[maxy-shpfy]

Description

Gives the Tangent browser (sidekick) sub-agent access to the session's shared resource catalog — the files Prime, the user, or agents on other environments contribute to a session (e.g. an uploaded uploads/*.pipeline.yaml) — so a pipeline produced in one environment can be read, written, and imported from another.

What's added

• Session-resource tools for the remote editor sub-agent (sessionResourceTools.ts): list_session_resources, read_session_resource, and put_session_resource. These are host capabilities (not CSOM mutations) and reach the main-thread socket client through a narrow, per-turn SessionResourceBridge Comlink proxy, scoped to the turn's session. They are always attached outside the spawn allowlist — mirroring the pi host, whose resource extension is likewise always registered — and appear only when the host wired a bridge for that turn.
• Host wiring (remoteEnvHost.ts, createRemoteEnvWorkerApi.ts, session.ts): runTurn now accepts an optional resources bridge backed by the session socket client (listResources / readResource / addResource), and a session-scoped readResource host method for reading a resource by its handle without holding the socket.
• import_pipeline workarea tool (createWorkareaRemoteTools.ts): imports a complete pipeline and opens it in the Dynamic Workarea from either a resourceUri (a session resource another agent contributed) or inline yaml, instead of rebuilding node by node. The pipeline is attached to the project automatically.
• importAndAttachPipeline (createAndAttachPipeline.ts): validates the YAML is a graph pipeline spec, assigns an available unique name, creates the file, and attaches it — reusing a shared attachOrCleanup helper extracted from createAndAttachPipeline.
• decodeBase64Utf8 utility (string.ts) for decoding resource content.
• Sidekick prompt guidance (remoteEditor.md) explaining the resource catalog and that it is separate from the live canvas.

Related Issue and Pull requests

Stacked on #2914 (base branch maxy/chore--describe-browser-remote-env-for-tangent).

Type of Change

• New feature

Line Breakdown

Category	Added	Removed
Production code	334	19
Comments	28	0
Tests	99	0
Docs	4	0
Total	465	19

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Test Instructions

1. Open a Tangent project session and connect a browser environment.
2. Contribute a pipeline YAML to the session (e.g. have Prime or another environment's agent put an uploads/*.pipeline.yaml).
3. Ask the sidekick agent to list_session_resources and confirm the uploaded file appears with its name, uri, and kind.
4. Have it read_session_resource by uri and confirm the decoded contents match.
5. Have it put_session_resource and confirm other agents / Prime can fetch the written file from uploads/.
6. Use import_pipeline with that resourceUri (and separately with inline yaml) and confirm the pipeline opens in the Dynamic Workarea and is attached to the project (shows up in Resources). Verify a non-graph YAML is rejected, and that passing both resourceUri and yaml errors.

Additional Comments

Reading a resource does not change the pipeline, and editing the pipeline does not touch the catalog — the two surfaces are intentionally separate.

[github-actions]

🎩 Preview

A preview build has been created at: maxy/feat--tangent-browser-agent-support-session-resources/041b550