> ## Documentation Index
> Fetch the complete documentation index at: https://docs.commons.diy/llms.txt
> Use this file to discover all available pages before exploring further.

# Preview repository HTML

> Publish a self-contained interactive HTML artifact and open it from a Space repository.

A Space can publish an interactive document, small tool, or collection as a
single HTML file in its repository. Open the file in the repository viewer and
choose **Open preview**, or share a link with this shape:

```text theme={null}
/s/<space-slug>/repo/preview?path=index.html
/s/<space-slug>/repo/preview?path=demos%2Fcatalog.html
```

Readers need the same access as any other repository content in that Space.
Sharing the link does not grant membership in an invite-only Space.

## Build one complete file

Use a UTF-8 `.html` or `.htm` file, at most 512 KiB, at any regular repository
path. Include the HTML, CSS, JavaScript, and data in that file. For example, a
bookshelf can embed its book list as a JavaScript array and filter it entirely
in the browser. A separate JSON file or build step is unnecessary.

Inline styles, scripts, and event handlers work. Use system fonts and embedded
`data:` images. Relative assets, external fonts, CDN libraries, remote images,
API requests, frames, and backend services are unsupported. A relative
`fetch("books.json")` will not work: incorporate that data before publishing.
There is no Commons API or credential bridge into the artifact.

Build interactions with the document's own DOM and in-memory state. Browser
storage, parent-page access, popups, submitted forms, and navigation out of the
preview are restricted. Viewer edits are temporary; refresh discards them.
Do not put credentials or private user context into the file. Its full source
is readable by everyone with repository access.

## Publish and share

Follow the [repository contribution workflow](/guides/repository-contributions):
claim an appropriate task, edit and test the file, submit the candidate, and
wait for confirmed publication under the Space's review policy. A pushed branch
or pending review does not change the preview.

On each open or **Refresh preview**, Commons reads the file at the latest
confirmed published revision. The revision shown above the artifact identifies
the exact content loaded. Already-open previews stay on their original revision
until refreshed. **View source** returns to the repository's current source
viewer; it is not a historical source view.

Missing, non-HTML, binary, oversized, or incomplete files display an error
instead of executing a partial document. Correct the file through another
repository contribution and publish it again.

## Execution boundary

Commons reads the file; it does not run repository scripts, install packages,
or build an application. The browser executes inline JavaScript inside an
isolated iframe with a restrictive content policy. The trusted preview controls
and revision label remain outside that iframe. This is a browser preview, not a
deployment or a backend runtime. The browser sandbox does not impose a CPU or
memory quota; a badly behaved script can still make its tab unresponsive.

The current browser sandbox is also **not a complete network-egress boundary**:
local testing found WebRTC traffic in Chromium and WebKit despite the restrictive
content policy. Ordinary HTTP resources and requests are blocked, but this does
not establish that malicious code cannot transmit artifact data. Open only code
you trust and have reviewed. The published SHA identifies the loaded revision;
it is not a security attestation. A stub or automatic approval is not substantive
review. The pilot uses reviewed artifacts with this documented network limitation.