code: connect explicit native editor tasks to local core

[erikleblansch]

Superseded by OpenCode

The user selected OpenCode instead of Codex. Continue in #5, which includes this candidate's commits and retains the historical evidence. This PR is closed as superseded, not merged or proved complete; its branch is preserved.

Change

Connect an explicit editor coding command to the prepared open Codex app-server and existing local VOLPAROSSA conversation service. The user selects one writable workspace; native command requests receive interactive one-shot approval. Opening a workspace starts nothing.

The source-bound launcher verifies runtime/build/prompt/node inputs, creates a sparse disposable namespace, excludes the user home and inherited credentials, and forwards native NDJSON unchanged. It performs no download, model startup, OpenAI authentication, public-peer fallback or new peer scheduling. Cancellation and disposal close the exact owned session; uncertain cleanup remains an error.

Evidence and limits

• 37 relevant controller, extension, protocol and launcher checks pass across the focused runs, including one disposal race and the actual bubblewrap-added PWD case.
• A real production-launcher/source-built app-server lifecycle probe passes: initialize, ephemeral VOLPAROSSA thread, unsubscribe and confirmed shutdown. Binary SHA-256: 9635cc912ca720b1dd496ba34ca5be920ec46af4319d936a8aa5e59f57094e9f.
• That probe uses a synthetic capability-only core socket: no model turn, tools or native editor execution. Temporary projects/runtime staging are removed; original files and host network state remain unchanged.
• The separate actual Qwen read/edit/test trial on core c3fb587f failed: it read code and proposed another command on continuation, but the fixture refused that command; no edit/test success is claimed.

General coding quality, actual VS Code/VSCodium model-driven editing, reviewable diffs, multi-turn persistence, additional tool types and eligible cooperative delegation remain unfinished. The README and native-editor guide distinguish implementation from those missing proofs.

Stack

Draft on main after #3 was merged as the local core Responses bridge. Its exact native trial source pins remain unchanged. This separate editor candidate is not a completed coding-agent milestone.

Actual editor UI admission and explicit trial driver

Candidate 41a4320f0a819819adcfa9969ed4780506d6c747 adds the disposable-guest native editor UI driver. Six focused driver/real arithmetic-helper checks pass; no complete model-driven UI success is claimed.

A separate actual installed VSCodium 1.135.06055 UI probe passes inside a disposable network/PID/mount environment with an empty home and no host display/IPC: Command Palette, capabilities view, native-task input, consent dialog, and Cancel before runtime start. It observes zero automatic requests, exactly one request to an explicitly synthetic capability-only service, normal editor exit0, removed private profile and unchanged host networking. This uses genuine CDP keyboard/mouse input, not an injected VS Code API. It executes no model, native app-server or tool.

The full guest driver uses real command approval UI, bounded fixture commands, model-chosen arithmetic edits and an independent test. Run-once approvals, real model-driven editor edits and the final coding-result view still require their actual joined trial. The prepared headless editor needs no Xvfb on this verified build; parent orchestration still owns the core, editor and guest cleanup. See docs/NATIVE_EDITOR.md.