feat(app): open agent-referenced files as rich artifact tabs - #49882

Agents drop files everywhere: screenshots, recordings, reports, generated pages, CSV dumps. Referencing one in a reply used to be a dead end. file:// links were stripped by DOMPurify and blocked by Electron, relative links tried to navigate the renderer, and the file tab decoded every byte as text.

Now a reference in the timeline opens the file in the side panel, the tab renders whatever it is, and the agent can do the same on its own with browser.preview.

flowchart LR
  A["markdown link · `inline/path`"] --> R
  T["agent: browser.preview({ path })"] --> R
  R{inside workspace?}
  R -- no --> N["absolute path · read from its own folder"] --> D
  R -- yes --> D{kind}
  D -- html, local desktop<br/>with browser pane --> E["browser tab: file://"]
  D -- anything else --> F["file tab viewer + Preview / Source"]

Viewers

Before / after

	before	after
image
video
pdf
html

Everything else

timeline links	large image: fit
large image: click → 1:1	svg preview
svg source	audio
markdown preview	markdown source
csv table	font specimen
code via link	code via `inline/path`
mermaid	binary
outside the workspace (C:/tmp/…)

Agent tool

// packages/plugin-browser/src/rpc.ts
operation("preview", "Show a file in the user's Review pane and focus its tab…", { path: short }, Schema.Struct({ path: short }))

server tool browser.preview ─rpc─▶ desktop browser-pane ─ipc─▶ renderer ArtifactOpener.open(path)

Discoverable through search(): the description carries the words agents use (show, display, view, artifact, media, screenshot, image, video, pdf, csv, font, …) and a test pins each phrase. browser.navigate / tabs.open with a file:// URL fail with a message that points here.

The desktop answers immediately and reports { type: "preview", path } on the pane attachment; the renderer resolves the path against the session workspace and applies the same rules as a clicked link. Older desktops answer unsupported through the existing version handshake.

How it fits together

• packages/session-ui: the DOMPurify hook keeps local hrefs as data-local-link (same pattern as data-local-image), and Markdown routes clicks on those anchors and on `path` inline code to a new optional openLocalFile on MarkdownProvider.
• packages/app/src/workspaces/files/artifact.ts: extension → kind/mime, fileContentFromBytes (media stays base64 with a mime type, NUL-sniffed unknown binaries keep only their size), resolveArtifactPath for ../, parseDelimited, contentBytes.
• packages/app/src/session/files/open-artifact.tsx: ArtifactOpenerProvider resolves a link against the workspace root or the referencing file's directory, keeps files outside the root absolute so they still open in a tab, picks a browser tab or a file tab, and subscribes to browser.preview requests.
• packages/app/src/session/files/artifact-view.tsx: the viewers and the toolbar.
• packages/desktop/src/main/browser/policy.ts: the browser pane accepts file:// only when the server endpoint is loopback, since that agent already has the machine's disk. Popups and the agent-facing browser.navigate tool stay HTTP only.

resolveArtifactPath("docs/api", "../index.md") // "docs/index.md"
resolveArtifactPath("docs", "../../etc/passwd") // undefined → outside workspace

fileContentFromBytes("a.png", bytes)
// { type: "binary", content: "iVBOR…", encoding: "base64", mimeType: "image/png" }

Notes

• The HTML preview is an opaque-origin blob document: no app storage, cookies, or credentialed requests reach it. Relative assets inside it do not resolve; on a local desktop server Open in browser loads the real file:// page instead.
• The HTML→browser-tab path and browser.preview need the desktop app with the experimental browser pane; link clicks fall back to the in-app viewer everywhere else.