020ce50414
The round-four review's v6 pass found three factual gaps and the v5 pass two nits. Correct them before merge: - The in-process note claimed a koffi signature mistake is 'contained to the worker thread' — worker_threads share the process, so a native access violation takes down the whole Node process with no PowerShell fallback. State the real blast radius and record the deferred pkg-VFS worker-spawn arm in Consequences (both languages, pairing re-recorded). - The 2026-07-27 picker note claimed unconditional 'per-monitor-v2 DPI'; PMv2-less hosts (Server 2016 / Win10 1607) cascade to per-monitor or system-aware. Say 'the best thread DPI awareness the host accepts' (both languages, pairing re-recorded). - built-worker.e2e.ts was not in any keyless gate (vitest.e2e config is not part of the default unit run and builtBinSmokeGate's explicit list missed it), so lib/worker.cjs load regressions passed keyless CI. Add it to builtBinSmokeGate alongside the workflow-workerthread sibling. - Remove the dead trailing 'void bindings' in win32-dialog-logic.spec.ts and give native-picker.spec.ts the sibling module header it lacked.
@deepseek-ai/dsh-host-directory-picker-native
English | 中文
The native-OS-chooser backend of the directory-picker seam: NativeDirectoryPicker registers ctx.directoryPicker with the native capability, whose pick(signal) opens one native chooser per call and resolves the chosen absolute path (null on cancel). Platform tools run without a shell: osascript on macOS and Zenity with a KDialog fallback on Linux; the caller's abort terminates the native process. Windows opens the modern IFileOpenDialog in-process — a koffi-driven COM conversation on a worker thread with the best thread DPI awareness the host accepts (per-monitor-v2 first), aborted by posting WM_CLOSE to the dialog thread — and falls back to a PowerShell-hosted dialog (pwsh, then Windows PowerShell 5.1, which every Windows ships) whenever that native surface is unavailable; a resolvable pwsh that cannot deliver the dialog (PowerShell 6 has no WinForms) falls through the same way. Only viable when the operator sits at the host's display — remote deployments compose -browse instead. The command boundary (DirectoryPickerRunner) and platform facts are injectable for deterministic tests. The shared no-shell subprocess runner lives in dsh-native-command.
Dual-face package: the browser half (./client) registers a renderless flow occupant into ui-workspace's two directory-flow holes — each open request drives host.pickDirectory and reports the one outcome (picked path / cancel / failure) through the hole's owner conversation. One cordis.yml row therefore composes both sides of the native interaction; the client carries no capability-kind branching, and mounting a second flow package fails at load (the holes are single kind).
Model Experience
None, as the backend serves the GUI host's directory selection; nothing here reaches a model request.
KV Cache effect
None; this package neither assembles nor sends a provider request.
Known Limitations and Deferred Work
- Linux requires desktop tooling — with neither Zenity nor KDialog installed,
pickrejects with an actionable error; it does not fall back to a typed-path prompt (the browse backend is that fallback at the composition level). - The Windows fallback chain degrades the dialog — the in-process picker is the modern Explorer-style dialog; where koffi cannot drive COM the PowerShell tiers take over, and a machine that only reaches Windows PowerShell 5.1 gets the legacy folder tree, DPI-corrected but not the modern UI.
- A wedged abort can leak one dialog thread — when
WM_CLOSEnever lands (the dialog window was never created), the driver terminates and unrefs the worker; Node cannot interrupt a thread blocked in the native modal call, so that thread lives until process exit.