fix(preview): resolve workspace-relative paths against session cwd for HTML and media routes

[kolawong]

Fixes #692. Extends #689.

Symptom

When opening or previewing a workspace-relative file (e.g. pelican-bicycle.html or files emitted by agent tools) in the editor's HTML preview or media preview, the route failed with 400 ENOENT:

{"ok":false,"error":{"code":"fs-error","message":"cannot resolve target \"/pelican-bicycle.html\": ENOENT: no such file or directory, realpath '/pelican-bicycle.html'"}}

Root Cause

1. htmlUrl and fileUrl in src/client/api.ts passed relative file paths (e.g. pelican-bicycle.html) directly into encodeHtmlUrl or the query param without resolving against scope.cwd.
2. When decodeHtmlUrl decoded the pathname, it prepended /, turning pelican-bicycle.html into root /pelican-bicycle.html.
3. The server-side route handler checked ensureWorkspacePath(cwd, "/pelican-bicycle.html"), which treated it as an absolute path at the host root / rather than the session workspace, throwing ENOENT: realpath '/pelican-bicycle.html'.

Changes (Defense in Depth)

1. Client URL Builders (src/client/api.ts):
   • htmlUrl: resolve relative path against scope.cwd via resolveSidebarPath before encoding.
   • fileUrl: resolve relative path against scope.cwd via resolveSidebarPath before setting path search parameter.
2. Server Route Fallback (src/index.ts):
   • In /sidebar/html and /sidebar/file: if the decoded path is not within the session workspace cwd, try candidate join(cwd, target.replace(/^[\/\\]+/, '')). If candidate is within cwd, resolve to candidate safely.
3. Tests (tests/paths.spec.ts):
   • Added test cases verifying workspace-relative path resolution for both htmlUrl and mediaUrl/downloadUrl.

Verification

• pnpm test passed (127 test files, 1347 tests passed).
• pnpm typecheck (tsc --noEmit) clean.
• Verified on live DSH server: /sidebar/html/<sessionId>/pelican-bicycle.html returns HTTP 200 OK with full HTML content rendered properly in the preview iframe.