feat(explorer): basic file management with drag & drop

[thePlannerIvan]

Summary

Adds VSCode-explorer-parity file management to the sidebar file tree:

• New file / new folder: hover buttons on folder rows (and the root row) plus context-menu entries; inline name input (Enter commits, Esc cancels, collapsed parents auto-expand).
• Rename: context menu opens an inline input on the row (Enter / Esc).
• Delete: context menu arms a two-step inline confirmation (permanent, recursive; the session cwd itself can never be removed).
• Drag & drop: files and folders drag onto directory rows, the root row or the explorer body to move; target rows highlight; moving into one's own subtree is refused; affected levels refetch after every mutation.
• Host API: fs.mkdir, fs.create, fs.rename, fs.move, fs.remove - all confined to the session cwd (isWithin, 403 otherwise), single-segment name validation ('.', '..', '/', '' refused), 'wx' create so existing files are never silently overwritten.
• Explorer listing also filters macOS Finder metadata files (.DS_Store, .localized).

Files changed

src/fs-tree.ts, src/index.ts, src/client/api.ts, src/client/ExplorerView.tsx

Verification

• pnpm run typecheck: pass
• pnpm test: 417 passed / 5 failed - identical to clean main (pre-existing environment failures, unrelated to this PR)
• pnpm run build: pass

Notes

• Labels for the new actions are hardcoded zh strings for now (matching the GUI); happy to move them into locales.ts if preferred.
• lib/ artifacts intentionally not included (build output).

[Menghuan1918]

@codex Do CR

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[Menghuan1918]

@codex do cr now

[chatgpt-codex-connector]

Summary

• Reviewed the explorer file-management implementation and fixed two high-impact issues:
  • Mutation paths now resolve their parent directories before use, preventing symlinked directories from escaping the session working-directory boundary. src/index.tsL220-L239 src/index.tsL281-L301
  • Rename and move operations now reject existing destinations instead of silently overwriting files or directories. src/index.tsL303-L337
• Prevented API callers from renaming, moving, or deleting the session working directory itself. src/index.tsL303-L306 src/index.tsL319-L324 src/index.tsL339-L345
• Added route-level regression tests verifying that destination contents are preserved and symlink traversal cannot create files outside the session cwd. tests/smoke.spec.tsL421-L464
• Committed the fixes as 1f0d6fe fix(explorer): harden file mutations and prepared the follow-up PR titled “fix(explorer): prevent unsafe file mutations.”

Testing

• ✅ pnpm exec vitest run tests/smoke.spec.ts — 32 tests passed.
• ✅ pnpm run typecheck
• ✅ pnpm run build
• ✅ git diff --check
• ⚠️ pnpm test — 423 tests passed and one unrelated environment-dependent test failed because the expected node-pty spawn-helper prebuild is absent.

View task →