fix: make Home working directory writable

[Hendrikc4]

Addresses #7643

Why

I hit this on macOS with OpenDesign 0.21.1 while trying to use an existing repository as the working directory for a new project.

The Home “Working directory” control opened the trusted native folder picker correctly, but project creation then treated the chosen folder as linked reference code. That made it read-only and started the agent in OpenDesign's generated project folder instead.

The picker already returns a short-lived authorization token, and the app already has a safe working-directory update flow. The missing piece was passing the chosen folder and token into that flow instead of converting the folder to linkedDirs.

Issue #7643 also contains broader project-discovery concerns. This PR addresses the working-directory/cwd part without claiming to close the entire issue.

What users will see

Selecting a Working directory on Home now makes that folder the writable workspace for the new project.

• New sessions start in the selected folder.
• The folder is stored as metadata.baseDir and becomes the writable project root.
• Folders added as reference context remain in metadata.linkedDirs and remain read-only.
• If a folder was previously linked and is then promoted to the workspace, the conflicting read-only classification is removed, including filesystem aliases.
• Choosing a recent folder in the desktop app reopens the trusted native picker to obtain a fresh authorization token.
• Picker/token failures continue to stop uploads and auto-send and show the existing clear error instead of silently continuing in the generated folder.

Surface area

• UI — corrects the behavior of the existing Home working-directory control
• Keyboard shortcut — new or changed
• CLI / env var — new od subcommand or flag, new tools-dev / tools-pack flag, or new OD_* env var
• API / contract — no endpoint or response-shape change
• Extension point — new entry under skills/, design-systems/, design-templates/, or craft/, or change to the skills protocol
• i18n keys — added new translation keys
• New top-level dependency — adding any new entry to the root package.json
• Default behavior change — the existing control now applies the selected folder as its writable workspace
• None — internal refactor, docs, tests, or translation update only

Screenshots

No visual layout or copy changes. This corrects what happens after using the existing Home → Working directory picker.

Manual macOS verification used the existing control and confirmed a new session started in /Users/hendrik/coding/startupseeker_v2, could create and remove a probe file there, and persisted the repository as baseDir rather than linkedDirs.

Bug fix verification

• Red specs:
  • apps/web/tests/components/EntryShell.onboarding.test.tsx
  • apps/web/tests/components/HomeView.working-dir.test.tsx
  • apps/daemon/tests/folder-import-route.test.ts
• The new tests were run against an untouched main worktree and failed in the expected places: Home converted the workspace to linkedDirs, recent desktop selection did not re-authorize it, and promotion left the workspace alias in linkedDirs.
• The same tests pass on this branch.
• The daemon regression uses signed desktop picker tokens, verifies replay is rejected, verifies filesystem aliases are removed from linkedDirs, preserves an unrelated linked folder, and confirms the temporary handoff marker is cleared.

Validation

• pnpm guard — passed
• pnpm typecheck — passed across the workspace
• Focused web tests — 126 passed:
  • EntryShell.onboarding.test.tsx
  • HomeView.working-dir.test.tsx
  • App.project-create-race.test.tsx
• Folder import/working-directory daemon suite — 39 passed
• Full web suite — 676 files passed; 7,177 tests passed, 1 expected failure, 11 skipped
• git diff --check — passed
• Independent OpenCode Muse Spark 1.3 review — no blocking findings after canonical-path and transient-metadata hardening
• Manual packaged-flow verification on macOS:
  • new session cwd matched the selected repository
  • repository was writable and accepted a create/read/delete probe
  • metadata.baseDir matched the repository
  • the repository was absent from linkedDirs

For transparency, I also started the full daemon suite. Four unrelated tests in od-next-automatic-simple-server.test.ts timed out amid their existing closed-database watcher noise, so I stopped that long sweep after the failures. The complete touched daemon test file passes, and none of the timeout failures exercise working-directory or import behavior.

[lefarcen]

Thanks @Hendrikc4 — this is a nicely scoped fix for the writable-workspace path, especially the split between baseDir and read-only linkedDirs plus the fresh-token handling for recent desktop selections. I'll get the reviewer and validation routing set up now.

[lefarcen]

🧪 This PR has changes that need a manual QA pass before merge — please hold off self-merging for now; we'll loop QA in once it's merge-ready (and design/product have signed off, where applicable).

[github-actions]

Visual regression review

Head: e9f8845 · Base: d4138ea

1 changed · 52 unchanged · 0 new without baseline · 0 failed

Changed cases

Case	Main	PR	Diff
visual-settings-byok-model-dropdown 1,474 px (0.11%)

Unchanged cases

Case	Main	PR	Diff
visual-avatar-local-agent-list 0 px (0.00%)
visual-avatar-local-agent-list-panel 0 px (0.00%)
visual-avatar-menu 0 px (0.00%)
visual-avatar-menu-panel 0 px (0.00%)
visual-avatar-open-design-model-picker 0 px (0.00%)
visual-critical-settings 0 px (0.00%)
visual-critical-workspace 0 px (0.00%)
visual-critical-workspace-preview 0 px (0.00%)
visual-deepseek-unpaid-campaign-600 0 px (0.00%)
visual-deepseek-unpaid-campaign-short-height 0 px (0.00%)
visual-design-system-detail 0 px (0.00%)
visual-design-systems 0 px (0.00%)
visual-home 0 px (0.00%)
visual-home-catalog 0 px (0.00%)
visual-home-context-picker 0 px (0.00%)
visual-home-context-picker-popover 0 px (0.00%)
visual-home-plugin-filter 0 px (0.00%)
visual-home-plugin-use-staged 0 px (0.00%)
visual-home-plugin-use-with-query 0 px (0.00%)
visual-home-staged-attachment 0 px (0.00%)

Visual diff is advisory only and does not block merging.

[mrcfps]

@Hendrikc4 thank you for this — it is a focused, well-aimed fix for the Home working-directory path.

I reviewed the live diff at 8821d45b12da5496904803692bd1f7841967ba5f. Home now stamps userWorkingDir plus the host token instead of classifying the picked folder as read-only linkedDirs, desktop recents re-open the native picker so a remembered path cannot skip authorization, and POST /api/projects/:id/working-dir drops the transient hint while realpath-filtering linkedDirs so a promoted folder (including symlink aliases) does not stay --add-dir read-only. That matches the existing App.tsx handoff, which already spends the token before upload or auto-send. The web, daemon, and e2e specs were updated to the new create contract.

Really nice work on the baseDir vs linkedDirs split and the red-spec coverage. 🙏

_{🔁 Powered by Looper · runner=reviewer · agent=omp · An autonomous AI dev team for your GitHub repos.}