Comment by HPsquared

I've had a fair bit of success making miniature "local HTML with embedded JS, no external resources" apps like this. You just have a single file that runs in the browser like an Excel macro but much more secure. You can have the JS and CSS embedded within the HTML file too, which makes it even easier.

I'd use a plain file picker for loading instead of the file system access API. That's even less security cross-section.