From bf54651fb02fccc90e926e39906f57e6e57ac141 Mon Sep 17 00:00:00 2001
From: ZDDC <caseywitt@proton.me>
Date: Sun, 3 May 2026 19:03:05 -0500
Subject: [PATCH] release: v0.0.11 lockstep

---
 mdedit/dist/mdedit.html                      |  2 +-
 zddc/internal/apps/embedded/archive.html     | 27 +++++++++++++++++---
 zddc/internal/apps/embedded/classifier.html  | 11 ++++----
 zddc/internal/apps/embedded/index.html       |  2 +-
 zddc/internal/apps/embedded/mdedit.html      |  2 +-
 zddc/internal/apps/embedded/transmittal.html | 17 +++++++-----
 zddc/internal/apps/embedded/versions.txt     | 12 ++++-----
 zddc/internal/handler/form.html              |  2 +-
 8 files changed, 50 insertions(+), 25 deletions(-)

diff --git a/mdedit/dist/mdedit.html b/mdedit/dist/mdedit.html
index bf20787..c66669f 100644
--- a/mdedit/dist/mdedit.html
+++ b/mdedit/dist/mdedit.html
@@ -1774,7 +1774,7 @@ body.help-open .app-header {
                 </svg>
                 <div class="header-title-group">
                     <span class="app-header__title">ZDDC Markdown</span>
-                    <span class="build-timestamp">v0.0.10</span>
+                    <span class="build-timestamp">v0.0.11</span>
                 </div>
                 <button id="select-directory" class="btn btn-primary" title="Select a Directory">Select Directory</button>
             </div>
diff --git a/zddc/internal/apps/embedded/archive.html b/zddc/internal/apps/embedded/archive.html
index 7d8bad3..3562716 100644
--- a/zddc/internal/apps/embedded/archive.html
+++ b/zddc/internal/apps/embedded/archive.html
@@ -2113,7 +2113,7 @@ td[data-field="trackingNumber"] {
                 </svg>
                 <div class="header-title-group">
                     <span class="app-header__title">ZDDC Archive</span>
-                    <span class="build-timestamp">v0.0.10</span>
+                    <span class="build-timestamp">v0.0.11</span>
                 </div>
                 <button id="addDirectoryBtn" class="btn btn-primary">Add Local Directory</button>
                 <button id="refreshHeaderBtn" class="btn btn-secondary hidden" title="Refresh Data" style="font-size:1.1rem;">⟳</button>
@@ -5548,9 +5548,28 @@ window.app.modules.filtering = {
      */
     async function showFilePreview(file) {
         const ext = file.extension.toLowerCase();
-        
+
         try {
-            const url = await getFileBlobUrl(file);
+            // For HTML preview, prefer the file's real server URL over a
+            // blob URL when available (zddc-server-backed archives have
+            // file.url set; local FileSystemAccessAPI mode doesn't).
+            //
+            // Why it matters: HTML files in an archive often link to
+            // sibling/parent paths via relative URLs — e.g.
+            // ../.archive/<tracking>.html — which zddc-server intercepts
+            // and resolves. From a blob: URL the relative resolution
+            // produces blob:.../.archive/X.html, which never reaches the
+            // server. Loading the iframe from the actual https://zddc.../
+            // URL means relative links resolve back to the server and the
+            // .archive interception fires as designed.
+            //
+            // Other types (pdf, images rendered via canvas / iframe etc.)
+            // are content-only — they don't depend on relative URLs — so
+            // a blob URL is fine.
+            const isHtml = ext === 'html' || ext === 'htm';
+            const url = (isHtml && file.url)
+                ? file.url
+                : await getFileBlobUrl(file);
             
             // Mirror the parent window's theme in the popup
             const parentTheme = document.documentElement.getAttribute('data-theme') || '';
@@ -5714,7 +5733,7 @@ window.app.modules.filtering = {
         <button class="btn" onclick="downloadFile()">Download</button>
     </div>
     ${(ext === 'pdf' || ext === 'html' || ext === 'htm')
-        ? '<iframe src="' + url + '"' + (ext === 'pdf' ? '' : ' sandbox=""') + '></iframe>'
+        ? '<iframe src="' + url + '"' + (ext === 'pdf' ? '' : ' sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"') + '></iframe>'
         : '<div id="previewContent"><div class="loading">Loading preview...</div></div>'}
     <script>
         var blobUrl = "${url}";
diff --git a/zddc/internal/apps/embedded/classifier.html b/zddc/internal/apps/embedded/classifier.html
index d7e5490..a097553 100644
--- a/zddc/internal/apps/embedded/classifier.html
+++ b/zddc/internal/apps/embedded/classifier.html
@@ -1376,7 +1376,7 @@ body.help-open .app-header {
                     </svg>
                     <div class="header-title-group">
                         <span class="app-header__title">ZDDC Classifier</span>
-                        <span class="build-timestamp">v0.0.10</span>
+                        <span class="build-timestamp">v0.0.11</span>
                     </div>
                     <button id="selectDirectoryBtn" class="btn btn-primary">Select Directory</button>
                     <button id="refreshBtn" class="btn btn-secondary hidden" title="Refresh and rescan directory">Refresh</button>
@@ -6782,10 +6782,11 @@ body.help-open .app-header {
             case 'pdf':
                 return `<iframe src="${blobUrl}#view=FitV"></iframe>`;
             case 'html':
-                // Render the HTML natively (not as literal text). sandbox=""
-                // disables scripts / forms / top-level nav / plugins so an
-                // archived HTML file can't run code in the popup's origin.
-                return `<iframe src="${blobUrl}" sandbox=""></iframe>`;
+                // Render the HTML natively (not as literal text). Sandbox
+                // flags allow same-origin resource loads + opening links
+                // in real new tabs (target=_blank / middle-click), but
+                // NOT allow-scripts — archived HTML cannot run JS.
+                return `<iframe src="${blobUrl}" sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"></iframe>`;
             case 'image':
                 return `<img src="${blobUrl}" alt="${escapeHtml(file.originalFilename)}" />`;
             case 'text':
diff --git a/zddc/internal/apps/embedded/index.html b/zddc/internal/apps/embedded/index.html
index 329a925..04f0958 100644
--- a/zddc/internal/apps/embedded/index.html
+++ b/zddc/internal/apps/embedded/index.html
@@ -866,7 +866,7 @@ body {
                 </g>
             </svg>
             <span class="app-header__title">ZDDC Archive</span>
-            <span class="build-timestamp">v0.0.10</span>
+            <span class="build-timestamp">v0.0.11</span>
         </div>
         <div class="header-right">
             <button id="theme-btn" class="btn btn-secondary" title="Theme: auto (follows OS)" aria-label="Theme: auto (follows OS)">◐</button>
diff --git a/zddc/internal/apps/embedded/mdedit.html b/zddc/internal/apps/embedded/mdedit.html
index bf20787..c66669f 100644
--- a/zddc/internal/apps/embedded/mdedit.html
+++ b/zddc/internal/apps/embedded/mdedit.html
@@ -1774,7 +1774,7 @@ body.help-open .app-header {
                 </svg>
                 <div class="header-title-group">
                     <span class="app-header__title">ZDDC Markdown</span>
-                    <span class="build-timestamp">v0.0.10</span>
+                    <span class="build-timestamp">v0.0.11</span>
                 </div>
                 <button id="select-directory" class="btn btn-primary" title="Select a Directory">Select Directory</button>
             </div>
diff --git a/zddc/internal/apps/embedded/transmittal.html b/zddc/internal/apps/embedded/transmittal.html
index 03db07f..cefc66f 100644
--- a/zddc/internal/apps/embedded/transmittal.html
+++ b/zddc/internal/apps/embedded/transmittal.html
@@ -2210,7 +2210,7 @@ dialog.modal--narrow {
         </svg>
         <div class="header-title-group">
             <span class="app-header__title">ZDDC Transmittal</span>
-            <span class="build-timestamp">v0.0.10</span>
+            <span class="build-timestamp">v0.0.11</span>
         </div>
         <div class="app-header__spacer"></div>
         <div class="app-header__icons">
@@ -7615,15 +7615,20 @@ dialog.modal--narrow {
         // PDF and HTML preview natively in an iframe — for HTML this
         // means the page is RENDERED (not shown as literal source text);
         // the blob's MIME type ('text/html', see getMimeType) tells the
-        // browser to render. `sandbox=""` on the HTML iframe disables
-        // all dangerous capabilities (scripts, top-level navigation,
-        // forms, plugins, popups) since these are arbitrary archived
-        // files we don't trust to run JS in the parent's origin.
+        // browser to render. The HTML iframe is sandboxed:
+        //   - allow-same-origin: needed so the iframe's resource loads
+        //     (img / link / etc.) work normally for same-origin paths.
+        //   - allow-popups + allow-popups-to-escape-sandbox: clicking
+        //     <a target="_blank"> (or middle-click) opens a real new tab
+        //     with full browser features. Without these, link clicks
+        //     intended for new tabs silently no-op.
+        //   - NO allow-scripts: archived HTML cannot run JS in this
+        //     popup's origin.
         var contentHtml;
         if (ext === 'pdf') {
             contentHtml = '<iframe src="' + safeHref + '"></iframe>';
         } else if (ext === 'html' || ext === 'htm') {
-            contentHtml = '<iframe src="' + safeHref + '" sandbox=""></iframe>';
+            contentHtml = '<iframe src="' + safeHref + '" sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"></iframe>';
         } else {
             contentHtml = '<div id="previewContent"><div class="loading">Loading preview...</div></div>';
         }
diff --git a/zddc/internal/apps/embedded/versions.txt b/zddc/internal/apps/embedded/versions.txt
index fc30987..8331d4d 100644
--- a/zddc/internal/apps/embedded/versions.txt
+++ b/zddc/internal/apps/embedded/versions.txt
@@ -1,7 +1,7 @@
 # Generated by build.sh — do not edit. One <app>=<build label> per line.
-archive=v0.0.10
-transmittal=v0.0.10
-classifier=v0.0.10
-mdedit=v0.0.10
-landing=v0.0.10
-form=v0.0.10
+archive=v0.0.11
+transmittal=v0.0.11
+classifier=v0.0.11
+mdedit=v0.0.11
+landing=v0.0.11
+form=v0.0.11
diff --git a/zddc/internal/handler/form.html b/zddc/internal/handler/form.html
index 948336b..c590ec0 100644
--- a/zddc/internal/handler/form.html
+++ b/zddc/internal/handler/form.html
@@ -722,7 +722,7 @@ body.help-open .app-header {
                 </g>
             </svg>
             <span class="app-header__title" id="form-title">ZDDC Form</span>
-            <span class="build-timestamp">v0.0.10</span>
+            <span class="build-timestamp">v0.0.11</span>
         </div>
         <div class="header-right">
             <button id="theme-btn" class="btn btn-secondary" title="Theme: auto (follows OS)" aria-label="Theme: auto (follows OS)">◐</button>