couldn't you just embed the js directly into the html file though? that would sidestep the CORS error. and since most of the people using a program like this are likely to be using AI to generate their ( likely throwaway ) applets anyway, readability and maintainability for the source doesn't matter as much as it would with human authors so having a separate js file doesn't bring that many advantages anyway.

Sharing HTML files with embedded Javascript is problematic: iOS users can't open the files directly, and have to save the file and then 'open with ... '.

Sounds like iOS is problematic.

Isn't that the price of a relatively well sandboxed experience by browsers?

I've experienced the same limits building small tools for myself and friends that I wanted to contain in a single HTML file without external dependencies... but I understand why the same project without these restrictions could easily become malware, and ones that could be easily propagated.

I wish the browser would either allow local-only or internet-only, then only make up its mind after the first attempted request. Fetch an image from the internet? No script access for local files. Fetch a JS from elsewhere on the hard drive? No internet access. That could provide the sandbox while still being flexible.