GChat Preview Files

Someone drops an .html report, a .md spec or a .json export into a Google Chat thread, and reading it costs you four steps: download, find it in Downloads, open it, come back. This extension adds a Preview button next to the attachment and shows you the file in place. WHAT IT PREVIEWS • HTML — rendered as the page it is, exactly as the sender built it. • Markdown — headings, lists, tables, code blocks and links, properly rendered rather than shown as source. • JSON — a collapsible tree with syntax colouring, array indices and key counts, plus Expand all and Collapse all. A file that fails to parse still opens: you get the parse error above the raw text, because seeing why it is broken is usually the point. Plain .txt is deliberately left alone — Google Chat already previews it, and a second button next to Google's own preview would only be noise. DIAGRAMS IN MARKDOWN Fenced ```mermaid blocks are drawn as flowcharts, sequence diagrams and the rest, rendered entirely on your own machine — nothing is sent anywhere. Fenced ```plantuml blocks are drawn too; PlantUML has no browser renderer, so those send the diagram source to a PlantUML server. That is on by default using the public plantuml.com, and you can switch it off or point it at a server inside your own network. Mermaid diagrams never leave your browser. BUILT FOR FILES YOU DID NOT WRITE Anyone in a chat can send you a file, so every previewed file is treated as hostile. • It cannot reach your Google session. The preview renders in a doubly sandboxed iframe with no same-origin access — your cookies, the Chat page and the extension's own APIs are all out of reach. The file's markup is never inserted into the Google Chat page. • It cannot phone home. Network access inside a preview is switched off at the Content Security Policy level: no fetch, no XHR, no WebSocket, no form posts, no popups, no remote images, fonts or scripts. Nothing a previewed file observes can leave your browser. • Its scripts do not run until you say so. HTML previews start fully static and gain scripting only when you click Enable scripts on that specific preview. A page that cannot run code cannot capture what you type, which is what makes a fake login form in an attachment harmless. Markdown and JSON previews have no such toggle at all — the extension builds those documents itself and escapes every tag, so a JSON value containing <script> is just characters on screen. The cost of that last rule, stated plainly: files that pull images, fonts or libraries from a CDN will render without them. SETTINGS Open the options page from chrome://extensions to choose which file types get a Preview button, whether HTML previews start with scripts enabled (off by default), whether Mermaid and PlantUML render, which PlantUML server to use, how much of a JSON tree opens by default, and the maximum file size to preview (5 MB by default). PRIVACY The extension has no analytics, no account, no server of its own, and sends nothing anywhere except the two cases it tells you about: fetching the attachment you asked to preview from Google's own servers, and — if you leave PlantUML enabled — the source of a PlantUML diagram to the PlantUML server you have configured. Full policy: https://hblab-dieuhd.github.io/gchat-preview-files/privacy-policy.html Not affiliated with, endorsed by, or sponsored by Google. Google Chat is a trademark of Google LLC.