feat(agent-consoles): remote file browser — read-only, MCP-backed (slice 3)

[brettchien]

What

Slice 3 of the agent-consoles ADR (#49) — the remote file editor's read path (Part D), on fresh main (slices 1 #66 + 2 #67 + registry editor #69 + the Part D decision #70 all merged). Adds a capability-gated, read-only directory browser + file viewer to the agent console.

Reworked after #70 — fs is MCP, not bespoke fs/*

The Part D decision (#70) locked the mechanism: fs is an MCP files server the target agent exposes, reached Studio-brokered via the oab reverse-MCP tool — not a bespoke fs/* method set on /acp. This slice was rewritten to match:

• Dropped the earlier draft's bespoke crates/acp-tunnel fs/* client (fs.rs + Session::fs_list/fs_read/fs_stat) — the mechanism docs(adr): agent-consoles Part D — fs = MCP files server, Studio-brokered #70 rejected. No Rust change in this PR now.
• Kept the browser UI it fronted — it is source-agnostic and unchanged in behaviour.

The fs MCP server + the oab fs-relay are upstream (openab) and absent today, the same bucket as token streaming / tool_call. So this slice ships the UI + the source-agnostic read contract now; live fs traffic (MCP-backed read, then write/apply) lands in slice 4 with the server + relay. On a real endpoint the browser shows a "pending the fs MCP files server" placeholder; the browser build's mock serves a fixture filesystem so the surface is reviewable.

Changes (console)

• fileBrowser.ts — capability-gated directory browser + read-only CodeMirror viewer, mounted per open console, disposed on close/switch. .toml highlighted; strictly read-only.
• render.ts — pure fsListingHtml (dirs-before-files, sizes, open-marking, data-fs-* nav hooks) + fsUnavailableHtml.
• types/source/fixtures — the fs view-models; fsCapability/fsList/fsRead (Mock = fixture FS; Tauri = honestly unsupported until slice 4).
• index.html / styles.css — the Files region (listing + viewer split).

ADR fidelity / security

• Read-only — fs/write/Apply is slice 4, gated at the fs server's tool level: agent-declared roots, writable default-off, explicit Apply, no /-wide default.
• Least privilege intact — filesystem content over the Studio-brokered MCP channel; the oab relay stays management-only, no orchestrator/kube creds, no reverse-MCP grant widening.

Testing

• console — tsc --noEmit clean · 84 vitest (incl. fs render cases) · vite build OK.
• No Rust change (the bespoke acp-tunnel fs client is removed).

Follows: slice 4 — fs MCP server + oab fs-relay, then write/apply.

🤖 Generated with Claude Code