fix(web): render HTML files in file preview

[tastelessjolt]

Opening an HTML workspace file currently shows source only, and served-web users cannot fall back to the Electron-only preview browser.

This adds the existing Source/Rendered toggle pattern to .html and .htm files. Rendered mode uses an iframe srcdoc sandbox that permits scripts while withholding same-origin access, forms, popups, top-level navigation, and downloads. Source remains the default, and line-reveal requests continue to select source mode.

Closes #5100

Screenshots

Before	After

Verification

• vp test run apps/web/src/components/files/FilePreviewPanel.test.ts
• vp run --filter @t3tools/web typecheck
• targeted lint and formatting checks
• served-web verification with styled .html and interactive .htm fixtures
• verified source switching, sandbox isolation, and in-frame script interaction

Built with GPT-5.6 Codex through the Codex harness in T3 Code.

Note

Render HTML files in the file preview panel with sandboxed iframe

• Adds isHtmlPreviewFile to detect .html/.htm files and prepareHtmlPreviewDocument to rewrite the document's <base href> to the signed asset directory URL, enabling relative assets to resolve correctly in preview.
• Adds a RenderedHtmlSurface component that fetches the signed asset URL, prepares the HTML document, and renders it in a sandboxed iframe with referrerPolicy=no-referrer.
• Integrates HTML rendering into FilePreviewPanel with a localStorage-backed toggle (t3code.renderHtml), sharing toggle UX with the existing Markdown render preference.
• Behavioral Change: .html/.htm files now default to a rendered preview (iframe) rather than raw source; users can toggle back to source view.

^{Macroscope summarized a63d845.}

---

Note

Medium Risk
Sandboxed iframe preview runs authored scripts with allow-scripts, which is intentional but still a security-sensitive surface; base URL rewriting touches served asset paths.

Overview
Workspace .html / .htm files can now switch between source and rendered preview, mirroring the existing markdown toggle. The preference is stored in t3code.renderHtml; source stays the default, and line-reveal still forces source view.

Rendered HTML is shown in a sandboxed iframe (allow-scripts, no-referrer) via srcDoc. prepareHtmlPreviewDocument injects or rewrites a <base href> so relative assets resolve against the signed workspace asset URL.

Unit tests cover HTML file detection and base-tag preparation.

^{Reviewed by Cursor Bugbot for commit a63d845. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7bfd9583-73c1-45bf-848b-b13154a1fdc7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature that renders HTML files with JavaScript execution enabled in a sandboxed iframe. The security implications of executing user-provided scripts, even in a sandbox, warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}