dsh-multi-folder 0.2.4 → 0.3.1

package/README.md

@@ -49,7 +49,7 @@ A Multi-folder button appears in the session header, and a second entry appears
 
 | Action | Behavior |
 | ------ | -------- |
-| Add directory | Opens the native directory picker |
+| Add directory | Opens the plugin's own directory browser (path field, one level of child directories, optional new folder) |
 | Remove / refresh | Applies immediately |
 | Switch session | The panel auto-switches to that session's directories |
 | Reopen panel | Uses the per-session cache — no redundant command rows |
@@ -82,7 +82,8 @@ When a shell run ends in such a denial and references a configured secondary dir
 - **Prompt injection** — one ordered `systemPrompt` section with a text provider evaluated per assembly, rendering only for sessions whose workspace has configured directories.
 - **Notifications** — a pending notice armed by the command handler (only on actual change) is consumed at the next boundary by either the `agent/pre-step` waterfall (prepend into the entering message batch) or the `tools/post-execute` waterfall (attach as `additionalContexts`), whichever fires first — the framework's native plugin-sourced `notice` context.
 - **Configuration & security boundary** — per-workspace config lives in a host-owned store outside every agent sandbox root (`<DSH_HOME>/storages/multi-folder/<workspace-key>.json`). Direct `write`/`edit` attempts against the config file are rejected with an explicit message — **the agent can never self-grant directories; configuration is user-managed by design**. See [SECURITY.md](SECURITY.md).
-- **Sessionless remote API** — a `multiFolder` namespace registered through `ctx.typert.register` (hand-written `src-json` descriptors) plus a plain-object service provided as `multiFolder`. Its `list`/`add`/`remove`/`set` methods are keyed by workspace **path** and share one validated core with the `/multi-folder` command, so the creation page can configure directories before any session exists.
+- **Sessionless remote API** — a `multiFolder` namespace registered through `ctx.typert.register` (hand-written `src-json` descriptors) plus a plain-object service provided as `multiFolder`. Its `list`/`add`/`remove`/`set` methods are keyed by workspace **path** and share one validated core with the `/multi-folder` command, so the creation page can configure directories before any session exists. `browse`/`makeDir` ride the same namespace: they serve the plugin's own directory browser and never touch the configuration store.
+- **Owned directory browser** — "Add directory" is drawn by this plugin and served by `browse`/`makeDir`, so it behaves identically in every deployment: the host's native chooser composition, the browse composition (LAN or remote clients, desktop shells) and shells that compose no picker at all. Listing rides the host `fs` seam (`fs.resolve` + `fs.listDir`).
 - **Client** — a hand-maintained factory bundle (`window.__ModuleLoader__.load`), no build toolchain required. The panel drives the host through two channels: the Remote BFF (`ctx.remote.commands.execute`) for sessions, and the shared `/api` RPC channel (`ctx.connection.rpc.call`) for the sessionless endpoints.
 
 ## Project layout
@@ -90,8 +91,8 @@ When a shell run ends in such a denial and references a configured secondary dir
 | Path | Purpose |
 | ---- | ------- |
 | `cordis.patch.yml` | Profile patch layer inserting the `dsh-multi-folder` row |
-| `lib/index.js` | Host plugin: config store, tool-pipeline interception, prompt injection, dual-channel notifications, `/multi-folder` command, sessionless `multiFolder/*` remote API |
-| `lib/client.js` | Client plugin (factory bundle): session-header button + overlay panel + session-creation page entry (input-dock chip / upstream hero chip / fixed fallback launcher) |
+| `lib/index.js` | Host plugin: config store, tool-pipeline interception, prompt injection, dual-channel notifications, `/multi-folder` command, sessionless `multiFolder/*` remote API (configuration plus `browse`/`makeDir` for the owned browser) |
+| `lib/client.js` | Client plugin (factory bundle): session-header button + overlay panel + session-creation page entry (input-dock chip / upstream hero chip / fixed fallback launcher) + the owned directory browser behind "Add directory" |
 | `test/` | Runtime-free behavior tests (see Development) |
 | `docs/` | Design and analysis documents |
 

package/README.zh.md

@@ -49,7 +49,7 @@ dsh plugin --profile web add dsh-multi-folder
 
 | 操作 | 行为 |
 | ---- | ---- |
-| 添加目录 | 打开原生目录选择器 |
+| 添加目录 | 打开插件自带的目录浏览器（路径输入框 + 一级子目录列表 + 可新建文件夹） |
 | 移除 / 刷新 | 立即生效 |
 | 切换会话 | 面板自动切换为该会话的副工作目录 |
 | 重新打开面板 | 使用会话级缓存，不产生冗余命令行 |
@@ -82,7 +82,8 @@ Agent 无需任何额外操作：`read` / `glob` / `grep` 随处可用；`write`
 - **提示词注入**——一个有序 `systemPrompt` 段落，text provider 每次组装按会话求值，仅为配置了副目录的会话渲染。
 - **通知**——命令处理器仅在目录集合实际变化时置位 pending notice；`agent/pre-step`（前置注入进入批次）与 `tools/post-execute`（附加为 `additionalContexts`）两个通道中先触发者消费——均使用框架原生的插件来源 `notice` 上下文。
 - **配置与安全边界**——per-workspace 配置存储于 Agent 沙箱之外的宿主自有目录（`<DSH_HOME>/storages/multi-folder/<workspace-key>.json`）。对配置文件的任何直接 `write`/`edit` 都会收到显式拒绝——**Agent 永远无法自我授予目录，配置权仅属于用户**。详见 [SECURITY.md](SECURITY.md)。
-- **无会话远程 API**——经 `ctx.typert.register` 注册 `multiFolder` 命名空间（手写 `src-json` 描述符），并以普通对象服务 `multiFolder` 提供；`list`/`add`/`remove`/`set` 以工作区**路径**为键，与 `/multi-folder` 命令共享同一套校验核心，因此会话尚未建立时创建页也能直接配置。
+- **无会话远程 API**——经 `ctx.typert.register` 注册 `multiFolder` 命名空间（手写 `src-json` 描述符），并以普通对象服务 `multiFolder` 提供；`list`/`add`/`remove`/`set` 以工作区**路径**为键，与 `/multi-folder` 命令共享同一套校验核心，因此会话尚未建立时创建页也能直接配置。`browse`/`makeDir` 属于同一命名空间：它们只服务插件自带的目录浏览器，不触碰配置存储。
+- **自带目录浏览器**——「添加目录」由插件自己绘制、经 `browse`/`makeDir` 提供服务，因此在任何部署下行为一致：宿主使用原生选择器的组合、使用 browse 后端的组合（局域网/远程客户端、桌面壳），以及完全没有选择器的壳。列目录走宿主 `fs` seam（`fs.resolve` + `fs.listDir`）。
 - **客户端**——手写维护的 factory bundle（`window.__ModuleLoader__.load`），无需构建工具链；面板经两条通道驱动宿主：会话内走 Remote BFF（`ctx.remote.commands.execute`），无会话端点走共享 `/api` RPC 通道（`ctx.connection.rpc.call`）。
 
 ## 目录结构
@@ -90,8 +91,8 @@ Agent 无需任何额外操作：`read` / `glob` / `grep` 随处可用；`write`
 | 路径 | 作用 |
 | ---- | ---- |
 | `cordis.patch.yml` | profile patch 层，插入 `dsh-multi-folder` 行 |
-| `lib/index.js` | 宿主插件：配置存储、工具流水线拦截、提示词注入、双通道通知、`/multi-folder` 命令、无会话 `multiFolder/*` 远程 API |
-| `lib/client.js` | 客户端插件（factory bundle）：会话头部按钮 + 覆盖层面板 + 会话创建页入口（输入框上方的 dock 胶囊 / 上游 hero chip / 右下角兜底浮动按钮） |
+| `lib/index.js` | 宿主插件：配置存储、工具流水线拦截、提示词注入、双通道通知、`/multi-folder` 命令、无会话 `multiFolder/*` 远程 API（配置端点 + 自带浏览器用的 `browse`/`makeDir`） |
+| `lib/client.js` | 客户端插件（factory bundle）：会话头部按钮 + 覆盖层面板 + 会话创建页入口（输入框上方的 dock 胶囊 / 上游 hero chip / 右下角兜底浮动按钮）+「添加目录」背后的自带目录浏览器 |
 | `test/` | 免 DSH 运行时的行为测试（见开发） |
 | `docs/` | 设计与分析文档 |
 

package/docs/design.md

@@ -14,8 +14,8 @@ agent informed. No new tools are added.
 
 | Half | File | Role |
 | ---- | ---- | ---- |
-| Host | `lib/index.js` | Config store, tool-pipeline interception, prompt section, notifications, `/multi-folder` command, sessionless `multiFolder/*` remote API |
-| Client | `lib/client.js` | Session-header button + overlay panel; session-creation page entry (input-dock chip, upstream hero chip, or fixed fallback launcher — one at a time), all driving the host through the Remote BFF / shared RPC channel |
+| Host | `lib/index.js` | Config store, tool-pipeline interception, prompt section, notifications, `/multi-folder` command, sessionless `multiFolder/*` remote API (configuration plus the browser's `browse`/`makeDir`) |
+| Client | `lib/client.js` | Session-header button + overlay panel; session-creation page entry (input-dock chip, upstream hero chip, or fixed fallback launcher — one at a time), all driving the host through the Remote BFF / shared RPC channel; the owned directory browser behind "Add directory" |
 
 The package declares both faces: `dsh.bundle.patch` (the host row inserted by
 `cordis.patch.yml`) and `dsh.client` (the web bundle at `exports["./client"]`).
@@ -120,7 +120,7 @@ opens its own **sessionless** endpoints on the shared `/api` RPC channel:
   `ctx.inject(['typert'], (t) => t.typert.register(REMOTE_CONTRIBUTION))` —
   the sanctioned manual path documented by `dsh-typert-loader` ("Manual
   `ctx.typert.register()` remains available for contributions that do not use
-  a `./typert` artifact"). All four descriptors use `src-json` codecs (no zod
+  a `./typert` artifact"). All six descriptors use `src-json` codecs (no zod
   schemas needed) with `invocation: { kind: 'direct' }`:
 
   | Endpoint | Parameters (wire) | Result |
@@ -129,6 +129,11 @@ opens its own **sessionless** endpoints on the shared `/api` RPC channel:
   | `multiFolder/add` | `workspace`, `path` | `{ workspace, dirs, changed }` |
   | `multiFolder/remove` | `workspace`, `path` | `{ workspace, dirs, changed }` |
   | `multiFolder/set` | `workspace`, `dirs` | `{ workspace, dirs, changed }` |
+  | `multiFolder/browse` | `path` | `{ path, parent, home, entries, truncated }` |
+  | `multiFolder/makeDir` | `parent`, `name` | `{ path, parent }` |
+
+  The four configuration endpoints are keyed by workspace; the last two serve
+  the plugin's own directory browser and are keyed by path instead.
 
   The workspace argument is a **path**, not a session id; the client derives
   it from the workspaces store (`WorkspaceView.path`). Business errors throw
@@ -160,6 +165,17 @@ opens its own **sessionless** endpoints on the shared `/api` RPC channel:
   - the next boundary consumes it — `agent/pre-step` prepends it to the entering
     message batch, or `tools/post-execute` attaches it as `additionalContexts` —
     whichever fires first. No turn is ever interrupted.
+  - the notice's `source` declares a **producer-owned kind**
+    (`kind: 'plugin:dsh-multi-folder'`, `form: 'notice'`, `summary`). Session
+    format v4 admitted only the retired catch-all wrapper `kind: 'plugin'` for
+    nothing: `sessionFormatCatalog.encodeCurrentEvent` — which the JSONL writer
+    runs on every appended event — throws
+    `format v4 message requires a producer-owned source kind` for it, failing the
+    run the moment a notice is logged. `plugin:<plugin>` is the spelling the
+    format's v3→v4 migration itself produces for a non-first-party producer
+    (`session-format-v3-to-v4/src/sources.ts`), so it is also what this plugin's
+    older logs migrate to. The `workdir` diagnosis attached at a tool-call
+    boundary is built by the same function and fixed with it.
 
 ## Client
 
@@ -208,6 +224,25 @@ window.__ModuleLoader__.load({
     'multiFolder/<op>', { args })` against the sessionless remote endpoints.
     The panel runs in either mode according to how it was opened; mutations
     and refreshes route per mode, and both modes share the same row/error UI.
+- Owned directory browser ("Add directory"): the plugin draws the picking
+  interaction itself and serves it from `multiFolder/browse` +
+  `multiFolder/makeDir` over the shared RPC channel, instead of asking the host
+  for a picker. One interaction therefore covers every deployment, which no
+  host picker does: `uiWorkspace.pickDirectory()` is native-only (the host
+  answers `directory-picker/unavailable` when it composed the browse backend —
+  a LAN bind, a remote client, a desktop shell), its
+  `listDirectory`/`createDirectory` twins are refused under the native
+  composition, and the shipped in-app browser is reachable only by the shell's
+  own workspace surfaces (its `directoryFlow` holes are declared and driven by
+  ui-workspace, not by plugins). Listing rides the **`fs` seam**
+  (`fs.resolve` + `fs.listDir`), which every composition provides; only
+  directories are returned, hidden entries are flagged, the level is capped at
+  1000 with a `truncated` flag, and paths must be fully qualified. Creation
+  mirrors the shipped browse backend (`dsh-host-directory-picker-browse`) by
+  calling Node's `mkdir` on a validated single segment, because the `fs` seam
+  exposes no creation primitive. Neither endpoint touches the configuration
+  store: choosing a level still commits through the mode's own channel
+  (`/multi-folder add` in a session, `multiFolder/add` on the creation page).
 - Session switch: a `React.useEffect` on `sessionId` re-points the open panel
   to the current session (reusing the per-session cache) — this also folds a
   workspace-mode panel back into session mode once the first message creates
@@ -346,10 +381,15 @@ window.__ModuleLoader__.load({
 `test/smoke-host.mjs`, `test/intercept.mjs`, and `test/smoke-client.mjs` run without
 the DSH runtime using mock services and a React shim. They cover interception,
 canonicalization, the config guard, both notification channels, notice
-gating, command flows, the panel's session-switch/caching behavior, the
+gating and the producer-owned notice source kind v4 admits, command flows, the panel's session-switch/caching behavior, the
 sessionless remote contribution shape and behavior (list/add/set/remove,
 idempotence, sanitization, error prefixing, cross-channel cache coherence),
-and the hero/workspace-mode client flows. The client test's `slots.inject` mock
+the owned browser's host half (`browse` filtering/sorting/hidden flags, the
+fully-qualified-path fence, `makeDir` segment validation against a real
+temporary directory, and that neither endpoint writes the config store),
+and the hero/workspace-mode client flows — including the browser's own client
+flow (open at the panel workspace, enter a level, commit through the mode's
+channel, create a child and enter it, and return without a remote call). The client test's `slots.inject` mock
 is declaration-aware like the real service (a wait fires only while its slot is
 declared, and a collapse disposes the registration), so it covers all three
 session-creation seats: the dock chip on an rc.6-style shell (registration

package/lib/client.js

@@ -27,6 +27,18 @@
  * (`ctx.connection.rpc.call('/api', endpoint, { args })`), keyed by workspace
  * path instead of sessionId.
  *
+ * "Add directory" never asks the host for a picker: the plugin draws its own
+ * browser (an editable path field, one level of child directories, an optional
+ * "new folder") on the `multiFolder/browse` + `multiFolder/makeDir` endpoints
+ * over the shared RPC channel. One interaction serves every deployment, which
+ * the host's own picker cannot: `uiWorkspace.pickDirectory()` is native-only
+ * (it answers `directory-picker/unavailable` whenever the host composed the
+ * browse backend — a LAN bind, a remote client, a desktop shell), while its
+ * `listDirectory`/`createDirectory` twins are refused under the native
+ * composition. Listing this way also stays clear of the DSH Windows native
+ * chooser worker, whose crash surfaces as `directory picker failed: … worker
+ * exited …`.
+ *
  * Layout shape: an entry in the session header action row, one chip row above
  * the composer card on the session-creation page, and a frame-wide overlay
  * panel. Every surface reads one tiny module-scoped store; opening the panel
@@ -74,6 +86,16 @@ window.__ModuleLoader__.load({
       heroClaims: [],
       /** Which surface owns the open panel: 'overlay' | 'dock' | 'extras'. */
       anchor: 'overlay',
+      /** The owned directory browser (the "Add directory" interaction). */
+      browseOpen: false,
+      /** The level on display: { path, parent, home, entries, truncated } | null. */
+      browse: null,
+      browseBusy: false,
+      browseError: null,
+      /** Editable path field, seeded from the level on display. */
+      browseDraft: '',
+      /** "new folder" name draft. */
+      newDirName: '',
       /** Bumped on every workspaceCache write so chips re-read their count. */
       cacheRev: 0,
     };
@@ -186,6 +208,19 @@ window.__ModuleLoader__.load({
       'panel.remove': '移除',
       'panel.refresh': '刷新',
       'panel.footnote': 'Agent 的主工作目录不变；在 Workspace Write 模式下，Agent 对上述目录拥有与主工作目录同等的读写与命令执行权限。配置变更会在下一条消息或工具调用结束时通知 Agent。',
+      'browse.title': '选择目录',
+      'browse.pathLabel': '目录路径',
+      'browse.go': '前往',
+      'browse.up': '↑ 上级',
+      'browse.use': '选择此目录',
+      'browse.back': '← 返回',
+      'browse.loading': '读取中…',
+      'browse.empty': '此目录下没有子目录。',
+      'browse.truncated': '仅显示前 {count} 个子目录。',
+      'browse.enter': '进入此目录',
+      'browse.newDirPlaceholder': '新建文件夹名称',
+      'browse.newDirCreate': '创建',
+      'browse.hint': '浏览宿主机文件系统；选中的目录将作为副工作目录添加。',
     };
     /** English dictionary — checked complete against the zh key set. */
     var enDict = {
@@ -210,17 +245,29 @@ window.__ModuleLoader__.load({
       'panel.remove': 'Remove',
       'panel.refresh': 'Refresh',
       'panel.footnote': "The agent's primary working directory stays unchanged; under Workspace Write mode the agent has the same read/write and command-execution rights on the listed directories as on the primary workspace. Configuration changes are announced at the next message or tool-call boundary.",
+      'browse.title': 'Choose a directory',
+      'browse.pathLabel': 'Directory path',
+      'browse.go': 'Go',
+      'browse.up': '↑ Up',
+      'browse.use': 'Use this directory',
+      'browse.back': '← Back',
+      'browse.loading': 'Loading…',
+      'browse.empty': 'No subdirectories here.',
+      'browse.truncated': 'Showing the first {count} subdirectories.',
+      'browse.enter': 'Enter this directory',
+      'browse.newDirPlaceholder': 'New folder name',
+      'browse.newDirCreate': 'Create',
+      'browse.hint': 'Browses the host filesystem; the chosen directory is added as a secondary working directory.',
     };
 
     // ------------------------------------------------------------- plugin
     var name = 'dsh-multi-folder';
-    var inject = ['remote', 'remote.commands', 'slots', 'workspaces', 'uiWorkspace', 'connection', 'sessions', 'locale'];
+    var inject = ['remote', 'remote.commands', 'slots', 'workspaces', 'connection', 'sessions', 'locale'];
 
     function apply(ctx) {
       var slots = ctx.slots;
       var remote = ctx.remote;
       var workspaces = ctx.workspaces;
-      var uiWorkspace = ctx.uiWorkspace;
       var connection = ctx.connection;
       var sessions = ctx.sessions;
       var locale = ctx.locale;
@@ -324,6 +371,7 @@ window.__ModuleLoader__.load({
        *  renders it as its own popover, everything else uses the overlay. */
       function openForWorkspace(workspacePath, anchor) {
         var seat = anchor || 'overlay';
+        patch(browserReset());
         if (!workspacePath) {
           patch({ open: true, mode: 'workspace', sessionId: null, workspace: null, dirs: [], error: null, anchor: seat });
           return;
@@ -398,28 +446,94 @@ window.__ModuleLoader__.load({
         });
       }
 
+      // -------------------------------------------- owned directory browser
+      // "Add directory" is served entirely by this plugin (host item 8): the
+      // browser reads levels over `multiFolder/browse` and may create one child
+      // through `multiFolder/makeDir`, so the interaction never depends on the
+      // host's composed directory picker — the native chooser, the browse
+      // backend and a shell with no picker at all all behave the same here.
+
+      /** Read one level into the store. A blank path asks the host for its
+       *  home directory, so the browser always has somewhere to start. */
+      function browseTo(path) {
+        patch({ browseBusy: true, browseError: null });
+        return remoteCall('multiFolder/browse', { path: typeof path === 'string' ? path : '' }).then(function (value) {
+          var level = value && typeof value === 'object'
+            ? value
+            : { path: '', parent: null, home: '', entries: [], truncated: false };
+          patch({
+            browseBusy: false,
+            browse: level,
+            browseDraft: level.path,
+            browseError: null,
+            newDirName: '',
+          });
+          return level;
+        }).catch(function (e) {
+          patch({ browseBusy: false, browseError: String(e && e.message ? e.message : e) });
+          return null;
+        });
+      }
+
+      /** Open the browser at the panel's workspace (or the host home when the
+       *  panel has no workspace path yet) and read its first level. */
       function addDirectory() {
-        // DSH 0.1.2 moved the directory picker onto `uiWorkspace`; earlier
-        // shells kept it on `workspaces`. Pick whichever service actually
-        // exposes it (and call it with the right receiver), surfacing a clear
-        // error when neither does instead of throwing synchronously.
-        var picker = (uiWorkspace && typeof uiWorkspace.pickDirectory === 'function')
-          ? uiWorkspace
-          : (workspaces && typeof workspaces.pickDirectory === 'function') ? workspaces : null;
-        if (picker === null) {
-          patch({ error: 'multi-folder: the directory picker service is unavailable' });
-          return;
+        var snapshot = getSnapshot();
+        patch({
+          browseOpen: true,
+          browse: null,
+          browseBusy: false,
+          browseError: null,
+          browseDraft: snapshot.workspace || '',
+          newDirName: '',
+        });
+        browseTo(snapshot.workspace || '');
+      }
+
+      /** Leave the browser without adding anything. */
+      function closeBrowser() {
+        patch(browserReset());
+      }
+
+      /** The store fields that put the panel back on its directory list. Any
+       *  fresh open of the panel (header button, chip, launcher) starts there,
+       *  so a browser left open by a dismissed panel never comes back stale. */
+      function browserReset() {
+        return { browseOpen: false, browse: null, browseBusy: false, browseError: null, newDirName: '' };
+      }
+
+      /** Adopt one path as a secondary working directory through the channel
+       *  the panel already uses: the `/multi-folder add` command inside a
+       *  session, the sessionless `multiFolder/add` endpoint on the
+       *  session-creation page. The browser stays open when the Host refused,
+       *  so the error sits beside the path the user was looking at. */
+      function commitBrowsePath(path) {
+        var snapshot = getSnapshot();
+        var settled;
+        if (snapshot.sessionId) {
+          settled = mutate(snapshot.sessionId, '/multi-folder add "' + String(path).replace(/"/g, '\\"') + '"');
+        } else if (snapshot.workspace) {
+          settled = mutateWorkspace(snapshot.workspace, 'multiFolder/add', { path: path });
+        } else {
+          return Promise.resolve();
         }
-        picker.pickDirectory().then(function (path) {
-          if (path === null || path === undefined) return;
-          var snapshot = getSnapshot();
-          if (snapshot.sessionId) {
-            mutate(snapshot.sessionId, '/multi-folder add "' + path.replace(/"/g, '\\"') + '"');
-          } else if (snapshot.workspace) {
-            mutateWorkspace(snapshot.workspace, 'multiFolder/add', { path: path });
-          }
+        return Promise.resolve(settled).then(function () {
+          if (!getSnapshot().error) closeBrowser();
+        });
+      }
+
+      /** Create one child directory and enter it. */
+      function createBrowseDir() {
+        var snapshot = getSnapshot();
+        var name = String(snapshot.newDirName || '').trim();
+        if (!snapshot.browse || name === '') return Promise.resolve();
+        patch({ browseBusy: true, browseError: null });
+        return remoteCall('multiFolder/makeDir', { parent: snapshot.browse.path, name: name }).then(function (created) {
+          patch({ browseBusy: false, newDirName: '' });
+          return browseTo(created && created.path ? created.path : snapshot.browse.path);
         }).catch(function (e) {
-          patch({ error: String(e && e.message ? e.message : e) });
+          patch({ browseBusy: false, browseError: String(e && e.message ? e.message : e) });
+          return null;
         });
       }
 
@@ -428,6 +542,7 @@ window.__ModuleLoader__.load({
       function openFor(sessionId) {
         if (!sessionId) return;
         var cached = sessionCache[sessionId];
+        patch(browserReset());
         patch({
           open: true,
           mode: 'session',
@@ -491,6 +606,191 @@ window.__ModuleLoader__.load({
         return btn;
       }
 
+      /** The owned browser, rendered in place of the directory list: an
+       *  editable path field, up/use/back actions, one level of child
+       *  directories, and the optional "new folder" row. Returned as an ARRAY
+       *  for the same reason `panelBody` is. */
+      function browseBody(store, t) {
+        var level = store.browse;
+        var busy = !!store.busy || !!store.browseBusy;
+        var entries = level && Array.isArray(level.entries) ? level.entries : null;
+        var inputStyle = {
+          flex: 1,
+          minWidth: 0,
+          padding: '4px 8px',
+          borderRadius: 6,
+          border: '1px solid ' + TOKEN.border,
+          background: 'transparent',
+          color: TOKEN.ink,
+          fontSize: 12,
+          fontFamily: 'inherit',
+        };
+        var smallButton = function (extra) {
+          return Object.assign({
+            padding: '4px 10px',
+            borderRadius: 6,
+            border: '1px solid ' + TOKEN.border,
+            background: 'transparent',
+            color: TOKEN.ink,
+            fontSize: 12,
+            fontFamily: 'inherit',
+          }, extra || {});
+        };
+        var rows = entries === null ? null : entries.map(function (entry, index) {
+          return React.createElement(
+            'button',
+            {
+              key: index,
+              type: 'button',
+              title: t('browse.enter'),
+              disabled: busy,
+              onClick: function () { browseTo(entry.path); },
+              style: {
+                display: 'block',
+                width: '100%',
+                textAlign: 'left',
+                padding: '5px 8px',
+                marginBottom: 4,
+                borderRadius: 6,
+                border: '1px solid transparent',
+                background: TOKEN.subtle,
+                color: entry.hidden ? TOKEN.inkMuted : TOKEN.ink,
+                cursor: busy ? 'default' : 'pointer',
+                fontFamily: 'inherit',
+                fontSize: 12,
+                overflow: 'hidden',
+                textOverflow: 'ellipsis',
+                whiteSpace: 'nowrap',
+                opacity: busy ? 0.6 : 1,
+              },
+            },
+            '📁 ' + entry.name,
+          );
+        });
+        return [
+          React.createElement(
+            'div',
+            { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 10 } },
+            React.createElement('div', { style: { fontWeight: 600, fontSize: 14, color: TOKEN.ink } }, t('browse.title')),
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                title: t('title.close'),
+                onClick: function () { closeBrowser(); patch({ open: false }); },
+                style: { padding: '2px 8px', borderRadius: 6, border: '1px solid transparent', background: 'transparent', color: TOKEN.inkMuted, cursor: 'pointer' },
+              },
+              '✕',
+            ),
+          ),
+          React.createElement(
+            'div',
+            { style: { display: 'flex', gap: 6, marginBottom: 6 } },
+            React.createElement('input', {
+              type: 'text',
+              value: store.browseDraft,
+              placeholder: t('browse.pathLabel'),
+              spellCheck: false,
+              onChange: function (event) { patch({ browseDraft: event.target.value }); },
+              onKeyDown: function (event) { if (event.key === 'Enter') browseTo(store.browseDraft); },
+              style: inputStyle,
+            }),
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                disabled: busy,
+                onClick: function () { browseTo(store.browseDraft); },
+                style: smallButton({ background: TOKEN.fill, cursor: busy ? 'default' : 'pointer', opacity: busy ? 0.6 : 1 }),
+              },
+              t('browse.go'),
+            ),
+          ),
+          React.createElement(
+            'div',
+            { style: { display: 'flex', gap: 6, marginBottom: 8 } },
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                disabled: busy || !level || !level.parent,
+                onClick: function () { if (level && level.parent) browseTo(level.parent); },
+                style: smallButton({ cursor: busy || !level || !level.parent ? 'default' : 'pointer', opacity: busy || !level || !level.parent ? 0.5 : 1 }),
+              },
+              t('browse.up'),
+            ),
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                disabled: busy || !level,
+                onClick: function () { if (level) commitBrowsePath(level.path); },
+                style: smallButton({ flex: 1, border: '1px solid ' + TOKEN.accent, background: TOKEN.fill, cursor: busy || !level ? 'default' : 'pointer', opacity: busy || !level ? 0.6 : 1 }),
+              },
+              t('browse.use'),
+            ),
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                onClick: function () { closeBrowser(); },
+                style: smallButton({ border: '1px solid transparent', color: TOKEN.inkMuted, cursor: 'pointer' }),
+              },
+              t('browse.back'),
+            ),
+          ),
+          store.browseError
+            ? React.createElement('div', { style: { marginBottom: 8, color: TOKEN.danger, whiteSpace: 'pre-wrap', fontSize: 12 } }, String(store.browseError))
+            : null,
+          React.createElement(
+            'div',
+            { style: { maxHeight: 200, overflowY: 'auto', marginBottom: 6 } },
+            rows === null
+              ? (store.browseError
+                  ? null
+                  : React.createElement('div', { style: { color: TOKEN.inkMuted, fontSize: 12 } }, t('browse.loading')))
+              : (rows.length > 0
+                  ? rows
+                  : React.createElement('div', { style: { color: TOKEN.inkMuted, fontSize: 12 } }, t('browse.empty'))),
+          ),
+          level && level.truncated
+            ? React.createElement(
+                'div',
+                { style: { marginBottom: 6, color: TOKEN.inkMuted, fontSize: 11 } },
+                t('browse.truncated', { count: entries ? entries.length : 0 }),
+              )
+            : null,
+          React.createElement(
+            'div',
+            { style: { display: 'flex', gap: 6, marginBottom: 8 } },
+            React.createElement('input', {
+              type: 'text',
+              value: store.newDirName,
+              placeholder: t('browse.newDirPlaceholder'),
+              spellCheck: false,
+              onChange: function (event) { patch({ newDirName: event.target.value }); },
+              onKeyDown: function (event) { if (event.key === 'Enter') createBrowseDir(); },
+              style: inputStyle,
+            }),
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                disabled: busy || String(store.newDirName || '').trim() === '',
+                onClick: function () { createBrowseDir(); },
+                style: smallButton({ background: TOKEN.fill, cursor: busy ? 'default' : 'pointer', opacity: busy || String(store.newDirName || '').trim() === '' ? 0.5 : 1 }),
+              },
+              t('browse.newDirCreate'),
+            ),
+          ),
+          React.createElement(
+            'div',
+            { style: { fontSize: 11, lineHeight: 1.5, color: TOKEN.inkMuted } },
+            t('browse.hint'),
+          ),
+        ];
+      }
+
       // Panel body ---------------------------------------------------------
       /** The panel's children, shared verbatim by the overlay panel and the
        *  chip popover. Returned as an ARRAY so each wrapper can spread it as
@@ -498,6 +798,9 @@ window.__ModuleLoader__.load({
       function panelBody(store, t) {
         var sessionMode = store.mode === 'session';
         var usable = sessionMode || !!store.workspace;
+        // The owned browser replaces the directory list while it is open; the
+        // panel header and its placement stay the same.
+        if (store.browseOpen) return browseBody(store, t);
         var rows = (store.dirs || []).map(function (dir, index) {
           return React.createElement(
             'div',

package/lib/index.js

@@ -56,16 +56,32 @@
  *    — where no session exists yet — can read and edit the configuration
  *    directly. The `/multi-folder` command and the remote methods share
  *    one core so validation, canonicalization, and the config guard are
- *    identical on both channels.
+ *    identical on both channels. `browse` and `makeDir` ride the same
+ *    namespace: they serve the plugin's own directory browser (see 8) rather
+ *    than the configuration store.
  * 7. Failure diagnosis: a `pwsh`/`bash` run that ends in an OS-level
  *    `Permission denied` touching a secondary working directory (the ACL
  *    runner confines each process tree to ONE writable root, so `git -C
  *    <secondary>` launched from the primary workspace cannot write the
  *    repo) gets a workdir-fix hint attached as an additional context at
  *    the `tools/post-execute` boundary.
+ * 8. Owned directory browser: "Add directory" opens a browser drawn by the
+ *    client half and served by `browse`/`makeDir` above. Listing rides the
+ *    `fs` seam (`fs.listDir`), which — unlike the host's directory-picker
+ *    seam — is composed in EVERY deployment, so one interaction covers the
+ *    native-chooser composition, the browse composition (LAN / remote
+ *    clients / desktop shells) and shells that compose no picker at all.
+ *    The framework offers no plugin-facing alternative: `uiWorkspace`'s
+ *    `pickDirectory()` is native-only (it answers `directory-picker/unavailable`
+ *    under the browse composition), its `listDirectory`/`createDirectory`
+ *    twins are browse-only, and the shipped in-app browser is reachable only
+ *    by the shell's own workspace surfaces. Directory creation mirrors the
+ *    shipped browse backend, which uses Node's `mkdir` (the fs seam has no
+ *    creation primitive).
  */
 
-import { join } from 'node:path'
+import { mkdir } from 'node:fs/promises'
+import { join, posix, win32 } from 'node:path'
 import os from 'node:os'
 
 export const name = 'dsh-multi-folder'
@@ -248,6 +264,97 @@ export function apply(ctx) {
     return { workspace: ws, dirs: [...next], changed }
   }
 
+  // ------------------------------------------------- owned directory picker
+  // The plugin owns its picking interaction (see the file header, item 8):
+  // one in-app browser over these two endpoints, so "Add directory" behaves
+  // identically under every host picker composition instead of depending on
+  // the native-only `uiWorkspace.pickDirectory()` service.
+
+  /** Complete-result bound of one listing level (mirrors the shipped browse backend). */
+  const MAX_BROWSE_ENTRIES = 1000
+
+  /**
+   * Whether a path names one fixed filesystem location regardless of process
+   * state: POSIX-absolute on POSIX; on Windows only drive-qualified (`C:\…`)
+   * or complete UNC (`\\server\share…`) forms. Rooted drive-less forms
+   * (`\foo`, `/foo`) are `isAbsolute` yet still resolve against the host
+   * process's current drive, so they are refused rather than rebased.
+   */
+  const fullyQualified = (path) =>
+    process.platform === 'win32'
+      ? win32.isAbsolute(path) && /^(?:[A-Za-z]:[\\/]|[\\/]{2}[^\\/]+[\\/]+[^\\/]+)/.test(path)
+      : posix.isAbsolute(path)
+
+  /** The path flavour one fully qualified path belongs to (flavour, never the host platform). */
+  const pathApiFor = (path) => (/^[A-Za-z]:[\\/]|^\\\\/.test(path) ? win32 : posix)
+
+  /** The parent level of one absolute path, or null at a filesystem root. */
+  const parentOf = (path) => {
+    const parent = pathApiFor(path).dirname(path)
+    return parent === path ? null : parent
+  }
+
+  /**
+   * List the direct subdirectories of one level for the plugin's browser.
+   * An absent/blank path lists the host user's home directory. Only
+   * directories are returned (a file is not addable as a secondary working
+   * directory), hidden entries are flagged for the client to style, and the
+   * level is capped with a `truncated` flag.
+   * @param path - fully qualified directory path, or nothing for the home directory.
+   * @returns the level's canonical path, its parent, the home directory, the child directories, and the cap state.
+   */
+  const coreBrowse = async (path) => {
+    const requested = typeof path === 'string' && path.trim().length > 0 ? path.trim() : os.homedir()
+    if (!fullyQualified(requested)) {
+      throw new Error('browse requires a fully qualified path, got "' + requested + '"')
+    }
+    const target = await fs.resolve(requested)
+    const absolute = fs.processPath(target)
+    let children
+    try {
+      children = await fs.listDir(target)
+    } catch (e) {
+      throw new Error('cannot list "' + absolute + '": ' + String(e && e.message ? e.message : e))
+    }
+    const api = pathApiFor(absolute)
+    const entries = []
+    for (const child of children ?? []) {
+      if (child === null || child === undefined || child.type !== 'directory') continue
+      const entryName = String(child.name)
+      entries.push({ name: entryName, path: api.join(absolute, entryName), hidden: entryName.startsWith('.') })
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name))
+    const truncated = entries.length > MAX_BROWSE_ENTRIES
+    if (truncated) entries.length = MAX_BROWSE_ENTRIES
+    return { path: absolute, parent: parentOf(absolute), home: os.homedir(), entries, truncated }
+  }
+
+  /**
+   * Create one child directory for the plugin's browser. Mirrors the shipped
+   * browse backend: the parent must be fully qualified, the name one path
+   * segment, and the creation non-recursive (the browser shows the parent, so
+   * a missing level is a real failure, not a level to invent).
+   * @param parent - fully qualified existing parent directory.
+   * @param name - single path segment name.
+   * @returns the created directory's canonical path.
+   */
+  const coreMakeDir = async (parent, name) => {
+    if (typeof parent !== 'string' || !fullyQualified(parent)) {
+      throw new Error('makeDir requires a fully qualified parent path')
+    }
+    if (typeof name !== 'string' || name.trim() === '' || name === '.' || name === '..' || /[/\\]/.test(name)) {
+      throw new Error('makeDir requires a single path segment name')
+    }
+    const target = pathApiFor(parent).join(parent, name)
+    try {
+      await mkdir(target)
+    } catch (e) {
+      if (e && e.code === 'EEXIST') throw new Error('"' + target + '" already exists')
+      throw new Error('cannot create "' + target + '": ' + String(e && e.message ? e.message : e))
+    }
+    return { path: target, parent }
+  }
+
   // ----------------------------------------------- sessionless remote API
   // `multiFolder/*` endpoints over the Typert gateway. Hand-written
   // `src-json` descriptors registered through ctx.typert.register (the
@@ -287,6 +394,20 @@ export function apply(ctx) {
         throw new Error(remoteErrorMessage(e))
       }
     },
+    async browse(path) {
+      try {
+        return await coreBrowse(path)
+      } catch (e) {
+        throw new Error(remoteErrorMessage(e))
+      }
+    },
+    async makeDir(parent, name) {
+      try {
+        return await coreMakeDir(parent, name)
+      } catch (e) {
+        throw new Error(remoteErrorMessage(e))
+      }
+    },
   }
   Object.defineProperty(multiFolderApi, 'typertRemote', {
     value: Object.freeze({
@@ -316,17 +437,29 @@ export function apply(ctx) {
       remoteInvocation('add', ['workspace', 'path']),
       remoteInvocation('remove', ['workspace', 'path']),
       remoteInvocation('set', ['workspace', 'dirs']),
+      remoteInvocation('browse', ['path']),
+      remoteInvocation('makeDir', ['parent', 'name']),
     ],
   }
 
   // -------------------------------------------------------- notice channel
+  // A message's `source.kind` must be a PRODUCER-OWNED kind. Session format v4
+  // retired the catch-all `{ kind: 'plugin', plugin: X }` wrapper: the durable
+  // log's encoder refuses it with
+  // `format v4 message requires a producer-owned source kind`, which surfaces
+  // as a failed run the moment a notice is appended. First-party producers name
+  // themselves (`plan-mode`, `tool-jobs`, `model-selection`); the format's
+  // v3→v4 migration maps every other plugin's legacy wrapper to
+  // `plugin:<plugin>` (`session-format-v3-to-v4/sources.ts`), so an external
+  // plugin's canonical spelling is that same namespaced kind — and our own
+  // earlier logs, which used the retired wrapper, migrate to exactly it.
+  const NOTICE_SOURCE_KIND = 'plugin:' + name
   const noticeMessage = (text) => ({
     id: 'mf-note-' + (++noteSeq),
     role: 'user',
     content: [{ type: 'text', text }],
     source: {
-      kind: 'plugin',
-      plugin: name,
+      kind: NOTICE_SOURCE_KIND,
       form: 'notice',
       summary: String(text).split('\n')[0].slice(0, 120),
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-multi-folder",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "description": "DeepSeek Harness plugin: secondary working directories for a project. The agent keeps the primary workspace as cwd, gains equal write/exec permissions on configured secondary directories under workspace-write mode, and is notified of configuration changes at the next message boundary. Configurable from the session header AND from the session-creation page (before the first message) through a sessionless multiFolder remote API.",
   "keywords": [
     "dsh-plugin",
@@ -42,6 +42,8 @@
     "compatibility": {
       "node": ">=20",
       "dshReleases": {
+        "0.2.0-rc.1": "compatible",
+        "0.1.7-rc.2": "compatible",
         "0.1.6-alpha.1": "compatible",
         "0.1.2-alpha.5": "compatible",
         "0.1.2-alpha.4": "compatible",