperations.js

@@ -0,0 +1,171 @@
+/**
+ * Audio Operations Module
+ *
+ * Handles audio manipulation via `ffmpeg`: format conversion, trim, extract (audio
+ * track from video/audio), and merge (concat demuxer). Because ffmpeg is an external
+ * binary, this module is split into pure/testable argument-builder functions and a
+ * single `executeOperation` that is the only piece which actually spawns ffmpeg —
+ * the ffmpeg binary path and the `execFile` implementation are both injected so tests
+ * can replace them with fakes, without invoking a real binary.
+ *
+ * @module AudioOperations
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFile } = require('child_process');
+
+/**
+ * Build args for a straight format conversion. ffmpeg infers the output format from
+ * outputPath's extension; only pass -f explicitly when format is given and differs
+ * from that extension.
+ */
+function buildConvertArgs({ inputPath, outputPath, format }) {
+  const args = ['-i', inputPath, '-y'];
+
+  if (format) {
+    const ext = path.extname(outputPath).replace(/^\./, '').toLowerCase();
+    if (format.toLowerCase() !== ext) {
+      args.push('-f', format);
+    }
+  }
+
+  args.push(outputPath);
+  return args;
+}
+
+/**
+ * Build args to trim inputPath to [startTime, startTime + duration) seconds.
+ * startTime/duration must be finite, non-negative numbers — they become argv
+ * elements passed straight to execFile with no shell involved, so there's no
+ * injection risk, but malformed values should still fail fast rather than reach
+ * ffmpeg with garbage.
+ */
+function buildTrimArgs({ inputPath, outputPath, startTime, duration }) {
+  const isValid = (n) => typeof n === 'number' && Number.isFinite(n) && n >= 0;
+
+  if (!isValid(startTime) || !isValid(duration)) {
+    throw new Error('Invalid trim range');
+  }
+
+  return ['-i', inputPath, '-ss', String(startTime), '-t', String(duration), '-y', outputPath];
+}
+
+/**
+ * Build args to extract the audio track (stream copy, no video, no re-encode).
+ * If codec copy fails, executeOperation's 'extract' case retries without -acodec copy.
+ */
+function buildExtractArgs({ inputPath, outputPath }) {
+  return ['-i', inputPath, '-vn', '-acodec', 'copy', '-y', outputPath];
+}
+
+/**
+ * Fallback extract args that let ffmpeg transcode instead of stream-copying.
+ */
+function buildExtractFallbackArgs({ inputPath, outputPath }) {
+  return ['-i', inputPath, '-vn', '-y', outputPath];
+}
+
+/**
+ * Build args to merge 2+ files via the concat demuxer. Returns both concatListContent
+ * (the `file '<path>'` lines the caller writes to a temp list file) and args — the
+ * caller doesn't know the temp list file's path until it creates it, so tempListPath
+ * is an optional param: executeOperation's 'merge' case calls this once to obtain
+ * concatListContent, writes it to disk, then calls it again with the real
+ * tempListPath to obtain the final args referencing that file.
+ */
+function buildMergeArgs({ inputPaths, outputPath, tempListPath = null }) {
+  if (!Array.isArray(inputPaths) || inputPaths.length < 2) {
+    throw new Error('inputPaths must contain at least 2 files');
+  }
+
+  const concatListContent = inputPaths.map((p) => `file '${p}'`).join('\n') + '\n';
+
+  const args = ['-f', 'concat', '-safe', '0', '-i', tempListPath, '-c', 'copy', '-y', outputPath];
+
+  return { args, concatListContent };
+}
+
+/**
+ * Run ffmpeg with the given args via the injected execFileFn, wrapped in a Promise.
+ */
+function runFfmpeg(ffmpegPath, args, execFileFn) {
+  return new Promise((resolve, reject) => {
+    execFileFn(ffmpegPath, args, { maxBuffer: 10 * 1024 * 1024 }, (error, stdout, stderr) => {
+      if (error) {
+        reject(new Error(stderr || error.message));
+        return;
+      }
+      resolve();
+    });
+  });
+}
+
+async function executeOperation(operation, data, { ffmpegPath, execFileFn } = {}) {
+  const resolvedFfmpegPath = ffmpegPath || 'ffmpeg';
+  const resolvedExecFileFn = execFileFn || execFile;
+
+  switch (operation) {
+    case 'convert': {
+      const { inputPath, outputPath, format } = data || {};
+      const args = buildConvertArgs({ inputPath, outputPath, format });
+      await runFfmpeg(resolvedFfmpegPath, args, resolvedExecFileFn);
+      return { success: true, outputPath };
+    }
+
+    case 'trim': {
+      const { inputPath, outputPath, startTime, duration } = data || {};
+      const args = buildTrimArgs({ inputPath, outputPath, startTime, duration });
+      await runFfmpeg(resolvedFfmpegPath, args, resolvedExecFileFn);
+      return { success: true, outputPath };
+    }
+
+    case 'extract': {
+      const { inputPath, outputPath } = data || {};
+      try {
+        const args = buildExtractArgs({ inputPath, outputPath });
+        await runFfmpeg(resolvedFfmpegPath, args, resolvedExecFileFn);
+      } catch {
+        // Codec copy can fail when the source audio codec isn't valid in the target
+        // container — fall back to letting ffmpeg transcode instead.
+        const fallbackArgs = buildExtractFallbackArgs({ inputPath, outputPath });
+        await runFfmpeg(resolvedFfmpegPath, fallbackArgs, resolvedExecFileFn);
+      }
+      return { success: true, outputPath };
+    }
+
+    case 'merge': {
+      const { inputPaths, outputPath } = data || {};
+      const { concatListContent } = buildMergeArgs({ inputPaths, outputPath });
+
+      const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'audio-merge-'));
+      const tempListPath = path.join(tempDir, 'concat-list.txt');
+
+      try {
+        fs.writeFileSync(tempListPath, concatListContent, 'utf8');
+        const { args } = buildMergeArgs({ inputPaths, outputPath, tempListPath });
+        await runFfmpeg(resolvedFfmpegPath, args, resolvedExecFileFn);
+      } finally {
+        try {
+          fs.rmSync(tempDir, { recursive: true, force: true });
+        } catch {
+          /* best-effort cleanup */
+        }
+      }
+
+      return { success: true, outputPath };
+    }
+
+    default:
+      throw new Error(`Unknown operation: ${operation}`);
+  }
+}
+
+module.exports = {
+  executeOperation,
+  buildConvertArgs,
+  buildTrimArgs,
+  buildExtractArgs,
+  buildMergeArgs,
+};

src/main/DocxFontEmbedder.js

@@ -0,0 +1,126 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const JSZip = require('jszip');
+
+const REL_NS = 'http://schemas.openxmlformats.org/package/2006/relationships';
+
+function generatedRId(idx) {
+  return `rIdFont${idx}`;
+}
+
+async function patchZipWithFonts(inputPath, fonts) {
+  const buf = fs.readFileSync(inputPath);
+  const zip = await JSZip.loadAsync(buf);
+  const existingFontNames = new Set();
+
+  // Detect prior embeds (idempotency: skip TTF files already present).
+  for (const f of Object.keys(zip.files)) {
+    if (zip.files[f].name && /^word\/fonts\//.test(zip.files[f].name)) {
+      existingFontNames.add(path.basename(f));
+    }
+  }
+
+  for (let i = 0; i < fonts.length; i++) {
+    const { path: fontPath } = fonts[i];
+    const fname = path.basename(fontPath);
+    const wordPath = `word/fonts/${fname}`;
+    if (!existingFontNames.has(fname)) {
+      zip.file(wordPath, fs.readFileSync(fontPath));
+      existingFontNames.add(fname);
+    }
+  }
+
+  // Build/replace word/fontTable.xml so Word knows the family and where to
+  // fetch the embedded TTF data.
+  const fontTableXml =
+    `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n` +
+    `<w:fonts xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/main">\n` +
+    fonts
+      .map(
+        (f, i) =>
+          `  <w:font w:name="${f.family}"><w:embedRegular r:id="${generatedRId(i)}" xmlns:r="${REL_NS}"/></w:font>`
+      )
+      .join('\n') +
+    `\n</w:fonts>\n`;
+
+  zip.file('word/fontTable.xml', fontTableXml);
+
+  // Patch [Content_Types].xml — add Override for /word/fontTable.xml and each TTF.
+  const ctPath = '[Content_Types].xml';
+  let ct = await zip.file(ctPath).async('string');
+  if (!ct.includes('PartName="/word/fontTable.xml"')) {
+    ct = ct.replace(
+      '</Types>',
+      '<Override PartName="/word/fontTable.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.fontTable+xml"/></Types>'
+    );
+  }
+  for (const f of fonts) {
+    const ttfCt = 'application/x-font-ttf';
+    const filePart = `/word/fonts/${path.basename(f.path)}`;
+    if (!ct.includes(`PartName="${filePart}"`)) {
+      ct = ct.replace(
+        '</Types>',
+        `<Override PartName="${filePart}" ContentType="${ttfCt}"/></Types>`
+      );
+    }
+  }
+  if (!ct.includes('Default Extension="ttf"')) {
+    ct = ct.replace(
+      '</Types>',
+      '<Default Extension="ttf" ContentType="application/x-font-ttf"/></Types>'
+    );
+  }
+  zip.file(ctPath, ct);
+
+  // Patch word/_rels/document.xml.rels — relationships for fontTable + each font.
+  const relsPath = 'word/_rels/document.xml.rels';
+  if (!zip.files[relsPath]) {
+    zip.file(
+      relsPath,
+      `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<Relationships xmlns="${REL_NS}"/>`
+    );
+  }
+  let rels = await zip.file(relsPath).async('string');
+  if (!rels.includes('fontTable.xml')) {
+    rels = rels.replace(
+      '</Relationships>',
+      `<Relationship Id="${generatedRId(fonts.length)}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/fontTable" Target="fontTable.xml"/></Relationships>`
+    );
+  }
+  for (let i = 0; i < fonts.length; i++) {
+    const fname = path.basename(fonts[i].path);
+    if (!rels.includes(fname)) {
+      rels = rels.replace(
+        '</Relationships>',
+        `<Relationship Id="${generatedRId(i)}" Type="http://schemas.microsoft.com/office/2011/relationships/font" Target="fonts/${fname}"/></Relationships>`
+      );
+    }
+  }
+  zip.file(relsPath, rels);
+
+  // Patch word/styles.xml — bind SourceCode/VerbatimChar styles to the family.
+  const stylesPath = 'word/styles.xml';
+  if (zip.files[stylesPath]) {
+    let styles = await zip.file(stylesPath).async('string');
+    const family = fonts[0].family;
+    if (!styles.includes(`w:ascii="${family}"`)) {
+      styles = styles.replace(
+        /(<w:style[^>]*w:styleId="(?:SourceCode|VerbatimChar)"[^>]*>)/,
+        `$1<w:rPr><w:rFonts w:ascii="${family}" w:hAnsi="${family}" w:cs="${family}"/></w:rPr>`
+      );
+    }
+    zip.file(stylesPath, styles);
+  }
+
+  const outBuf = await zip.generateAsync({ type: 'nodebuffer' });
+  fs.writeFileSync(inputPath, outBuf);
+  return inputPath;
+}
+
+async function embed(docxPath, fonts) {
+  return patchZipWithFonts(docxPath, fonts);
+}
+
+module.exports = { embed };

src/main/EpubFontEmbedder.js

@@ -0,0 +1,44 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const JSZip = require('jszip');
+
+// Patches an EPUB produced by pandoc so it embeds the supplied TTF font files
+// inside the OEBPS and registers them in the OPF manifest. Used after
+// `pandoc --epub-embed-font=...` runs (which embeds the font data) but does
+// not always add the manifest item we need for readers to discover the font.
+//
+// Writes a new file at `${epubPath}.patched.epub` and returns the patched path.
+// Caller should overwrite the original after a successful export.
+async function patchManifest(epubPath, fonts) {
+  const zip = await JSZip.loadAsync(fs.readFileSync(epubPath));
+  const opfPath = Object.keys(zip.files).find((f) => f.endsWith('content.opf'));
+  if (!opfPath) throw new Error('EPUB has no content.opf');
+  let opf = await zip.file(opfPath).async('string');
+
+  for (const { path: fontPath, family, weight } of fonts) {
+    const filename = path.basename(fontPath);
+    const inFontDir = `OEBPS/fonts/${filename}`;
+    zip.file(inFontDir, fs.readFileSync(fontPath));
+    if (!opf.includes(filename)) {
+      const safeFamily = String(family || 'Font').replace(/\s+/g, '-');
+      const item = `<item id="font-${safeFamily}-${weight}" href="${inFontDir}" media-type="application/x-font-ttf"/>`;
+      if (opf.includes('</manifest>')) {
+        opf = opf.replace('</manifest>', `${item}</manifest>`);
+      } else {
+        // OPF without a manifest element (unusual but tolerated): inject one
+        // just before </package> so the font item is still discoverable.
+        opf = opf.replace('</package>', `<manifest>${item}</manifest></package>`);
+      }
+    }
+  }
+
+  zip.file(opfPath, opf);
+  const buf = await zip.generateAsync({ type: 'nodebuffer' });
+  const tmp = `${epubPath}.patched.epub`;
+  fs.writeFileSync(tmp, buf);
+  return tmp;
+}
+
+module.exports = { patchManifest };

src/main/ExportCss.js

@@ -0,0 +1,34 @@
+'use strict';
+
+const fs = require('fs');
+
+function toDataUri(filePath) {
+  const buf = fs.readFileSync(filePath);
+  return `data:font/woff2;base64,${buf.toString('base64')}`;
+}
+
+function build({ activeFontPath, family, weight = 400, ligatures = false }) {
+  const features = ligatures ? 'normal' : "'liga' 0, 'calt' 0, 'dlig' 0";
+  const faceBlock = activeFontPath
+    ? `@font-face {
+  font-family: '${family}';
+  font-weight: ${weight};
+  font-style: normal;
+  font-display: swap;
+  src: url('${toDataUri(activeFontPath)}') format('woff2');
+}
+`
+    : '';
+
+  return `${faceBlock}code, pre, kbd, samp {
+  font-family: '${family}', monospace;
+  font-feature-settings: ${features};
+}
+pre, code {
+  white-space: pre;
+  tab-size: 4;
+}
+`;
+}
+
+module.exports = { build };