feat: agent context configuration

apps/backend-agent-manager/project.json

@@ -213,7 +213,13 @@
       "defaultConfiguration": "test"
     },
     "start-containers": {
-      "dependsOn": ["api-container-image"],
+      "dependsOn": [
+        "api-container-image",
+        "worker-container-image",
+        "vnc-container-image",
+        "ssh-container-image",
+        "agi-container-image"
+      ],
       "cache": false,
       "executor": "nx:run-commands",
       "options": {

apps/frontend-agent-console/src/i18n/messages.de.xlf

@@ -438,6 +438,22 @@
         <source>Open Editor</source>
         <target>Editor öffnen</target>
         </trans-unit>
+      <trans-unit id="featureChat-openAgentConfigFiles" datatype="html">
+        <source>Open agent config</source>
+        <target>Agentenkonfiguration öffnen</target>
+        </trans-unit>
+      <trans-unit id="featureChat-openAgentConfigFilesTitle" datatype="html">
+        <source>Open provider agent config files (requires workspace management access)</source>
+        <target>Provider-Konfigurationsdateien öffnen (erfordert Verwaltungszugriff auf den Arbeitsbereich)</target>
+        </trans-unit>
+      <trans-unit id="featureChat-openAgentConfigFilesNewWindow" datatype="html">
+        <source>Open agent config in New Window</source>
+        <target>Agentenkonfiguration in neuem Fenster öffnen</target>
+        </trans-unit>
+      <trans-unit id="featureChat-agentConfigBadge" datatype="html">
+        <source>Agent config</source>
+        <target>Agentenkonfiguration</target>
+        </trans-unit>
       <trans-unit id="featureChat-openVirtualDesktop" datatype="html">
         <source>Open Virtual Desktop</source>
         <target>Virtuellen Desktop öffnen</target>

apps/frontend-agent-console/src/i18n/messages.xlf

@@ -299,6 +299,18 @@
       <trans-unit id="featureChat-openEditor" datatype="html">
         <source>Open Editor</source>
         </trans-unit>
+      <trans-unit id="featureChat-openAgentConfigFiles" datatype="html">
+        <source>Open agent config</source>
+        </trans-unit>
+      <trans-unit id="featureChat-openAgentConfigFilesTitle" datatype="html">
+        <source>Open provider agent config files (requires workspace management access)</source>
+        </trans-unit>
+      <trans-unit id="featureChat-openAgentConfigFilesNewWindow" datatype="html">
+        <source>Open agent config in New Window</source>
+        </trans-unit>
+      <trans-unit id="featureChat-agentConfigBadge" datatype="html">
+        <source>Agent config</source>
+        </trans-unit>
       <trans-unit id="featureChat-openVirtualDesktop" datatype="html">
         <source>Open Virtual Desktop</source>
         </trans-unit>

libs/domains/framework/backend/feature-agent-controller/docs/overview.mmd

@@ -30,10 +30,10 @@ flowchart TB
 
     subgraph FILES["📁 HTTP REST API - Proxied File System (/api/clients/:id/agents/:agentId/files)"]
         direction TB
-        FILES_USE["Use Case: File System Operations via Client<br/>Proxy to Remote Agent-Manager<br/>Request-Response Pattern"]
-        FILES_USE --> FILES1["📖 Read File (Proxied)<br/>GET /api/clients/:id/agents/:agentId/files/*path<br/>Returns: File Content (base64)"]
-        FILES_USE --> FILES2["✍️ Write File (Proxied)<br/>PUT /api/clients/:id/agents/:agentId/files/*path<br/>Returns: 204 No Content"]
-        FILES_USE --> FILES3["📂 List Directory (Proxied)<br/>GET /api/clients/:id/agents/:agentId/files?path=<br/>Returns: File Nodes"]
+        FILES_USE["Use Case: File System Operations via Client<br/>Proxy to Remote Agent-Manager<br/>Optional query context=app|config (config needs workspace management)"]
+        FILES_USE --> FILES1["📖 Read File (Proxied)<br/>GET /api/clients/:id/agents/:agentId/files/*path?context=<br/>Returns: File Content (base64)"]
+        FILES_USE --> FILES2["✍️ Write File (Proxied)<br/>PUT /api/clients/:id/agents/:agentId/files/*path?context=<br/>Returns: 204 No Content"]
+        FILES_USE --> FILES3["📂 List Directory (Proxied)<br/>GET /api/clients/:id/agents/:agentId/files?path=&context=<br/>Returns: File Nodes"]
         FILES_USE --> FILES4["➕ Create File/Dir (Proxied)<br/>POST /api/clients/:id/agents/:agentId/files/*path<br/>Returns: 201 Created"]
         FILES_USE --> FILES5["🗑️ Delete File/Dir (Proxied)<br/>DELETE /api/clients/:id/agents/:agentId/files/*path<br/>Returns: 204 No Content"]
     end

libs/domains/framework/backend/feature-agent-controller/docs/sequence-http-files.mmd

@@ -11,8 +11,9 @@ sequenceDiagram
 
     rect rgb(230, 240, 255)
         Note over Client,Remote: Read File (Proxied)
-        Client->>API: GET /api/clients/{id}/agents/{agentId}/files/{path}
-        API->>FileProxy: readFile(clientId, agentId, filePath)
+        Client->>API: GET /api/clients/{id}/agents/{agentId}/files/{path}?context=app|config
+        API->>API: authorizeFileProxyRequest<br/>(ensureClientAccess or<br/>ensureWorkspaceManagementAccess if config)
+        API->>FileProxy: readFile(clientId, agentId, filePath, context)
         FileProxy->>Repo: findByIdOrThrow(clientId)
         Repo-->>FileProxy: client entity
         alt Authentication Type: API_KEY
@@ -25,16 +26,16 @@ sequenceDiagram
             FileProxy->>FileProxy: getAuthHeader(clientId)<br/>Returns: Bearer {token}
         end
         FileProxy->>FileProxy: buildAgentFilesApiUrl(endpoint, agentId)
-        FileProxy->>Remote: GET {endpoint}/api/agents/{agentId}/files/{path}<br/>Authorization: Bearer {token/apiKey}
+        FileProxy->>Remote: GET .../files/{path}?context=...<br/>Authorization: Bearer {token/apiKey}
         Remote-->>FileProxy: 200 OK<br/>{content: base64, encoding: 'utf-8'|'base64'}
         FileProxy-->>API: FileContentDto
         API-->>Client: 200 OK<br/>{file content}
     end
 
     rect rgb(240, 255, 240)
         Note over Client,Remote: Write File (Proxied)
-        Client->>API: PUT /api/clients/{id}/agents/{agentId}/files/{path}<br/>{content: base64, encoding?}
-        API->>FileProxy: writeFile(clientId, agentId, filePath, writeFileDto)
+        Client->>API: PUT /api/clients/{id}/agents/{agentId}/files/{path}?context=app|config<br/>{content: base64, encoding?}
+        API->>FileProxy: writeFile(clientId, agentId, filePath, writeFileDto, context)
         FileProxy->>Repo: findByIdOrThrow(clientId)
         Repo-->>FileProxy: client entity
         FileProxy->>FileProxy: getAuthHeader(clientId)

libs/domains/framework/backend/feature-agent-controller/spec/openapi.yaml

@@ -1265,7 +1265,8 @@ paths:
           name: path
           schema:
             type: string
-          description: Directory path relative to /app (defaults to '.')
+          description: Directory path relative to the selected context root (defaults to '.')
+        - $ref: '#/components/parameters/fileManagerContext'
       responses:
         '200':
           description: Array of file nodes
@@ -1275,8 +1276,10 @@ paths:
                 type: array
                 items:
                   $ref: '#/components/schemas/FileNodeDto'
+        '400':
+          description: Invalid context or agent type does not support configuration file access (proxied from agent-manager)
         '403':
-          description: User does not have access to this client
+          description: User does not have access to this client, or lacks workspace management rights when context is config
         '404':
           description: Client, agent, or directory not found
   /clients/{id}/agents/{agentId}/files/{path}:
@@ -1303,7 +1306,8 @@ paths:
           required: true
           schema:
             type: string
-          description: File path relative to /app (supports nested paths)
+          description: File path relative to the selected context root (supports nested paths)
+        - $ref: '#/components/parameters/fileManagerContext'
       responses:
         '200':
           description: File content (base64-encoded)
@@ -1312,9 +1316,9 @@ paths:
               schema:
                 $ref: '#/components/schemas/FileContentDto'
         '400':
-          description: Invalid path
+          description: Invalid path, invalid context, or agent type does not support configuration file access
         '403':
-          description: User does not have access to this client
+          description: User does not have access to this client, or lacks workspace management rights when context is config
         '404':
           description: Client, agent, or file not found
     put:
@@ -1340,7 +1344,8 @@ paths:
           required: true
           schema:
             type: string
-          description: File path relative to /app (supports nested paths)
+          description: File path relative to the selected context root (supports nested paths)
+        - $ref: '#/components/parameters/fileManagerContext'
       requestBody:
         required: true
         content:
@@ -1351,9 +1356,9 @@ paths:
         '204':
           description: File written successfully
         '400':
-          description: Invalid path or content too large
+          description: Invalid path, content too large, invalid context, or agent type does not support configuration file access
         '403':
-          description: User does not have access to this client
+          description: User does not have access to this client, or lacks workspace management rights when context is config
         '404':
           description: Client or agent not found
     delete:
@@ -1379,14 +1384,15 @@ paths:
           required: true
           schema:
             type: string
-          description: File or directory path relative to /app (supports nested paths)
+          description: File or directory path relative to the selected context root (supports nested paths)
+        - $ref: '#/components/parameters/fileManagerContext'
       responses:
         '204':
           description: File or directory deleted successfully
         '400':
-          description: Invalid path
+          description: Invalid path, invalid context, or agent type does not support configuration file access
         '403':
-          description: User does not have access to this client
+          description: User does not have access to this client, or lacks workspace management rights when context is config
         '404':
           description: Client, agent, or file/directory not found
     patch:
@@ -1412,7 +1418,8 @@ paths:
           required: true
           schema:
             type: string
-          description: Source file or directory path relative to /app (supports nested paths)
+          description: Source file or directory path relative to the selected context root (supports nested paths)
+        - $ref: '#/components/parameters/fileManagerContext'
       requestBody:
         required: true
         content:
@@ -1423,9 +1430,9 @@ paths:
         '204':
           description: File or directory moved successfully
         '400':
-          description: Invalid path or destination
+          description: Invalid path, destination, invalid context, or agent type does not support configuration file access
         '403':
-          description: User does not have access to this client
+          description: User does not have access to this client, or lacks workspace management rights when context is config
         '404':
           description: Client, agent, or source file/directory not found
     post:
@@ -1451,7 +1458,8 @@ paths:
           required: true
           schema:
             type: string
-          description: File or directory path relative to /app (supports nested paths)
+          description: File or directory path relative to the selected context root (supports nested paths)
+        - $ref: '#/components/parameters/fileManagerContext'
       requestBody:
         required: true
         content:
@@ -1462,9 +1470,9 @@ paths:
         '201':
           description: File or directory created
         '400':
-          description: Invalid request
+          description: Invalid request, invalid context, or agent type does not support configuration file access
         '403':
-          description: User does not have access to this client
+          description: User does not have access to this client, or lacks workspace management rights when context is config
         '404':
           description: Client or agent not found
   /clients/{id}/agents/{agentId}/environment:
@@ -3304,6 +3312,18 @@ components:
       type: http
       scheme: bearer
       bearerFormat: JWT
+  parameters:
+    fileManagerContext:
+      name: context
+      in: query
+      required: false
+      schema:
+        type: string
+        enum: [app, config]
+        default: app
+      description: |
+        Proxied to agent-manager. `app` (default) is the workspace root; `config` is the provider configuration directory when supported.
+        When `config` is set, the caller must have workspace management rights (same as other workspace configuration APIs).
   schemas:
     AuthenticationType:
       type: string