dsh-multi-folder 0.1.3 → 0.1.5

package/README.md

@@ -36,7 +36,7 @@ Then **restart the DSH backend** (host composition loads at process start) and *
 
 ## Usage
 
-A Multi-folder button appears in the session header, and a second entry appears on the **session-creation page** (fixed launcher in the bottom-right corner while the new-session screen is shown; an inline chip beside the workspace picker once the upstream `conversation.hero.workspaceExtras` slot is available). The panel lets you:
+A Multi-folder button appears in the session header, and a second entry appears on the **session-creation page**: a chip row directly above the composer card (the same band the git-branch chip uses), aligned with the workspace/preset chips of the new-session screen. Clicking it opens the panel as a popover anchored to the chip. Exactly one session-creation entry is ever shown — the plugin registers three candidate seats and elects the best available one (upstream `conversation.hero.workspaceExtras` chip > `conversation.input.dock` row > fixed bottom-right launcher for shells declaring neither). The panel lets you:
 
 | Action | Behavior |
 | ------ | -------- |
@@ -56,6 +56,17 @@ Equivalent slash command for the user:
 
 The agent needs nothing extra: `read` / `glob` / `grep` work everywhere, and `write` / `edit` / `pwsh` / `bash` are intercepted and re-rooted automatically when the target path (or `workdir`) falls inside a configured secondary directory.
 
+## Permission model
+
+Each confined command runs under **exactly ONE writable root** — the workspace root the call is re-rooted to (the Windows ACL runner grants a single workspace write SID per process tree). Consequences:
+
+- A command whose cwd stays the **primary workspace cannot create files inside a secondary directory**. `git -C <secondary> commit`, `cd <secondary>` inside a script, `git clone <url> <secondary>`, or absolute-path writes all fail with an OS-level `Permission denied` (e.g. `fatal: Unable to create '.../.git/index.lock': Permission denied`).
+- Symmetrically, a command re-rooted to a secondary directory cannot write to the **primary workspace** (or another secondary directory) in the same invocation.
+- **Rule for file-creating commands: set `workdir` to the directory the command writes into.** For git, run the command from inside the repository (pass `workdir` pointing at it) instead of using `git -C` from the primary workspace.
+- Reads are unrestricted and need no `workdir`.
+
+When a shell run ends in such a denial and references a configured secondary directory, the plugin attaches a short diagnostic hint to the tool result explaining the workdir fix.
+
 ## How it works
 
 - **Interception** — a listener on the `tools/execute` around-dispatch waterfall short-circuits `write` / `edit` / `pwsh` / `bash` calls whose resolved path (or `workdir`) lands inside a configured secondary directory, and executes them with the session's standing sandbox policy **re-rooted to that directory** (`{ ...standingPolicy, workspaceRoot: secondaryDir }`). The mode itself is untouched, which is what gives every sandbox mode its identical primary-workspace semantics for free. Paths are canonicalized through `fs.resolve` + `processPath` before matching, so `..`, symlinks, and case differences behave correctly.
@@ -71,7 +82,7 @@ The agent needs nothing extra: `read` / `glob` / `grep` work everywhere, and `wr
 | ---- | ------- |
 | `cordis.patch.yml` | Profile patch layer inserting the `dsh-multi-folder` row |
 | `lib/index.js` | Host plugin: config store, tool-pipeline interception, prompt injection, dual-channel notifications, `/multi-folder` command, sessionless `multiFolder/*` remote API |
-| `lib/client.js` | Client plugin (factory bundle): session-header button + overlay panel + session-creation page entry (hero launcher / upstream hero chip) |
+| `lib/client.js` | Client plugin (factory bundle): session-header button + overlay panel + session-creation page entry (input-dock chip / upstream hero chip / fixed fallback launcher) |
 | `test/` | Runtime-free behavior tests (see Development) |
 | `docs/` | Design and analysis documents |
 

package/README.zh.md

@@ -36,7 +36,7 @@ dsh plugin --profile web add dsh-multi-folder
 
 ## 使用
 
-会话头部出现「多工作目录」按钮（英文界面显示 "Multi-folder"）；**会话创建页**也有入口（新会话界面右下角的浮动按钮；当上游 DSH 声明 `conversation.hero.workspaceExtras` 插槽后，还会在工作区选择器旁显示内联 chip）。打开面板即可：
+会话头部出现「多工作目录」按钮（英文界面显示 "Multi-folder"）；**会话创建页**的入口位于**输入框上方**——与 git 分支胶囊同一条 dock 带，左边缘对齐新会话界面的工作区/预设胶囊，点击后面板以锚定在该胶囊上的浮层展开。会话创建页始终只显示**一个**入口：插件注册三个候选座位并选用当前可用的最佳者（上游 `conversation.hero.workspaceExtras` chip > `conversation.input.dock` 行 > 两者皆未声明时的右下角浮动按钮）。打开面板即可：
 
 | 操作 | 行为 |
 | ---- | ---- |
@@ -56,6 +56,17 @@ dsh plugin --profile web add dsh-multi-folder
 
 Agent 无需任何额外操作：`read` / `glob` / `grep` 随处可用；`write` / `edit` / `pwsh` / `bash` 在路径（或 `workdir`）落入副目录时自动拦截并以该目录为沙箱根执行。
 
+## 权限模型
+
+每条受沙箱约束的命令只拥有**唯一一个可写根**——即本次调用被换根到的那个目录（Windows ACL runner 为每个进程树只授予一个工作区写 SID）。由此：
+
+- cwd 停留在**主工作区**的命令**不能在副目录创建文件**。`git -C <副目录> commit`、脚本内 `cd <副目录>`、`git clone <url> <副目录>`、按绝对路径写文件等都会以操作系统级 `Permission denied` 失败（例如 `fatal: Unable to create '.../.git/index.lock': Permission denied`）。
+- 对称地，被换根到副目录的命令在同一次调用中也**不能写主工作区**（或另一个副目录）。
+- **创建文件的命令必须把 `workdir` 设为它要写入的目录。** 对 git 而言，请进入仓库目录执行（`workdir` 指向该仓库），而不是从主工作区用 `git -C`。
+- 读操作不受限制，无需 `workdir`。
+
+当 shell 命令以这类拒绝失败且命令引用了已配置的副目录时，插件会在工具结果后附带一条简短的诊断提示，说明 workdir 的修正方式。
+
 ## 工作原理
 
 - **拦截**——监听 `tools/execute` 环绕分派瀑布，对解析路径（或 `workdir`）落在副目录内的 `write` / `edit` / `pwsh` / `bash` 调用短路，并以**换根后的会话站立策略**（`{ ...standingPolicy, workspaceRoot: secondaryDir }`）执行。模式本身不变，因此各种沙箱模式与主工作区的语义天然一致。匹配前先经 `fs.resolve` + `processPath` 规范化，`..`、符号链接与大小写差异均正确处理。
@@ -71,7 +82,7 @@ Agent 无需任何额外操作：`read` / `glob` / `grep` 随处可用；`write`
 | ---- | ---- |
 | `cordis.patch.yml` | profile patch 层，插入 `dsh-multi-folder` 行 |
 | `lib/index.js` | 宿主插件：配置存储、工具流水线拦截、提示词注入、双通道通知、`/multi-folder` 命令、无会话 `multiFolder/*` 远程 API |
-| `lib/client.js` | 客户端插件（factory bundle）：会话头部按钮 + 覆盖层面板 + 会话创建页入口（hero 浮动按钮 / 上游 hero chip） |
+| `lib/client.js` | 客户端插件（factory bundle）：会话头部按钮 + 覆盖层面板 + 会话创建页入口（输入框上方的 dock 胶囊 / 上游 hero chip / 右下角兜底浮动按钮） |
 | `test/` | 免 DSH 运行时的行为测试（见开发） |
 | `docs/` | 设计与分析文档 |
 

package/docs/design.md

@@ -15,7 +15,7 @@ agent informed. No new tools are added.
 | Half | File | Role |
 | ---- | ---- | ---- |
 | Host | `lib/index.js` | Config store, tool-pipeline interception, prompt section, notifications, `/multi-folder` command, sessionless `multiFolder/*` remote API |
-| Client | `lib/client.js` | Session-header button + overlay panel; session-creation page entry (hero launcher + upstream hero chip), both driving the host through the Remote BFF / shared RPC channel |
+| Client | `lib/client.js` | Session-header button + overlay panel; session-creation page entry (input-dock chip, upstream hero chip, or fixed fallback launcher — one at a time), all driving the host through the Remote BFF / shared RPC channel |
 
 The package declares both faces: `dsh.bundle.patch` (the host row inserted by
 `cordis.patch.yml`) and `dsh.client` (the web bundle at `exports["./client"]`).
@@ -157,9 +157,12 @@ window.__ModuleLoader__.load({
   `@deepseek-ai/dsh-client-connection`, `@deepseek-ai/dsh-client-locale`,
   `@deepseek-ai/dsh-client-runtime`).
 - UI registrations: `conversation.session.header.actions` (session-scoped button),
-  `shell.overlay` panel, `shell.overlay` hero launcher (root-scoped, fixed
-  position), and `conversation.hero.workspaceExtras` (upstream slot; see
-  below). One module-level store is shared by all of them.
+  `shell.overlay` panel, `conversation.input.dock` chip row (session-scoped
+  list entry above the composer card — the session-creation page's shipped
+  seat), `shell.overlay` hero launcher (root-scoped fixed-position fallback),
+  and `conversation.hero.workspaceExtras` (upstream slot; see below). One
+  module-level store is shared by all of them, and only ONE session-creation
+  entry ever renders (see "hero seat election").
 - **Localization (zh / en).** All client copy goes through
   `@deepseek-ai/dsh-client-locale` (always composed by the standard web
   profile). The bundle registers a `multi-folder` dictionary namespace with
@@ -189,23 +192,68 @@ window.__ModuleLoader__.load({
 - Caching: per-session cache (`sessionCache`) keeps pure reads off the
   conversation; per-workspace cache (`workspaceCache`) plays the same role for
   the sessionless channel.
-- Hero (session-creation page) support:
-  - The **hero launcher** (`shell.overlay` entry, `multi-folder-hero`)
-    subscribes to `sessions.list` + `workspaces.list` and observes the
-    conversation root's `data-phase="hero"` attribute (MutationObserver on
-    `document.body`). While the hero is visible it renders a fixed-position
-    「多工作目录」 button; the workspace path is derived from the current
-    (blank) session's `WorkspaceView.path`, falling back to `SessionSummary.cwd`.
-  - Clicking it opens the panel in workspace mode; without a selected
-    workspace the panel shows the "pick a workspace first" hint.
+- Hero (session-creation page) support — **three candidate seats, one visible
+  entry**:
+  - The **dock chip** (`conversation.input.dock`, id `multi-folder`,
+    order 120) is the shipped seat: a `list` slot the rc.6 shell declares and
+    renders directly ABOVE the composer card, in the same band as the
+    git-branch chip. The entry receives the dock owner share (`{ session,
+    input }`) plus the standard `useSessions` / `useWorkspaces` selector hooks,
+    so the hero phase (`composerPhase === 'blank' && (openState === 'open' ||
+    blank)`) and the target workspace come from framework props instead of DOM
+    probing. The row stays **in flow** — `display:flex` with the official hero
+    row's 20px indent, no absolute positioning — so the framework's list-slot
+    arrangement keeps it clear of every other plugin's dock row. It renders
+    only on the session-creation page; an active session keeps its entry in the
+    session header, so the two never appear together.
   - The **hero chip** registers into `conversation.hero.workspaceExtras` via
     `slots.inject`, which waits for the declaration: with an upstream DSH
     build that declares the slot, the chip renders inline beside the workspace
-    picker; without one, the registration is a harmless no-op and the fixed
-    launcher covers the page.
+    picker; without one, the registration contributes nothing.
+  - The **hero launcher** (`shell.overlay` entry, `multi-folder-hero`) is the
+    last-resort fallback for shells that declare neither slot. Only then does
+    it subscribe to `sessions.list` + `workspaces.list` and observe the
+    conversation root's `data-phase="hero"` attribute (MutationObserver on
+    `document.body`) to render a fixed-position button; the
+    workspace path is derived from the current (blank) session's
+    `WorkspaceView.path`, falling back to `SessionSummary.cwd`.
+  - **Hero seat election.** Each seat claims a token while its slot declaration
+    is live (`slots.inject` fires only for declared slots and disposes on
+    collapse); the components render only while holding the best live claim
+    (`extras` > `dock` > fallback). The framework arranges *different plugins*
+    on a shared `list` slot but has no opinion about one plugin holding several
+    alternative seats, so this election is the plugin's own duty.
+  - Clicking any of them opens the panel in workspace mode; without a selected
+    workspace the panel shows the "pick a workspace first" hint.
+- Panel placement: one `panelBody(store, t)` function returns the panel's
+  children, spread by whichever wrapper owns the panel — the fixed
+  `shell.overlay` panel (session-header path) or an `AnchoredPanel` popover
+  rendered by the chip itself (opening upward from the dock row, downward from
+  the hero row). `store.anchor` names the owner, and the overlay wrapper stands
+  down whenever a chip owns it, so the panel never renders twice.
+- Styling: all surfaces use the official `--dsw-alias-*` design tokens
+  (`dsh-client-ui-theme`) with inert fallbacks, so themes and applied skins
+  restyle this plugin's chip and panel along with the shell's own controls.
 
 ## Known limitations
 
+- Each confined command runs under exactly ONE writable root: the Windows ACL
+  runner grants a single workspace write SID per process tree (`--write-sid`
+  must match `--workspace`), and re-rooting replaces the root. A command whose
+  cwd stays the primary workspace therefore cannot create files inside a
+  secondary directory — `git -C <secondary> commit`, `cd <secondary>` inside a
+  script, `git clone <url> <secondary>`, and absolute-path writes fail with an
+  OS-level `Permission denied` (`fatal: Unable to create '.../.git/index.lock':
+  Permission denied`) that carries no sandbox marker. Symmetrically, a command
+  re-rooted to a secondary directory cannot write the primary workspace in the
+  same invocation. The injected prompt states the workdir rule, and a
+  `tools/post-execute` heuristic attaches a workdir-fix hint when a failed
+  `pwsh`/`bash` run both mentions a configured secondary directory and ends in
+  a denial (`permission denied` / `access … denied` / `is denied` / `eacces`;
+  the plugin's own `[sandbox: …]` marker lines are excluded from the scan).
+  Lifting this to real multi-root confinement needs an upstream change
+  (`SandboxExecutionPolicy` carrying extra write roots and the ACL runner
+  accepting several workspace write SIDs).
 - Intercepted secondary-directory writes bypass the fs observation policy: they emit
   no `fs/observed` event and do not participate in the `fs/write-intent` intent guard.
   This is deliberate — secondary directories sit outside the primary workspace's
@@ -227,12 +275,26 @@ window.__ModuleLoader__.load({
   visible in the conversation UI by framework design; they are log-only and never
   reach the model. Workspace-mode (session-creation page) operations avoid them
   entirely by using the sessionless remote channel.
-- The hero launcher relies on the conversation root's `data-phase="hero"`
-  attribute and the `sessions.list`/`workspaces.list` snapshot shapes — DOM and
-  client-runtime internals rather than documented APIs. They are guarded
-  defensively (missing services or DOM degrade to "launcher hidden"), and the
-  upstream `conversation.hero.workspaceExtras` slot (see
-  [upstream-hero-slot.md](upstream-hero-slot.md)) is the long-term surface.
+- The session-creation entry depends on shell internals to different degrees per
+  seat. The **dock chip** reads only declared contract surfaces (the
+  `conversation.input.dock` declaration, its owner share, and the standard
+  selector hooks), but its 20px indent is tuned to the shipped hero row's
+  padding — a restyled shell would misalign it, never break it. The **fallback
+  launcher** relies on the conversation root's `data-phase="hero"` attribute and
+  the `sessions.list`/`workspaces.list` snapshot shapes — DOM and client-runtime
+  internals rather than documented APIs; they are guarded defensively (missing
+  services or DOM degrade to "launcher hidden") and it only mounts when no
+  declared seat exists. The upstream `conversation.hero.workspaceExtras` slot
+  (see [upstream-hero-slot.md](upstream-hero-slot.md)) remains the long-term
+  surface.
+- Sharing the `conversation.input.dock` band is safe by construction (unique
+  `id`, explicit `order`, in-flow layout) but `order` is a shared number space,
+  not an enforced allocation: another plugin may pick the same `order` and the
+  tie is then broken by registration sequence. The rows still stack without
+  overlapping — only their vertical sequence is unspecified. Absolute-positioned
+  neighbours (the git-branch chip lifts itself into the hero row) are outside
+  the framework's arrangement entirely; this plugin deliberately does not do the
+  same.
 - The `multiFolder/*` endpoints use hand-written `src-json` Typert descriptors
   registered through `ctx.typert.register`. `src-json` gives JSON-safety
   boundary checks, not schema validation; the shared core performs all
@@ -248,5 +310,11 @@ canonicalization, the config guard, both notification channels, notice
 gating, command flows, the panel's session-switch/caching behavior, the
 sessionless remote contribution shape and behavior (list/add/set/remove,
 idempotence, sanitization, error prefixing, cross-channel cache coherence),
-and the hero/workspace-mode client flows (launcher visibility, RPC routing,
-workspace-mode mutations and error surfacing).
+and the hero/workspace-mode client flows. The client test's `slots.inject` mock
+is declaration-aware like the real service (a wait fires only while its slot is
+declared, and a collapse disposes the registration), so it covers all three
+session-creation seats: the dock chip on an rc.6-style shell (registration
+shape, in-flow row, hero-only visibility, RPC routing, anchored popover), the
+upstream hero chip taking over the moment its slot is declared, and the fixed
+launcher returning once both declarations collapse — asserting at each step that
+the other two surfaces stand down.

package/docs/upstream-hero-slot.md

@@ -8,10 +8,14 @@ place configuration UI next to the workspace picker.
 
 This document specifies the small upstream change to
 `@deepseek-ai/dsh-client-ui-conversation` that adds one, and explains how the
-plugin consumes it. Until this lands in a DSH release, the plugin's fixed
-`shell.overlay` hero launcher covers the same page (B2); the slot registration
-below is a waiting no-op (`slots.inject` fires only once the declaration
-exists), so the plugin works with and without the upstream change.
+plugin consumes it. Until this lands in a DSH release, the plugin's
+`conversation.input.dock` chip row covers the same page (an in-flow chip
+directly above the composer card, in the band the git-branch chip uses); the
+slot registration below is a waiting no-op (`slots.inject` fires only once the
+declaration exists), so the plugin works with and without the upstream change.
+When the declaration does arrive, the hero chip claims the better seat and the
+dock row stands down automatically — see the "hero seat election" section of
+[design.md](design.md).
 
 ## 1. Declare the slot
 
@@ -85,19 +89,24 @@ active locale (English: "Multi-folder", Chinese: 「多工作目录」):
 
 ```js
 slots.inject('conversation.hero.workspaceExtras', function () {
-  return slots.register(
+  var release = claimHeroSeat('extras');
+  var dispose = slots.register(
     { name: 'conversation.hero.workspaceExtras', id: 'multi-folder', order: 30, label: () => t('label'), locale: NS },
     function (props) { return React.createElement(HeroChip, props); },
   );
+  return function () { dispose(); release(); };
 });
 ```
 
 (`NS` is the plugin's `multi-folder` namespace and `t` its bound translator —
-see the localization section of [design.md](design.md).)
+see the localization section of [design.md](design.md). `claimHeroSeat('extras')`
+is the seat election: while this declaration lives, the `conversation.input.dock`
+row and the fixed fallback launcher render nothing.)
 
 `HeroChip` prefers the owner-supplied `props.workspacePath` and falls back to
-the store-derived hero workspace. It opens the same overlay panel in workspace
-mode, which reads and writes the configuration through the sessionless
+the store-derived hero workspace. It opens the shared panel body as its own
+popover anchored under the chip (matching the official workspace picker on the
+same row), reading and writing the configuration through the sessionless
 `multiFolder/*` endpoints (see [design.md](design.md)).
 
 ## Compiled-bundle equivalent (for local patching)
@@ -118,10 +127,14 @@ bundle; the same change there is three touchpoints:
 
 ## Verification
 
-- Unit: the plugin's `test/smoke-client.mjs` registers and drives `HeroChip`
-  with a mock owner share (`workspacePath`), asserting the panel opens in
-  workspace mode and reuses the per-workspace cache.
+- Unit: the plugin's `test/smoke-client.mjs` declares the slot mid-run through
+  a declaration-aware `slots.inject` mock, then drives `HeroChip` with a mock
+  owner share (`workspacePath`), asserting the chip registers on declaration,
+  opens its popover in workspace mode from the per-workspace cache, and that
+  the `conversation.input.dock` row plus the fixed launcher both stand down
+  while the slot lives (and that the dock row returns once it collapses).
 - Manual: with the patched build, the Multi-folder chip (「多工作目录」 in the
   Chinese UI) renders in the hero workspace row between the preset chip and
   the composer; clicking it lists the workspace's secondary directories
-  before any message is sent.
+  before any message is sent, and the chip row above the composer card
+  disappears (one entry, not two).

package/lib/client.js

@@ -11,20 +11,42 @@
  * human-readable result carrying a `[MF:JSON]` line the panel parses for
  * structured state.
  *
- * Session-creation page UI (no session exists yet):
- * - a hero-phase launcher in `shell.overlay` (fixed-position entry) whose
- *   visibility follows the conversation root's `data-phase="hero"` attribute;
- * - an inline chip registered into the upstream `conversation.hero.workspaceExtras`
- *   slot when that slot exists (the `slots.inject` wait is a no-op until the
- *   DSH core declares it).
- * Both open the same panel in WORKSPACE mode and drive the sessionless
+ * Session-creation page UI (no message sent yet). Three candidate seats are
+ * registered, best first, and EXACTLY ONE renders — see "hero seat election":
+ * - `conversation.hero.workspaceExtras` (upstream additive hero row; the
+ *   `slots.inject` wait is a no-op until a DSH core declares it);
+ * - `conversation.input.dock` (shipped since 0.1.9, declared by rc.6): an
+ *   in-flow chip row directly ABOVE the composer card, left-aligned with the
+ *   official hero chip row — the same band the git-branch chip uses;
+ * - `shell.overlay` fixed-position launcher: last-resort fallback for shells
+ *   that declare neither slot.
+ * All three open the same panel in WORKSPACE mode and drive the sessionless
  * `multiFolder/*` endpoints over the shared RPC channel
  * (`ctx.connection.rpc.call('/api', endpoint, { args })`), keyed by workspace
  * path instead of sessionId.
  *
- * Layout shape: an entry in the session header action row plus a frame-wide
- * overlay panel. Both read one tiny module-scoped store; opening the panel
+ * Layout shape: an entry in the session header action row, one chip row above
+ * the composer card on the session-creation page, and a frame-wide overlay
+ * panel. Every surface reads one tiny module-scoped store; opening the panel
  * refreshes the list from the Host.
+ *
+ * ## Hero seat election (multi-plugin coexistence)
+ *
+ * `conversation.input.dock` is a `list` slot, so the framework already
+ * arranges co-registered entries for us: entries are sorted by
+ * `(priority, order)`, a duplicate `(id, priority)` pair is rejected at
+ * registration with an error naming the sitting occupant, and the outlet
+ * renders `display:contents` so each entry becomes its own row of the
+ * composer stack. This plugin therefore stays a good citizen by construction:
+ * one unique `id`, one explicit `order`, and NO absolute positioning that
+ * would escape the framework's arrangement and overlap a neighbour.
+ *
+ * What the framework does NOT do is stop ONE plugin from occupying several
+ * alternative seats at once (each is a legitimate, differently-declared
+ * slot). That is this plugin's own duty: each seat claims a token when its
+ * declaration arrives (`slots.inject` fires only for declared slots), and the
+ * components render only while they hold the best live claim, so the
+ * session-creation page never shows two Multi-folder entries.
  */
 window.__ModuleLoader__.load({
   id: 'dsh-multi-folder',
@@ -35,7 +57,24 @@ window.__ModuleLoader__.load({
 
     // ------------------------------------------------------------- store
     var listeners = new Set();
-    var state = { open: false, mode: null, sessionId: null, dirs: [], workspace: null, busy: false, error: null, hero: false, heroWorkspace: null };
+    var state = {
+      open: false,
+      mode: null,
+      sessionId: null,
+      dirs: [],
+      workspace: null,
+      busy: false,
+      error: null,
+      /** Fallback launcher only: hero visibility derived from the DOM. */
+      hero: false,
+      heroWorkspace: null,
+      /** Live hero-seat claims, in claim order (see "hero seat election"). */
+      heroClaims: [],
+      /** Which surface owns the open panel: 'overlay' | 'dock' | 'extras'. */
+      anchor: 'overlay',
+      /** Bumped on every workspaceCache write so chips re-read their count. */
+      cacheRev: 0,
+    };
     function patch(next) {
       state = Object.assign({}, state, next);
       listeners.forEach(function (fn) { fn(); });
@@ -64,6 +103,58 @@ window.__ModuleLoader__.load({
       try { return JSON.parse(m[1]); } catch (_) { return null; }
     }
 
+    /** Stand-in for an absent standard-kit selector hook: runs the selector
+     *  against no snapshot, so callers keep one unconditional call site. */
+    function selectNothing(selector) { return selector(undefined); }
+
+    // -------------------------------------------------- hero seat election
+    /** Candidate seats for the session-creation page, best first. */
+    var HERO_SEATS = ['extras', 'dock'];
+    /** Order of this plugin's `conversation.input.dock` row. The shipped band
+     *  already carries other plugins' entries (the aionui drop inlay at 90/91
+     *  and the git-branch chip at 100); 120 keeps this row closest to the
+     *  composer card without contesting theirs. */
+    var DOCK_ORDER = 120;
+
+    /** The best seat currently claimed, or null when only the fallback is left. */
+    function bestHeroSeat(claims) {
+      for (var i = 0; i < HERO_SEATS.length; i++) {
+        if (claims.indexOf(HERO_SEATS[i]) >= 0) return HERO_SEATS[i];
+      }
+      return null;
+    }
+
+    /** Claim a seat for as long as its slot declaration lives. */
+    function claimHeroSeat(kind) {
+      patch({ heroClaims: getSnapshot().heroClaims.concat([kind]) });
+      return function () {
+        var claims = getSnapshot().heroClaims.slice();
+        var at = claims.indexOf(kind);
+        if (at >= 0) claims.splice(at, 1);
+        patch({ heroClaims: claims });
+      };
+    }
+
+    // ------------------------------------------------------------- theme
+    /** Official `--dsw-alias-*` design tokens (dsh-client-ui-theme) with inert
+     *  fallbacks, so the surfaces follow the active theme and any applied skin
+     *  instead of guessing a palette. */
+    var TOKEN = {
+      border: 'var(--dsw-alias-border-l2, rgba(127,127,127,0.35))',
+      borderSoft: 'var(--dsw-alias-border-l1, rgba(127,127,127,0.20))',
+      surface: 'var(--dsw-alias-bg-overlay, #ffffff)',
+      subtle: 'var(--dsw-alias-bg-layer-2, rgba(127,127,127,0.08))',
+      fill: 'var(--dsw-alias-button-tool-bar-fill, rgba(127,127,127,0.10))',
+      hover: 'var(--dsw-alias-interactive-bg-hover, rgba(127,127,127,0.14))',
+      ink: 'var(--dsw-alias-label-primary, #1a1a1a)',
+      inkSoft: 'var(--dsw-alias-label-secondary, #4a4a4a)',
+      inkMuted: 'var(--dsw-alias-label-tertiary, #6b6b6b)',
+      inkFaint: 'var(--dsw-alias-label-caption, #8a8a8a)',
+      danger: 'var(--dsw-alias-state-error-primary, #c62828)',
+      accent: 'var(--dsw-alias-brand-primary, #4c6ef5)',
+      shadow: '0 8px 24px var(--dsw-alias-bg-mask-2, rgba(0,0,0,0.18))',
+    };
+
     // ------------------------------------------------------------- i18n
     /** Locale namespace owned by this plugin. Dictionaries are registered
      *  with the `locale` service (`@deepseek-ai/dsh-client-locale`, always
@@ -74,7 +165,9 @@ window.__ModuleLoader__.load({
     var zhDict = {
       'label': '多工作目录',
       'label.open': '多工作目录 ▾',
+      'label.withCount': '多工作目录 · {count}',
       'label.heroLauncher': '多工作目录（新会话）',
+      'label.heroDock': '多工作目录（输入框上方）',
       'title.header': '多工作目录（副工作目录）',
       'title.remove': '移除此副工作目录',
       'title.close': '关闭',
@@ -96,7 +189,9 @@ window.__ModuleLoader__.load({
     var enDict = {
       'label': 'Multi-folder',
       'label.open': 'Multi-folder ▾',
+      'label.withCount': 'Multi-folder · {count}',
       'label.heroLauncher': 'Multi-folder (new session)',
+      'label.heroDock': 'Multi-folder (above the composer)',
       'title.header': 'Multi-folder (secondary working directories)',
       'title.remove': 'Remove this secondary working directory',
       'title.close': 'Close',
@@ -161,17 +256,42 @@ window.__ModuleLoader__.load({
         });
       }
 
+      /** Write one workspace's list into the cache and return it normalized. */
+      function storeWorkspace(workspacePath, value) {
+        var normalized = value && Array.isArray(value.dirs)
+          ? value
+          : { workspace: workspacePath, dirs: [] };
+        workspaceCache[workspacePathKey(workspacePath)] = normalized;
+        return normalized;
+      }
+
+      /** Whether the open panel is the one showing `workspacePath`. */
+      function panelTargets(workspacePath) {
+        var current = getSnapshot();
+        return !current.sessionId
+          && current.mode === 'workspace'
+          && !!current.workspace
+          && workspacePathKey(current.workspace) === workspacePathKey(workspacePath);
+      }
+
+      /** Patch after a workspace-mode read/write: always publish the new cache
+       *  revision (chips show the configured count), and refresh the panel
+       *  body only when it is the panel for this workspace. */
+      function publishWorkspace(workspacePath, value) {
+        var normalized = storeWorkspace(workspacePath, value);
+        var next = { busy: false, cacheRev: getSnapshot().cacheRev + 1 };
+        if (panelTargets(workspacePath)) {
+          next.workspace = normalized.workspace;
+          next.dirs = normalized.dirs || [];
+        }
+        patch(next);
+      }
+
       function refreshWorkspace(workspacePath) {
         if (!workspacePath) return;
         patch({ busy: true, error: null });
         remoteCall('multiFolder/list', { workspace: workspacePath }).then(function (value) {
-          workspaceCache[workspacePathKey(workspacePath)] = value || { workspace: workspacePath, dirs: [] };
-          var current = getSnapshot();
-          if (!current.sessionId && current.mode === 'workspace' && current.workspace && workspacePathKey(current.workspace) === workspacePathKey(workspacePath)) {
-            patch({ busy: false, workspace: value.workspace, dirs: value.dirs || [] });
-          } else {
-            patch({ busy: false });
-          }
+          publishWorkspace(workspacePath, value);
         }).catch(function (e) {
           patch({ busy: false, error: String(e && e.message ? e.message : e) });
         });
@@ -182,23 +302,27 @@ window.__ModuleLoader__.load({
         patch({ busy: true, error: null });
         var payload = Object.assign({ workspace: workspacePath }, args);
         return remoteCall(endpoint, payload).then(function (value) {
-          workspaceCache[workspacePathKey(workspacePath)] = value || { workspace: workspacePath, dirs: [] };
-          var current = getSnapshot();
-          if (!current.sessionId && current.mode === 'workspace' && current.workspace && workspacePathKey(current.workspace) === workspacePathKey(workspacePath)) {
-            patch({ busy: false, workspace: value.workspace, dirs: value.dirs || [] });
-          } else {
-            patch({ busy: false });
-          }
+          publishWorkspace(workspacePath, value);
         }).catch(function (e) {
           patch({ busy: false, error: String(e && e.message ? e.message : e) });
         });
       }
 
+      /** Configured directory count for a workspace, or null while unread. */
+      function dirCountOf(workspacePath) {
+        if (!workspacePath) return null;
+        var cached = workspaceCache[workspacePathKey(workspacePath)];
+        return cached && Array.isArray(cached.dirs) ? cached.dirs.length : null;
+      }
+
       /** Open the panel in WORKSPACE mode (session-creation page): a null
-       *  workspace shows the "pick a workspace first" hint instead. */
-      function openForWorkspace(workspacePath) {
+       *  workspace shows the "pick a workspace first" hint instead.
+       *  `anchor` names the surface that owns the panel — an inline chip
+       *  renders it as its own popover, everything else uses the overlay. */
+      function openForWorkspace(workspacePath, anchor) {
+        var seat = anchor || 'overlay';
         if (!workspacePath) {
-          patch({ open: true, mode: 'workspace', sessionId: null, workspace: null, dirs: [], error: null });
+          patch({ open: true, mode: 'workspace', sessionId: null, workspace: null, dirs: [], error: null, anchor: seat });
           return;
         }
         var cached = workspaceCache[workspacePathKey(workspacePath)];
@@ -209,6 +333,7 @@ window.__ModuleLoader__.load({
           workspace: workspacePath,
           dirs: cached ? cached.dirs : [],
           error: null,
+          anchor: seat,
         });
         if (!cached) refreshWorkspace(workspacePath);
       }
@@ -293,6 +418,7 @@ window.__ModuleLoader__.load({
           dirs: cached ? cached.dirs : [],
           workspace: cached ? cached.workspace : null,
           error: null,
+          anchor: 'overlay',
         });
         if (cached === undefined) refresh(sessionId);
       }
@@ -336,9 +462,9 @@ window.__ModuleLoader__.load({
               gap: 6,
               padding: '4px 10px',
               borderRadius: 8,
-              border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
-              background: open ? 'var(--color-bg-accent, rgba(80,120,255,0.18))' : 'transparent',
-              color: 'var(--color-text, inherit)',
+              border: '1px solid ' + TOKEN.border,
+              background: open ? TOKEN.hover : 'transparent',
+              color: TOKEN.ink,
               fontSize: 13,
               cursor: 'pointer',
             },
@@ -348,11 +474,11 @@ window.__ModuleLoader__.load({
         return btn;
       }
 
-      // Overlay panel ------------------------------------------------------
-      function Panel(props) {
-        var store = useStore();
-        var t = props.t;
-        if (!store.open || !store.mode) return null;
+      // Panel body ---------------------------------------------------------
+      /** The panel's children, shared verbatim by the overlay panel and the
+       *  chip popover. Returned as an ARRAY so each wrapper can spread it as
+       *  its own direct children (one DOM shape, two placements). */
+      function panelBody(store, t) {
         var sessionMode = store.mode === 'session';
         var usable = sessionMode || !!store.workspace;
         var rows = (store.dirs || []).map(function (dir, index) {
@@ -366,7 +492,7 @@ window.__ModuleLoader__.load({
                 gap: 8,
                 padding: '6px 8px',
                 borderRadius: 6,
-                background: 'var(--color-bg-subtle, rgba(127,127,127,0.08))',
+                background: TOKEN.subtle,
                 marginBottom: 6,
               },
             },
@@ -391,42 +517,24 @@ window.__ModuleLoader__.load({
                     mutateWorkspace(store.workspace, 'multiFolder/remove', { path: dir });
                   }
                 },
-                style: { padding: '2px 8px', borderRadius: 6, border: '1px solid transparent', background: 'transparent', color: 'var(--color-danger, #c62828)', cursor: 'pointer' },
+                style: { padding: '2px 8px', borderRadius: 6, border: '1px solid transparent', background: 'transparent', color: TOKEN.danger, cursor: 'pointer' },
               },
               t('panel.remove'),
             ),
           );
         });
-        return React.createElement(
-          'div',
-          {
-            style: {
-              position: 'fixed',
-              top: 64,
-              right: 20,
-              width: 380,
-              maxWidth: 'calc(100vw - 40px)',
-              zIndex: 400,
-              background: 'var(--color-bg-elevated, #ffffff)',
-              color: 'var(--color-text, #1a1a1a)',
-              border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
-              borderRadius: 12,
-              boxShadow: '0 8px 32px rgba(0,0,0,0.18)',
-              padding: 14,
-              fontSize: 13,
-            },
-          },
+        return [
           React.createElement(
             'div',
             { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 10 } },
-            React.createElement('div', { style: { fontWeight: 600, fontSize: 14 } }, t('panel.title')),
+            React.createElement('div', { style: { fontWeight: 600, fontSize: 14, color: TOKEN.ink } }, t('panel.title')),
             React.createElement(
               'button',
               {
                 type: 'button',
                 title: t('title.close'),
                 onClick: function () { patch({ open: false }); },
-                style: { padding: '2px 8px', borderRadius: 6, border: '1px solid transparent', background: 'transparent', cursor: 'pointer' },
+                style: { padding: '2px 8px', borderRadius: 6, border: '1px solid transparent', background: 'transparent', color: TOKEN.inkMuted, cursor: 'pointer' },
               },
               '✕',
             ),
@@ -434,21 +542,21 @@ window.__ModuleLoader__.load({
           store.workspace
             ? React.createElement(
                 'div',
-                { style: { marginBottom: 8, color: 'var(--color-text-muted, #6b6b6b)', fontSize: 12, wordBreak: 'break-all' } },
+                { style: { marginBottom: 8, color: TOKEN.inkMuted, fontSize: 12, wordBreak: 'break-all' } },
                 t('panel.project', { path: store.workspace }),
               )
             : (!sessionMode
                 ? React.createElement(
                     'div',
-                    { style: { marginBottom: 8, color: 'var(--color-text-muted, #6b6b6b)' } },
+                    { style: { marginBottom: 8, color: TOKEN.inkMuted } },
                     t('panel.noWorkspaceHint'),
                   )
                 : null),
           usable
-            ? (rows.length > 0 ? rows : React.createElement('div', { style: { marginBottom: 8, color: 'var(--color-text-muted, #6b6b6b)' } }, t('panel.empty')))
-            : React.createElement('div', { style: { marginBottom: 8, color: 'var(--color-text-muted, #6b6b6b)' } }, t('panel.pickWorkspaceHint')),
+            ? (rows.length > 0 ? rows : React.createElement('div', { style: { marginBottom: 8, color: TOKEN.inkMuted } }, t('panel.empty')))
+            : React.createElement('div', { style: { marginBottom: 8, color: TOKEN.inkMuted } }, t('panel.pickWorkspaceHint')),
           store.error
-            ? React.createElement('div', { style: { marginBottom: 8, color: 'var(--color-danger, #c62828)', whiteSpace: 'pre-wrap' } }, String(store.error))
+            ? React.createElement('div', { style: { marginBottom: 8, color: TOKEN.danger, whiteSpace: 'pre-wrap' } }, String(store.error))
             : null,
           React.createElement(
             'div',
@@ -463,9 +571,9 @@ window.__ModuleLoader__.load({
                   flex: 1,
                   padding: '6px 10px',
                   borderRadius: 8,
-                  border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
-                  background: 'var(--color-bg-accent, rgba(80,120,255,0.14))',
-                  color: 'var(--color-text, inherit)',
+                  border: '1px solid ' + TOKEN.border,
+                  background: TOKEN.fill,
+                  color: TOKEN.ink,
                   cursor: store.busy || !usable ? 'default' : 'pointer',
                   opacity: store.busy || !usable ? 0.6 : 1,
                 },
@@ -487,9 +595,9 @@ window.__ModuleLoader__.load({
                 style: {
                   padding: '6px 10px',
                   borderRadius: 8,
-                  border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
+                  border: '1px solid ' + TOKEN.border,
                   background: 'transparent',
-                  color: 'var(--color-text, inherit)',
+                  color: TOKEN.ink,
                   cursor: store.busy || !usable ? 'default' : 'pointer',
                   opacity: store.busy || !usable ? 0.6 : 1,
                 },
@@ -504,33 +612,262 @@ window.__ModuleLoader__.load({
                 marginTop: 10,
                 fontSize: 11,
                 lineHeight: 1.5,
-                color: 'var(--color-text-muted, #6b6b6b)',
+                color: TOKEN.inkMuted,
               },
             },
             t('panel.footnote'),
           ),
+        ];
+      }
+
+      /** Spread `children` as the direct children of one element (keeps the
+       *  panel's DOM shape identical across both placements). */
+      function element(type, props, children) {
+        return React.createElement.apply(null, [type, props].concat(children));
+      }
+
+      // Overlay panel ------------------------------------------------------
+      function Panel(props) {
+        var store = useStore();
+        var t = props.t;
+        if (!store.open || !store.mode) return null;
+        // An inline chip owns its own popover; the overlay stands down.
+        if (store.anchor !== 'overlay') return null;
+        return element(
+          'div',
+          {
+            style: {
+              position: 'fixed',
+              top: 64,
+              right: 20,
+              width: 380,
+              maxWidth: 'calc(100vw - 40px)',
+              zIndex: 400,
+              background: TOKEN.surface,
+              color: TOKEN.ink,
+              border: '1px solid ' + TOKEN.border,
+              borderRadius: 12,
+              boxShadow: TOKEN.shadow,
+              padding: 14,
+              fontSize: 13,
+            },
+          },
+          panelBody(store, t),
+        );
+      }
+
+      // Anchored popover ---------------------------------------------------
+      /** The same panel body as a popover anchored to a chip. `direction`
+       *  'up' opens above the chip (the dock row sits above the composer
+       *  card), 'down' opens below it (the hero chip row). */
+      function AnchoredPanel(props) {
+        var store = useStore();
+        var t = props.t;
+        var up = props.direction !== 'down';
+        var placement = up ? { bottom: 'calc(100% + 6px)' } : { top: 'calc(100% + 6px)' };
+        return element(
+          'div',
+          {
+            style: Object.assign(
+              {
+                position: 'absolute',
+                left: 0,
+                zIndex: 40,
+                width: 380,
+                maxWidth: 'calc(100vw - 40px)',
+                // The composer stack lives in a scroll container with
+                // `overflow: hidden auto`; capping the height keeps a tall
+                // list inside the viewport instead of clipping it.
+                maxHeight: 'min(60vh, 420px)',
+                overflowY: 'auto',
+                background: TOKEN.surface,
+                color: TOKEN.ink,
+                border: '1px solid ' + TOKEN.border,
+                borderRadius: 12,
+                boxShadow: TOKEN.shadow,
+                padding: 14,
+                fontSize: 13,
+                textAlign: 'left',
+              },
+              placement,
+            ),
+          },
+          panelBody(store, t),
+        );
+      }
+
+      /** Click-outside catcher for an open popover. */
+      function Backdrop() {
+        return React.createElement('div', {
+          onClick: function () { patch({ open: false }); },
+          style: { position: 'fixed', inset: 0, zIndex: 30 },
+        });
+      }
+
+      /** One chip + its popover, wrapped in the positioning context the
+       *  popover anchors to. Shared by the dock row and the hero chip. */
+      function chipWithPopover(seat, direction, t, button) {
+        var store = getSnapshot();
+        var open = store.open && store.anchor === seat;
+        return React.createElement(
+          'div',
+          { style: { position: 'relative', display: 'inline-flex', minWidth: 0 } },
+          button,
+          open ? React.createElement(Backdrop, { key: 'backdrop' }) : null,
+          open ? React.createElement(AnchoredPanel, { key: 'panel', t: t, direction: direction }) : null,
+        );
+      }
+
+      /** The chip pill, styled from the official chip recipe. */
+      function chipButton(options) {
+        return React.createElement(
+          'button',
+          {
+            type: 'button',
+            title: options.title,
+            onClick: options.onClick,
+            style: {
+              display: 'inline-flex',
+              alignItems: 'center',
+              gap: 6,
+              height: 24,
+              padding: '0 10px',
+              borderRadius: 999,
+              border: '1px solid ' + (options.open ? TOKEN.accent : TOKEN.border),
+              background: options.open ? TOKEN.hover : TOKEN.fill,
+              color: options.open ? TOKEN.ink : TOKEN.inkSoft,
+              fontSize: 12,
+              lineHeight: 1,
+              whiteSpace: 'nowrap',
+              cursor: 'pointer',
+              maxWidth: 260,
+              overflow: 'hidden',
+              opacity: options.dimmed ? 0.7 : 1,
+            },
+          },
+          React.createElement(
+            'span',
+            { style: { overflow: 'hidden', textOverflow: 'ellipsis' } },
+            options.label,
+          ),
+          React.createElement('span', { style: { color: TOKEN.inkFaint, fontSize: 10 } }, '▾'),
         );
       }
 
       // Hero (session-creation page) support --------------------------------
+      /** The shell's own hero predicate, read from the dock's owner share: a
+       *  blank conversation with an open session. A still-loading blank
+       *  session already lists as blank, so it may enter the hero phase
+       *  before the composer snapshot settles to `open`. */
+      function isHeroPhase(session, blank) {
+        if (!session) return false;
+        return session.composerPhase === 'blank' && (session.openState === 'open' || blank === true);
+      }
+
+      /** The workspace path a session belongs to, from the workspaces list. */
+      function workspacePathIn(snapshot, sessionId) {
+        var items = snapshot && snapshot.items ? snapshot.items : [];
+        for (var i = 0; i < items.length; i++) {
+          var workspace = items[i];
+          if (workspace && workspace.path && Array.isArray(workspace.sessionIds) && workspace.sessionIds.indexOf(sessionId) >= 0) {
+            return workspace.path;
+          }
+        }
+        return null;
+      }
+
       /** Workspace path of the current session (blank-session hero), or null
-       *  while no session/workspace is selected at all. */
+       *  while no session/workspace is selected at all. Store-read twin of
+       *  `workspacePathIn` for the fallback launcher, which has no props. */
       function heroWorkspacePath() {
         var sessionList = sessions && sessions.list ? sessions.list.getSnapshot() : null;
         var id = sessionList && sessionList.current;
         if (!id) return null;
         var workspaceList = workspaces && workspaces.list ? workspaces.list.getSnapshot() : null;
-        var items = workspaceList && workspaceList.items ? workspaceList.items : [];
-        for (var i = 0; i < items.length; i++) {
-          var workspace = items[i];
-          if (workspace && workspace.path && Array.isArray(workspace.sessionIds) && workspace.sessionIds.indexOf(id) >= 0) {
-            return workspace.path;
-          }
-        }
+        var fromWorkspaces = workspacePathIn(workspaceList, id);
+        if (fromWorkspaces !== null) return fromWorkspaces;
         var row = sessionList && sessionList.byId ? sessionList.byId[id] : undefined;
         return row && row.cwd ? row.cwd : null;
       }
 
+      /**
+       * Dock chip (session-creation page, preferred shipped seat): one in-flow
+       * row in `conversation.input.dock`, directly above the composer card and
+       * left-aligned with the official hero chip row. The row stays IN FLOW —
+       * the framework arranges co-registered dock entries as sibling rows, so
+       * absolute positioning here would silently overlap a neighbour's chip.
+       *
+       * Renders only on the session-creation page: an active session keeps its
+       * entry in the session header, so the two never appear at once.
+       */
+      function DockChip(props) {
+        var store = useStore();
+        var t = props.t;
+        var sessionId = props.sessionId;
+        // The standard kit always supplies these selector hooks; the absent
+        // form keeps the hook call unconditional (stable hook order) for
+        // hosts and tests that render the entry without the kit.
+        var useSessions = typeof props.useSessions === 'function' ? props.useSessions : selectNothing;
+        var useWorkspaces = typeof props.useWorkspaces === 'function' ? props.useWorkspaces : selectNothing;
+        var blank = useSessions(function (s) {
+          return !!(s && s.byId && sessionId !== undefined && s.byId[sessionId] && s.byId[sessionId].blank === true);
+        });
+        var cwd = useSessions(function (s) {
+          var row = s && s.byId && sessionId !== undefined ? s.byId[sessionId] : undefined;
+          return row && row.cwd ? row.cwd : null;
+        });
+        var fromWorkspaces = useWorkspaces(function (s) { return workspacePathIn(s, sessionId); });
+        var workspacePath = fromWorkspaces || cwd;
+        var hero = isHeroPhase(props.session, blank);
+        var mine = bestHeroSeat(store.heroClaims) === 'dock';
+        // Fill the count cache once per workspace. Workspace mode rides the
+        // sessionless RPC, so this read produces no conversation row.
+        React.useEffect(
+          function () {
+            if (!hero || !mine || !workspacePath) return undefined;
+            if (workspaceCache[workspacePathKey(workspacePath)] === undefined) refreshWorkspace(workspacePath);
+            return undefined;
+          },
+          [hero, mine, workspacePath],
+        );
+        if (!hero || !mine) return null;
+        var open = store.open && store.anchor === 'dock';
+        var count = dirCountOf(workspacePath);
+        return React.createElement(
+          'div',
+          {
+            style: {
+              // The dock outlet is display:contents, so this row is a direct
+              // child of the composer stack — the same 20px indent as the
+              // official hero chip row above it.
+              display: 'flex',
+              alignItems: 'center',
+              gap: 6,
+              minWidth: 0,
+              paddingLeft: 20,
+            },
+          },
+          chipWithPopover(
+            'dock',
+            'up',
+            t,
+            chipButton({
+              open: open,
+              dimmed: !workspacePath,
+              title: workspacePath ? t('title.heroChip') : t('title.heroLauncher.noWorkspace'),
+              label: count !== null && count > 0 ? t('label.withCount', { count: count }) : t('label'),
+              onClick: function () {
+                if (open) {
+                  patch({ open: false });
+                } else {
+                  openForWorkspace(workspacePath, 'dock');
+                }
+              },
+            }),
+          ),
+        );
+      }
+
       /** Re-read the conversation root's `data-phase` attribute (authoritative
        *  hero signal) and the derivable workspace, then patch the store. */
       function syncHero() {
@@ -546,13 +883,17 @@ window.__ModuleLoader__.load({
         }
       }
 
-      /** Fixed-position hero launcher (B2): visible only while the
-       *  conversation root reports the hero phase. */
+      /** Fixed-position hero launcher: the last-resort fallback, mounted only
+       *  while NO declared slot seat is available. Its DOM/store probing (and
+       *  the MutationObserver behind it) stays unwired whenever a real seat
+       *  holds the page. */
       function HeroLauncher(props) {
         var store = useStore();
         var t = props.t;
+        var seat = bestHeroSeat(store.heroClaims);
         React.useEffect(
           function () {
+            if (bestHeroSeat(getSnapshot().heroClaims) !== null) return undefined;
             var disposers = [];
             if (sessions && sessions.list && typeof sessions.list.subscribe === 'function') {
               disposers.push(sessions.list.subscribe(syncHero));
@@ -576,15 +917,16 @@ window.__ModuleLoader__.load({
               if (observer) observer.disconnect();
             };
           },
-          [],
+          [seat],
         );
+        if (seat !== null) return null;
         if (!store.hero) return null;
         return React.createElement(
           'button',
           {
             type: 'button',
             title: store.heroWorkspace ? t('title.heroLauncher.hasWorkspace') : t('title.heroLauncher.noWorkspace'),
-            onClick: function () { openForWorkspace(store.heroWorkspace); },
+            onClick: function () { openForWorkspace(store.heroWorkspace, 'overlay'); },
             style: {
               position: 'fixed',
               bottom: 24,
@@ -595,12 +937,12 @@ window.__ModuleLoader__.load({
               gap: 6,
               padding: '6px 12px',
               borderRadius: 999,
-              border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
-              background: 'var(--color-bg-elevated, #ffffff)',
-              color: 'var(--color-text, inherit)',
+              border: '1px solid ' + TOKEN.border,
+              background: TOKEN.surface,
+              color: TOKEN.ink,
               fontSize: 13,
               cursor: 'pointer',
-              boxShadow: '0 4px 16px rgba(0,0,0,0.14)',
+              boxShadow: TOKEN.shadow,
               opacity: store.heroWorkspace ? 1 : 0.7,
             },
           },
@@ -609,32 +951,33 @@ window.__ModuleLoader__.load({
       }
 
       /** Inline chip for the upstream `conversation.hero.workspaceExtras`
-       *  slot (B1): rendered beside the workspace picker once the DSH core
-       *  declares the slot; a no-op registration until then. */
+       *  slot: rendered beside the workspace picker once the DSH core declares
+       *  the slot; a no-op registration until then. Its popover opens
+       *  DOWNWARD, matching the official workspace picker on the same row. */
       function HeroChip(props) {
         var store = useStore();
         var t = props.t;
         var workspacePath = props && props.workspacePath ? props.workspacePath : store.heroWorkspace;
-        return React.createElement(
-          'button',
-          {
-            type: 'button',
-            title: t('title.heroChip'),
-            onClick: function () { openForWorkspace(workspacePath); },
-            style: {
-              display: 'inline-flex',
-              alignItems: 'center',
-              gap: 6,
-              padding: '4px 10px',
-              borderRadius: 999,
-              border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
-              background: 'transparent',
-              color: 'var(--color-text, inherit)',
-              fontSize: 13,
-              cursor: 'pointer',
+        if (bestHeroSeat(store.heroClaims) !== 'extras') return null;
+        var open = store.open && store.anchor === 'extras';
+        var count = dirCountOf(workspacePath);
+        return chipWithPopover(
+          'extras',
+          'down',
+          t,
+          chipButton({
+            open: open,
+            dimmed: !workspacePath,
+            title: workspacePath ? t('title.heroChip') : t('title.heroLauncher.noWorkspace'),
+            label: count !== null && count > 0 ? t('label.withCount', { count: count }) : t('label'),
+            onClick: function () {
+              if (open) {
+                patch({ open: false });
+              } else {
+                openForWorkspace(workspacePath, 'extras');
+              }
             },
-          },
-          t('label'),
+          }),
         );
       }
 
@@ -651,19 +994,40 @@ window.__ModuleLoader__.load({
           function (props) { return React.createElement(Panel, props); },
         );
       });
+      // Session-creation page, shipped seat: the official input dock band (a
+      // session-scoped `list` slot rendered directly above the composer
+      // card). One unique id, one explicit order, one in-flow row — the
+      // framework arranges this row against every other plugin's dock entry.
+      slots.inject('conversation.input.dock', function () {
+        var release = claimHeroSeat('dock');
+        var dispose = slots.register(
+          { name: 'conversation.input.dock', id: 'multi-folder', order: DOCK_ORDER, label: function () { return t('label.heroDock'); }, locale: NS },
+          function (props) { return React.createElement(DockChip, props); },
+        );
+        return function () {
+          dispose();
+          release();
+        };
+      });
       slots.inject('shell.overlay', function () {
         return slots.register(
           { name: 'shell.overlay', id: 'multi-folder-hero', order: 200, label: function () { return t('label.heroLauncher'); }, locale: NS },
           function (props) { return React.createElement(HeroLauncher, props); },
         );
       });
-      // Upstream slot (B1): the callback fires only once a DSH build declares
-      // `conversation.hero.workspaceExtras`; until then this contributes nothing.
+      // Upstream slot: the callback fires only once a DSH build declares
+      // `conversation.hero.workspaceExtras`; until then this contributes
+      // nothing and the dock row above holds the page.
       slots.inject('conversation.hero.workspaceExtras', function () {
-        return slots.register(
+        var release = claimHeroSeat('extras');
+        var dispose = slots.register(
           { name: 'conversation.hero.workspaceExtras', id: 'multi-folder', order: 30, label: function () { return t('label'); }, locale: NS },
           function (props) { return React.createElement(HeroChip, props); },
         );
+        return function () {
+          dispose();
+          release();
+        };
       });
     }
 

package/lib/index.js

@@ -39,6 +39,12 @@
  *    directly. The `/multi-folder` command and the remote methods share
  *    one core so validation, canonicalization, and the config guard are
  *    identical on both channels.
+ * 7. Failure diagnosis: a `pwsh`/`bash` run that ends in an OS-level
+ *    `Permission denied` touching a secondary working directory (the ACL
+ *    runner confines each process tree to ONE writable root, so `git -C
+ *    <secondary>` launched from the primary workspace cannot write the
+ *    repo) gets a workdir-fix hint attached as an additional context at
+ *    the `tools/post-execute` boundary.
  */
 
 import { join } from 'node:path'
@@ -321,6 +327,100 @@ export function apply(ctx) {
     return text
   }
 
+  // -------------------------------------------- failure diagnosis (post-exec)
+  // The Windows ACL runner confines each process tree to exactly ONE writable
+  // workspace root (a single `--write-sid` that must match `--workspace`). A
+  // command that creates files inside a secondary directory while its cwd is
+  // confined elsewhere therefore fails with an OS-level `Permission denied`
+  // (git: `fatal: Unable to create '.../.git/index.lock': Permission denied`)
+  // and carries NO sandbox marker — the sandbox worked as designed. These
+  // helpers surface the workdir fix at the next tool-call boundary instead.
+
+  const DENIAL_MARK = /permission denied|access(?: is)? denied|eacces|is denied/i
+
+  const flattenResultText = (result) => {
+    const parts = []
+    if (result && Array.isArray(result.content)) {
+      for (const block of result.content) {
+        if (block && block.type === 'text' && typeof block.text === 'string') parts.push(block.text)
+      }
+    }
+    const value = result && result.value
+    if (value && typeof value === 'object') {
+      for (const stream of [value.stdout, value.stderr]) {
+        if (stream && typeof stream.text === 'string') parts.push(stream.text)
+      }
+    }
+    // The plugin's own `[sandbox: ...]` markers describe runner-level denials,
+    // not path-level EACCES; keep them out of the scan.
+    return parts
+      .join('\n')
+      .split('\n')
+      .filter((line) => !line.startsWith('[sandbox:'))
+      .join('\n')
+  }
+
+  /** The configured secondary dir a call's workdir lands in, or null. */
+  const workdirHitFor = async (exec) => {
+    if (!exec || !exec.agent || !exec.agent.session || !exec.agent.session.header) return null
+    const primary = exec.agent.session.header.cwd
+    if (typeof primary !== 'string' || primary.length === 0) return null
+    const dirs = dirsForSync(primary)
+    if (dirs === null) return null
+    const args = exec.arguments || {}
+    const rawWorkdir = typeof args.workdir === 'string' ? args.workdir : null
+    const joined =
+      rawWorkdir === null
+        ? String(primary)
+        : isAbsolute(rawWorkdir)
+          ? rawWorkdir
+          : String(primary).replace(/[\\/]+$/, '') + '/' + rawWorkdir
+    const target = await fs.resolve(joined, { cwd: primary })
+    const abs = fs.processPath(target)
+    return longestRootFirst(dirs).find((d) => pathInside(abs, d)) ?? null
+  }
+
+  /**
+   * A user-visible diagnostic for a shell run that ended in an OS-level
+   * permission denial touching a secondary working directory. Returns the
+   * hint text or undefined. Never throws — a hint failure must never touch
+   * the tool pipeline.
+   */
+  const permissionHint = async (exec, result) => {
+    try {
+      if (!exec || (exec.name !== 'pwsh' && exec.name !== 'bash')) return undefined
+      if (!exec.agent || !exec.agent.session || !exec.agent.session.header) return undefined
+      const exitCode =
+        result && result.value && typeof result.value.exitCode === 'number' ? result.value.exitCode : null
+      if (exitCode !== null && exitCode === 0) return undefined
+      if (!DENIAL_MARK.test(flattenResultText(result))) return undefined
+      const primary = exec.agent.session.header.cwd
+      if (typeof primary !== 'string' || primary.length === 0) return undefined
+      const dirs = dirsForSync(primary)
+      if (dirs === null) return undefined
+      const reRooted = await workdirHitFor(exec)
+      if (reRooted !== null) {
+        return (
+          'This command ran confined to the secondary working directory "' +
+          reRooted +
+          '", so writes OUTSIDE that directory (for example to the primary workspace or another secondary directory) were denied at the OS level. ' +
+          "Split the work into per-directory commands and set each command's `workdir` to the directory it writes into."
+        )
+      }
+      const cmdNorm = wsKey(String((exec.arguments || {}).command || ''))
+      const referenced = longestRootFirst(dirs).find((d) => cmdNorm.includes(wsKey(d)))
+      if (referenced === undefined) return undefined
+      return (
+        'This command ran with its cwd confined to the primary workspace, so creating files inside the secondary working directory "' +
+        referenced +
+        '" was denied at the OS level — each command can write inside only ONE root. ' +
+        'Re-run it with `workdir` set to that directory; for git, run the command from inside the repository instead of using `git -C` from the primary workspace.'
+      )
+    } catch {
+      return undefined
+    }
+  }
+
   // ------------------------------------------------------ prompt injection
   systemPrompt.section({
     name: SECTION_NAME,
@@ -336,8 +436,11 @@ export function apply(ctx) {
       return (
         'Secondary working directories are available in this session (dsh-multi-folder plugin):\n' +
         dirs.map((d) => '- ' + d).join('\n') +
-        '\nYou have the SAME read/write/edit and command-execution permissions on these directories as on the primary workspace under the current sandbox mode. ' +
+        '\nYou have the SAME read/write/edit and command-execution permissions on these directories as on the primary workspace under the current sandbox mode, ' +
+        'but each command can write inside only ONE root — the directory its workdir resolves to. ' +
+        'A command whose cwd stays the primary workspace CANNOT create files inside a secondary directory. ' +
         'For shell tools, pass `workdir` pointing inside one of these directories — foreground and background (`run_in_background`) runs alike. ' +
+        'File-creating commands, git included, MUST set `workdir` to the secondary directory: do not run `git -C <secondary>` or `cd <secondary>` inside a command launched from the primary workspace. ' +
         'Reads from these directories work without `workdir`. The primary workspace remains the default working directory.'
       )
     },
@@ -358,17 +461,21 @@ export function apply(ctx) {
   // --------------------------------------- notification (tool-call boundary)
   ctx.on('tools/post-execute', async (exec, result, next) => {
     const decision = await next()
-    const text = takeNotice(exec.agent)
-    if (text === undefined) return decision
-    const msg = noticeMessage(text)
+    const extras = []
+    const notice = takeNotice(exec.agent)
+    if (notice !== undefined) extras.push(notice)
+    const hint = await permissionHint(exec, result)
+    if (hint !== undefined) extras.push(hint)
+    if (extras.length === 0) return decision
+    const msgs = extras.map((text) => noticeMessage(text))
     if (decision.kind === 'block') {
       return {
         kind: 'block',
         feedback: decision.feedback,
-        additionalContexts: [msg, ...(decision.additionalContexts || [])],
+        additionalContexts: [...msgs, ...(decision.additionalContexts || [])],
       }
     }
-    return { ...decision, additionalContexts: [msg, ...(decision.additionalContexts || [])] }
+    return { ...decision, additionalContexts: [...msgs, ...(decision.additionalContexts || [])] }
   })
 
   // ------------------------------------------------- tool-pipeline intercept

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-multi-folder",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "DeepSeek Harness plugin: secondary working directories for a project. The agent keeps the primary workspace as cwd, gains equal write/exec permissions on configured secondary directories under workspace-write mode, and is notified of configuration changes at the next message boundary. Configurable from the session header AND from the session-creation page (before the first message) through a sessionless multiFolder remote API.",
   "keywords": [
     "dsh-plugin",