- HMR/unmount bumps both request generations, so a listing or creation
settling after disposal neither updates dead state nor issues the
post-create relist.
- A selection whose preview listing fails clears back to the single pane:
the breadcrumb names the level, so the level must be the committing
target (reverses the earlier keep-marked behavior with its test).
A draft edit can invalidate the selection's preview request; Escape then
left selected set with no child and nothing loading — a half-empty
two-pane view. Cancel now clears the selection when no preview exists
(ds-review-bot round 7).
Editing the draft bumps the request sequence, so a slow lookup that settles
afterwards can neither clear the newer text nor repopulate the view with
the older path (ds-review-bot round 6).
- Open and New folder disable while a path draft is uncommitted: targetPath
still names the previous selection/listing, and committing against it
while a different path shows in the header adopts the wrong directory.
- The Miller columns keep their own row so a status/error line renders below
them inside the card instead of competing as a third flex item the dialog
clips off-screen.
- Both text inputs (path editor, folder name) carry the IME composition
guard the workspace-name inputs already had: a composing Enter confirms
the candidate, never submits.
With no listed level (an unreadable or missing home directory), the
path-edit zone previously disabled forever, stranding the operator on the
alert with only Cancel; it now opens with an empty draft so an absolute
path remains the way forward. Covered by a recovery test.
Rows keep their NATIVE button role inside a listitem seat (role overrides
exposed selectable folders as passive list items to assistive technology),
the crumb trail becomes a navigation landmark, and the path-edit input joins
the parentInert derivation so the nested create dialog cannot be undercut
through it.
- Dismissal (Escape/mask) is ignored while adoption is busy: the owner's
in-flight createWorkspace must not land behind an apparent cancel.
- Every parent control goes inert while the nested create dialog is open
(Modal traps no focus, so Shift-Tab/AT could close, adopt, or retarget
underneath the child).
- Creation settlements are gated on an open-generation ref: a create that
resolves or rejects after the flow closed (and possibly reopened) can no
longer relist the stale target or surface its alert in the fresh dialog.
- The keyless snapshot waits for the Open button's enabled state before
clicking — on slow runners the selection's child listing was still in
flight and the click landed on a disabled button.
- Escape (and the mask) now reaches only the topmost dialog: while the
nested New-folder dialog is up the browser ignores its own Modal close,
and the nested dialog's in-flight fence keeps both open during creation.
- New folder disables while any listing loads, so a slow post-create
relist/select sequence cannot host a second create against a target the
pending listing is about to change.
- Deep ancestry scrolls inside a dedicated crumb trail whose tail is pinned
into view; the path-edit zone keeps its reserved width instead of being
clipped by the card, preserving cross-drive path entry.
- The workspace-management e2e records a directory-browser aria golden at a
staged tree (host HOME pointed at the scaffold cwd collapses ancestry into
the Home crumb, keeping the artifact machine-independent), and the keyless
snapshot's row targeting goes through visible label text — listitem
accessible-name computation differs across dom-accessibility-api
environments (the CI-only miss).
directory-picker-browse becomes dual-face: its browser half fills
ui-workspace's two directory-flow holes with the Select Workspace Directory
dialog (figma Harness 813-23126 family — Miller two-column view, breadcrumb
with click-to-edit path zone, nested New-folder dialog), driving the node
half's host.listDirectory/host.createDirectory and owning its locale
namespace (directory-browser, zh default / en). The dialog moves here from
ui-workspace wholesale — the trigger surfaces keep only the flow-hole owner
conversation.
apps/cli flips its one directory-picker row -native -> -browse, swapping the
host backend and the client interaction together; picking now works for
remote deployments out of the box. The keyless workspace-flow snapshot boots
the browse bundle and drives menu -> dialog -> Documents -> project -> Open
against the fixture tree.
ds-review-bot round 5: '\\' and '\\server' satisfy win32.isAbsolute and
the previous two-separator test, yet resolve() collapses them to
drive-relative roots. The UNC arm now requires server and share components;
incomplete prefixes reject with the business codes, covered per-platform.
ds-review-bot round 4. On Windows, isAbsolute admits rooted drive-less
forms (\foo, /foo) that resolve() then rebases onto the process's current
drive; both browse primitives now gate on a fullyQualified check (drive
letter or UNC on win32, POSIX-absolute elsewhere) with a platform test
seam, per-platform unit cases, and the contract wording updated on the
seam, the backend README pair, and the error messages.
The picker-kind effect also kept a resolved 'dialog' across close, so a
backend swapped while the menu was closed could paint the stale entry for
one frame on reopen; the close arm now clears the state, pinned by a
reopen-under-pending-read race test.
ds-review-bot round 2. The workspace UI never consulted the advertised
directoryPicker kind: under a browse (or merge-added) backend it still
rendered 'Open local folder…' and called pickDirectory(), which the host
answers with directory-picker-unavailable. The create flow now reads
directoryPickerKind() per menu open and renders the dialog affordance only
under 'dialog' — browse (until its in-app browser UI lands) and unknown
kinds hide the entry, realizing the seam's documented default; a keyless
workspace-flow snapshot pins the hidden entry over the browse fixture.
The browse backend also resolved wire paths, silently rebasing '' or
relative parents under the host process cwd; both primitives now reject
non-absolute explicit paths with their business codes, and the seam JSDoc
carries the contract.
The web GUI's folder picking was hardwired to one interaction: a native
OS chooser compiled into the gateway, unusable for remote deployments
and swappable only by editing apiproxy source.
Directory picking becomes a three-package capability seam in
packages/host: ctx.directoryPicker returns a discriminated capability —
dialog (the extracted native chooser; host-display only) or browse
(new: one-level listing + child creation over Node stdlib, hidden flags
host-stamped, symlinks followed, ancestry crumbs; remote-capable). The
gateway injects the seam, advertises the kind via
host.describe.directoryPicker, serves host.listDirectory /
host.createDirectory under browse, and answers
directory-picker-unavailable across kinds. cordis.yml is the swap
point; apps/cli keeps dialog mounted, so behavior is unchanged until
the in-app browser PR flips the default. The connection fixture serves
a deterministic browse tree; WorkspacesService gains the browse calls
the browser UI will drive. Decision record:
.agents/notes/implemented/architecture/2026-07-28-directory-picker-capability-seam.md
creatixchu