HTML review preview blocks in-page anchor navigation #80

Problem

Clicking an in-page anchor such as <a href="#section"> in an HTML artifact's review preview replaces the document with the browser error “This content is blocked. Contact the site owner to fix the issue.”

Reproduction

1. Publish an HTML artifact containing a link to #section and an element with id="section" further down the page.
2. Open the artifact in the review UI and switch to Interact mode.
3. Click the link.

Expected: scroll to the section within the rendered document.
Actual: the iframe attempts to navigate to the content lease host and CSP blocks it.

Cause

apps/web/src/review-frame/base-href.ts prepends a content-host <base href> to the srcdoc document so relative resources resolve correctly. Fragment-only links also resolve against that base, so they become a navigation away from about:srcdoc. The review-frame policy uses default-src 'none' with no frame-src; Chromium reports that framing the content URL violates that directive.

This was reproduced with Chromium using the same srcdoc/base/sandbox/CSP arrangement. The sandbox and policy are intentional security boundaries and should remain in place.

Proposed fix

Handle same-document fragment activation within the sandboxed preview and scroll to the document target without network navigation. Preserve authored handlers, annotation mode, relative resource resolution, and immutable artifact bytes. Add browser regressions for ordinary and encoded fragments, keyboard activation, legacy named anchors, missing targets, and sandbox isolation.

A focused implementation and browser verification are in progress.