DRAFT: asset-aware llama.cpp chat and safe export lineage (adapt #246)

[JayceeB1]

Scope

Port the useful behaviors of upstream #246, originally contributed by @OmarB97, without reverting Modly 0.4.3 from llama.cpp/compatible cloud providers back to Ollama. This stacks on our draft #4, not main.

Context-aware chat

• Inject current workspace asset, available/active GLB animation clips, and descriptive sidecar metadata (name, project, tags, parent/root lineage) into the existing local/cloud assistant.
• Use a small stdlib-only api/services/asset_context.py module for bounded reads. Reject traversal, sibling-prefix escapes, symlink escapes and oversized sidecars/GLB JSON chunks.
• Treat filenames and metadata as untrusted labels, not instructions.
• Restore long, resizable ParamSchema.multiline text input controls.
• 5 isolated Python tests passed.

Mesh-export lineage

• Carry sourceAssetPath from a loaded mesh across process nodes and the process-runner input type, instead of guessing ancestry at the exporter.
• If incoming branches disagree on origins, leave lineage unspecified.
• On export, realpath-confine reads to the workspace, cap sidecar/GLB metadata sizes, and write two refs only: immediate parent and original root (when known).
• Avoid following untrusted ancestor metadata as filesystem locations.
• Add 7 new Node tests for direct parent/root, multi-generation ancestry, GLB fallback, symlink/prefix escape, malformed references and oversized data.
• Explicitly wire the parameter-binding and lineage suites into npm run test:node.

Status / remaining gates

• Isolated Python asset-context tests: 5/5.
• Isolated Node lineage tests: 7/7 on Node 22/Linux.
• Source code remains in one child branch; published upstream and fork main unchanged.
• Combined npm test, npm run lint, TS type checks, Electron build and full Windows runtime tests.
• Test actual GLB exports through multi-hop workflows and the renderer → Python bridge → llama.cpp request path.
• Review sidecar metadata trust model and malformed workflow paths with the maintainers.

See docs/experimental-library-integration-ledger.md for the running ledger. No work from lightningpixel#252 is included.

Draft only: not a validated application build. Do not merge/package based solely on isolated tests.