From f5ffd408f2585393645fd48e6de706baaa6058c7 Mon Sep 17 00:00:00 2001
From: ZDDC <caseywitt@proton.me>
Date: Sun, 3 May 2026 17:11:46 -0500
Subject: [PATCH] release: v0.0.10 lockstep

---
 mdedit/dist/mdedit.html                      |  2 +-
 zddc/internal/apps/embedded/archive.html     | 17 +++++++++++++----
 zddc/internal/apps/embedded/classifier.html  | 11 ++++++++++-
 zddc/internal/apps/embedded/index.html       |  2 +-
 zddc/internal/apps/embedded/mdedit.html      |  2 +-
 zddc/internal/apps/embedded/transmittal.html | 15 +++++++++++++--
 zddc/internal/apps/embedded/versions.txt     | 12 ++++++------
 zddc/internal/handler/form.html              |  2 +-
 8 files changed, 46 insertions(+), 17 deletions(-)

diff --git a/mdedit/dist/mdedit.html b/mdedit/dist/mdedit.html
index 101174f..bf20787 100644
--- a/mdedit/dist/mdedit.html
+++ b/mdedit/dist/mdedit.html
@@ -1774,7 +1774,7 @@ body.help-open .app-header {
                 </svg>
                 <div class="header-title-group">
                     <span class="app-header__title">ZDDC Markdown</span>
-                    <span class="build-timestamp">v0.0.9</span>
+                    <span class="build-timestamp">v0.0.10</span>
                 </div>
                 <button id="select-directory" class="btn btn-primary" title="Select a Directory">Select Directory</button>
             </div>
diff --git a/zddc/internal/apps/embedded/archive.html b/zddc/internal/apps/embedded/archive.html
index 73e9b6d..7d8bad3 100644
--- a/zddc/internal/apps/embedded/archive.html
+++ b/zddc/internal/apps/embedded/archive.html
@@ -2113,7 +2113,7 @@ td[data-field="trackingNumber"] {
                 </svg>
                 <div class="header-title-group">
                     <span class="app-header__title">ZDDC Archive</span>
-                    <span class="build-timestamp">v0.0.9</span>
+                    <span class="build-timestamp">v0.0.10</span>
                 </div>
                 <button id="addDirectoryBtn" class="btn btn-primary">Add Local Directory</button>
                 <button id="refreshHeaderBtn" class="btn btn-secondary hidden" title="Refresh Data" style="font-size:1.1rem;">⟳</button>
@@ -5713,7 +5713,9 @@ window.app.modules.filtering = {
         <h1>${window.app.modules.app.escapeHtml(file.name)}</h1>
         <button class="btn" onclick="downloadFile()">Download</button>
     </div>
-    ${ext === 'pdf' ? '<iframe src="' + url + '"></iframe>' : '<div id="previewContent"><div class="loading">Loading preview...</div></div>'}
+    ${(ext === 'pdf' || ext === 'html' || ext === 'htm')
+        ? '<iframe src="' + url + '"' + (ext === 'pdf' ? '' : ' sandbox=""') + '></iframe>'
+        : '<div id="previewContent"><div class="loading">Loading preview...</div></div>'}
     <script>
         var blobUrl = "${url}";
         var fileName = "${window.app.modules.app.escapeHtml(file.name).replace(/"/g, '\\"')}";
@@ -5755,8 +5757,15 @@ window.app.modules.filtering = {
                 filePreviewWindow.focus();
             }
             
-            // For non-PDF types, render content into the preview window
-            if (ext === 'docx') {
+            // For non-PDF / non-HTML types, render content into the
+            // preview window. PDF and HTML are already wired up via the
+            // <iframe> in the popup's body (see buildPreviewHtml above);
+            // for HTML this means the page is RENDERED, not shown as
+            // literal source text. The previewBlobUrl carries the right
+            // MIME type ('text/html') so the iframe loads natively.
+            if (ext === 'pdf' || ext === 'html' || ext === 'htm') {
+                // iframe already wired in popup HTML; nothing to do
+            } else if (ext === 'docx') {
                 await renderDocxInWindow(file);
             } else if (ext === 'xlsx' || ext === 'xls') {
                 await renderXlsxInWindow(file);
diff --git a/zddc/internal/apps/embedded/classifier.html b/zddc/internal/apps/embedded/classifier.html
index cc1da17..d7e5490 100644
--- a/zddc/internal/apps/embedded/classifier.html
+++ b/zddc/internal/apps/embedded/classifier.html
@@ -1376,7 +1376,7 @@ body.help-open .app-header {
                     </svg>
                     <div class="header-title-group">
                         <span class="app-header__title">ZDDC Classifier</span>
-                        <span class="build-timestamp">v0.0.9</span>
+                        <span class="build-timestamp">v0.0.10</span>
                     </div>
                     <button id="selectDirectoryBtn" class="btn btn-primary">Select Directory</button>
                     <button id="refreshBtn" class="btn btn-secondary hidden" title="Refresh and rescan directory">Refresh</button>
@@ -6781,6 +6781,11 @@ body.help-open .app-header {
         switch (previewType) {
             case 'pdf':
                 return `<iframe src="${blobUrl}#view=FitV"></iframe>`;
+            case 'html':
+                // Render the HTML natively (not as literal text). sandbox=""
+                // disables scripts / forms / top-level nav / plugins so an
+                // archived HTML file can't run code in the popup's origin.
+                return `<iframe src="${blobUrl}" sandbox=""></iframe>`;
             case 'image':
                 return `<img src="${blobUrl}" alt="${escapeHtml(file.originalFilename)}" />`;
             case 'text':
@@ -6810,6 +6815,10 @@ body.help-open .app-header {
      * Get preview type from extension
      */
     function getPreviewType(ext) {
+        // HTML is technically in TEXT_EXTENSIONS (used for editor
+        // syntax-highlighting elsewhere) but for previews we want to
+        // RENDER it, not show source. Check before the text branch.
+        if (ext === 'html' || ext === 'htm') return 'html';
         if (PDF_EXTENSIONS.includes(ext)) return 'pdf';
         if (TIFF_EXTENSIONS.includes(ext)) return 'tiff';
         if (IMAGE_EXTENSIONS.includes(ext)) return 'image';
diff --git a/zddc/internal/apps/embedded/index.html b/zddc/internal/apps/embedded/index.html
index 6d97ee5..329a925 100644
--- a/zddc/internal/apps/embedded/index.html
+++ b/zddc/internal/apps/embedded/index.html
@@ -866,7 +866,7 @@ body {
                 </g>
             </svg>
             <span class="app-header__title">ZDDC Archive</span>
-            <span class="build-timestamp">v0.0.9</span>
+            <span class="build-timestamp">v0.0.10</span>
         </div>
         <div class="header-right">
             <button id="theme-btn" class="btn btn-secondary" title="Theme: auto (follows OS)" aria-label="Theme: auto (follows OS)">◐</button>
diff --git a/zddc/internal/apps/embedded/mdedit.html b/zddc/internal/apps/embedded/mdedit.html
index 101174f..bf20787 100644
--- a/zddc/internal/apps/embedded/mdedit.html
+++ b/zddc/internal/apps/embedded/mdedit.html
@@ -1774,7 +1774,7 @@ body.help-open .app-header {
                 </svg>
                 <div class="header-title-group">
                     <span class="app-header__title">ZDDC Markdown</span>
-                    <span class="build-timestamp">v0.0.9</span>
+                    <span class="build-timestamp">v0.0.10</span>
                 </div>
                 <button id="select-directory" class="btn btn-primary" title="Select a Directory">Select Directory</button>
             </div>
diff --git a/zddc/internal/apps/embedded/transmittal.html b/zddc/internal/apps/embedded/transmittal.html
index 1ec362d..03db07f 100644
--- a/zddc/internal/apps/embedded/transmittal.html
+++ b/zddc/internal/apps/embedded/transmittal.html
@@ -2210,7 +2210,7 @@ dialog.modal--narrow {
         </svg>
         <div class="header-title-group">
             <span class="app-header__title">ZDDC Transmittal</span>
-            <span class="build-timestamp">v0.0.9</span>
+            <span class="build-timestamp">v0.0.10</span>
         </div>
         <div class="app-header__spacer"></div>
         <div class="app-header__icons">
@@ -7612,9 +7612,18 @@ dialog.modal--narrow {
         var safeName = util.escapeHtml(file.name || file.path || 'file');
         var safeHref = util.escapeHtmlAttribute(url);
 
+        // PDF and HTML preview natively in an iframe — for HTML this
+        // means the page is RENDERED (not shown as literal source text);
+        // the blob's MIME type ('text/html', see getMimeType) tells the
+        // browser to render. `sandbox=""` on the HTML iframe disables
+        // all dangerous capabilities (scripts, top-level navigation,
+        // forms, plugins, popups) since these are arbitrary archived
+        // files we don't trust to run JS in the parent's origin.
         var contentHtml;
         if (ext === 'pdf') {
             contentHtml = '<iframe src="' + safeHref + '"></iframe>';
+        } else if (ext === 'html' || ext === 'htm') {
+            contentHtml = '<iframe src="' + safeHref + '" sandbox=""></iframe>';
         } else {
             contentHtml = '<div id="previewContent"><div class="loading">Loading preview...</div></div>';
         }
@@ -7827,7 +7836,9 @@ dialog.modal--narrow {
                 previewWindow.focus();
             }
 
-            if (ext === 'docx') {
+            if (ext === 'pdf' || ext === 'html' || ext === 'htm') {
+                // iframe already wired in popup HTML; nothing more to do
+            } else if (ext === 'docx') {
                 await renderDocxInWindow(file);
             } else if (ext === 'xlsx' || ext === 'xls') {
                 await renderXlsxInWindow(file);
diff --git a/zddc/internal/apps/embedded/versions.txt b/zddc/internal/apps/embedded/versions.txt
index 3949f33..fc30987 100644
--- a/zddc/internal/apps/embedded/versions.txt
+++ b/zddc/internal/apps/embedded/versions.txt
@@ -1,7 +1,7 @@
 # Generated by build.sh — do not edit. One <app>=<build label> per line.
-archive=v0.0.9
-transmittal=v0.0.9
-classifier=v0.0.9
-mdedit=v0.0.9
-landing=v0.0.9
-form=v0.0.9
+archive=v0.0.10
+transmittal=v0.0.10
+classifier=v0.0.10
+mdedit=v0.0.10
+landing=v0.0.10
+form=v0.0.10
diff --git a/zddc/internal/handler/form.html b/zddc/internal/handler/form.html
index 8180d0a..948336b 100644
--- a/zddc/internal/handler/form.html
+++ b/zddc/internal/handler/form.html
@@ -722,7 +722,7 @@ body.help-open .app-header {
                 </g>
             </svg>
             <span class="app-header__title" id="form-title">ZDDC Form</span>
-            <span class="build-timestamp">v0.0.9</span>
+            <span class="build-timestamp">v0.0.10</span>
         </div>
         <div class="header-right">
             <button id="theme-btn" class="btn btn-secondary" title="Theme: auto (follows OS)" aria-label="Theme: auto (follows OS)">◐</button>