V0.1.3/m2/webview UI

[Vedansi18]

Adds the decision-session UI surface of the VS Code extension — modules
M6 (WebviewViewProvider), M7 (HTML template), and M8 (prompt
injection) per dev plan §3 M2 §2.2. The webview renders advisory +
options inside Cursor / Windsurf's activity-bar panel, auto-reveals when
a DecisionSessionPayload arrives, and round-trips the user's selection
back to the host's chat input (via clipboard + toast for now; B4 will
plug in a direct-injection primary path via the injectFn contract this
branch sets up). No Layer C file is touched.

Stacked on M2 Branch 1 (v0.1.3/m2/extension-skeleton, commit
879ed5e) per the dependency table in dev plan §3.0. Does NOT depend on
M2/B2 — webview UI is parallelisable with chat-history capture.

Modules covered (per dev plan §3 M2 §2.2)

Module	File(s)	What it does
M6 — View provider	src/webview/view-provider.ts	NexpathDecisionSessionViewProvider implements vscode.WebviewViewProvider. resolveWebviewView wires enableScripts + localResourceRoots +
initial HTML + onDidReceiveMessage + onDidDispose. publishPayload stores the payload, replaces HTML, and calls webviewView.show(true) for the auto-reveal UX matching architecture rev 2 §4 /
discussion log §2 Correction 9. Payload survives view dispose / re-show. Message handler catches onSelect errors so they never become unhandled rejections (added in audit follow-up).
M7 — HTML template	src/webview/html.ts	Pure function renderDecisionSessionHtml(payload, opts) — no I/O. Returns full self-contained HTML for the webview. Two modes: empty/watching state
(no scripts) and populated state (advisory + numbered option buttons + dismiss). CSP default-src 'none' with nonce-scoped scripts. All user-controlled strings HTML-escaped including attribute-breaking
" (</>/&/"/'). Theming via --vscode-* CSS variables — inherits the host's theme automatically.
M8 — Prompt injection	src/webview/prompt-injection.ts	handleOptionSelection(text, deps) with TWO paths: (1) primary — deps.injectFn(text) if provided and returns true; (2) fallback —
vscode.env.clipboard.writeText + info toast directing user to paste. injectFn is the load-bearing contract for Branch 4 to fill in per agent (see memory
project_b4_prompt_injection_contract.md).

Layer C UX consistency

After reading src/decision-session/TtySelectFn.ts (Layer C — DO NOT MODIFY),
the following UX patterns from the existing TTY decision-session were
mirrored into the webview:

TTY pattern	Webview behaviour
Ctrl+X opt-out (TtySelectFn.ts:128)	Webview keydown handler dispatches {type: 'dismiss'}
Standard cancel	Esc also dispatches {type: 'dismiss'}
Numbered options	Visible 1. 2. … prefixes + keys 1–9 dispatch select
First option focus	optionButtons[0].focus() on render
Discoverable hints	Visible (press 1–N, or Esc / Ctrl+X to dismiss) hint in the options header

Not mirrored (intentional): TTY's two-step "Send now / Copy to clipboard"
sub-menu — until B4's injectFn lands, every path ends in clipboard
anyway, so the two-step adds friction without value. TTY's 60s
auto-dismiss timeout — webview is non-modal, the user can let it sit.

Files

Path	Type	Tests
src/ext-vscode/src/webview/view-provider.ts	M6	16
src/ext-vscode/src/webview/view-provider.test.ts	tests	—
src/ext-vscode/src/webview/html.ts	M7	19
src/ext-vscode/src/webview/html.test.ts	tests	—
src/ext-vscode/src/webview/prompt-injection.ts	M8	10
src/ext-vscode/src/webview/prompt-injection.test.ts	tests	—
src/ext-vscode/src/extension.ts (modified)	wiring	+5 tests in extension.test.ts
src/ext-vscode/src/extension.test.ts (modified)	tests	—
src/ext-vscode/package.json (modified)	manifest — view type webview, dropped viewsWelcome (rendered inside the webview now)	—

50 new unit tests added in this branch. Sub-package total: 75 tests
across 6 files (was 25 in B1).

Test plan

Automated

# Root + sub-package typecheck
npx tsc --noEmit                          # root
(cd src/ext-vscode && npx tsc --noEmit)   # sub-package — both EXIT=0

# Sub-package tests in isolation
(cd src/ext-vscode && npx vitest run)
# expected: 75/75 pass across 6 test files

# Full root test suite (vitest picks up sub-package via vi.mock('vscode'))
npm test
# expected: 1901 passing + 18 pre-existing TtySelectFn carry-forward

# Extension bundle still builds
(cd src/ext-vscode && npm run build)
# expected: out/extension.js produced (~12.3 KB — was 3.4 KB in B1)

Manual

End-to-end against a real Cursor / Windsurf is the Branch 5 smoke-test
gate, not this PR. For this branch, manual verification is unit-driven
- esbuild bundle inspection.

To eyeball the webview HTML output:

cd src/ext-vscode
node --input-type=module -e "
import { renderDecisionSessionHtml } from './out/webview/html.js';
console.log(renderDecisionSessionHtml(
  { advisory: 'Consider clarifying scope.', options: [
      { id: 'a', label: 'Refine the request' },
      { id: 'b', label: 'Proceed with caution' },
  ]},
  { cspSource: 'vscode-resource:test' }
));
"
# expected: full HTML printed — advisory + 2 numbered buttons + dismiss button + keyboard hint