Fix up #247: route main's other file access through the checked io layer

design.browseTheme reads its path with io::read_file, and File › Info sizes the file with
io::file_len (which checks the read root), so commands_do_not_touch_the_file_system_themselves
passes. spell.rs is allow-listed beside recovery.rs: it touches only the app's own dictionary
folders. main's render_slide MCP tool refuses a `path` argument (#371), so the root tests
render to a file through call_app ui.render instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/engine/src/cmd/design.rs

@@ -152,7 +152,7 @@ fn browse_theme(s: &mut Session, p: &Value) -> Result<Value> {
         #[cfg(not(target_arch = "wasm32"))]
         {
             let path = str_param(p, "path").ok_or_else(|| bad("design.browseTheme", "give `path` or `data`"))?;
-            std::fs::read(path).map_err(|e| crate::EngineError::Other(format!("{path}: {e}")))?
+            crate::io::read_file(path).map_err(crate::EngineError::Other)?
         }
         #[cfg(target_arch = "wasm32")]
         return Err(bad("design.browseTheme", "give `data`"));

crates/engine/src/cmd/file.rs

@@ -476,7 +476,7 @@ fn info(s: &mut Session, _p: &Value) -> Result<Value> {
     let st = s.doc()?;
     let doc = &st.doc;
     #[cfg(not(target_arch = "wasm32"))]
-    let bytes = st.path.as_ref().and_then(|p| std::fs::metadata(p).ok()).map(|m| m.len());
+    let bytes = st.path.as_deref().and_then(crate::io::file_len);
     #[cfg(target_arch = "wasm32")]
     let bytes: Option<u64> = None;
     Ok(json!({

crates/engine/src/file_access.rs

@@ -460,7 +460,11 @@ mod tests {
         for path in files {
             let name = path.file_name().and_then(|n| n.to_str()).unwrap_or("");
             // `io` and this module are the checked gateway; `tests*.rs` are test-only modules.
-            if path.parent() == Some(src.as_path()) && matches!(name, "io.rs" | "file_access.rs" | "recovery.rs") || name.starts_with("tests") {
+            // `recovery` and `spell` touch only the app's own folders (AutoRecover files, the
+            // system and user spelling dictionaries), never a path a command names.
+            if path.parent() == Some(src.as_path()) && matches!(name, "io.rs" | "file_access.rs" | "recovery.rs" | "spell.rs")
+                || name.starts_with("tests")
+            {
                 continue;
             }
             let text = std::fs::read_to_string(&path).unwrap();

crates/engine/src/io.rs

@@ -33,3 +33,16 @@ pub fn write_file(path: &str, bytes: &[u8]) -> Result<(), String> {
 pub fn write_file(path: &str, _bytes: &[u8]) -> Result<(), String> {
     Err(format!("{path}: saving to a path is not available in the browser"))
 }
+
+/// The size in bytes of the file at `path`; `None` when it can't be read (or is outside the
+/// automation read root, so File › Info doesn't reveal files the agent may not read).
+#[cfg(not(target_arch = "wasm32"))]
+pub fn file_len(path: &str) -> Option<u64> {
+    crate::file_access::check_read(path).ok()?;
+    std::fs::metadata(path).ok().map(|m| m.len())
+}
+
+#[cfg(target_arch = "wasm32")]
+pub fn file_len(_path: &str) -> Option<u64> {
+    None
+}