@galda/cli 0.10.80 → 0.10.82

package/app/index.html

@@ -10628,7 +10628,7 @@ function renderCtxBar(){
       + `<span class="pt">\u200e${esc(folderShort(r.dir))}</span></button>`)
     .join('');
   const openRow = `<button type="button" class="appopt ctxopen" id="ctxopenfolder" title="Open the OS folder chooser"><svg viewBox="0 0 24 24"><path d="M3 7a2 2 0 012-2h4l2 2h8a2 2 0 012 2v8a2 2 0 01-2 2H5a2 2 0 01-2-2z"/><path d="M12 11v6M9 14h6"/></svg><span class="nm">Open folder…</span></button>`;
-  menu.innerHTML = `${opts}${openRow}<div class="ctxpath"><input type="text" id="ctxdirin" placeholder="~/path/to/repo" aria-label="Folder path" spellcheck="false"><button type="button" class="appopt" id="ctxdiruse" style="width:auto">Use</button></div><div class="ctxmsg" id="ctxdirmsg"></div>`;
+  menu.innerHTML = `${opts}${openRow}<div class="ctxmsg" id="ctxdirmsg"></div>`;
 }
 // Workspace mode is fixed to the isolated worktree (clean separate checkout). The
 // direct-workspace escape hatch was removed after two accidents where a stray click
@@ -10656,7 +10656,7 @@ async function setProjectFolder(dir){
   const want = String(dir ?? '').trim();
   const msg = $('ctxdirmsg');
   const say = (t, bad) => { if (msg) { msg.textContent = t; msg.classList.toggle('bad', Boolean(bad)); } };
-  if (!want) { say('Type a path, or pick one above.', true); return; }
+  if (!want) { say('Choose a folder.', true); return; }
   say('');
   try {
     const r = await fetch(withKey(`/api/projects/${encodeURIComponent(state.active)}`), {
@@ -10678,14 +10678,14 @@ function isLocalSession(){ return ['localhost', '127.0.0.1'].includes(location.h
 async function openFolderNative(){
   const msg = $('ctxdirmsg');
   const say = (t, bad) => { if (msg) { msg.textContent = t; msg.classList.toggle('bad', Boolean(bad)); } };
-  if (!isLocalSession()) { $('ctxdirin')?.focus(); say('Remote session — pick a repo above or type a path.'); return; }
+  if (!isLocalSession()) { say('Open Manager locally to choose a folder on this computer.', true); return; }
   say('Opening the folder chooser…');
   try {
     const r = await fetch(withKey('/api/choose-folder'), { method: 'POST' });
     const body = await r.json().catch(() => ({}));
     if (body.path) { setProjectFolder(body.path); return; }        // reuse: PUT the project's dir, close, render
     if (body.cancelled) { say(''); return; }
-    if (body.unsupported) { say('This engine can’t open a folder dialog — pick a repo above or type a path.'); return; }
+    if (body.unsupported) { say('This engine can’t open a folder dialog on this system.', true); return; }
     say(body.error || 'Could not open the folder chooser.', true);
   } catch { say('Could not reach the engine.', true); }
 }
@@ -10701,11 +10701,6 @@ $('ctxdirmenu').addEventListener('click', (e) => {
   if (e.target.closest('#ctxopenfolder')) { openFolderNative(); return; }
   const opt = e.target.closest('[data-ctxdir]');
   if (opt) { setProjectFolder(opt.dataset.ctxdir); return; }
-  if (e.target.closest('#ctxdiruse')) setProjectFolder($('ctxdirin')?.value ?? '');
-});
-$('ctxdirmenu').addEventListener('keydown', (e) => {
-  e.stopPropagation();
-  if (e.key === 'Enter' && !e.isComposing && e.target.id === 'ctxdirin') { e.preventDefault(); setProjectFolder(e.target.value); }
 });
 $('appbtn').onclick = (e) => { e.stopPropagation(); $('appmenu').classList.toggle('show'); };
 $('appmenu').addEventListener('click', (e) => {

package/engine/lib.mjs

@@ -97,8 +97,14 @@ export function rebasePreviewUrl(declaredUrl, serverUrl) {
     const declared = new URL(declaredUrl);
     const server = new URL(serverUrl);
     const params = new URLSearchParams(declared.search);
+    // The isolated preview is a different Manager instance with its own
+    // secret.key. A worker declaration can carry the parent instance's stale
+    // `key`, but that credential can never authenticate the ephemeral server.
+    // Preserve all artifact parameters while making the target server the
+    // authority for authentication.
+    if (server.searchParams.has('key')) params.delete('key');
     for (const [key, value] of server.searchParams) {
-      if (!params.has(key)) params.set(key, value);
+      if (!params.has(key) || key === 'key') params.set(key, value);
     }
     server.pathname = declared.pathname || '/';
     server.search = params.toString();

package/engine/server.mjs

@@ -4101,13 +4101,17 @@ const server = createServer(async (req, res) => {
   // (otherwise the dialog would open on the server, not the person's screen). It
   // returns only the chosen path — nothing is scanned, listed, or invented.
   //   { path, label } | { cancelled: true } | { unsupported: true } | { error }
-  // MANAGER_NO_NATIVE_DIALOG (and any non-macOS host) short-circuits to
-  // {unsupported} so tests/CI/headless never block on a GUI.
+  // MANAGER_NO_NATIVE_DIALOG short-circuits so tests/CI/headless never block
+  // on a GUI. macOS, Windows and common Linux desktops use their native picker.
   if (url.pathname === '/api/choose-folder' && req.method === 'POST') {
-    if (process.platform !== 'darwin' || process.env.MANAGER_NO_NATIVE_DIALOG) {
+    if (process.env.MANAGER_NO_NATIVE_DIALOG) {
       return json(res, 200, { unsupported: true });
     }
-    execFile('osascript', ['-e', chooseFolderScript()], { timeout: 120000 }, (err, stdout, stderr) => {
+    const windowsScript = 'Add-Type -AssemblyName System.Windows.Forms; $d = New-Object System.Windows.Forms.FolderBrowserDialog; if ($d.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) { [Console]::Write($d.SelectedPath) }';
+    const command = process.platform === 'darwin' ? 'osascript' : process.platform === 'win32' ? 'powershell.exe' : 'zenity';
+    const args = process.platform === 'darwin' ? ['-e', chooseFolderScript()] : process.platform === 'win32'
+      ? ['-NoProfile', '-NonInteractive', '-Command', windowsScript] : ['--file-selection', '--directory', '--title=Choose a project folder'];
+    execFile(command, args, { timeout: 120000 }, (err, stdout, stderr) => {
       const verdict = parseChosenFolder({ code: err ? (err.code ?? 1) : 0, stdout, stderr });
       if (verdict.path) verdict.label = folderLabel(verdict.path, HOME);
       json(res, 200, verdict);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.80",
+  "version": "0.10.82",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {