flea-qml 0.0.0-stage → 0.2.0

package/ui/UnlockDialog.qml

@@ -0,0 +1,450 @@
+import QtQuick
+import Quickshell.Io
+import qs.Commons
+import "." as Flea
+import "js/Buttons.js" as Buttons
+import "js/Format.js" as Format
+import "js/Unlock.js" as Unlock
+
+// Unlock (U039): the encrypted-drive dialog the board draws; the passphrase goes to udisksctl unlock on stdin, never argv.
+FocusScope {
+    id: root
+    anchors.fill: parent
+    visible: opened || opacity > 0
+    // Closed means no input, even while the fade-out is still drawn.
+    enabled: opened
+    opacity: 0
+    property bool opened: false
+    property string device: ""
+    property string driveLabel: ""
+    property double driveSize: 0
+    property string crypto: "LUKS"
+    // typing is the default, unlocking dims the field, wrong carries the error.
+    property string phase: "typing"
+    property string noteText: ""
+    property bool noteIsError: false
+    property string _secret: ""
+    property string _unlockOutput: ""
+    property string _unlockErr: ""
+    property string _mountOutput: ""
+    property bool _started: false
+    // The child in flight: unlock, mount; relock is a failed mount's lock, abandon a Cancel the late exit still settles.
+    property string _stage: "idle"
+    property string _lockLabel: ""
+    // A late lock from an abandoned attempt never refuses the dialog, reopened or not.
+    property bool _quietLock: false
+    // The drive a Cancelled attempt was unlocking, so its late lock closes that drive and names it, whatever the dialog opened since.
+    property string _abandonDevice: ""
+    property string _abandonLabel: ""
+    // A submit made while an earlier attempt's client or its late lock still runs; it starts when they end.
+    property bool _queued: false
+    property int unlockTimeoutMs: 15000
+    readonly property var cardItem: card
+    // Read by the capture harness: the controls unlockState names, no look change.
+    readonly property var fieldItem: field
+    function buttonItem(name) { return ({cancel: cancelButton, unlock: unlockButton})[name] || null }
+    signal unlocked(string path, string label, string note)
+    signal closed()
+    signal lockFailed(string note)
+
+    function openFor(devicePath, label, size, fstype, fsver) {
+        root.device = String(devicePath || "")
+        root.describe(label, size, fstype, fsver)
+        root.phase = "typing"
+        root.noteText = ""
+        root.noteIsError = false
+        root._secret = ""
+        field.text = ""
+        field.heldMask = 0
+        field.error = false
+        root.opened = true
+        field.takeFocus()
+    }
+
+    // The name row and every sentence name the drive through this, so a later rail row can name it for flea --unlock.
+    function describe(label, size, fstype, fsver) {
+        root.driveLabel = String(label || root.device)
+        root.driveSize = Number(size) || 0
+        root.crypto = Unlock.cryptoName(String(fstype || ""), String(fsver || ""))
+    }
+
+    // The tab order: the field, then Cancel, then Unlock; while Unlocking, Cancel is the one live control.
+    function tabStops() {
+        return root.phase === "unlocking" ? [cancelButton] : [field.input, cancelButton, unlockButton]
+    }
+
+    function stepTab(back) {
+        var stops = root.tabStops()
+        var at = -1
+        for (var i = 0; i < stops.length; i++) {
+            if (stops[i].activeFocus) { at = i; break }
+        }
+        var next = at < 0 ? (back ? stops.length - 1 : 0) : (at + (back ? stops.length - 1 : 1)) % stops.length
+        stops[next].forceActiveFocus()
+    }
+
+    // Read by the capture harness and ui/UnlockHost.qml: which stop holds the keyboard, and whether the field holds typed or held keys.
+    function focusPart() {
+        return field.input.activeFocus ? "field" : cancelButton.activeFocus ? "cancel" : unlockButton.activeFocus ? "unlock" : ""
+    }
+    readonly property bool masked: field.text.length > 0 || field.heldMask > 0
+    readonly property string subtitleText: Unlock.subtitle(root.driveLabel, root.driveSize > 0 ? Format.size(root.driveSize) : "", root.crypto)
+
+    function close() {
+        unlockTimeout.stop()
+        root._queued = false
+        if (root._stage === "unlock") {
+            // A Cancelled unlock may finish on the daemon after its client is gone, so the client runs on and the late exit locks back.
+            root._stage = "abandon"
+            root._abandonDevice = root.device
+            root._abandonLabel = root.driveLabel
+        } else if (root._stage === "relock") {
+            root._stage = "idle"
+        } else if (root._stage === "mount") {
+            // The late exit of the killed mount locks the container, so the dialog leaves it as it found it.
+            root._stage = "abandon"
+            root._abandonDevice = root.device
+            root._abandonLabel = root.driveLabel
+            if (mountProcess.running)
+                mountProcess.running = false
+            else
+                root.lockContainer(false, root._abandonDevice, root._abandonLabel)
+        }
+        field.text = ""
+        field.heldMask = 0
+        root._secret = ""
+        root.opened = false
+        root.closed()
+    }
+
+    // Ends an attempt with a sentence the user can act on; no path leaves the passphrase held.
+    function refuse(note) {
+        unlockTimeout.stop()
+        root._stage = "idle"
+        root._secret = ""
+        root.showRefusal(note)
+    }
+
+    function showRefusal(note) {
+        root.phase = "wrong"
+        field.error = true
+        root.noteText = note
+        root.noteIsError = true
+        field.takeFocus()
+    }
+
+    // A dialog that ends without a mounted volume leaves the container locked; relock keeps the dialog open on the mount sentence.
+    function lockContainer(relock, device, label) {
+        root._stage = relock ? "relock" : "idle"
+        root._lockLabel = label || root.driveLabel
+        lockProcess.command = ["udisksctl", "lock", "--block-device", device || root.device]
+        lockProcess.running = true
+    }
+
+    function submit() {
+        if (!root.opened || root.phase === "unlocking")
+            return
+        if (field.text.length === 0) {
+            // An empty field refuses without touching _stage, so a Cancelled attempt's late exit still locks back.
+            root.showRefusal(Unlock.wrongNote(root.driveLabel))
+            return
+        }
+        root._secret = field.text
+        // Only the submitted length is kept, so the dots draw from a count.
+        field.heldMask = field.text.length
+        field.text = ""
+        root.phase = "unlocking"
+        cancelButton.forceActiveFocus()
+        field.error = false
+        root.noteText = Unlock.unlockingNote(root.driveLabel)
+        root.noteIsError = false
+        // An earlier attempt's client, its killed mount or its late lock still runs, so this one waits under the same bound.
+        if (unlockProcess.running || lockProcess.running || root._stage === "abandon") {
+            root._queued = true
+            unlockTimeout.restart()
+            return
+        }
+        root._startUnlock()
+    }
+
+    function _startQueued() {
+        if (!root._queued)
+            return
+        root._queued = false
+        unlockTimeout.stop()
+        root._startUnlock()
+    }
+
+    function _startUnlock() {
+        root._unlockOutput = ""
+        root._unlockErr = ""
+        root._started = false
+        root._stage = "unlock"
+        root._quietLock = false
+        unlockProcess.command = Unlock.unlockArgv(root.device)
+        // The last attempt closed stdin to send EOF, so a retry opens it again before starting.
+        unlockProcess.stdinEnabled = true
+        unlockProcess.running = true
+        unlockTimeout.restart()
+    }
+
+    Flea.Reveal { target: root; shown: root.opened; lift: card }
+    Keys.onTabPressed: function (event) { root.stepTab((event.modifiers & Qt.ShiftModifier) !== 0); event.accepted = true }
+    Keys.onBacktabPressed: function (event) { root.stepTab(true); event.accepted = true }
+    Keys.onPressed: function(event) {
+        if (event.key === Qt.Key_Escape) {
+            root.close()
+            event.accepted = true
+            return
+        }
+        if (event.key === Qt.Key_Return || event.key === Qt.Key_Enter) {
+            root.submit()
+            event.accepted = true
+        }
+    }
+
+    Timer {
+        id: unlockTimeout
+        interval: root.unlockTimeoutMs
+        repeat: false
+        // Only a child that never started is ended here: a slow KDF has no bound, and Cancel leaves a running one to its late exit.
+        onTriggered: {
+            // A queued submit never reached its client: it is refused and the passphrase dropped, and the earlier attempt still settles.
+            if (root._queued) {
+                root._queued = false
+                root._secret = ""
+                root.showRefusal(Unlock.unlockFailedNote(root.driveLabel))
+                return
+            }
+            if (root._started || root._stage !== "unlock")
+                return
+            unlockProcess.running = false
+            root.refuse(Unlock.unlockFailedNote(root.driveLabel))
+        }
+    }
+
+    Flea.DialogScrim {
+        onDismissed: root.close()
+    }
+
+    Rectangle {
+        id: card
+        x: Theme.cardOrigin(root.width, width)
+        y: Theme.cardOrigin(root.height, height)
+        width: Theme.cardSpan(448, root.width - 2 * Theme.spacing.gap)
+        height: Theme.cardSpan(body.wanted + card.cardPadding + card.cardBottomPadding, root.height - 2 * Theme.spacing.gap)
+        color: Theme.color.surface
+        border.color: Theme.color.mutedFrame
+        border.width: Theme.spacing.hairline
+        radius: Style.cornerRadius
+        // The Unlock board's padding 16 16 12 and 6 px of air over the buttons, at its 13 px reference.
+        readonly property real referenceScale: Theme.font.bodySmall / 13
+        readonly property real cardPadding: Math.round(16 * referenceScale)
+        readonly property real cardBottomPadding: Math.round(12 * referenceScale)
+        readonly property real buttonsAir: Math.round(6 * referenceScale)
+        MouseArea {
+            anchors.fill: parent
+            hoverEnabled: true
+            acceptedButtons: Qt.LeftButton | Qt.RightButton
+            // Without this sink a press on the card padding falls to the ground, which closes the dialog.
+            onClicked: {}
+            onWheel: function(wheel) { wheel.accepted = true }
+        }
+        Flea.CardFrame {
+            id: body
+            anchors.fill: parent
+            anchors.leftMargin: card.cardPadding
+            anchors.rightMargin: card.cardPadding
+            anchors.topMargin: card.cardPadding
+            anchors.bottomMargin: card.cardBottomPadding
+            title: Flea.DialogHeader {
+                width: parent.width
+                text: Unlock.title(root.driveLabel)
+            }
+            Column {
+                width: parent.width
+                spacing: Theme.spacing.gap
+                Row {
+                    width: parent.width
+                    spacing: Theme.spacing.gap
+                    Flea.Glyph {
+                        width: Theme.markSize
+                        height: Theme.fileRowHeight
+                        name: "drive"
+                        color: Theme.color.foreground
+                    }
+                    Text {
+                        width: parent.width - Theme.markSize - parent.spacing
+                        anchors.verticalCenter: parent.verticalCenter
+                        text: root.subtitleText
+                        textFormat: Text.PlainText
+                        elide: Text.ElideRight
+                        color: Theme.color.foreground
+                        font { family: Theme.font.family; pixelSize: Theme.font.body }
+                    }
+                }
+                Flea.DialogField {
+                    id: field
+                    width: parent.width
+                    label: "Passphrase"
+                    secret: true
+                    enabled: root.phase !== "unlocking"
+                    opacity: root.phase === "unlocking" ? Buttons.DISABLED_OPACITY : 1
+                    onAccepted: root.submit()
+                    onTabbed: function (from, back) { root.stepTab(back) }
+                    // A retry starts clean, as the archive card does.
+                    onEdited: {
+                        if (field.error || root.noteIsError) {
+                            field.error = false
+                            root.noteText = ""
+                            root.noteIsError = false
+                        }
+                    }
+                }
+                Text {
+                    width: parent.width
+                    visible: root.noteText.length > 0
+                    text: root.noteText
+                    textFormat: Text.PlainText
+                    wrapMode: Text.Wrap
+                    color: root.noteIsError ? Theme.color.errorOnSurface : Theme.color.muted
+                    font { family: Theme.font.family; pixelSize: Theme.font.caption }
+                }
+            }
+            buttons: Item {
+                width: parent.width
+                height: buttonRow.height
+                Row {
+                    id: buttonRow
+                    anchors.right: parent.right
+                    topPadding: card.buttonsAir
+                    spacing: Theme.spacing.gap
+                    Flea.DialogButton {
+                        id: cancelButton
+                        label: "Cancel"
+                        focused: activeFocus
+                        onActivated: root.close()
+                    }
+                    Flea.DialogButton {
+                        id: unlockButton
+                        label: "Unlock"
+                        primary: true
+                        // Disabled with the field, so a keyboard that Tabbed here drops to the card and Cancel keeps the one ring.
+                        enabled: root.phase !== "unlocking"
+                        opacity: root.phase === "unlocking" ? Buttons.DISABLED_OPACITY : 1
+                        onActivated: root.submit()
+                    }
+                }
+            }
+        }
+    }
+
+    Process {
+        id: unlockProcess
+        environment: ({ "LC_ALL": "C" })
+        stdinEnabled: true
+        stdout: StdioCollector { id: unlockOut; waitForEnd: true; onStreamFinished: root._unlockOutput = text }
+        stderr: StdioCollector { id: unlockErr; waitForEnd: true; onStreamFinished: root._unlockErr = text }
+        onStarted: {
+            root._started = true
+            if (root._stage !== "unlock") {
+                // A Cancel won the race: close stdin so the waiting --key-file /dev/stdin reads EOF and exits.
+                unlockProcess.stdinEnabled = false
+                return
+            }
+            var secret = root._secret
+            root._secret = ""
+            // --key-file /dev/stdin reads every byte to EOF as the key, so no newline and stdin closes after it.
+            unlockProcess.write(secret)
+            unlockProcess.stdinEnabled = false
+            secret = ""
+        }
+        onExited: function(exitCode) {
+            unlockTimeout.stop()
+            // A Cancelled unlock that still succeeded left the container open with nobody waiting: lock it back quietly.
+            if (root._stage === "abandon") {
+                if (exitCode === 0) {
+                    var late = Unlock.parseUnlocked(String(unlockOut.text || root._unlockOutput || ""))
+                    if (late.length > 0) {
+                        root._quietLock = true
+                        root.lockContainer(true, root._abandonDevice, root._abandonLabel)
+                        return
+                    }
+                }
+                root._stage = "idle"
+                root._startQueued()
+                return
+            }
+            // Nothing waits on this exit, so a late one does nothing.
+            if (root._stage !== "unlock")
+                return
+            if (exitCode !== 0) {
+                // Wrong passphrase versus any other refusal is read off the D-Bus error name, never off udisksctl's own sentences.
+                root.refuse(Unlock.refusalNote(String(unlockErr.text || root._unlockErr || ""), root.driveLabel))
+                return
+            }
+            var mapped = Unlock.parseUnlocked(String(unlockOut.text || root._unlockOutput || ""))
+            if (mapped.length === 0) {
+                root.refuse(Unlock.wrongNote(root.driveLabel))
+                return
+            }
+            root._mountOutput = ""
+            root._stage = "mount"
+            mountProcess.command = ["udisksctl", "mount", "--block-device", mapped]
+            mountProcess.running = true
+        }
+    }
+
+    Process {
+        id: mountProcess
+        environment: ({ "LC_ALL": "C" })
+        stdout: StdioCollector { id: mountOut; waitForEnd: true; onStreamFinished: root._mountOutput = text }
+        stderr: StdioCollector { waitForEnd: true }
+        onExited: function(exitCode) {
+            if (root._stage === "abandon") {
+                root.lockContainer(false, root._abandonDevice, root._abandonLabel)
+                return
+            }
+            if (root._stage !== "mount")
+                return
+            var folder = exitCode === 0 ? Unlock.parseMounted(String(mountOut.text || root._mountOutput || "")) : ""
+            if (folder.length === 0) {
+                root.lockContainer(true)
+                return
+            }
+            var label = root.driveLabel
+            var note = Unlock.unlockedNote(label)
+            root._stage = "idle"
+            field.text = ""
+            field.heldMask = 0
+            root.opened = false
+            root.closed()
+            root.unlocked(folder, label, note)
+        }
+    }
+
+    Process {
+        id: lockProcess
+        environment: ({ "LC_ALL": "C" })
+        // Every lock exit frees the drive for a submit that queued behind it.
+        onExited: function(exitCode) {
+            root._lockExited(exitCode)
+            root._startQueued()
+        }
+    }
+
+    function _lockExited(exitCode) {
+        var quiet = root._quietLock
+        root._quietLock = false
+        if (root._stage === "relock") {
+            // Open on a relock, the mount failure is what the user reads; a quiet lock or one nobody waits on takes no focus.
+            if (root.opened && !quiet)
+                root.refuse(Unlock.mountNote(root._lockLabel))
+            else
+                root._stage = "idle"
+        }
+        // Every refused lock is told, beside the mount failure or alone.
+        if (exitCode !== 0)
+            root.lockFailed(Unlock.lockNote(root._lockLabel))
+    }
+}

package/ui/UnlockHost.qml

@@ -0,0 +1,206 @@
+import QtQuick
+import "." as Flea
+import "js/Unlock.js" as Unlock
+
+// Unlock (U039): the encrypted-drive dialog's host, over the whole window.
+// Created once per window on first use, so no placeholder object stands before it; the unlocked-drive follow lives here.
+Item {
+    id: root
+    anchors.fill: parent
+    property var window: null
+    property var footer: null
+    property var sidebar: null
+    property string pendingPath: ""
+    property int lockedCursor: -1
+    // The device flea --unlock opened on, until a rail row names it.
+    property string unnamedDevice: ""
+    // The pending poller answered once, so its Loader never runs again for this card.
+    property bool _namePollDone: false
+    // The poller's last listing, kept after its Loader ends, so the first row still names the card.
+    property var _pollEntries: []
+    readonly property bool opened: loader.item !== null && loader.item.opened
+    // The test seam reads the card through this, so no writer ever reaches past the host.
+    readonly property var dialog: loader.item
+    // The test seam reads the poller's life through this, never its item.
+    readonly property bool namePolling: namePoller.active
+
+    function openFor(device, label, size, fstype, rail) {
+        if (rail !== undefined && rail !== null)
+            root.sidebar = rail
+        root.lockedCursor = root.cursorOnRow(device)
+        loader.active = true
+        loader.item.openFor(device, label, size, fstype, root.versionFor(root.sidebar, device))
+    }
+    // The rail row carries lsblk's FSVER, so the card reads LUKS1 or LUKS2 with no signal change.
+    function versionFor(rail, device) {
+        var row = Unlock.namingRow(rail ? rail.deviceEntries : [], root.fallbackEntries(), device)
+        return row ? String(row.fsver || "") : ""
+    }
+    // The locked row wherever the device list lives, the rail first; a hidden rail unloads its own list with the Sidebar.
+    function lookupRow(device) {
+        return Unlock.namingRow(root.sidebar ? root.sidebar.deviceEntries : [], root.fallbackEntries(), device)
+    }
+    // A hidden rail unloads its poll with the Sidebar, so this one-shot lister names the CLI card instead.
+    function fallbackEntries() {
+        return namePoller.item ? namePoller.item.entries : root._pollEntries
+    }
+    // flea --unlock may open before the rail's first lsblk, so the card shows the device's leaf until its locked row names it.
+    function openForDevice(devicePath, rail) {
+        var leaf = String(devicePath || "").split("/").pop()
+        openFor(devicePath, leaf, 0, "LUKS", rail)
+        root._namePollDone = false
+        root._pollEntries = []
+        root.unnamedDevice = String(devicePath || "")
+        root.nameDevice()
+    }
+    // A card the user has started on never takes a name, so its poller never starts.
+    function cardTouched() {
+        var unlockDialog = loader.item
+        return !!unlockDialog && (unlockDialog.phase !== "typing" || unlockDialog.noteText.length > 0 || unlockDialog.masked)
+    }
+    // The first touch latches the one-shot shut, so erasing never restarts the poller.
+    readonly property bool _touched: root.cardTouched()
+    on_TouchedChanged: if (root._touched) root._namePollDone = true
+    // Only an untouched card takes the name, so nothing the user has started on changes the drive it names.
+    function nameDevice() {
+        var unlockDialog = loader.item
+        if (root.unnamedDevice.length === 0 || !unlockDialog || !unlockDialog.opened || unlockDialog.device !== root.unnamedDevice) {
+            root.unnamedDevice = ""
+            return
+        }
+        // A touched card ends the pending name for good, so no later listing renames it.
+        if (root.cardTouched()) {
+            root._namePollDone = true
+            root.unnamedDevice = ""
+            return
+        }
+        var row = root.lookupRow(root.unnamedDevice)
+        // One-shot: the poller's first listing ends the wait whether it named the card or not.
+        if (!row) {
+            if (root._namePollDone)
+                root.unnamedDevice = ""
+            return
+        }
+        root.unnamedDevice = ""
+        unlockDialog.describe(row.label, row.size, row.fstype, row.fsver)
+    }
+
+    // After an unlock the locked row is a crypt row in the same place; put the cursor on it,
+    // so the unlocked drive stays current. Matched by mountpoint: udisksctl names /dev/dm-N, lsblk /dev/mapper/.
+    function followUnlocked(path) {
+        root.pendingPath = String(path || "")
+        root.landCursor(true)
+    }
+    // Answers whether the cursor landed; stashes for the next rebuild when asked.
+    function landCursor(stash) {
+        var rail = root.sidebar
+        var want = root.pendingPath
+        if (!rail || want.length === 0) {
+            root.pendingPath = ""
+            return false
+        }
+        var at = rail.placesEntries.length + rail.networkEntries.length
+        for (var i = 0; i < rail.deviceEntries.length; i++) {
+            if (String(rail.deviceEntries[i].path || "") === want) {
+                root.pendingPath = ""
+                rail.cursorIndex = at + i
+                return true
+            }
+        }
+        if (stash !== true)
+            root.pendingPath = ""
+        return false
+    }
+
+    // The rail index of the cursor when it sits on this device's own row, else -1: the locked row the unlock was asked on.
+    function cursorOnRow(device) {
+        var rail = root.sidebar
+        if (!rail || rail.cursorIndex < 0)
+            return -1
+        var row = rail.deviceEntries[rail.cursorIndex - rail.placesEntries.length - rail.networkEntries.length]
+        return row && String(row.device || "") === device ? rail.cursorIndex : -1
+    }
+
+    // A rebuilt rail ends the follow when the cursor moved off the locked row, and lands it otherwise.
+    function settleFollow() {
+        if (root.pendingPath.length === 0)
+            return
+        var rail = root.sidebar
+        if (!rail || (rail.cursorIndex !== -1 && rail.cursorIndex !== root.lockedCursor)) {
+            root.pendingPath = ""
+            return
+        }
+        root.landCursor(false)
+    }
+
+    // The CLI card's own poll while its name is pending, one listing only; it overlaps the rail's poll because the rail's first lsblk can lag the CLI open.
+    Loader {
+        id: namePoller
+        active: root.unnamedDevice.length > 0 && root.opened && !root._namePollDone && !root.cardTouched()
+        sourceComponent: pollerComponent
+    }
+    Component {
+        id: pollerComponent
+        Flea.DeviceMounts {}
+    }
+    Connections {
+        target: namePoller.item
+        // The first answer ends the Loader below, so its listing is kept here first.
+        function onEntriesChanged() { root._pollEntries = namePoller.item.entries }
+        // An empty first listing changes no entries, so its answer latches here instead.
+        function onFirstAnsweredChanged() {
+            if (namePoller.item && namePoller.item.firstAnswered) {
+                // A listing the timeout ended answered nothing, so the one-shot polls again for one that did.
+                if (namePoller.item.listTimedOut) {
+                    namePoller.item.firstAnswered = false
+                    namePoller.item.poll()
+                    return
+                }
+                root._namePollDone = true
+                root.nameDevice()
+            }
+        }
+    }
+    Loader {
+        id: loader
+        anchors.fill: parent
+        z: 2
+        active: false
+        source: "UnlockDialog.qml"
+        onLoaded: {
+            item.closed.connect(root.onDialogClosed)
+            item.unlocked.connect(root.onDialogUnlocked)
+            item.lockFailed.connect(root.onDialogLockFailed)
+        }
+    }
+    Connections {
+        // A plain test rail emits nothing, so only a rail with the signal is the target.
+        target: root.sidebar && root.sidebar.entriesChanged ? root.sidebar : null
+        function onEntriesChanged() { root.settleFollow(); root.nameDevice() }
+    }
+    function onDialogClosed() {
+        if (root.window)
+            root.window.currentPane.forceActiveFocus()
+    }
+    // A dialog that ended without a volume could not put the container back; the drive is named.
+    function onDialogLockFailed(note) {
+        if (root.footer)
+            root.footer.say(note, true)
+    }
+    // The rail's own open, so a rail Enter's focus claim lands in the folder as any mount-first open does (RailKeys.landed).
+    function onDialogUnlocked(path, label, note) {
+        if (!root.window)
+            return
+        if (!root.sidebar) {
+            // No rail to open through, so the current pane opens the folder itself, with the note said below.
+            root.window.currentPane.open(path)
+        } else {
+            root.sidebar.opened(path)
+            // The unlocked row and its eject mark land now, not at the rail's next five second poll.
+            root.sidebar.pollDevices()
+            root.followUnlocked(path)
+        }
+        if (root.footer)
+            root.footer.say(note, false)
+    }
+}