feat: add secure multi-runtime controls

Make agent backends configurable and governable with encrypted credentials, explicit context sharing, and tool approval boundaries.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

src/preload/index.ts

@@ -4,7 +4,10 @@ import {
   type AgentRequest,
   type AgentRuntimeStatus,
   type AppInfo,
-  type DesktopApi
+  type ContextAttachment,
+  type DesktopApi,
+  type RuntimeSettings,
+  type RuntimeSettingsInput
 } from '../shared/contracts'
 import { ipcChannels } from '../shared/ipc-channels'
 
@@ -34,12 +37,38 @@ const desktopApi: DesktopApi = {
     cancel: async (requestId: string) => {
       await ipcRenderer.invoke(ipcChannels.agentCancel, requestId)
     },
+    respondApproval: async (approvalId: string, approved: boolean) => {
+      await ipcRenderer.invoke(ipcChannels.agentApprovalRespond, {
+        approvalId,
+        approved
+      })
+    },
     onEvent: (listener) => {
       const handler = (_event: Electron.IpcRendererEvent, payload: AgentEvent): void =>
         listener(payload)
       ipcRenderer.on(ipcChannels.agentEvent, handler)
       return () => ipcRenderer.removeListener(ipcChannels.agentEvent, handler)
     }
+  },
+  settings: {
+    getRuntime: () =>
+      ipcRenderer.invoke(
+        ipcChannels.runtimeSettingsGet
+      ) as Promise<RuntimeSettings>,
+    updateRuntime: (input: RuntimeSettingsInput) =>
+      ipcRenderer.invoke(
+        ipcChannels.runtimeSettingsUpdate,
+        input
+      ) as Promise<RuntimeSettings>
+  },
+  context: {
+    selectFiles: () =>
+      ipcRenderer.invoke(
+        ipcChannels.contextSelectFiles
+      ) as Promise<ContextAttachment[]>,
+    remove: async (contextId: string) => {
+      await ipcRenderer.invoke(ipcChannels.contextRemove, contextId)
+    }
   }
 }