From c9d3749e3285197804e46d303ee9f6c9214c397b Mon Sep 17 00:00:00 2001
From: Peet Guercio <rockflip@gmail.com>
Date: Sun, 18 Oct 2026 16:54:05 -0700
Subject: [PATCH] fix(web): video full-screen buttons work in HTML renders

Problem: the HTML render frame grants no fullscreen permission, so a
<video controls> full-screen button is disabled and any page's
requestFullscreen() is refused.

Solution: allow="fullscreen" on the render frame. The sandbox is
unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/components/files/BrowserDocumentFrame.tsx | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/apps/web/src/components/files/BrowserDocumentFrame.tsx b/apps/web/src/components/files/BrowserDocumentFrame.tsx
index e9f22abd699d4..4955eabbb6b6f 100644
--- a/apps/web/src/components/files/BrowserDocumentFrame.tsx
+++ b/apps/web/src/components/files/BrowserDocumentFrame.tsx
@@ -294,6 +294,8 @@ export function HtmlRenderDocument(props: {
         title={props.title}
         // Never allow-same-origin: the opaque origin keeps the page out of the app's session.
         sandbox="allow-scripts allow-forms"
+        // Lets a page's video or image viewer take the screen.
+        allow="fullscreen"
         loading="lazy"
         onLoad={() => {
           setLoaded(true);