FileInspector

Browses an app's own file storage. Every path is resolved against a fixed set of app-owned roots and canonicalized; anything escaping a root (.., symlinks, absolute paths) is refused. Text previews are redacted. Only regular files are ever touched -- never a directory tree -- across every operation here, including create/replace/rename. Every mutation (and readBytes, since it returns raw unredacted bytes) is ungated here -- callers (the Compose adapter in sdk:full, and the browser server routes in sdk:server-ktor) enforce the EditingCapabilities.files opt-in. Declared in sdk:server-api -- a plain boundary module with no Android dependency -- so both surfaces can share this one contract without a circular module dependency, the same way io.devconsole.state.SessionFeatureFlags reaches GET/POST /api/v1/flags.