v0.24.1

Story map, and the security audit's fixes. Export → Story map makes one dark, phone-first page that answers "What are you writing?" in pictures: the shape of the story, its people, and every scene so far, with a few lines of dialogue. It runs no code and fetches nothing, and your notes never go in. The desktop app takes a dropped file only from a real drop, and every pull request is checked on GitHub.

Added

• Story map: one page that answers "What are you writing?" in pictures, to send by text or email to anyone who doesn't read scripts. Export → Story map… (the toolbar's Export menu, the Drafter menu, the palette, and the desktop app's File → Export) opens Make a story map, a short dialog whose choices start sensible, so Enter makes the page. It saves one file, <title> – story map.html.
  • What's on it: the title, your name with "What I'm writing" under it, the logline, how far along it is, and big numbers (pages, running time, scenes, characters, places); the shape of the story along its pages, coloured by time of day or by act, with inside and outside, day and night, and how long the scenes run; the characters, ranked by screen time, with cards for the eight who lead (a hook from their introduction, where they appear, and a line of their own) and who shares the most scenes; every scene in order, with where and when, its length, a one-line summary, who is in it, and now and then a line of dialogue; the places, sized by time spent there; and your setups joined to their payoffs. Every chart has Show as a table. No screenwriting words: Inside and Outside, minutes and pages.
  • The dialog: In progress or Finished, an optional planned length in pages, the logline, the line under your name, the sentence that explains the page, what goes in (scene summaries, lines of dialogue, and threads on; your contact off), and, folded away, the lines Drafter picked (untick one, or Pick another from the same scene) and each lead's hook. The logline is written to the title page as Logline: (it never prints in the script), the planned length and edited hooks to the metadata block, and the other choices are kept per script in this browser. On a phone the dialog is a sheet.
  • Lines of dialogue are picked for you, about one scene in four, at most 12, 3 to 18 words each. [[Quote]] in a speech always puts it in; [[No quote]] keeps it out. Use in story map and Never use in story map write them for the speech at the cursor, in one undo (the palette, and the desktop app's Edit and right-click menus).
  • Gaps, shown as unfinished, not broken: an act with nothing in it, a planned scene (a heading with no action or dialogue), a to-do note (the mark only, never its words), and the pages still to write when you give a planned length. One sentence sums it up and never says more than the numbers. Finished leaves the planned scenes out and says "The end".
  • Acts only when you mark them (# sections, or headings that start with "Act"); otherwise the scenes are one run, "The story". A one-act play reads "A one-act play in progress". An early draft (under 10 pages or 6 scenes) keeps the shape simple.
  • Stage plays: settings in place of places; an interval between Acts 1 and 2 when there are two acts or more, moved with [[Interval]] or turned off with [[No interval]]; and who's on stage, a bar per character from entrance to exit with a plain sentence ("Dev enters halfway"), and the pairs who share the stage most.
  • Private and safe: notes are never included (only Setup and Payoff names, with Threads on), nor the boneyard, to-do text, revision marks, or the script itself. The page has no JavaScript, a security policy that lets it load nothing, and its fonts inside (Anton, Archivo, and Courier Prime, all under the SIL Open Font License, listed on the Third-party licences page). It is dark on screen, prints light, and a 120-page script's is about 250 KB.
  • A Story map help page, linked from Help, What is Drafter?, and What's new.
• drafter build script.fountain --story-map map.html writes the same page from the command line, with the dialog's starting choices and no contact; --status in-progress or --status finished says which. A Drafter draft file shows its draft's number and ID; any other file is Draft 01 with the SHA-256 of its text.
• Four new trap documents (262 in all): hostile titles, names, places, and lines in a story map, a 100,000-character name, a 10,000-character marked line, and a name said 50,000 times. Every inert trap's story map is checked to stay inert.
• docs: a second clean-room audit, 1 November 2026 (docs/clean-room-audit-2026-11-01.md), over everything since the first (v0.3.1 to v0.24.0, and the Story map plan): no copied code, no screenwriting package, no GPL code shipped, and every Final Draft, Highland, and Fade In test file synthetic. It compares itself with the first audit check by check, and lists two small fixes (a film catchphrase back in one test, and an unrecorded source for 18 Final Draft element names). The first audit is now docs/clean-room-audit-2026-10-27.md. A new index, docs/AUDITS.md, lists every security, clean-room, and accessibility audit, newest first, linked from the README, Developing Drafter, and SECURITY.md.
• What is Drafter? links Audits from Can I trust this? and from its technical links.
• docs: Drafter's first formal security audit, 1 November 2026 (docs/security-audit-2026-11-01.md), of the web app, the desktop app, the command line, the build, and the security claims in the docs: no exploitable hole, and nothing leaves the device. To fix: turn on GitHub's private vulnerability reporting. It compares itself with the earlier security reviews, area by area, and is listed in docs/AUDITS.md, SECURITY.md, and the README.

Changed

• Every pull request is checked automatically on GitHub (lint, build, every test suite, the trap documents, and the browser tests in Chromium), Dependabot's included.
• The spellcheck's budget for a check after a one-letter edit is 150 ms, generous enough for a shared CI machine, as its own comment intends.
• The outline's twenty-thousand-run Markdown property test has a minute to finish, not the default five seconds.
• The pull-request checks skip the tests with a fixed time limit, which the release gates still run; the tests that compare a script with one 4 or 8 times its size run everywhere.
• The tests that copy the fonts, dictionaries, and icons into the web app have half a minute each (set with vi.setConfig, which the linter accepts).
• The pull-request checks require lint, the build, every unit test, the trap documents, and the typechecks; the browser tests run too, on macOS and Linux, shown but not required, since a shared runner is too slow for them to be reliable (DEFERRED tracks it). The full browser suite stays a release gate. On CI, Playwright also writes an HTML report, kept with a failed run. The browser-test jobs build the packages first, since some tests read them.
• A second clean-room audit (1 November 2026, docs/clean-room-audit-2026-11-01.md), with an index of every audit, newest first (docs/AUDITS.md). What it asked for is done: a film line and a film's names in tests are original now, and the Final Draft settings names say where they come from.
• docs/DEPENDENCIES.md names every workspace edge its rows had missed (history, lint, the editor package, and the command line) and two tools: axe in the desktop tests, and the Mermaid command line the diagrams are drawn with (through npx, never installed).
• shares (whole percents that add up to 100) moved from the app's Stats code to @drafter/cast, so the story map and the Stats tab round alike. @drafter/fountain gains setTitleField, and a title page holding only Logline: is a title page. @drafter/notes reads the whole-note marks [[Quote]], [[No quote]], [[Interval]], and [[No interval]] (wholeMarkOf). @drafter/render-html-file exports cspHash, base64, fontKind, and langOf.
• Requests to the export worker go one at a time, so the story map dialog's look at the lines never collides with an export already running.
• The Story map design (docs/drafter-story-map-design.md), approved with mockups for a screenplay and a stage play, is in the repository; Story map ships in v0.24.1.
• The desktop build makes the history package and the packages it needs before the desktop tests, which read it from its source.
• The desktop menu test for Report a Problem… types the report before it looks for the version info, which the preview shows once there is something to send.

Security

• Desktop: a dropped file is granted only when the preload saw the browser's own drop event and told the main process; the page then claims it by an opaque id, once, and can no longer hand the main process a path for a drop (security audit F2).
• CI: the Linux, Windows, and Mac jobs check out with persist-credentials: false, as publish already did, so no job leaves its token in .git/config. The workflow stays contents: read, with contents: write on publish alone, which makes the release (security audit F7).
• Dependabot: weekly version updates for npm and GitHub Actions, minor and patch grouped into one PR each (.github/dependabot.yml). Dependabot alerts and security updates are on in the repository's settings (security audit F4).
• Nuxt 4.6.3 (from 4.6.2), which clears its five advisories (the dev server's file reads and config, and server/middleware dot segments; none reached drafter.dev, a static site). pnpm audit --prod goes from 25 advisories to 20; the rest are in build and dev-server tooling (security audit F3).
• Technical details no longer says the app has no v-html: Drafter's own code has none, and the one library component that does, Nuxt UI's palette, has its label slot replaced with text. The palette test now also searches inside the tag, and says it pins this (security audit F5).
• The README, What is Drafter?, Why Drafter, and Technical details say the web app updates when you reload, or the next time you open it after closing every Drafter tab, as a service worker does (security audit F10).
• GitHub's private vulnerability reporting is on (turned on at the maintainer's request), so SECURITY.md, the README, and What is Drafter? name Report a vulnerability on the Security tab plainly, with the email beside it, and DEFERRED no longer lists it (security audit F1).
• DEFERRED lists what the security audit left as known limits: HSTS is Netlify's default (F6), desktop updates are checked by SHA-512 but not signed (F8), what the drop grant still trusts, the advisories left in tooling, and Dependabot PRs running no CI.
• docs: the security audit ends with a Follow-up listing each finding's status, and docs/AUDITS.md's result says all were addressed the same day.

Downloads

• Windows (x64): Drafter-0.24.1-windows-x64-setup.exe
• Linux: Drafter-0.24.1-linux-amd64.deb or Drafter-x86_64.AppImage
• Or write in your browser at drafter.dev. Free, no login.