fix(web): address the review of the workspace-file route

Isolation is restored on the premise the review corrected: a workspace file
need not be agent-authored — a read row makes every file in a cloned
repository openable — and a same-origin active document was measured driving
/api/settings.describe to a 200 with full data. Script-capable documents go
back into an opaque origin; the preview's lost localStorage is the known cost,
and a separate serving origin is the way to retire it.

- confine(): a workspace rooted at a filesystem root has a realpath already
  ending in the separator, and the doubled prefix 403'd every child.
- turnDeliverables(): reset on the turn boundary, not only at a closing
  assistant, so an interrupted turn cannot spill into the next turn's row;
  and recognize a mutation by render intent (diff card, or generic with
  kind 'edit') so str_replace_editor's insert counts.
- 405 answers name the methods it allows.
- The e2e now cold-seeds a recorded WRITE turn, so the assembled application
  covers the Produced row, its chip's served URL, and the isolation header.
- Agent Note matched to what shipped (the row is in this PR, not deferred);
  ui-conversation README documents the new destination and the row; the
  fixture lane's dead-tab quirk and the cold-path listing cost are recorded.

apps/web/tests/workspace-file-open.e2e.ts

@@ -1,29 +1,31 @@
-// Web e2e scenario: clicking a tool row's file path opens that file in a new
-// browser tab, served by the web transport's own /f route. Cold-seeds the
-// seeded-history fixture (zero model calls). The surface package tests can
-// assert which opener the click reaches, but only the assembled application
-// proves the opened URL actually serves the workspace file — the whole point
-// of the route (docs/testing.md snapshot rule).
-import { mkdir, readFile, writeFile } from 'node:fs/promises'
+// Web e2e scenario: a produced file, from the row that lists it to the bytes
+// the browser gets. Cold-seeds a recorded write turn (zero model calls).
+// Package tests cover the derivation and the route in isolation, but only the
+// assembled application shows that the turn's Produced row, the URL it opens,
+// and the file on disk are the same thing (docs/testing.md snapshot rule).
+import { readFile, writeFile, mkdir } from 'node:fs/promises'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import type { Browser, Page } from 'playwright'
 import { chromium } from 'playwright'
 import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
 import {
-  fixtureUserPrompts, launchWebScaffold, seedSession, watchConsole, webSnapshotMode, type WebScaffold,
+  launchWebScaffold, seedSession, watchConsole, webSnapshotMode, type WebScaffold,
 } from './scaffold.ts'
 import { newEnglishPage, saveFailureShot } from './support.ts'
 
-// Borrowed read-only: this scenario needs any settled turn whose tool rows
-// carry a workspace file path, not a new recording (message-actions pattern).
-const SEED = fileURLToPath(new URL('./snapshots/seeded-history/seed.jsonl', import.meta.url))
+// Borrowed read-only: this scenario needs any settled turn whose tools WROTE a
+// file, not a new recording (the message-actions borrowing pattern).
+const SEED = fileURLToPath(new URL('./snapshots/permission-policy-context/session.jsonl', import.meta.url))
 const MODE = webSnapshotMode()
 const SEED_ID = 'workspace-file-open-web-e2e'
 
-const PROMPT = 'Use the read tool twice in one assistant message: read a.txt and b.txt. Then reply with the single word DONE and stop.'
+/** The file the borrowed recording's write tool produces. */
+const PRODUCED = 'policy-neutral.txt'
+/** An active document placed alongside it, for the isolation header the route puts on those. */
+const ACTIVE = 'preview.html'
 
-describe('web e2e: opening a workspace file from a tool row', () => {
+describe('web e2e: opening a produced file from the conversation', () => {
   let scaffold: WebScaffold
   let browser: Browser
   let page: Page
@@ -31,15 +33,13 @@ describe('web e2e: opening a workspace file from a tool row', () => {
 
   beforeAll(async () => {
     scaffold = await launchWebScaffold({})
-    // The seeded Session's cwd is the scaffold workspace itself; the recording's
-    // own nested directory is written too, so the seed's paths stay resolvable.
+    // The seeded Session's cwd is the scaffold workspace; the recording's own
+    // nested directory is created too, so its paths stay resolvable.
     await mkdir(join(scaffold.workspaceCwd, 'workspace'), { recursive: true })
-    for (const dir of [scaffold.workspaceCwd, join(scaffold.workspaceCwd, 'workspace')]) {
-      await writeFile(join(dir, 'a.txt'), 'alpha\n')
-      await writeFile(join(dir, 'b.txt'), 'beta\n')
-    }
+    await writeFile(join(scaffold.workspaceCwd, PRODUCED), 'neutral\n')
+    await writeFile(join(scaffold.workspaceCwd, ACTIVE), '<h1>produced</h1>\n')
     const raw = await readFile(SEED, 'utf8')
-    expect(fixtureUserPrompts(raw), 'borrowed seed must carry the drive prompt').toEqual([PROMPT])
+    expect(raw, 'borrowed recording must carry the write this scenario reads').toContain(PRODUCED)
     await seedSession(scaffold, raw, SEED_ID)
     browser = await chromium.launch()
     page = await newEnglishPage(browser)
@@ -53,7 +53,7 @@ describe('web e2e: opening a workspace file from a tool row', () => {
     await scaffold?.close()
   })
 
-  it.skipIf(MODE === 'record')('opens the read row’s file in a new tab, served from the session workspace', async () => {
+  it.skipIf(MODE === 'record')('ends the turn with its produced file, which opens as the workspace file itself', async () => {
     onTestFailed(() => saveFailureShot(page, 'web-e2e-workspace-file-open'))
     const groupRow = page.locator('[role="treeitem"]').first()
     await groupRow.waitFor({ timeout: 15_000 })
@@ -61,26 +61,32 @@ describe('web e2e: opening a workspace file from a tool row', () => {
     const sessionRow = page.locator('[role="treeitem"]').nth(1)
     await sessionRow.waitFor({ timeout: 10_000 })
     await sessionRow.click()
-    await expect.poll(() => page.getByText('DONE', { exact: true }).count(), { timeout: 15_000 }).toBe(1)
 
-    // The row summary IS the link: a button whose label is the tool's path.
-    const fileLink = page.getByRole('button', { name: 'a.txt', exact: true }).first()
-    await fileLink.waitFor({ timeout: 10_000 })
+    // The row the turn ends with — derived from the write call's locations,
+    // not from whatever the closing message happened to say.
+    const chip = page.getByRole('button', { name: `Open ${PRODUCED}`, exact: true }).first()
+    await chip.waitFor({ timeout: 15_000 })
+    expect(await chip.innerText()).toBe(PRODUCED)
+
     const [opened] = await Promise.all([
       page.context().waitForEvent('page', { timeout: 15_000 }),
-      fileLink.click(),
+      chip.click(),
     ])
     await opened.waitForLoadState('domcontentloaded')
-    expect(new URL(opened.url()).pathname).toBe(`/f/${SEED_ID}/a.txt`)
-    expect(await opened.locator('body').innerText()).toContain('alpha')
+    expect(new URL(opened.url()).pathname).toBe(`/f/${SEED_ID}/${PRODUCED}`)
+    expect(await opened.locator('body').innerText()).toContain('neutral')
 
-    // The served response is a workspace read, not a download, and never cached
-    // past the turn that produced it.
     const served = await page.request.get(opened.url())
     expect(served.status()).toBe(200)
     expect(served.headers()['x-content-type-options']).toBe('nosniff')
     expect(served.headers()['cache-control']).toBe('no-store')
 
+    // A workspace file is not necessarily agent-authored, so an active document
+    // is served into an opaque origin rather than same-origin with /api.
+    const active = await page.request.get(`${scaffold.baseUrl}/f/${SEED_ID}/${ACTIVE}`)
+    expect(active.status()).toBe(200)
+    expect(active.headers()['content-security-policy']).toContain('sandbox')
+
     // Nothing outside the Session's workspace is reachable through the route.
     const escape = await page.request.get(`${scaffold.baseUrl}/f/${SEED_ID}/..%2Fetc%2Fhosts`)
     expect(escape.status()).toBe(404)