Add HTML artifact view

[samuelstroschein]

Summary

• add a built-in view for .html and .htm workspace files
• render self-contained HTML, CSS, and JavaScript edge-to-edge in the center panel
• isolate artifacts in an opaque sandbox and inject a restrictive CSP that blocks remote resources and connections
• add loading, accessibility, routing, security, and reactive-update coverage
• include a seeded interactive artifact for visual QA

Validation

• pnpm run ci
• pnpm typecheck
• pnpm lint (0 errors; existing warnings only)
• pnpm format:check
• production and consumer builds
• wide/narrow browser QA
• independent QA and code review passes

Fixes opral/flashtype#163

---

Note

Medium Risk
Runs untrusted workspace HTML with scripts in a sandboxed iframe; mitigations (CSP + sandbox) are central but warrant careful review for bypasses.

Overview
Adds a hidden built-in file view for .html / .htm workspace files so self-contained HTML artifacts open inside Atelier instead of as raw text.

Preview loads file bytes into a sandboxed iframe (allow-scripts, no-referrer, srcdoc) after buildSandboxedHtmlDocument parses the markup with DOMParser and prepends a restrictive CSP to the real document head (blocking network, frames, forms, etc., while allowing inline scripts/styles). Tests cover extension routing, CSP placement (including decoy-markup cases), reactive updates, and unsupported paths. The extension is wired through builtin-extension-registry, documented in the README, and a seeded interactive-plan.html supports visual QA.

^{Reviewed by Cursor Bugbot for commit 80ca199. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	atelier-preview	80ca199	Commit Preview URL Branch Preview URL	Jul 10 2026, 08:57 PM