Clarify direct and in-chat HTML preview policies

mateclaw-server/src/main/resources/docs/en/chat.md

@@ -116,7 +116,8 @@ Images, audio/video and 3D models always previewed inline — but a Word report
 - **Click to preview**: pdf / docx / xlsx / html / markdown / txt / code files open in a glass-styled preview layer from the attachment card — uploaded and AI-generated alike.
 - **Pure client-side rendering**: PDF, Word and Excel parse and render in the browser — nothing leaves your machine, no external preview service, the single-JAR and desktop packaging story is unchanged.
 - **Server fallback for the stubborn formats**: pptx and legacy binary Office (doc / xls / ppt) are converted to PDF server-side before preview; if the converter (LibreOffice) isn't present, they degrade gracefully to download — no error, no hang.
-- **Safe HTML preview**: rendered in a sandboxed iframe — interactive pages and charts fully work (scripts run), but the iframe sits in an opaque origin and cannot read the app's login state or local storage.
+- **In-chat HTML preview**: HTML fetched with authorization is rendered in an opaque-origin sandboxed iframe. Scripts are allowed to support interactive pages and charts; app same-origin privileges are not granted. This does not guarantee compatibility with every script, network resource, or browser.
+- **Direct generated-file viewing**: opening an HTML/SVG response from `/api/v1/files/generated/{id}` uses a stricter policy: scripts and forms are blocked, with permitted static styles and media retained. Use the in-chat HTML preview for pages that depend on JavaScript; these two viewing paths have different policies.
 
 ### Primary model can't see images? "Multimodal sidecar" routing
 

mateclaw-server/src/main/resources/docs/zh/chat.md

@@ -116,7 +116,8 @@ ChatConsole 不只是你自己聊天的地方。它是一个**运营控制台**
 - **点开即预览**：pdf / docx / xlsx / html / markdown / txt / 代码文件，点击附件卡片在玻璃拟态风格的预览层里打开——上传的和 AI 生成的都一样。
 - **纯前端渲染**：PDF、Word、Excel 都在浏览器里解析渲染，不出网、不依赖任何外部预览服务，单 JAR 与桌面端打包形态不变。
 - **啃不动的格式走服务端兜底**：pptx 与老版二进制 Office（doc / xls / ppt）由服务端转成 PDF 再预览；转换组件（LibreOffice）不在时优雅降级为下载，不报错不卡壳。
-- **HTML 附件安全预览**：在沙箱 iframe 里渲染——交互页面和图表完整可用（脚本可执行），但 iframe 处于隔离源，读不到应用的登录态与本地存储。
+- **聊天内 HTML 预览**：已授权读取的 HTML 在隔离源的沙箱 iframe 中渲染，允许脚本以支持交互页面和图表，不授予应用同源权限。这不保证所有脚本、网络资源或浏览器行为均兼容。
+- **直接查看生成文件**：直接打开 `/api/v1/files/generated/{id}` 的 HTML/SVG 响应采用更严格的策略：禁止脚本和表单，只保留允许的静态样式与媒体。依赖 JavaScript 的页面应使用聊天内 HTML 预览；两种查看路径的策略不同。
 
 ### 主模型不支持图片？走"多模态旁路"