@neuralis/brain-core 0.3.2 → 0.4.0

package/app/filesystem/ui/SourcesPanel.tsx

@@ -29,7 +29,7 @@ import {
   Trash2,
   type LucideIcon,
 } from 'lucide-react';
-import { meetsRequires } from '@neuralis/package-system/access';
+import { isOwnerOrAdminEffective, meetsRequires } from '@neuralis/package-system/access';
 import { SkillLauncher, createPackageApi } from '@neuralis/package-system/client';
 import { cn } from '../lib/cn';
 import {
@@ -46,23 +46,23 @@ import {
   getSyncStatus,
   startReembed,
   resetSync,
-  browseDirectories,
   listSourceKinds,
   setSourceEnabled,
-  listDiscoverableSources,
   fetchSourceCounts,
+  browseDirectories,
   type SourceKindRecord,
   type DiscoverableSourceSuggestion,
 } from '../api';
-import { dimmedSourceTone, getSourceVisualTone, sourceLiveReasonLabel } from '../lib/treeVisualState';
-import { fieldControl, rootFieldMeta, selectOptionsFrom, type OptionsRoute, type SelectOption } from '../lib/sourceKindForm';
+import { dimmedSourceTone, getSourceVisualTone, sourceLiveReasonLabel, sourceWatchBadge, syncErrorLabel } from '../lib/treeVisualState';
+import { configFields, fieldControl, kindSummary, rootFieldMeta, selectOptionsFrom, transportChosen, type ConfigField, type OptionsRoute, type SelectOption } from '../lib/sourceKindForm';
 import { resolveIconWithFallback, resolveLucideIcon } from '../lib/iconResolver';
-import { useFilesystemStore } from '../store/filesystemStore';
+import { discoverableKey, useFilesystemStore } from '../store/filesystemStore';
 import { fileKey, sourceFromUri, sourceRootUri } from '../store/helpers';
 import { VectorHealthPanel } from './VectorHealthPanel';
 import { PolicyEditor } from './PolicyEditor';
 import { SourceDeleteConfirm } from './SourceDeleteConfirm';
 import { ReembedDialog } from './ReembedDialog';
+import { DEVICE_FOLDER_NOT_ALLOWED, DeviceFolderAsk, FolderPicker, type FolderSuggestion } from './FolderPicker';
 import { useFilesystemHost } from '../FilesystemHost';
 import type {
   SourceConfigRecord,
@@ -115,10 +115,38 @@ type AddDraftState = {
    * in the Policy editor after saving.
    */
   policies: PathPermissionRecord[];
-  /** R2b — create this local source as a package source too (owner/admin). */
-  recognizesPackages: boolean;
+  /** R2b — the folder's package folders, one per line (`.` = the whole folder; owner/admin). */
+  packageFolders: string;
+  /** The chosen device's claimed platform (its WHERE option's), for the folder hint; never submitted. */
+  transportPlatform: string;
 };
 
+/** No suggestions held for the current pair — one stable reference, so a selector never churns. */
+const NO_SUGGESTIONS: readonly DiscoverableSourceSuggestion[] = [];
+
+/** The ONE folder kind (brain-core's connector; the stored `device` picks the transport). */
+const HOST_KIND = 'host';
+
+/**
+ * `packageFolders` ⇄ the one-per-line field both forms show: `.` (or `/`) is the
+ * whole folder (`''`), every other line a folder relative to the source root,
+ * surrounding slashes dropped. The server validates what this produces.
+ */
+function parsePackageFolders(text: string): string[] {
+  const out: string[] = [];
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line) continue;
+    const folder = line === '.' || line === '/' ? '' : line.replace(/^\/+|\/+$/g, '');
+    if (!out.includes(folder)) out.push(folder);
+  }
+  return out;
+}
+
+function formatPackageFolders(folders: readonly string[] | undefined): string {
+  return (folders ?? []).map((folder) => (folder === '' ? '.' : folder)).join('\n');
+}
+
 const DEFAULT_SYNC: NonNullable<UpdateSourceConfigRequest['sync']> = {
   exclude: [],
   trigger: 'manual',
@@ -210,8 +238,14 @@ function suggestedSourceKey(params: {
   return `${base}-${ids.agentSlug || shortToken(ids.agentId)}`;
 }
 
-function scopeOptions(meta: SourceKindRecord | null): SourceScopeKind[] {
-  return meta?.allowedScopes?.length ? meta.allowedScopes : ['project', 'user', 'agent'];
+/**
+ * The scopes the form offers. A DEVICE folder (a transport chosen) is the
+ * attaching owner's user or the project's — never an agent's — mirroring the
+ * server's refusal, so the form never offers what the create would 400.
+ */
+function scopeOptions(meta: SourceKindRecord | null, config: Readonly<Record<string, unknown>> = {}): SourceScopeKind[] {
+  const all: SourceScopeKind[] = meta?.allowedScopes?.length ? meta.allowedScopes : ['project', 'user', 'agent'];
+  return transportChosen(meta, config) ? all.filter((scope) => scope !== 'agent') : all;
 }
 
 function supportsSync(meta: SourceKindRecord | null): boolean {
@@ -246,8 +280,13 @@ function defaultAccess(meta: SourceKindRecord | null): { read: boolean; write: b
   };
 }
 
-function buildAddDraft(meta: SourceKindRecord | null, ids: SourceKeyIds): AddDraftState {
-  const scope = meta?.defaultScope ?? 'project';
+/**
+ * A fresh add-form draft for `meta`. `scopeHint` is the Sources list tab the
+ * person is on: the new source starts there when the kind allows that scope,
+ * otherwise at the kind's own default.
+ */
+function buildAddDraft(meta: SourceKindRecord | null, ids: SourceKeyIds, scopeHint?: SourceScopeKind): AddDraftState {
+  const scope = scopeHint && meta?.scopeSelectable && scopeOptions(meta).includes(scopeHint) ? scopeHint : meta?.defaultScope ?? 'project';
   const access = defaultAccess(meta);
   return {
     // No folder picked yet → base falls back to the kind scheme.
@@ -262,7 +301,8 @@ function buildAddDraft(meta: SourceKindRecord | null, ids: SourceKeyIds): AddDra
     description: '',
     config: defaultConfig(meta),
     policies: [],
-    recognizesPackages: false,
+    packageFolders: '',
+    transportPlatform: '',
   };
 }
 
@@ -286,8 +326,8 @@ function buildDraft(c: SourceConfigRecord): UpdateSourceConfigRequest {
     source: c.source,
     permissions: normalizePerms(c.permissions),
     description: c.description ?? '',
-    // R2b — include in the draft so the toggle participates in isDirty + PATCH.
-    recognizesPackages: c.recognizesPackages ?? false,
+    // R2b — include in the draft so the list participates in isDirty + PATCH.
+    packageFolders: [...(c.packageFolders ?? [])],
     ...(c.sync ? {
       sync: {
         exclude: [...(c.sync.exclude ?? [])],
@@ -358,7 +398,7 @@ export function binarySkipLine(count: number | undefined): string | null {
  * source's own exclude/include globs and its scan cap (`usecases/list.ts`
  * `computeSourcesRegistry` pushes them into `connector.count()`), so editing
  * them moves the count immediately. Everything else a save can carry —
- * description, trigger cadence, `recognizesPackages`, the whole permissions
+ * description, trigger cadence, `packageFolders`, the whole permissions
  * tree — leaves both numbers where they were: the indexed count is a
  * project-scoped `countByFilter` with no per-caller policy input, and the
  * on-disk count is physical truth.
@@ -403,8 +443,12 @@ function triggerLabel(trigger: string): string {
 }
 
 function describeConn(c: SourceConfigRecord, meta: SourceKindRecord | null): string {
+  if (c.root_effective) return c.root_effective;
   const cfg = (c.connection.config ?? {}) as Record<string, unknown>;
-  // Prefer a schema-hint-driven summary: show the first string/number value.
+  // A folder kind names its folder: the form stores the transport (`device`)
+  // first, so "the first value" would show a device id where the path belongs.
+  if (typeof cfg.root === 'string' && cfg.root.length > 0) return cfg.root;
+  // Otherwise a schema-hint-driven summary: show the first string/number value.
   for (const [key, value] of Object.entries(cfg)) {
     if (typeof value === 'string' && value.length > 0) return value;
     if (typeof value === 'number') return String(value);
@@ -412,6 +456,12 @@ function describeConn(c: SourceConfigRecord, meta: SourceKindRecord | null): str
   return meta?.label ?? c.connection.kind;
 }
 
+/** A source this server opens through its container half (`root_effective` is the stored `root`) that has a machine half. */
+function isDockerBind(c: SourceConfigRecord): boolean {
+  const { root, hostRoot } = (c.connection?.config ?? {}) as { root?: unknown; hostRoot?: unknown };
+  return Boolean(hostRoot) && (c.root_effective === undefined || c.root_effective === root);
+}
+
 function sourceSummaryToObservedConfig(
   summary: SourceInfo,
   meta: SourceKindRecord | null,
@@ -435,6 +485,7 @@ function sourceSummaryToObservedConfig(
     ...(summary.origin_package ? { origin_package: summary.origin_package } : {}),
     ...(summary.live !== undefined ? { live: summary.live } : {}),
     ...(summary.live_reason ? { live_reason: summary.live_reason } : {}),
+    ...(summary.live_not_ready ? { live_not_ready: summary.live_not_ready } : {}),
   };
 }
 
@@ -487,10 +538,13 @@ export function SourcesPanel(props: Props) {
   const host = useFilesystemHost();
   const agentsState = host.useAgents();
   const userSlug = useMemo(() => deriveUserSlug(host.currentUser), [host.currentUser]);
-  // R2b — owner/admin-effective (ordinal priority ≤ 2) gates the
-  // `recognizesPackages` toggle in the UI. Server is the enforcement floor; this
-  // only HIDES the control. Undefined priority (no signal) ⇒ hide (deny-by-default).
-  const isOwnerEffective = (host.currentRole?.priority ?? 99) <= 2;
+  // R2b — the package-folders field shows for exactly the callers the server's
+  // gate admits: the SAME kernel predicate (`isOwnerOrAdminEffective`), so the
+  // hide cannot drift from the lock. The server stays the floor; no signal ⇒ hide.
+  const isOwnerEffective = isOwnerOrAdminEffective({
+    priority: host.currentRole?.priority,
+    grantedFeatures: host.grantedFeatures,
+  });
   // warded-wren — affordance mirror for the `sources.mount` gate that now covers
   // browse and the discoverable list. Same shape as `FileTree`'s: the ONE shared
   // kernel predicate, a copy at the boundary because the host keeps the grant
@@ -563,18 +617,18 @@ export function SourcesPanel(props: Props) {
   const healthOpen = useFilesystemStore((s) => s.vectorHealthOpen);
   const setVectorHealthOpen = useFilesystemStore((s) => s.setVectorHealthOpen);
   const [mountOpen, setMountOpen] = useState(false);
-  const [browseOpen, setBrowseOpen] = useState(false);
-  const [browseEntries, setBrowseEntries] = useState<Array<{ name: string; path: string }>>([]);
-  const [browsePath, setBrowsePath] = useState('/');
-  const [browseLoading, setBrowseLoading] = useState(false);
-  const [browseError, setBrowseError] = useState<string | null>(null);
-  const [dockerMounts, setDockerMounts] = useState<Array<{ name: string; path: string }>>([]);
-  const [dockerMountsLoading, setDockerMountsLoading] = useState(false);
+  /** The folder picker under the Folder field (`FolderPicker` owns its listing state). */
+  const [pickerOpen, setPickerOpen] = useState(false);
+  /** The device folder a Create found outside that device's allowed folders: ask, or attach anyway. */
+  const [deviceGuard, setDeviceGuard] = useState<string | null>(null);
   const [kinds, setKinds] = useState<SourceKindRecord[]>([]);
-  const [addKind, setAddKind] = useState<string>('local');
+  const [addKind, setAddKind] = useState<string>(HOST_KIND);
   const [kindsError, setKindsError] = useState<string | null>(null);
-  // W3E — discoverable (well-known but unattached) source roots.
-  const [discoverable, setDiscoverable] = useState<DiscoverableSourceSuggestion[]>([]);
+  // W3E — discoverable (well-known but unattached) source roots: the window
+  // store's ONE copy, shared with the tree's Discover dock (`loadDiscoverable`).
+  const loadDiscoverable = useFilesystemStore((s) => s.loadDiscoverable);
+  const discoverableKeyNow = discoverableKey(agentId, projectId ?? undefined);
+  const discoverable = useFilesystemStore((s) => (s.discoverable?.key === discoverableKeyNow ? s.discoverable.suggestions : NO_SUGGESTIONS));
 
   // Load registered source kinds once per mount — this is what powers the
   // schema-driven picker (replacing the old hardcoded KIND_META).
@@ -585,10 +639,10 @@ export function SourcesPanel(props: Props) {
         if (cancelled) return;
         setKinds(res.kinds ?? []);
         setKindsError(null);
-        const preferred = res.kinds?.find((k) => k.kind === 'local') ?? res.kinds?.[0] ?? null;
+        const preferred = res.kinds?.find((k) => k.kind === HOST_KIND) ?? res.kinds?.[0] ?? null;
         if (preferred) {
           setAddKind(preferred.kind);
-          const draft = buildAddDraft(preferred, sourceKeyIds);
+          const draft = buildAddDraft(preferred, sourceKeyIds, activeScope);
           autoKeyRef.current = draft.key;
           setAddDraft(draft);
         }
@@ -607,13 +661,22 @@ export function SourcesPanel(props: Props) {
   }, [kinds]);
   const selectedKind = kindByName.get(addKind) ?? null;
   const selectedKindSupportsSync = supportsSync(selectedKind);
-  const rootField = rootFieldMeta(selectedKind);
+  const rootField = rootFieldMeta(selectedKind, addDraft.config, addDraft.transportPlatform);
   const selectedKindNeedsPath = rootField.needed;
-  // The container-plane affordances: the `/mounts` volume picker, the
-  // `neuralis:mount` callout, and Browse (which readdirs in the SERVER process,
-  // i.e. the wrong machine for a host-plane root — that root lives on the paired
-  // device chosen below, bounded by that device's own allowlist).
-  const showContainerPathChrome = selectedKindNeedsPath && rootField.container;
+  // The non-root fields in the one-page order: WHERE first (it decides what the
+  // folder means), the plain fields, the advanced ones folded.
+  const formFields = configFields(selectedKind, addDraft.config);
+  // The device the folder lives on — the transport field's value — or `null` for this server.
+  const chosenDeviceValue = formFields.transport[0] ? addDraft.config[formFields.transport[0].key] : undefined;
+  const chosenDevice = typeof chosenDeviceValue === 'string' && chosenDeviceValue ? chosenDeviceValue : null;
+  // The picker's start on this server: the discoverable folders of the host kind
+  // (already loaded with the list — no request of its own).
+  const folderSuggestions = useMemo<FolderSuggestion[]>(
+    () => discoverable
+      .filter((s) => s.suggestedKind === HOST_KIND && typeof s.suggestedConfig.root === 'string')
+      .map((s) => ({ name: s.label, path: s.suggestedConfig.root as string })),
+    [discoverable],
+  );
 
   /**
    * Open the Add-Source form prefilled from a discoverable suggestion.
@@ -696,33 +759,34 @@ export function SourcesPanel(props: Props) {
   /** Whether the key field still holds an auto-suggestion (safe to re-suggest). */
   const keyIsUntouched = (key: string) => key === '' || key === autoKeyRef.current;
 
-  const load = useCallback(async () => {
+  const load = useCallback(async (fresh = true) => {
     if (!projectId) return; // Don't fetch without projectId — it would query the wrong directory
     setLoading(true);
     setError(null);
     try {
-      // W3E — load source configs and discoverable suggestions in parallel.
-      const [next, discoverableRes] = await Promise.all([
+      // W3E — load source configs and discoverable suggestions in parallel. The
+      // suggestions go through the store's one owner: on open an answer the
+      // tree's dock already holds (or is fetching) is reused; every other call
+      // (Refresh, after a mutation) re-reads, so an attached root drops out.
+      const [next] = await Promise.all([
         listSourceConfigs({
           agentId,
           projectId,
           scope: activeScope,
         }, client),
-        listDiscoverableSources({ agentId, projectId }, client)
-          .catch(() => ({ suggestions: [] as DiscoverableSourceSuggestion[] })),
+        loadDiscoverable({ agentId, projectId }, { fresh }),
       ]);
       setConfigs(next);
       setDrafts(Object.fromEntries(next.map((c) => [c.source, buildDraft(c)])));
       setExpanded((prev) => Object.fromEntries(next.map((c) => [c.source, prev[c.source] ?? false])));
-      setDiscoverable(discoverableRes.suggestions ?? []);
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Failed to load sources');
     } finally {
       setLoading(false);
     }
-  }, [activeScope, agentId, projectId]);
+  }, [activeScope, agentId, projectId, loadDiscoverable]);
 
-  useEffect(() => { if (open) void load(); }, [open, load]);
+  useEffect(() => { if (open) void load(false); }, [open, load]);
 
   // On panel open, do a COUNT-FREE refresh: the connector-first list merge still
   // populates `sourceSummaries` (`s.sources`) with source discovery (observed-only
@@ -792,21 +856,6 @@ export function SourcesPanel(props: Props) {
     return () => clearTimeout(t);
   }, [successMsg]);
 
-  // Docker mode: load available volume mounts when +Source form opens
-  useEffect(() => {
-    if (!showAddForm || !isDocker || !canMount) return;
-    setDockerMountsLoading(true);
-    browseDirectories({ path: '/mounts', agentId, ...(projectId ? { projectId } : {}) }, client)
-      .then((result) => {
-        // Filter out volumes already configured as sources
-        const configuredSources = new Set(configs.map((c) => c.source));
-        const unmounted = result.entries.filter((e) => !configuredSources.has(e.name));
-        setDockerMounts(unmounted);
-      })
-      .catch(() => setDockerMounts([]))
-      .finally(() => setDockerMountsLoading(false));
-  }, [showAddForm, isDocker, canMount, agentId, projectId, configs]);
-
   const merged = useMemo(() => {
     const seen = new Set<string>();
     const rows: Array<SourceConfigRecord & {
@@ -835,6 +884,8 @@ export function SourcesPanel(props: Props) {
         // the row icon + name when the connector can't reach its backing store.
         live: s?.live,
         live_reason: s?.live_reason,
+        live_not_ready: s?.live_not_ready,
+        watch: s?.watch,
         kind_icon: s?.kind_icon,
       };
     });
@@ -842,7 +893,9 @@ export function SourcesPanel(props: Props) {
     if (activeScope === 'project') {
       for (const summary of sourceSummaries) {
         const source = sourceFromUri(summary.uri_root);
-        if (!source || seen.has(source)) continue;
+        // A source configured at the user or agent scope is edited on its own
+        // tab — only one with no config at all is runtime-observed here.
+        if (!source || seen.has(source) || (summary.config_scope !== undefined && summary.config_scope !== 'project')) continue;
         const meta = kindByName.get(summary.source_kind) ?? null;
         const counts = countsBySource[source] ?? summary;
         rows.push({
@@ -897,13 +950,13 @@ export function SourcesPanel(props: Props) {
       // "no change" server-side and would preserve the old config. Send an
       // explicit clear flag when the source HAD sync and the draft turned it off.
       const clearSync = !draft.sync && !!config.sync;
-      // R2b — `recognizesPackages` is owner/admin-effective + local-only on the
-      // server. `buildDraft` always carries it, so STRIP it for a non-owner (or
-      // non-local source) to avoid tripping the server's owner-only gate on an
+      // R2b — `packageFolders` is owner/admin-effective + folder-kind-only on
+      // the server. `buildDraft` always carries it, so STRIP it for a non-owner
+      // (or another kind) to avoid tripping the server's owner-only gate on an
       // unrelated description/sync edit. Owner-effective callers send the real value.
-      const canEditRecognizes = isOwnerEffective && config.connection.kind === 'local';
-      const { recognizesPackages: _rp, ...draftRest } = draft;
-      const payload = canEditRecognizes ? draft : draftRest;
+      const canEditPackageFolders = isOwnerEffective && config.connection.kind === HOST_KIND;
+      const { packageFolders: _pf, ...draftRest } = draft;
+      const payload = canEditPackageFolders ? draft : draftRest;
       const updated = await updateSourceConfig({
         agentId,
         ...(projectId ? { projectId } : {}),
@@ -1004,17 +1057,18 @@ export function SourcesPanel(props: Props) {
   // the same time. Keep every hook above the guard.
   if (!open) return null;
 
-  const handleSync = async (source: string) => {
+  const handleSync = async (source: string, confirmEmpty = false) => {
     setSyncingSource(source);
     setError(null);
     try {
-      await triggerSourceSync({ agentId, ...(projectId ? { projectId } : {}), source }, client);
+      await triggerSourceSync({ agentId, ...(projectId ? { projectId } : {}), source, ...(confirmEmpty ? { confirmEmpty } : {}) }, client);
       await pollSyncJob(source);
       await load();
       await refresh({ agentId, projectId, withCounts: true });
       clearCachedCounts(source);
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Sync failed');
+      await load(); // the row's last-sync error (and its Sync anyway) comes from the reloaded config
+      setError(err instanceof Error ? syncErrorLabel(err.message) : 'Sync failed');
     } finally {
       setSyncingSource(null);
     }
@@ -1149,25 +1203,7 @@ export function SourcesPanel(props: Props) {
     }
   };
 
-  const openBrowser = async (path: string) => {
-    setBrowseOpen(true);
-    setBrowseLoading(true);
-    setBrowseError(null);
-    try {
-      const result = await browseDirectories({ path, agentId, ...(projectId ? { projectId } : {}) }, client);
-      setBrowseEntries(result.entries);
-      setBrowsePath(path);
-    } catch {
-      // One stable sentence, matching the route: the server never returns the
-      // path or the errno, so there is nothing here worth surfacing verbatim.
-      setBrowseError('That path is not available.');
-      setBrowseEntries([]);
-    } finally {
-      setBrowseLoading(false);
-    }
-  };
-
-  const selectBrowsePath = (path: string) => {
+  const selectPickedFolder = (path: string) => {
     setAddDraft((d) => {
       // Re-suggest the key from the picked folder's name — but only while the
       // key is still an auto-suggestion. A manually-typed key is preserved.
@@ -1176,18 +1212,88 @@ export function SourcesPanel(props: Props) {
       autoKeyRef.current = key;
       return { ...d, path, key };
     });
-    setBrowseOpen(false);
+    setPickerOpen(false);
   };
 
-  const handleAddSource = async () => {
+  /** One non-root config field (WHERE, a plain field, an advanced one) — its control from the declaration. */
+  const renderConfigField = ({ key, prop, label, help, placeholder }: ConfigField) => {
+    const field = fieldControl(prop, selectedKind?.packageId ?? '');
+    const isTransport = formFields.transport.some((f) => f.key === key);
+    const setValue = (value: string, option?: SelectOption) => {
+      setAddDraft((prev) => {
+        const d = isTransport ? { ...prev, transportPlatform: option?.platform ?? '' } : prev;
+        const config = { ...d.config, [key]: value };
+        const before = transportChosen(selectedKind, d.config);
+        const after = transportChosen(selectedKind, config);
+        if (before === after) return { ...d, config };
+        // Choosing a device makes the folder its owner's own by default
+        // (the server's default too): user scope, never agent, and
+        // nothing granted until the owner widens it — a device folder
+        // at project scope would otherwise open somebody's machine to
+        // every member the moment it exists. Back to this server: the
+        // kind's own defaults.
+        return after
+          ? { ...d, config, scope: 'user' as SourceScopeKind, read: false, write: false, exec: false }
+          : { ...d, config, scope: selectedKind?.defaultScope ?? 'project', ...defaultAccess(selectedKind) };
+      });
+      // A different machine: the open picker listed the other one.
+      if (isTransport) setPickerOpen(false);
+    };
+    return (
+      <div key={key} className="space-y-1">
+        <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">{label}</div>
+        {field.control === 'select' ? (
+          <OptionsRouteSelect
+            route={field.options}
+            {...(field.emptyLabel ? { emptyLabel: field.emptyLabel } : {})}
+            revision={deviceRevision}
+            projectId={projectId}
+            agentId={agentId}
+            value={String(addDraft.config[key] ?? '')}
+            onChange={setValue}
+          />
+        ) : (
+          <input
+            type={field.numeric ? 'number' : 'text'}
+            value={String(addDraft.config[key] ?? '')}
+            onChange={(e) => setValue(e.target.value)}
+            placeholder={placeholder ?? key}
+            className={inputCls}
+          />
+        )}
+        {help ? <div className="text-[8px] text-white/30 italic">{help}</div> : null}
+        {field.control === 'text' && field.refused ? (
+          <div className="text-[9px] text-amber-300/80">{field.refused}</div>
+        ) : null}
+      </div>
+    );
+  };
+
+  const handleAddSource = async (attachAnyway = false) => {
     if (!addDraft.key || (selectedKindNeedsPath && !addDraft.path)) return;
     setAddCreating(true);
     setError(null);
     try {
+      // A folder outside what the device allows would attach and then answer
+      // `host_fs_denied` on every read: say so BEFORE creating and offer the
+      // ask — attaching first and granting later stays a choice. One browse of
+      // that folder per Create (the device's clamp answers `ceiling_denied`
+      // whether or not it exists); any other answer creates as before.
+      if (chosenDevice && selectedKindNeedsPath && !attachAnyway) {
+        const verdict = await browseDirectories({ path: addDraft.path, agentId, ...(projectId ? { projectId } : {}), device: chosenDevice }, client).catch(() => null);
+        if (verdict?.state === 'ceiling_denied') {
+          setDeviceGuard(addDraft.path);
+          return;
+        }
+      }
+      setDeviceGuard(null);
+      // An optional field left empty is not sent: an empty `device` would be a
+      // malformed device id, not "this server".
       const config = {
-        ...addDraft.config,
+        ...Object.fromEntries(Object.entries(addDraft.config).filter(([, value]) => value !== '')),
         ...(selectedKindNeedsPath ? { root: addDraft.path } : {}),
       };
+      const packageFolders = parsePackageFolders(addDraft.packageFolders);
       await createSource({
         agentId,
         ...(projectId ? { projectId } : {}),
@@ -1210,15 +1316,16 @@ export function SourcesPanel(props: Props) {
             ...(linesToList(addDraft.include).length > 0 ? { include: linesToList(addDraft.include) } : {}),
           },
         } : {}),
-        // R2b — only send when an owner/admin-effective caller opted a local
-        // source in. The server re-gates (owner/admin + local-only).
-        ...(isOwnerEffective && addKind === 'local' && addDraft.recognizesPackages
-          ? { recognizesPackages: true }
+        // R2b — only send when an owner/admin-effective caller listed package
+        // folders. The server re-gates (owner/admin + folder kind only).
+        ...(isOwnerEffective && addKind === HOST_KIND && packageFolders.length > 0
+          ? { packageFolders }
           : {}),
       }, client);
       setShowAddForm(false);
+      setPickerOpen(false);
       {
-        const reset = buildAddDraft(selectedKind, sourceKeyIds);
+        const reset = buildAddDraft(selectedKind, sourceKeyIds, activeScope);
         autoKeyRef.current = reset.key;
         setAddDraft(reset);
       }
@@ -1251,7 +1358,16 @@ export function SourcesPanel(props: Props) {
           <div className="inline-flex items-center gap-0.5">
             <button
               type="button"
-              onClick={() => setShowAddForm((v) => !v)}
+              onClick={() => {
+                // A new source starts on the Sources tab the person is looking at
+                // (when the kind allows that scope and the draft is untouched).
+                if (!showAddForm && keyIsUntouched(addDraft.key) && !addDraft.path) {
+                  const draft = buildAddDraft(selectedKind, sourceKeyIds, activeScope);
+                  autoKeyRef.current = draft.key;
+                  setAddDraft(draft);
+                }
+                setShowAddForm((v) => !v);
+              }}
               className="h-7 px-2 rounded-l-md rounded-r-none text-cyan-300 hover:text-cyan-200 hover:bg-white/[0.05] transition inline-flex items-center gap-1 text-[10px] font-medium"
               title="Add source"
             >
@@ -1287,7 +1403,7 @@ export function SourcesPanel(props: Props) {
 
       {/* Description */}
       <div className="mt-2 text-[10px] text-white/35 italic">
-        Add filesystem-style sources from Neuralis packages. A source URI such as <code className="font-mono">neuralis://</code> or <code className="font-mono">machine-user://</code> is the stable handle agents use with fs_* tools.
+        Add filesystem-style sources from Neuralis packages. A source URI such as <code className="font-mono">neuralis://</code> or <code className="font-mono">&lt;machine-source-slug&gt;://</code> is the stable handle agents use with fs_* tools.
       </div>
 
       <div className="mt-2 flex items-center gap-1 rounded-md bg-white/[0.025] p-1">
@@ -1316,13 +1432,14 @@ export function SourcesPanel(props: Props) {
         <div className="mt-2 rounded-md bg-red-500/8 px-3 py-2 text-[10px] text-red-200/80">{error}</div>
       )}
 
-      {/* Source wizard (inline) */}
+      {/* Source wizard (inline) — one page, in the order a person decides:
+          kind → where → folder → who/what → sync → advanced. */}
       {showAddForm && (
         <div className="mt-2 rounded-lg bg-white/[0.03] border border-white/[0.08] p-3 space-y-2">
           <div className="text-[11px] font-semibold text-white/80">Add Source</div>
           {kindsError && (
             <div className="text-[9px] text-rose-300/80 bg-rose-500/10 rounded px-2 py-1">
-              Could not load source kinds: {kindsError}. Falling back to "local".
+              Could not load source kinds: {kindsError}. Falling back to the host folder kind.
             </div>
           )}
           {kinds.length > 1 && (
@@ -1334,7 +1451,8 @@ export function SourcesPanel(props: Props) {
                   const nextKind = e.target.value;
                   const nextMeta = kindByName.get(nextKind) ?? null;
                   setAddKind(nextKind);
-                  const draft = buildAddDraft(nextMeta, sourceKeyIds);
+                  setPickerOpen(false);
+                  const draft = buildAddDraft(nextMeta, sourceKeyIds, activeScope);
                   autoKeyRef.current = draft.key;
                   setAddDraft(draft);
                 }}
@@ -1347,10 +1465,64 @@ export function SourcesPanel(props: Props) {
                 ))}
               </select>
               <div className="text-[9px] text-white/30 italic">
-                {selectedKind?.description ?? ''}
+                {kindSummary(selectedKind) ?? selectedKind?.description ?? ''}
+                {selectedKind?.runtimeGated ? ' Serves only while its runtime runs.' : ''}
+              </div>
+            </div>
+          )}
+          {formFields.transport.map(renderConfigField)}
+          <div className="text-[10px] text-white/35 italic">
+            {!selectedKindNeedsPath
+              ? 'This connector does not need a local path. Choose the scope; the package owns the runtime binding.'
+              : !rootField.container
+                ? 'A folder on your own paired device. Browse opens the typed folder, or starts from the folders that device allows this server; for another one, ask on that device (tray → Allow a folder…, or neuralis device grant).'
+                : isDocker
+                  ? 'A folder under /mounts — this container’s bind mounts, or a folder inside one. Not there? Add a mount on the host (neuralis mount add) and restart, or attach it from your own device under Where.'
+                  : 'On this server: the project’s own folder (an owner may attach a protected zone). Another folder on your computer: choose your device under Where.'}
+          </div>
+          {selectedKindNeedsPath && (
+            <div className="space-y-1">
+              <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">{rootField.label}</div>
+              <div className="flex gap-1">
+                <input
+                  type="text"
+                  value={addDraft.path}
+                  onChange={(e) => setAddDraft((d) => ({ ...d, path: e.target.value }))}
+                  placeholder={isDocker && rootField.container ? '/mounts/<name>' : rootField.placeholder}
+                  className={cn(inputCls, 'flex-1')}
+                />
+                {/* Browse: a device folder through that device's broker (its
+                    owner only — the route refuses anyone else), a folder here
+                    only for a caller who could attach what they find. */}
+                {rootField.browse && (chosenDevice || canMount) && (
+                  <button
+                    type="button"
+                    onClick={() => setPickerOpen((v) => !v)}
+                    className="h-7 px-2 rounded-md bg-white/[0.04] hover:bg-white/[0.08] border border-white/[0.08] text-white/60 hover:text-white/90 transition shrink-0"
+                    title="Browse folders"
+                  >
+                    <FolderOpen className="h-3.5 w-3.5" />
+                  </button>
+                )}
               </div>
             </div>
           )}
+          {pickerOpen && selectedKindNeedsPath && (
+            <FolderPicker
+              key={chosenDevice ?? 'server'}
+              agentId={agentId}
+              projectId={projectId}
+              client={client}
+              device={chosenDevice}
+              isDocker={isDocker === true}
+              startPath={addDraft.path}
+              suggestions={chosenDevice ? [] : folderSuggestions}
+              wantWrite={addDraft.write}
+              onSelect={selectPickedFolder}
+              onClose={() => setPickerOpen(false)}
+            />
+          )}
+          {formFields.fields.map(renderConfigField)}
           {selectedKind?.scopeSelectable && (
             <div className="space-y-1">
               <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">Scope</div>
@@ -1369,215 +1541,27 @@ export function SourcesPanel(props: Props) {
                 }}
                 className={selectCls}
               >
-                {scopeOptions(selectedKind).map((scope) => (
+                {scopeOptions(selectedKind, addDraft.config).map((scope) => (
                   <option key={scope} value={scope}>{scope}</option>
                 ))}
               </select>
             </div>
           )}
-          {showContainerPathChrome && isDocker ? (
-            <>
-              <div className="text-[10px] text-amber-300/70 bg-amber-500/8 rounded px-2 py-1.5">
-                Docker mode: host folders still need the CLI mount script:{' '}
-                <code className="text-amber-200/90 font-mono">neuralis mount add</code>{' '}
-                on the host, then restart the container. Package sources like Machine do not require a host path here.
-              </div>
-              {/* Unmounted volume mounts */}
-              {dockerMountsLoading ? (
-                <div className="flex items-center gap-1.5 py-1">
-                  <Loader2 className="h-3 w-3 animate-spin text-white/30" />
-                  <span className="text-[9px] text-white/35">Scanning volume mounts...</span>
-                </div>
-              ) : dockerMounts.length > 0 ? (
-                <div className="space-y-1">
-                  <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">
-                    Available volume mounts (not yet configured)
-                  </div>
-                  {dockerMounts.map((mount) => (
-                    <div key={mount.path} className="flex items-center gap-2 rounded px-2 py-1.5 bg-white/[0.02] hover:bg-white/[0.04] transition">
-                      <Folder className="h-3 w-3 text-cyan-400/70 shrink-0" />
-                      <span className="text-[10px] text-white/75 font-medium flex-1 truncate">{mount.name}</span>
-                      <span className="text-[9px] text-white/30 font-mono truncate max-w-[120px]">{mount.path}</span>
-                      <button
-                        type="button"
-                        onClick={() => {
-                          setAddDraft((d) => ({ ...d, key: mount.name, path: mount.path }));
-                        }}
-                        className="px-2 py-0.5 rounded text-[8px] font-semibold text-cyan-300/80 bg-cyan-500/10 hover:bg-cyan-500/20 border border-cyan-400/20 transition shrink-0"
-                      >
-                        + Add
-                      </button>
-                    </div>
-                  ))}
-                </div>
-              ) : (
-                <div className="text-[9px] text-white/30 italic">
-                  All volume mounts are configured as sources.
-                </div>
-              )}
-            </>
-          ) : (
-            <div className="text-[10px] text-white/35 italic">
-              {!selectedKindNeedsPath
-                ? 'This connector does not need a local path. Choose the scope and URI scheme; the package owns the runtime binding.'
-                : rootField.container
-                  ? 'Mount any folder from your system. The path must be accessible to the server process.'
-                  : 'A folder on the device you choose below \u2014 your own paired machine. It needs no volume mount here; that device\u2019s own allowlist (neuralis device grant) still limits what is reachable.'}
-            </div>
-          )}
-          <div className="space-y-2">
-            <div className={cn('grid gap-2', selectedKindNeedsPath ? 'grid-cols-2' : 'grid-cols-1')}>
-              <div className="space-y-1">
-                <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">URI scheme</div>
-                <input
-                  type="text"
-                  value={addDraft.key}
-                  onChange={(e) => setAddDraft((d) => ({ ...d, key: e.target.value }))}
-                  placeholder={computeSuggestedKey(addDraft.scope, addDraft.path)}
-                  className={inputCls}
-                />
-                <div className="text-[8px] text-white/25 font-mono">{addDraft.key || computeSuggestedKey(addDraft.scope, addDraft.path)}://</div>
-              </div>
-              {selectedKindNeedsPath && (
-                <div className="space-y-1">
-                  <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">{rootField.label}</div>
-                  <div className="flex gap-1">
-                    <input
-                      type="text"
-                      value={addDraft.path}
-                      onChange={(e) => setAddDraft((d) => ({ ...d, path: e.target.value }))}
-                      placeholder={rootField.placeholder}
-                      className={cn(inputCls, 'flex-1')}
-                    />
-                    {/* Browse: container-plane roots only (the route readdirs in
-                        the SERVER process), outside Docker, and only for a caller
-                        who could actually attach what they find. */}
-                    {rootField.container && !isDocker && canMount && (
-                      <button
-                        type="button"
-                        onClick={() => void openBrowser(addDraft.path || '/')}
-                        className="h-7 px-2 rounded-md bg-white/[0.04] hover:bg-white/[0.08] border border-white/[0.08] text-white/60 hover:text-white/90 transition shrink-0"
-                        title="Browse directories"
-                      >
-                        <FolderOpen className="h-3.5 w-3.5" />
-                      </button>
-                    )}
-                  </div>
-                </div>
-              )}
-            </div>
-            {Object.entries(schemaObject(selectedKind).properties)
-              .filter(([key]) => key !== 'root')
-              .map(([key, prop]) => {
-                const field = fieldControl(prop, selectedKind?.packageId ?? '');
-                const setValue = (value: string) => setAddDraft((d) => ({
-                  ...d,
-                  config: { ...d.config, [key]: value },
-                }));
-                return (
-                  <div key={key} className="space-y-1">
-                    <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">
-                      {(prop as any)?.['x-neuralis']?.ui?.label ?? key}
-                    </div>
-                    {field.control === 'select' ? (
-                      <OptionsRouteSelect
-                        route={field.options}
-                        revision={deviceRevision}
-                        projectId={projectId}
-                        agentId={agentId}
-                        value={String(addDraft.config[key] ?? '')}
-                        onChange={setValue}
-                      />
-                    ) : (
-                      <input
-                        type={field.numeric ? 'number' : 'text'}
-                        value={String(addDraft.config[key] ?? '')}
-                        onChange={(e) => setValue(e.target.value)}
-                        placeholder={(prop as any)?.['x-neuralis']?.ui?.placeholder ?? (prop as any)?.description ?? key}
-                        className={inputCls}
-                      />
-                    )}
-                    {field.control === 'text' && field.refused ? (
-                      <div className="text-[9px] text-amber-300/80">{field.refused}</div>
-                    ) : null}
-                  </div>
-                );
-              })}
-            {/* Directory browser (non-Docker only) */}
-            {showContainerPathChrome && !isDocker && browseOpen && (
-              <div className="rounded-md bg-white/[0.03] border border-white/[0.1] overflow-hidden">
-                <div className="flex items-center gap-1.5 px-2 py-1.5 bg-white/[0.02] border-b border-white/[0.06]">
-                  <FolderOpen className="h-3 w-3 text-cyan-400 shrink-0" />
-                  <span className="text-[9px] font-mono text-white/60 truncate flex-1">{browsePath}</span>
-                  <button type="button" onClick={() => setBrowseOpen(false)}
-                    className="text-[9px] text-white/40 hover:text-white/70 px-1">Close</button>
-                </div>
-                {browseError && (
-                  <div className="px-2 py-1 text-[9px] text-red-300/80">{browseError}</div>
-                )}
-                {browseLoading ? (
-                  <div className="flex items-center justify-center py-3">
-                    <Loader2 className="h-3 w-3 animate-spin text-white/30" />
-                  </div>
-                ) : (
-                  <div className="max-h-[180px] overflow-y-auto">
-                    {browsePath !== '/' && (
-                      <button
-                        type="button"
-                        onClick={() => {
-                          const parent = browsePath.replace(/[/\\][^/\\]+$/, '') || '/';
-                          void openBrowser(parent);
-                        }}
-                        className="w-full flex items-center gap-1.5 px-2 py-1 text-left hover:bg-white/[0.04] transition"
-                      >
-                        <ChevronUp className="h-3 w-3 text-white/30" />
-                        <span className="text-[10px] text-white/50">..</span>
-                      </button>
-                    )}
-                    {browseEntries.length === 0 && !browseLoading && (
-                      <div className="px-2 py-2 text-[9px] text-white/30 italic">No subdirectories</div>
-                    )}
-                    {browseEntries.map((entry) => (
-                      <div key={entry.path} className="flex items-center gap-0.5 hover:bg-white/[0.04] transition">
-                        <button
-                          type="button"
-                          onClick={() => void openBrowser(entry.path)}
-                          className="flex items-center gap-1.5 px-2 py-1 flex-1 text-left min-w-0"
-                        >
-                          <Folder className="h-3 w-3 text-cyan-400/70 shrink-0" />
-                          <span className="text-[10px] text-white/75 truncate">{entry.name}</span>
-                        </button>
-                        <button
-                          type="button"
-                          onClick={() => selectBrowsePath(entry.path)}
-                          className="px-2 py-1 text-[8px] font-medium text-cyan-300/70 hover:text-cyan-200 shrink-0"
-                        >
-                          Select
-                        </button>
-                      </div>
-                    ))}
-                    <button
-                      type="button"
-                      onClick={() => selectBrowsePath(browsePath)}
-                      className="w-full flex items-center gap-1.5 px-2 py-1.5 text-left bg-cyan-500/5 hover:bg-cyan-500/10 border-t border-white/[0.06] transition"
-                    >
-                      <CheckCircle2 className="h-3 w-3 text-cyan-400 shrink-0" />
-                      <span className="text-[10px] font-medium text-cyan-300/80">Select this folder</span>
-                      <span className="text-[9px] text-white/30 font-mono truncate ml-auto">{browsePath}</span>
-                    </button>
-                  </div>
-                )}
-              </div>
-            )}
-          </div>
           <div className="flex items-center gap-2">
             <span className="text-[9px] font-semibold uppercase tracking-wider text-white/35 w-16 shrink-0">Access</span>
             {([
               { key: 'read' as const, label: 'Read', icon: Eye },
               { key: 'write' as const, label: 'Write', icon: Pencil },
               { key: 'exec' as const, label: 'Exec', icon: Terminal },
-            ]).map(({ key, label, icon: PIcon }) => (
-              <label key={key} className={cn(
+            ])
+              // Exec is a SOURCE policy bit: offered wherever a shell can run in
+              // the kind's sources at all (`shell`, the server's answer). Who may
+              // then run one is the caller's own feature (`execRequires`, the
+              // tooltip) — never a reason to hide the bit from the person setting
+              // it for others.
+              .filter(({ key }) => key !== 'exec' || selectedKind?.shell !== false)
+              .map(({ key, label, icon: PIcon }) => (
+              <label key={key} title={key === 'exec' && selectedKind?.execRequires?.length ? `Running programs here needs ${selectedKind.execRequires.join(' or ')}` : undefined} className={cn(
                 'inline-flex items-center gap-1 rounded px-2 py-1 text-[9px] cursor-pointer transition',
                 addDraft[key] ? 'bg-white/[0.06] text-white/85' : 'bg-white/[0.02] text-white/40',
               )}>
@@ -1588,20 +1572,25 @@ export function SourcesPanel(props: Props) {
               </label>
             ))}
           </div>
-          <div className="space-y-1">
-            <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">Description <span className="text-white/20 normal-case font-normal">(optional — shown to the agent)</span></div>
-            {/* The connector's own text as the PLACEHOLDER, not as a value:
-                leaving it blank resolves through the same chain at read time,
-                so the agent still gets the package's wording — and it keeps
-                tracking the package instead of freezing a copy here. */}
-            <input value={addDraft.description} onChange={(e) => setAddDraft((d) => ({ ...d, description: e.target.value }))} className={inputCls} placeholder={selectedKind?.description ?? 'What this source is for…'} maxLength={200} />
-          </div>
           {selectedKindSupportsSync && (
             <div className="flex items-center gap-2">
               <label className="inline-flex items-center gap-1.5 text-[10px] text-white/80 cursor-pointer">
                 <input type="checkbox" checked={addDraft.syncEnabled} onChange={(e) => setAddDraft((d) => ({ ...d, syncEnabled: e.target.checked }))} className="accent-emerald-400 h-3 w-3" />
                 Enable sync
               </label>
+              {addDraft.syncEnabled && (
+                <select
+                  value={addDraft.trigger.startsWith('interval:') ? 'manual' : addDraft.trigger}
+                  onChange={(e) => setAddDraft((d) => ({ ...d, trigger: e.target.value as SyncTriggerValue }))}
+                  className={cn(selectCls, 'w-auto')}
+                  title="When the folder syncs (a schedule is set on the source after it is added)"
+                >
+                  {addDraft.trigger.startsWith('interval:') && <option value={addDraft.trigger}>On schedule ({addDraft.trigger.slice('interval:'.length)})</option>}
+                  {TRIGGER_OPTIONS.filter((o) => o.value !== 'interval').map((o) => (
+                    <option key={o.value} value={o.value}>{o.label}</option>
+                  ))}
+                </select>
+              )}
             </div>
           )}
           {selectedKindSupportsSync && addDraft.syncEnabled && (
@@ -1617,22 +1606,48 @@ export function SourcesPanel(props: Props) {
               <div className="text-[8px] text-white/25 italic">Non-empty: only matching files sync. Excludes always win — an excluded path can never be re-included. This narrows the INDEX, not what the agent can read: the source root does that.</div>
             </div>
           )}
-          {addKind === 'local' && isOwnerEffective && (
-            <div className="space-y-1">
-              <label className="inline-flex items-start gap-1.5 text-[10px] text-white/80 cursor-pointer">
+          <details className="group rounded-md bg-white/[0.02] px-2 py-1">
+            <summary className="cursor-pointer select-none text-[9px] font-semibold uppercase tracking-wider text-white/35 hover:text-white/60">
+              Advanced <span className="normal-case font-normal text-white/25">· {addDraft.key || computeSuggestedKey(addDraft.scope, addDraft.path)}://</span>
+            </summary>
+            <div className="mt-2 space-y-2 pb-1">
+              <div className="space-y-1">
+                <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">URI scheme</div>
                 <input
-                  type="checkbox"
-                  checked={addDraft.recognizesPackages}
-                  onChange={(e) => setAddDraft((d) => ({ ...d, recognizesPackages: e.target.checked }))}
-                  className="accent-emerald-400 h-3 w-3 mt-0.5"
+                  type="text"
+                  value={addDraft.key}
+                  onChange={(e) => setAddDraft((d) => ({ ...d, key: e.target.value }))}
+                  placeholder={computeSuggestedKey(addDraft.scope, addDraft.path)}
+                  className={inputCls}
                 />
-                <span>
-                  Recognize packages
-                  <span className="block text-[9px] text-white/35 normal-case font-normal">
-                    Load packages found in this folder (in addition to <code>_packages/</code>) as soon as the source is added. Advertised only within this source&apos;s scope.
-                  </span>
-                </span>
-              </label>
+                <div className="text-[8px] text-white/25 font-mono">{addDraft.key || computeSuggestedKey(addDraft.scope, addDraft.path)}://</div>
+              </div>
+              {formFields.advanced.map(renderConfigField)}
+              <div className="space-y-1">
+                <div className="text-[9px] font-semibold uppercase tracking-wider text-white/35">Description <span className="text-white/20 normal-case font-normal">(optional — shown to the agent)</span></div>
+                {/* The connector's own text as the PLACEHOLDER, not as a value:
+                    leaving it blank resolves through the same chain at read time,
+                    so the agent still gets the package's wording — and it keeps
+                    tracking the package instead of freezing a copy here. */}
+                <input value={addDraft.description} onChange={(e) => setAddDraft((d) => ({ ...d, description: e.target.value }))} className={inputCls} placeholder={selectedKind?.description ?? 'What this source is for…'} maxLength={200} />
+              </div>
+              {addKind === HOST_KIND && isOwnerEffective && (
+                <PackageFoldersField
+                  value={addDraft.packageFolders}
+                  onChange={(packageFolders) => setAddDraft((d) => ({ ...d, packageFolders }))}
+                  note="as soon as the source is added"
+                />
+              )}
+            </div>
+          </details>
+          {chosenDevice && deviceGuard !== null && deviceGuard === addDraft.path && (
+            <div className="rounded-md border border-amber-400/20 bg-amber-500/[0.04] px-2 py-1.5 space-y-1">
+              <div className="text-[9px] text-amber-300/80">{DEVICE_FOLDER_NOT_ALLOWED} Ask there, or attach it now — it serves once the device allows it.</div>
+              <DeviceFolderAsk key={deviceGuard} device={chosenDevice} projectId={projectId} agentId={agentId} path={deviceGuard} wantWrite={addDraft.write} />
+              <button type="button" onClick={() => void handleAddSource(true)} disabled={addCreating}
+                className="h-6 px-2.5 rounded-md bg-white/[0.04] border border-white/[0.1] text-[9px] font-semibold text-white/70 hover:bg-white/[0.08] transition disabled:opacity-35">
+                Attach anyway — it serves once allowed
+              </button>
             </div>
           )}
           <div className="flex items-center gap-1.5 pt-1">
@@ -1657,7 +1672,7 @@ export function SourcesPanel(props: Props) {
         {grouped.map(([origin, rows]) => (
           <div key={origin}>
             {/* Origin group header — small, indented a touch LEFT of its rows,
-                replaces the per-row "first-party" badge. */}
+                replaces the per-row "native" badge. */}
             <div className="-ml-0.5 mb-0.5 flex items-center gap-1.5 px-1">
               <Package className="h-3 w-3 shrink-0 text-white/30" />
               <span className="truncate font-mono text-[10px] font-medium text-white/40">{origin}</span>
@@ -1689,13 +1704,14 @@ export function SourcesPanel(props: Props) {
           const dirty = editable && isDirty(config, draft);
           const tp = parseTrigger(syncDraft.trigger);
           const sections = subSections[config.source] ?? {};
+          const watchBadge = sourceWatchBadge(config.watch, config.live_reason);
 
           return (
             <div key={fileKey(sourceRootUri(config.source))} className="rounded-sm">
               {/* Accordion header: selection and enabled actions are siblings. */}
               <div className="w-full flex items-center gap-2 py-2 text-left group hover:bg-white/[0.02] rounded-md px-1 transition">
                 <button type="button" onClick={() => toggleSource(config.source)} aria-expanded={isOpen}
-                  title={disconnected ? sourceLiveReasonLabel(config.live_reason) : undefined}
+                  title={disconnected ? sourceLiveReasonLabel(config.live_reason, { kind: config.connection.kind, notReady: config.live_not_ready }) : undefined}
                   className="min-w-0 flex-1 flex items-center gap-2 text-left">
                 {/* Git indicator (G2.1) — a GitBranch overlay on a git-repo
                     source's icon, ORTHOGONAL to the sync tone (visualTone still
@@ -1709,6 +1725,17 @@ export function SourcesPanel(props: Props) {
                   <SourceIcon className={cn('h-4 w-4 shrink-0', visualTone.iconClassName)} />
                 )}
                 <span className={cn('min-w-0 flex-1 truncate text-[12.5px] font-semibold', dimmed ? 'text-white/45' : 'text-white/90')}>{config.source}</span>
+                {watchBadge ? (
+                  <span
+                    className={cn(
+                      'shrink-0 rounded px-1 text-[9px] uppercase tracking-wider',
+                      watchBadge.tone === 'pending' ? 'text-white/55 bg-white/[0.06]' : 'text-amber-200/80 bg-amber-500/10',
+                    )}
+                    title={watchBadge.title}
+                  >
+                    {watchBadge.label}
+                  </span>
+                ) : null}
                 {config.git?.isRepo && config.git.branch ? (
                   <span
                     className="inline-flex max-w-[96px] shrink-0 items-center gap-0.5 text-[10px] text-violet-300/70"
@@ -1812,10 +1839,16 @@ export function SourcesPanel(props: Props) {
                   </div>
 
                   {configSupportsSync && !config.sync?.lastSync ? (
-                    <div className="rounded-md border border-sky-300/15 bg-sky-500/5 px-2 py-1.5 text-[10px] text-sky-100/70">
-                      Never synced — run a sync to index this source and load its packages
-                      (skills, rules, instructions) for agents.
-                    </div>
+                    config.sync?.lastSyncResult?.error ? (
+                      <div className="rounded-md border border-rose-300/15 bg-rose-500/5 px-2 py-1.5 text-[10px] text-rose-100/70">
+                        {syncErrorLabel(config.sync.lastSyncResult.error)}
+                      </div>
+                    ) : (
+                      <div className="rounded-md border border-sky-300/15 bg-sky-500/5 px-2 py-1.5 text-[10px] text-sky-100/70">
+                        Never synced — run a sync to index this source and load its packages
+                        (skills, rules, instructions) for agents.
+                      </div>
+                    )
                   ) : null}
 
                   {config.observed ? (
@@ -1878,27 +1911,15 @@ export function SourcesPanel(props: Props) {
                     )}
                   </div>
 
-                  {/* R2b — Recognize packages toggle. Owner/admin-effective +
-                      local-kind only (server re-gates). Makes this source a package
-                      source too; advertised only within its own scope. */}
-                  {editable && isOwnerEffective && (meta?.kind ?? config.connection.kind) === 'local' && (
-                    <div className="pl-0">
-                      <label className="flex items-start gap-1.5 py-1 cursor-pointer">
-                        <Package className="h-3 w-3 text-cyan-400 shrink-0 mt-0.5" />
-                        <input
-                          type="checkbox"
-                          checked={draft.recognizesPackages ?? false}
-                          onChange={(e) => updateDraft(config.source, (d) => ({ ...d, recognizesPackages: e.target.checked }))}
-                          className="accent-cyan-400 h-3 w-3 mt-0.5"
-                        />
-                        <span className="text-[10px] text-white/70 leading-tight">
-                          Recognize packages
-                          <span className="block text-[9px] text-white/35 normal-case font-normal">
-                            Load packages found in this folder (in addition to <code>_packages/</code>) — applied on save; advertised only within this source&apos;s scope.
-                          </span>
-                        </span>
-                      </label>
-                    </div>
+                  {/* R2b — package folders. Owner/admin-effective + folder kind
+                      only (server re-gates). Makes those folders package sources
+                      too; advertised only within the source's own scope. */}
+                  {editable && isOwnerEffective && (meta?.kind ?? config.connection.kind) === HOST_KIND && (
+                    <PackageFoldersField
+                      value={formatPackageFolders(draft.packageFolders)}
+                      onChange={(text) => updateDraft(config.source, (d) => ({ ...d, packageFolders: parsePackageFolders(text) }))}
+                      note="applied on save"
+                    />
                   )}
 
                   {/* Permissions section — admin-style compact editor.
@@ -2069,7 +2090,10 @@ export function SourcesPanel(props: Props) {
                                 <span>Last sync: +{config.sync.lastSyncResult.filesAdded} -{config.sync.lastSyncResult.filesRemoved} ~{config.sync.lastSyncResult.filesUpdated}</span>
                                 <span>({(config.sync.lastSyncResult.durationMs / 1000).toFixed(1)}s)</span>
                                 {config.sync.lastSyncResult.error && (
-                                  <span className="text-rose-300/80 truncate max-w-[200px]" title={config.sync.lastSyncResult.error}>err</span>
+                                  <span className="text-rose-300/80 truncate max-w-[200px]" title={syncErrorLabel(config.sync.lastSyncResult.error)}>err</span>
+                                )}
+                                {config.sync.lastSyncResult.error === 'root_empty' && (
+                                  <button type="button" className="text-rose-200/80 underline" onClick={() => void handleSync(config.source, true)}>Sync anyway</button>
                                 )}
                               </div>
                             )}
@@ -2213,9 +2237,7 @@ export function SourcesPanel(props: Props) {
                 <SourceDeleteConfirm
                   source={config.source}
                   vectorCount={typeof config.indexed_count === 'number' ? config.indexed_count : null}
-                  isDockerMount={Boolean(
-                    (config.connection?.config as { hostRoot?: unknown } | undefined)?.hostRoot,
-                  )}
+                  isDockerMount={isDockerBind(config)}
                   busy={deleting}
                   onCancel={() => setDeleteConfirmFor(null)}
                   onConfirm={(opts) => void handleDelete(config.source, opts)}
@@ -2401,6 +2423,7 @@ const DIMMED_OPTION_STYLE = {
  */
 function OptionsRouteSelect({
   route,
+  emptyLabel,
   revision,
   projectId,
   agentId,
@@ -2408,11 +2431,14 @@ function OptionsRouteSelect({
   onChange,
 }: {
   route: OptionsRoute;
+  /** An optional field's empty choice (`fieldControl`), selectable — absent ⇒ a disabled "Choose…". */
+  emptyLabel?: string;
   revision: number;
   projectId?: string | null;
   agentId: string;
   value: string;
-  onChange: (value: string) => void;
+  /** The picked value and its row (`undefined` for the empty choice). */
+  onChange: (value: string, option?: SelectOption) => void;
 }) {
   const [options, setOptions] = useState<SelectOption[] | null>(null);
   const [loadError, setLoadError] = useState<string | null>(null);
@@ -2443,10 +2469,10 @@ function OptionsRouteSelect({
 
   if (loadError) return <div className="text-[9px] text-red-300/80">{loadError}</div>;
   if (options === null) return <div className="text-[9px] text-white/30 animate-pulse">Loading…</div>;
-  if (options.length === 0) return <div className="text-[9px] text-white/40 italic">Nothing to choose from.</div>;
+  if (options.length === 0 && !emptyLabel) return <div className="text-[9px] text-white/40 italic">Nothing to choose from.</div>;
   return (
-    <select value={value} onChange={(e) => onChange(e.target.value)} className={selectCls}>
-      <option value="" disabled>Choose…</option>
+    <select value={value} onChange={(e) => onChange(e.target.value, options.find((o) => o.value === e.target.value))} className={selectCls}>
+      {emptyLabel ? <option value="">{emptyLabel}</option> : <option value="" disabled>Choose…</option>}
       {options.map((o) => (
         <option key={o.value} value={o.value} style={o.dimmed ? DIMMED_OPTION_STYLE : undefined}>
           {o.label}
@@ -2455,3 +2481,37 @@ function OptionsRouteSelect({
     </select>
   );
 }
+
+/**
+ * The package-folders field both forms show — one folder per line, relative to
+ * the source root, `.` for the whole folder. It keeps its OWN text (a list
+ * round-trip would swallow the newline being typed) and reports every edit;
+ * the caller parses (`parsePackageFolders`). The list is UX: the server
+ * re-validates the folders and re-gates the owner/admin write.
+ */
+function PackageFoldersField({ value, onChange, note }: { value: string; onChange: (text: string) => void; note: string }) {
+  const [text, setText] = useState(value);
+  // An external change (a reset, a saved answer) replaces the text; an echo of
+  // this field's own edit does not.
+  useEffect(() => {
+    setText((current) => (parsePackageFolders(current).join('\n') === parsePackageFolders(value).join('\n') ? current : value));
+  }, [value]);
+  return (
+    <div className="space-y-1">
+      <div className="flex items-center gap-1.5 text-[9px] font-semibold uppercase tracking-wider text-white/35">
+        <Package className="h-3 w-3 text-cyan-400 shrink-0" />
+        Package folders
+      </div>
+      <textarea
+        value={text}
+        onChange={(e) => { setText(e.target.value); onChange(e.target.value); }}
+        rows={2}
+        className={cn(textareaCls, 'font-mono')}
+        placeholder={'# empty = none\n.\ntools/pkgs'}
+      />
+      <div className="text-[8px] text-white/25 italic">
+        Load the packages found in these folders (in addition to <code>_packages/</code>), {note}; <code>.</code> is the whole folder. Advertised only within this source&apos;s scope.
+      </div>
+    </div>
+  );
+}