feat(mdviewer): add clipboard permissions and table context menu paste

Add allow-clipboard-read/write sandbox flags and permissions policy
on the md viewer iframe for Chromium context menu paste support.
Hide paste menu items on browsers where Clipboard API is blocked
(Safari/Firefox sandboxed iframes). Add cut/copy/paste items to
the table right-click context menu.

Author: abose

src-mdviewer/src/components/context-menu.js

@@ -8,6 +8,24 @@ let menu = null;
 let cleanupFns = [];
 let savedRange = null;
 
+// Detect clipboard API availability (blocked in Safari/Firefox sandboxed iframes)
+let _clipboardApiSupported = null;
+function _isClipboardApiAvailable() {
+    if (_clipboardApiSupported !== null) { return _clipboardApiSupported; }
+    if (!navigator.clipboard || !navigator.clipboard.readText) {
+        _clipboardApiSupported = false;
+        return false;
+    }
+    // Probe by calling readText — if permissions policy blocks it, it throws synchronously
+    // or rejects immediately. Cache the result after first context menu open.
+    navigator.clipboard.readText()
+        .then(() => { _clipboardApiSupported = true; })
+        .catch(() => { _clipboardApiSupported = false; });
+    // Optimistic for first open on Chromium; will correct on next open if blocked
+    _clipboardApiSupported = true;
+    return _clipboardApiSupported;
+}
+
 export function initContextMenu() {
     menu = document.getElementById("context-menu");
     if (!menu) return;
@@ -141,16 +159,20 @@ function buildItems(ctx) {
             });
         }
 
-        items.push({
-            label: t("context.paste"),
-            shortcut: `${modLabel}+V`,
-            action: () => pasteFromClipboard(false)
-        });
-        items.push({
-            label: t("context.paste_plain"),
-            shortcut: `${modLabel}+\u21E7+V`,
-            action: () => pasteFromClipboard(true)
-        });
+        // Clipboard API paste only works in Chromium with permissions policy.
+        // In Safari/Firefox sandboxed iframes, it's blocked. Users can still Ctrl/Cmd+V.
+        if (_isClipboardApiAvailable()) {
+            items.push({
+                label: t("context.paste"),
+                shortcut: `${modLabel}+V`,
+                action: () => pasteFromClipboard(false)
+            });
+            items.push({
+                label: t("context.paste_plain"),
+                shortcut: `${modLabel}+\u21E7+V`,
+                action: () => pasteFromClipboard(true)
+            });
+        }
 
         items.push({ divider: true });
 

src-mdviewer/src/components/editor.js

@@ -1024,7 +1024,44 @@ function showTableContextMenu(x, y, ctx, contentEl) {
     const menu = document.getElementById("table-context-menu");
     if (!menu) return;
 
-    const items = [
+    const sel = window.getSelection();
+    const hasSelection = sel && !sel.isCollapsed;
+
+    const items = [];
+
+    // Cut/Copy/Paste
+    if (hasSelection) {
+        items.push({
+            label: t("context.cut") || "Cut",
+            action: () => { document.execCommand("cut"); }
+        });
+        items.push({
+            label: t("context.copy") || "Copy",
+            action: () => { document.execCommand("copy"); }
+        });
+    }
+    if (navigator.clipboard && navigator.clipboard.readText) {
+        items.push({
+            label: t("context.paste") || "Paste",
+            action: async () => {
+                contentEl.focus({ preventScroll: true });
+                try {
+                    const text = await navigator.clipboard.readText();
+                    if (text) {
+                        document.execCommand("insertText", false, text.replace(/[\r\n]+/g, " ").trim());
+                    }
+                } catch {
+                    document.execCommand("paste");
+                }
+            }
+        });
+    }
+    if (hasSelection || (navigator.clipboard && navigator.clipboard.readText)) {
+        items.push({ divider: true });
+    }
+
+    // Table operations
+    items.push(
         { label: t("table.add_row_above"), action: () => { flushSnapshot(contentEl); addTableRow(ctx.table, null, ctx.tr); dispatchInputEvent(contentEl); } },
         { label: t("table.add_row_below"), action: () => { flushSnapshot(contentEl); addTableRow(ctx.table, ctx.tr); dispatchInputEvent(contentEl); } },
         { label: t("table.add_col_left"), action: () => { flushSnapshot(contentEl); addTableColumn(ctx.table, ctx.colIdx - 1); dispatchInputEvent(contentEl); } },
@@ -1034,7 +1071,7 @@ function showTableContextMenu(x, y, ctx, contentEl) {
         { label: t("table.delete_col"), destructive: true, action: () => { flushSnapshot(contentEl); deleteTableColumn(ctx.table, ctx.colIdx); dispatchInputEvent(contentEl); } },
         { divider: true },
         { label: t("table.delete_table"), destructive: true, action: () => { flushSnapshot(contentEl); deleteTable(ctx.table); dispatchInputEvent(contentEl); } }
-    ];
+    );
 
     menu.innerHTML = "";
     items.forEach((item) => {

src/extensionsIntegrated/Phoenix-live-preview/main.js

@@ -141,12 +141,13 @@ define(function (require, exports, module) {
     // no allow-forms, allow-pointer-lock (not needed for markdown editing).
     // Communication works via MarkdownSync's own message handler (bypasses EventManager origin check).
     const _mdSandboxAttr = Phoenix.isTestWindow ? "" :
-        'sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox allow-modals"';
+        'sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox allow-modals allow-clipboard-read allow-clipboard-write"';
     const MDVIEWR_IFRAME_HTML = `
     <iframe id="${MDVIEWR_IFRAME_ID}" title="Markdown Preview" style="border: none"
              width="100%" height="100%" seamless="true"
              src='about:blank'
-             ${_mdSandboxAttr}>
+             ${_mdSandboxAttr}
+             allow="clipboard-read; clipboard-write">
     </iframe>
     `;