[Bug]: HTML file previews don't load relative resources that use ../ #26902

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. In a project, create:

   c.png
   site/index.html
   site/style.css
   site/a.png
   site/img/b.png
   

   with site/index.html referencing style.css, ./a.png, img/b.png and ../c.png.
2. From a thread of that project, open site/index.html in the file preview (e.g. by clicking a link to its absolute path).
3. Copy the same folder outside the thread's project and open that index.html the same way.

Expected behavior

Relative resources load as they do when the file is opened in a browser via file://, including references that climb with ../ while staying inside the project (e.g. <img src="../../../assets/logo/logo.png"> from proposals/v2/opus/index.html).

Actual behavior

• Inside the project: style.css, ./a.png and img/b.png load; ../c.png does not.
• Outside the project: nothing relative loads, not even ./a.png or the CSS.

Cause, as far as I can tell from apps/server/src/assets/AssetAccess.ts:

• finalizeWorkspaceFileAsset gives workspace HTML a workspace-file grant scoped to path.dirname(file), and issueAssetUrl builds /api/assets/<token>/<basename>. The browser normalizes ../c.png against that URL to /api/assets/c.png before sending the request, so the token segment is gone and the request 404s. The .. check in resolveAsset never even gets to run.
• HTML outside the thread's project goes through media-file (apps/web/src/components/files/filePreviewMode.ts, workspaceAssetResource), which is an exact-file grant, so no relative resource resolves.

A possible fix for the first case: root the HTML grant at the workspace and put the page's workspace-relative path in the URL (/api/assets/<token>/site/index.html), so ../ references resolve under the token. The existing dotfile, extension allowlist and root-containment checks would still apply. The trade-off is that an HTML page could load allowlisted resources from the whole workspace instead of only its own folder. I have this change with a regression test on a local branch and can open a PR if this direction is acceptable. It touches the same code as #18239.

The outside-the-project case needs a decision about which folder to grant without a project root, so I left it out.

Impact

Minor bug or occasional failure

Version or commit

main at 4c9c7d0

Environment

macOS desktop app