Context-tree top panel, vault browser, zoom fixes, framed paste fallback (Aaron's feedback)

[kateebonner]

Implements all three items of Aaron Trowbridge's 2026-07-26 feedback, plus the API-key paste fix Kate requested overnight.

1 · Knowledge graph → top panel, redesigned as the agent's context tree (ADR 0003)

• The inline brain strip is removed from the message timeline (TimelineRow.Brain deleted; ADR 0002's background direction marked superseded).
• New pinned, collapsible panel between the session header and the chat: a left-to-right tidy tree of the agent's actual context — root = amico, branches = turns (roman plates + prompt excerpt), leaves = the distinct markdown/source/skills/agents each turn pulled in. Re-touched items dedupe into thin recall links; marathon sessions fold old turns into one earlier branch.
• Interactive: hover raises labels; clicking a file node opens the real file — project files as a session file tab (same flow as the file tree), vault files land directly in the Vault panel. Wheel zooms about the cursor, drag pans, double-click refits. The log's hover-glance events still work against the tree.
• New purpose-built engine context-tree-engine.ts (declarative setTree, hit-testing, DPR-change-aware, reduced-motion) + pure context-tree-data.ts builder — 20 headless tests.

2 · The vault lives in the interface

• New read-only raw routes beside the mount list: GET /amicode/vault-files (recursive listing; skips dotfiles/machinery; symlinks that escape the mount are not listed) and GET /amicode/vault-file (single read; real-path traversal guard; 512 KB cap; binaries listed but marked unreadable). 14 server tests incl. traversal/symlink adversarial cases.
• New Vault panel drawer: mount chips → file tree → inline Markdown/source viewer. Entry points: titlebar vault button (both titlebar variants), command palette (Toggle vault panel), and context-tree clicks on vault nodes (deep-links to the file).

3 · Command zoom fixes (all hosts)

• Web/amicode host had no in-app zoom at all — added CSS-zoom-based webviewZoom for platform: web with palette commands Zoom in / out / reset (⌘= / ⌘− / ⌘0), persisted per-window; titlebar + terminal already consume the signal.
• Canvas blur after zoom: both engines now watch devicePixelRatio changes (webview zoom changes DPR without a resize) and re-arm per change.
• Desktop: zoom factor now persists across relaunch/new windows; macOS menu items dropped their native roles (they fought the renderer keydown over ⌘=/−/0 with mismatched step math and a stale signal) — one action path on every platform; setZoom now notifies the renderer.
• Canvas hit-testing normalizes by the rendered rect so picks stay true at any zoom.

4 · API-key paste fix (Kate, overnight report)

In any framed host without the amicode relay (VS Code Simple Browser at :3002, plain embeds), the clipboard fallback preventDefaulted native paste, posted a clipboard-request into the void, timed out, and inserted nothing — credential fields pasted dead, silently. An empty/timed-out bridge reply now falls through to navigator.clipboard.readText() — restores paste wherever the host grants clipboard-read; the VS Code webview bridge is unchanged and still wins when it answers. If your repro was elsewhere (e.g. the native Connect Cloud input box, which only appears when no server is up), say where and I'll chase that path too.

Also

• docs/design/agentic-surfaces.md — the agentic-static-elements proposal for you and Aaron to react to (tiered architecture, surface inventory, open questions). No implementation.
• CONTEXT.md glossary updated (Context tree + Vault panel; Brain/Glass retired), ADR 0002 marked superseded.

Verification

• Typecheck clean: app, ui, opencode, desktop. Lint: 0 errors. Build: green.
• Tests: app 442 ✓, ui 345 ✓, new server tests 14 ✓. The full opencode suite has ~18 pre-existing env failures (widget-src temp-dir dynamic imports, recorded-LLM fixtures, two long timeouts) — verified identical with this branch's changes reverted, i.e. not introduced here.
• Multi-agent adversarial review ran over the diff; both surviving findings (symlink listing leak, mount-name shadowing) are fixed with regression tests.

🤖 Generated with Claude Code