Dragging an image onto the markdown editor attached it to the strip (the drop zone fired) but ProseMirror also handled the same drop, parsing the drag's HTML into an inline image node with a blob:/localhost src. That URL then leaked into the markdown and surfaced as a stray link-preview chip. Add a ProseMirror handleDrop that declines drops carrying files, so the editor stops inlining them while the drop zone still routes them to the attachment strip. Extract the paste/drag file extraction into a shared transferFiles helper used by both paths. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01QtNQeBpkDJPC9obiB25pV6
Notes
CORS for desktop app
In dev: each renderer process has its own localhost port. The renderer process passes this in the Origin header for requests, and expects appropriate ACAO headers in the response.
In packaged app: the renderer process does not include Origin header, so expects no extra ACAO headers from the server, otherwise the client would fail to accept responses.