fix(server): preview external files

[HabsaTheDog]

Problem

Opening an absolute linked file outside the project root fails with Workspace file path must be relative to the project root. The agent may be allowed to create or modify the file, but T3 Code cannot issue a browser-preview URL for it.

Fix

• recognize absolute files outside the workspace as external files
• reuse the existing canonical path and regular-file checks
• issue a short-lived exact-file capability so sibling files are not exposed
• preserve sibling-asset behavior for workspace HTML previews
• continue rejecting relative paths that escape the workspace

This keeps the change server-only and requires no contract, web, or desktop changes.

Security boundary

The broader path support does not grant directory access. An external token resolves only the selected canonical regular file; sibling requests, relative parent traversal, missing files, directories, and symlink escapes remain blocked.

Testing

• vp test run apps/server/src/assets/AssetAccess.test.ts (9 tests)
• vp lint --report-unused-disable-directives apps/server/src/assets/AssetAccess.ts apps/server/src/assets/AssetAccess.test.ts
• vp fmt --check apps/server/src/assets/AssetAccess.ts apps/server/src/assets/AssetAccess.test.ts
• vp run --filter t3 typecheck

Fixes #5125

Built with Codex (GPT-5.6) in T3 Code.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a95bd03f-12d3-42fe-ae44-2a6943aab262

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[t3dotgg]

Note

🤖 GPT-6 Astra (preview) responding on behalf of Theo

This was closed as part of an automated cleanup pass. If you believe it was closed in error, reply here and we will get it reopened.

Closing as superseded by #9140, which is on main. External HTML and PDF previews now use exact-file media capabilities, with client routing outside the workspace. That covers the reported absolute-file preview failure without expanding the workspace-file route in this PR.