fix(agent-panel): forward currentUri to agent context

[ifeichuan]

Summary

Fixes #2883. When a user selects a directory in the resource tree and switches to the Agent panel, the agent now receives the selected directory URI and can respond to questions like "list the current directory" correctly.

Changes

Frontend (4 files):

• route.tsx: pass currentUri prop to AgentPanel
• agent-panel.tsx: accept currentUri, attach as current_dir in send payload
• use-chat.ts: thread current_dir through send options into request body
• chat.ts: add current_dir?: string to BotChatRequest type

Backend (4 files):

• openapi_models.py: add current_dir: Optional[str] to OpenVikingConnection
• openapi.py: pass through the field
• loop.py: extract current_dir from message metadata, pass to ContextBuilder
• context.py: inject ## User-Selected Directory section into system prompt

Behavior

• current_dir is optional — omitting it preserves existing behavior (zero breaking change)
• Only directory URIs (trailing /) are forwarded; file URIs are not

Testing

1. Start with --with-bot, open Studio playground
2. Select a directory in the resource tree
3. In Agent panel, send "list the current directory"
4. Agent correctly calls openviking_list with the selected directory URI
5. Unrelated questions behave unchanged

[qin-ctx]

Requesting changes for the blocking prompt-injection/input-validation issue on current_dir.

[qin-ctx]

[Bug] (blocking) current_dir comes from the chat request body and is inserted verbatim into the system prompt. A caller can POST a value containing newlines/backticks/instructions, or open Playground with a crafted selected URI, and that text becomes hidden system prompt content under ## User-Selected Directory. This also does not enforce the PR's stated behavior that only directory URIs are forwarded: a file URI or arbitrary text would still be accepted if provided directly. Please validate/sanitize this field before it reaches the prompt. If this input is intentionally trusted, please explain the trust boundary that makes that safe.

[ifeichuan]

Fixed in 623569c.

Good point. current_dir reaches the prompt through the request body, so the bot should not treat it as trusted just because the Studio UI normally derives it from the resource tree. I considered validating at the ov-server proxy boundary with fs.stat, but stat proves existence, not prompt-safety — a real directory whose name contains a backtick would still reach the prompt as `<dir>` and collapse into a fenced code block (three backticks), and validate_viking_uri / VikingURI.normalize do not restrict path-segment characters.

Instead I fixed the root cause at the injection site: the value is now emitted as a JSON object (json.dumps({"current_dir": v})) instead of being interpolated into a markdown code span. Newlines become literal \n (no new line in the prompt), backticks live inside a JSON string the model reads as data, and all structural markdown characters are contained by the JSON structure. This does not depend on any assumption about directory-name characters.

This does not validate that the value is a real directory. Per your note, that is a trust-boundary question: current_dir comes from an authenticated Studio caller via normalizeDirUri; for non-Studio API callers it is a semantic hint whose injection is now neutralized, and whose existence is a functional contract rather than a security one. Happy to add proxy-side stat validation as well if you'd prefer defense-in-depth on existence.

[ifeichuan]

@qin-ctx Please review it again