Render Command-clicked HTML files in browser panes - #9096

Summary

• Route terminal-linked .html and .htm files to the existing cmux Browser pane instead of FilePreviewPanel, across visible-path and Ghostty OPEN_URL routing in Workspace and Dock containers.
• Preserve FilePreview/external fallbacks when browser routing is disabled, unavailable, or remote.
• Keep local navigation on the existing BrowserPanel file-loading path, which uses loadFileURL(_:allowingReadAccessTo:) with the containing directory so sibling page assets work.
• Distinguish custom, WebKit-default, and non-web user-agent policy outcomes so file:// navigation clears stale custom identity without entering a cancel/replay loop.

Why: command-clicked agent-generated HTML was shown as raw source, and the first runtime build exposed a separate WebKit user-agent replay loop that left the Browser pane blank.

Regression coverage

• 147d96f417: failing behavior tests for .html/.htm visible-path routing and Dock terminal-link routing.
• fb56973857 and 1c848d8311: failing WebKit/package policy tests proving non-web destinations must be distinct from WebKit-default HTTP(S) identity.
• 74b1dd9faf: explicit policy resolution fix; local files clear custom identity without requesting navigation restart.

Testing

• swift test --package-path Packages/macOS/CmuxBrowser — 251 tests passed.
• xcrun swiftc -frontend -parse on every changed Swift file — passed.
• ./scripts/lint-pbxproj-test-wiring.sh — passed (625 test files checked).
• git diff --check — passed.
• Canonical cmux Aziz policy check — clean.
• Full CI run 30432310065 passed, including all app-host shards, package tests, warning-budget/build-and-lag coverage, and the universal Release build.
• Tagged Blacksmith cloud build 30435672942 passed at 0c2c39703a.

Final tagged-app verification completed at 0c2c39703a using the production Command-click harness through the tag-bound socket. /tmp/test.html opened as file:///tmp/test.html in a Browser panel (no FilePreview or Markdown panel), rendered hello and rendered, and computed the paragraph as rgb(0, 128, 0). A second local page loaded sibling CSS and JavaScript from its containing directory, and the debug log showed one file: policy decision followed by allow with no cancel/replay loop.

Demo Video

• No video attached. Final isolated tagged-app verification completed successfully; screenshots were captured for both the exact rendered repro and the sibling-asset proof.

Review Trigger (Copy/Paste as PR comment)

@codex review
@coderabbitai review
@greptile-apps review
@cubic-dev-ai review

Checklist

• I tested the change locally (package tests, parser, wiring, and the earlier tagged routing repro)
• I added or updated tests for behavior changes
• I updated docs/changelog if needed (not applicable: no docs or user-facing copy changed)
• I requested bot reviews after my latest commit (trigger comment below)
• All code review bot comments are resolved or have a verified reasoned disposition
• All human review comments are resolved (none submitted)

Closes #8627

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by cubic

Open command‑clicked and terminal‑linked .html/.htm files in the in‑app browser pane across Workspace and Dock, with deferral and safe fallbacks. Also formalizes non‑web user‑agent policy so local files clear custom identity without restarting, and fixes an RPC session capture bug, fulfilling #8627.

• New Features

  • Route .html/.htm to the Browser from command‑click and terminal links via TerminalHTMLFileBrowserAction, with injectable UserDefaults, deferral when containers aren’t ready, and fallback to file preview or external; keep BrowserPanel’s local asset loading path.
  • Add BrowserUserAgentPolicyResolution in CmuxBrowser: non‑web destinations are not applicable and clear the custom identity without a restart; Google Sheets uses WebKit’s default identity. Tests cover visible‑path and Dock routing and these policy outcomes.

• Bug Fixes

  • In CmuxMobileRPC, capture the MobileCoreRPCSession actor immutably during queued write recovery to prevent dropped work.

^{Written for commit 0c2c397. Summary will update on new commits.}

Summary by CodeRabbit

• New Features
  • Supported .html/.htm terminal links now open in a Browser panel (including docked layouts) when enabled in settings.
  • HTML link handling can be deferred and retried until the target panel/container is available.
• Bug Fixes
  • Improved local HTML routing reliability with more consistent fallbacks to the external browser when browser handling isn’t possible.
  • Browser user-agent policy now clears any custom identity for non-web destinations without requiring a restart.
• Tests
  • Added/updated coverage for HTML routing in visible/docked panels and destination-based user-agent policy resolution behavior.