feat(web): the Environment browser's tabs in the right panel (Lazurio overlay, 0191 point 12)

[immakermatty]

Status: ready for review. Head a201c7b6531568e01b896e876675d611ad2b77fa, base main f9d8ab6e2f.

Plan: HumanAndMachine-ai/mission-control-data:v3 data/mission-control/plans/2026/10/DEV-6646-environment-browser-and-desktop.yaml, task-2026-10-05-506 (web T3: the Browser panel with the people's view's tabs). Decisions: root 0191 points 11–18 (HumanAndMachines/Lazurio#505), LazurioPlatform F39 (Lazurio/LazurioPlatform#242, pingdotgg#250; released in v0.1.8-rc.39).

Why

The Environment browser's view for people is now LazurioPlatform's own people's view: https://browser.<…>/t/<id> shows exactly one remote tab. When framed, it posts to its parent:

• lazurio-browser:info with its tab's address and title;
• lazurio-browser:new-tab with the /t/<id> address of every tab its page opens as a new tab.

Root decision 0191 point 12: web T3 Code opens such a tab as a new tab of its Browser panel. Elsewhere the view offers it with one click. The existing panel keeps working unchanged with the new view (browser.json?session= answers the thread's /t/<id>); this adds the tabs.

What changes (web only; the desktop app keeps upstream's panel)

• Page tabs in the panel. A page's new tab becomes a surface environment-browser:<target id> with its view's address.
  • It opens in front when it came from the frame in view. It opens behind the surface in view when it came from a hidden frame, typically an agent's work, so the person is not pulled away. It never opens twice.
  • Only messages from the panel's own frame on the framed view's origin count. The address must be exactly https://<host>/t/<32 hex>, with no credentials, query or fragment, on that origin.
  • The address carries no token, so the surface is stored and survives a reload. The thread's own tab is still asked of the Environment on open.
• Titles. A panel tab shows the title its view reports instead of "Browser". Titles are session-only.
• Frames stay mounted while the panel shows the thread, hidden with visibility and inert rather than display:none.
  • The view keeps its viewer, so the Environment does not close a page's tab after its 30 s grace while the person merely looks at another tab or surface.
  • A hidden frame keeps the panel's size, so the remote window is never shrunk to 200×150, the agent's window included.
  • Closing the panel or leaving the thread ends the frames. Closing a tab with × closes its remote tab after the Environment's grace.
• Cost. While the panel is open, each hidden page tab holds a live stream. Frames come only when the remote page repaints, so an idle page costs close to nothing, and a constantly animating one streams continuously.
• Runbook (docs/operations/lazurio-fork-release.md): the new view instead of the dashboard and token, page tabs, mounted frames, the leave and close rules, and the cost.

Verification

• apps/web: pnpm exec vp test run src/lazurio src/rightPanelStore.test.ts src/components/RightPanelTabs.test.tsx src/components/ChatView.logic.test.ts: 258 passed (rerun by the lead).
• node --test scripts/lazurio-release-contract.test.mjs: 17/17 (rerun by the lead).
• pnpm exec vp run --filter @t3tools/web typecheck: exit 0 (rerun by the lead).
• pnpm exec vp fmt --check on the 10 changed files: clean (rerun by the lead).
• The whole web suite (415 files, 5537 tests), vp lint (no new warnings) and the CI allowlist replay passed in the implementer's run.
• Mutation check: each guard (frames shown, inert, background add, user-action accounting, desktop gate, per-thread keys, mounting only the active frame, display:none) was removed alone, and a test failed each time.
• Not done: no hands-on browser check yet. That happens on the pilot Environment with the Platform's rc.39 once a fork release carries this.

Follow-ups (not here)

• "+ Browser" could open a new remote tab (0191 point 11) instead of focusing the thread's own.
• An agent's browser.…/t/<id> link in the chat could open in the panel.
• A dead page tab whose view offers "Open a new tab" keeps its old address in the panel.

Release: the fork's release needs the Organization Admin's approval. This PR does not release.

🤖 Generated with Claude Code

[agentrozjedemeai]

QA review of exact head a201c7b (base f9d8ab6). The new-tab message is gated on the owning iframe and view origin, and the persisted address is restricted to an HTTPS /t/<32-hex> tab on that origin. I checked foreground/background routing, per-thread deduplication, title reporting, mounted but inert/invisible frames, the desktop bypass, and the release allowlist. No blocking finding.

Independent local verification in an isolated clone: 258 focused web tests passed; 17/17 release-contract tests passed; web typecheck passed; formatting clean on all 10 changed files; targeted lint exited 0 with warnings outside the changed lines. The live server/web compatibility job was still pending at the final review gate; this approval does not claim its result. Hands-on pilot browser verification and the Admin-gated fork release remain separate steps.