Live campaign dashboard: render HTML in Preview, keep it live, pop out to browser #2140

Acceptance Criteria

• Opening an .html file in Preview renders the page, not its source, with a Rendered/Source toggle like Markdown's.
• Nothing in a previewed page executes: <script>, inline event handlers, and meta refresh have no effect.
• Images the page references by relative path, absolute path or file:// URL render; remote https images render; nothing else is fetched.
• Clicking an https link opens the system browser; clicking a relative or file:// link opens that file in Preview; nothing navigates the frame.
• Rewriting the page on disk — by the agent's write tool or by any process, inside or outside the project — updates the visible view within a few seconds without losing scroll position; regenerating a referenced plot does the same.
• A pop-out control opens the previewed page in the system browser when the file is on this machine, and names why when it is not.
• The research loop's record step writes the campaign dashboard (status, latest verdicts, key findings, plots, and a "needs you" line) and links it once in chat.

Key Decisions

• Scripts off, same-origin sandbox. The frame carries a sandbox with same-origin allowed and scripts not allowed: page scripts cannot run, and the host can read the frame to intercept links, apply zoom and keep scroll. This pairing is safe only because scripts are never allowed alongside it.
• The host prepares the document. Before display the host parses the page, removes scripts, meta refresh, base and embedded frames, and replaces local image sources with data URIs read through the engine's file API. The original file is never modified.
• Reload is host-driven. Page-side refresh is stripped; the watcher event (and, while the tab is visible, a periodic re-read that only re-renders on a content change) is the single refresh mechanism.
• Pop-out is a new bridge message, restricted to existing local .html/.htm files, separate from the https-only open-external message.
• No new agent tool. A chat file:// link already opens Preview through link resolution; the page then stays live.

Data Contracts

• Dashboard location: inside a Research Project, under the project's reports (one folder per campaign ledger); otherwise under the local Amico home's dashboards folder — never the synced vault, where per-loop plot churn would bloat its history. One index.html per folder with a sibling plots/ folder.
• Pop-out message: kind open-html-external, one absolute path; the extension refuses anything that is not an existing local .html/.htm file.

Constraints & Invariants

• The frame never runs page code; the sandbox never combines script permission with same-origin.
• Unsaved Source edits are never overwritten by a reload (existing Preview rule).
• Existing Preview behaviour for Markdown, images, PDFs and text files is unchanged.
• Inlining is bounded (image count and total size) so a pathological page cannot stall the panel.

Prior Art

• Preview's file view and its watcher-driven reload and stale-read guard (PDF auto-reload: watcher-driven refresh when companion PDF changes on disk #1254, feat(app): Overleaf-like LaTeX preview — compile bridge, view-state persistence, live file tracking (#1252) #1414).
• The widget frame (sandboxed iframe; the reason srcdoc inherits the app's security policy).
• Chat link resolution and the bridge's open-external / open-file handlers (feat(app): posture-aware link resolution — vault-local, hub-Preview, remote explicit #1826).
• Research mode card and research skill, record step ("the campaign dashboard widget refresh where one exists").

Source

• Idea: Jackson ↔ Aaron DM, 2026-11-06 ("open an html window in my browser that updates every 15 seconds…"; Aaron: "this is something I've been wanting to add").

Notes

• Flip condition (scripts): if researchers need interactive charts, add an opt-in, per-file "run scripts" mode served as its own document with a no-network policy and an opaque origin (the widget-frame pattern), never by adding script permission to the same-origin frame.
• Follow-up (not here): the home campaign tile (campaign-digest) is registered but its campaign feeds are not served by the engine server and were dropped from the widget fetch allowlist in the 2026-09-02 overlay re-extract.