feat(web): serve workspace files from their own origin

A sandbox header bought isolation by taking the document's origin away, and
measuring that cost decided against it: the reported artifact throws
SecurityError on load, and because an uncaught exception aborts the rest of
its <script>, every listener declared after that line — theme toggle, mobile
menu, model tabs — never binds. Two of the four artifacts in the reporting
user's workspace were dead pages under it, and they still looked right.

A second listener on the API's host, answering /f and nothing else, is the
same boundary without the amputation: cross-origin to /api (refused by the
Origin fence and by CORS), same-origin with itself (localStorage, cookies and
fetch all work). Its port is published into the index page; the browser half
reads it to address previews, and its absence — the keyless fixture lane — is
what makes a file row fall back to the Host opener instead of a dead tab.

fileUrl moves from IWorkspaces to ConnectionHandle: the transport owns both
the listener that serves the bytes and the port that addresses it.

apps/web/tests/workspace-file-open.e2e.ts

@@ -73,25 +73,49 @@ describe('web e2e: opening a produced file from the conversation', () => {
       chip.click(),
     ])
     await opened.waitForLoadState('domcontentloaded')
-    expect(new URL(opened.url()).pathname).toBe(`/f/${SEED_ID}/${PRODUCED}`)
+    const url = new URL(opened.url())
+    expect(url.pathname).toBe(`/f/${SEED_ID}/${PRODUCED}`)
     expect(await opened.locator('body').innerText()).toContain('neutral')
 
+    // The isolation: previews come from the app's hostname on a DIFFERENT
+    // port, so a served document is cross-origin to /api while keeping its own
+    // capabilities. A workspace file is not necessarily agent-authored.
+    const app = new URL(scaffold.baseUrl)
+    expect(url.hostname).toBe(app.hostname)
+    expect(url.port).not.toBe(app.port)
+    const filesOrigin = url.origin
+
     const served = await page.request.get(opened.url())
     expect(served.status()).toBe(200)
     expect(served.headers()['x-content-type-options']).toBe('nosniff')
     expect(served.headers()['cache-control']).toBe('no-store')
+    // No document is stripped of its origin: the port is the boundary.
+    expect(served.headers()['content-security-policy']).toBeUndefined()
 
-    // A workspace file is not necessarily agent-authored, so an active document
-    // is served into an opaque origin rather than same-origin with /api.
-    const active = await page.request.get(`${scaffold.baseUrl}/f/${SEED_ID}/${ACTIVE}`)
-    expect(active.status()).toBe(200)
-    expect(active.headers()['content-security-policy']).toContain('sandbox')
+    // An active document keeps its own storage — the capability a sandbox
+    // header would have taken, and the reason this route has its own port.
+    const active = opened
+    await active.goto(`${filesOrigin}/f/${SEED_ID}/${ACTIVE}`, { waitUntil: 'load' })
+    expect(await active.evaluate(() => {
+      try { window.localStorage.setItem('probe', '1'); return 'ok' } catch { return 'blocked' }
+    })).toBe('ok')
+    // …and cannot reach the API, which lives on the other origin.
+    expect(await active.evaluate(async (base) => {
+      try {
+        await fetch(`${base}/api/session.list`, {
+          method: 'POST', headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ type: 'client-request', rpcId: 'x', method: 'session.list', payload: {} }),
+        })
+        return 'reached'
+      } catch { return 'blocked' }
+    }, scaffold.baseUrl)).toBe('blocked')
 
+    // The workspace-file origin serves that one prefix and nothing else.
+    expect((await page.request.get(`${filesOrigin}/`)).status()).toBe(404)
     // Nothing outside the Session's workspace is reachable through the route.
-    const escape = await page.request.get(`${scaffold.baseUrl}/f/${SEED_ID}/..%2Fetc%2Fhosts`)
-    expect(escape.status()).toBe(404)
+    expect((await page.request.get(`${filesOrigin}/f/${SEED_ID}/..%2Fetc%2Fhosts`)).status()).toBe(404)
 
-    await opened.close()
+    await active.close()
     expect(tripwire.pageErrors).toEqual([])
     expect(tripwire.warnings).toEqual([])
   }, 90_000)