fix(memory-sources): use the native directory chooser and never store a bare folder name

app/src-tauri/src/directory_picker.rs

@@ -0,0 +1,76 @@
+//! Native directory chooser for memory-source configuration (#5831).
+//!
+//! The folder memory-source used to be picked with an
+//! `<input type="file" webkitdirectory>` in the renderer. That element does
+//! not expose a filesystem path: Chromium only carries one on the
+//! non-standard `File.path` attribute, and only when the renderer has
+//! filesystem-aware integration. Outside that renderer the handler fell back
+//! to `webkitRelativePath.split('/')[0]` — the chosen directory's **name**
+//! with its location discarded — and stored it. The source then looked
+//! configured and could never sync, failing once per cycle forever with
+//! `folder does not exist: docs`.
+//!
+//! A native dialog has no such gap: it returns an absolute path in every
+//! renderer, on every platform.
+//!
+//! ## Why `rfd` and not `tauri-plugin-dialog`
+//!
+//! This mirrors [`crate::artifact_commands::save_artifact_via_dialog`]
+//! (#3162), which is already in this shell and already talks to the OS
+//! dialog APIs through `rfd`. Reusing it means **no new dependency, no new
+//! plugin, and no capability-allowlist entry** — the crate is declared in
+//! `Cargo.toml` with `default-features = false` plus `xdg-portal`, which is
+//! what keeps Linux off GTK. Adding the dialog plugin for one command would
+//! widen the dependency graph for a capability the shell already has.
+//!
+//! ## Trust boundary
+//!
+//! Deliberately none. Unlike the artifact commands — which re-validate that
+//! a renderer-supplied path sits inside the artifacts tree, because there
+//! the renderer *supplies* the path — this command takes no input and
+//! returns only what the user chose in an OS-owned dialog. The renderer
+//! cannot steer it at a directory, and picking a folder to index is the
+//! user's decision to make anywhere on their disk.
+
+/// Open the OS-native directory chooser and return the absolute path of the
+/// directory the user selected.
+///
+/// Returns:
+/// - `Ok(Some(path))` — the absolute path chosen.
+/// - `Ok(None)` — the user dismissed the dialog. Not an error; the caller
+///   leaves the field untouched.
+/// - `Err(_)` — the dialog could not run (for example, no xdg-desktop
+///   portal on a headless Linux host), or it somehow yielded a relative
+///   path. The caller surfaces this rather than storing anything.
+#[tauri::command]
+pub async fn pick_directory_via_dialog() -> Result<Option<String>, String> {
+    // On Linux this is the xdg-desktop portal (no GTK link); on macOS and
+    // Windows the system panel. The await resolves when the user picks or
+    // cancels.
+    let handle = rfd::AsyncFileDialog::new().pick_folder().await;
+
+    let Some(dir) = handle else {
+        log::info!("[directory_picker] pick_directory_via_dialog cancelled by user");
+        return Ok(None);
+    };
+
+    let path = dir.path().to_path_buf();
+
+    // The OS dialogs all hand back absolute paths, so this is a belt-and-braces
+    // check rather than a branch we expect to take. It exists because a
+    // relative value reaching the store is the entire defect this command was
+    // written to remove: an error here is recoverable and visible, whereas a
+    // stored relative path is neither.
+    if !path.is_absolute() {
+        return Err(format!(
+            "the directory chooser returned a non-absolute path: {}",
+            path.display()
+        ));
+    }
+
+    log::info!(
+        "[directory_picker] pick_directory_via_dialog chose {}",
+        path.display()
+    );
+    Ok(Some(path.display().to_string()))
+}

app/src-tauri/src/lib.rs

@@ -43,6 +43,7 @@ mod core_rpc;
 mod deep_link_ipc;
 #[cfg(target_os = "windows")]
 mod deep_link_ipc_windows;
+mod directory_picker;
 // Cross-platform module: the registry-reading function is windows-only, but
 // the parsing helpers compile (and test) everywhere so `cargo test` on the
 // developer host covers them.
@@ -3371,6 +3372,7 @@ pub fn run() {
             // and the Save-As fallback needs it there (CodeRabbit on #4127).
             artifact_commands::save_artifact_via_dialog,
             artifact_commands::download_artifact_to_downloads,
+            directory_picker::pick_directory_via_dialog,
             // Structured WhatsApp data (store lives shell-side).
             whatsapp_data::whatsapp_data_list_chats,
             whatsapp_data::whatsapp_data_list_messages,

app/src/components/intelligence/AddMemorySourceFields.tsx

@@ -19,6 +19,7 @@ import type { ComposioConnection } from '../../lib/composio/types';
 import { useT } from '../../lib/i18n/I18nContext';
 import type { SourceKind } from '../../services/memorySourcesService';
 import TextField from '../ui/TextField';
+import { directoryPathFromPickedFiles, pickDirectoryNatively } from './folderPicker';
 
 const log = debug('intelligence:add-memory-source-dialog');
 
@@ -60,50 +61,81 @@ interface FolderFieldProps {
 
 function FolderField({ label, value, onChange }: FolderFieldProps) {
   const { t } = useT();
+  const fallbackInputRef = useRef<HTMLInputElement | null>(null);
+  const [pickError, setPickError] = useState<string | null>(null);
+
+  // Never store a value that cannot work as a path. `no-absolute-path` is the
+  // #5831 case: a directory was chosen but the renderer would not say where it
+  // is, so the only honest outcomes are an error or nothing — not the bare
+  // directory name the old handler saved, which produced a source that looked
+  // configured and could never sync.
+  const applyResult = (result: { ok: true; path: string } | { ok: false; reason: string }) => {
+    if (result.ok) {
+      setPickError(null);
+      onChange(result.path);
+      return;
+    }
+    if (result.reason === 'no-absolute-path') {
+      log('folder picker produced no absolute path; refusing to store a bare name');
+      setPickError(t('memorySources.folderPathUnavailable'));
+    }
+    // `cancelled` leaves the field exactly as it was, silently.
+  };
+
+  const handleBrowse = async () => {
+    const native = await pickDirectoryNatively();
+    if (native.ok || native.reason !== 'unavailable') {
+      applyResult(native);
+      return;
+    }
+    // No native chooser here (a browser context, or no portal). Fall back to
+    // the directory input, which may still carry a real path.
+    setPickError(null);
+    fallbackInputRef.current?.click();
+  };
+
   return (
     <label className="block">
       <span className="text-xs font-medium text-content-secondary">{label}</span>
       <div className="mt-1 flex gap-2">
         <TextField
           type="text"
           value={value}
-          onChange={e => onChange(e.target.value)}
+          onChange={e => {
+            setPickError(null);
+            onChange(e.target.value);
+          }}
           placeholder={t('memorySources.folderPathPlaceholder')}
         />
-        <label
+        <button
+          type="button"
+          onClick={handleBrowse}
           className="shrink-0 cursor-pointer rounded-md border border-line-strong bg-surface px-3 py-2
                      text-xs font-medium text-content-secondary transition-colors
                      hover:border-primary-400 hover:text-primary-600
                      dark:bg-surface-muted dark:text-content-secondary
                      dark:hover:border-primary-500 dark:hover:text-primary-400">
           {t('memorySources.browse')}
-          <input
-            type="file"
-            // @ts-expect-error — non-standard but supported in CEF/Chromium
-            webkitdirectory=""
-            multiple
-            className="hidden"
-            onChange={e => {
-              const files = e.target.files;
-              if (!files || files.length === 0) return;
-              // Chromium exposes the chosen directory path on the first file's `path`
-              // attribute when the renderer has filesystem-aware integration (CEF).
-              // Fall back to webkitRelativePath split if `path` isn't available.
-              const first = files[0] as File & { path?: string };
-              if (first.path) {
-                // first.path is the absolute path to the file. Derive the directory
-                // by trimming the relative portion (everything after the chosen root).
-                const rel = first.webkitRelativePath || first.name;
-                const abs = first.path;
-                const idx = abs.lastIndexOf(rel);
-                onChange(idx > 0 ? abs.slice(0, idx).replace(/\/$/, '') : abs);
-              } else if (first.webkitRelativePath) {
-                onChange(first.webkitRelativePath.split('/')[0]);
-              }
-            }}
-          />
-        </label>
+        </button>
+        <input
+          ref={fallbackInputRef}
+          type="file"
+          // @ts-expect-error — non-standard but supported in CEF/Chromium
+          webkitdirectory=""
+          multiple
+          className="hidden"
+          onChange={e => {
+            applyResult(directoryPathFromPickedFiles(e.target.files));
+            // Clear so re-picking the same directory fires `change` again.
+            e.target.value = '';
+          }}
+        />
       </div>
+      {pickError ? (
+        <span role="alert" className="mt-1 block text-xs text-coral-600 dark:text-coral-400">
+          {pickError}
+        </span>
+      ) : null}
     </label>
   );
 }

app/src/components/intelligence/__tests__/folderPicker.test.ts

@@ -0,0 +1,136 @@
+/**
+ * #5831 — the folder picker must never hand back a value that cannot work
+ * as a path.
+ *
+ * The defect these tests pin: when `File.path` was unavailable the handler
+ * fell back to `webkitRelativePath.split('/')[0]`, storing the chosen
+ * directory's NAME with its location discarded. A source built from that
+ * value can never sync, and it fails once per cycle forever rather than once,
+ * visibly, at the moment of choosing.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { directoryPathFromPickedFiles, pickDirectoryNatively } from '../folderPicker';
+
+const hoisted = vi.hoisted(() => ({ invoke: vi.fn(), isTauri: vi.fn() }));
+
+vi.mock('../../../utils/tauriCommands/common', () => ({
+  safeInvoke: hoisted.invoke,
+  isTauri: hoisted.isTauri,
+}));
+
+/** A `webkitdirectory` file entry, with `path` present only when asked for. */
+function pickedFile(relativePath: string, absolutePath?: string): File {
+  const file = new File(['x'], relativePath.split('/').pop() ?? 'f.md');
+  Object.defineProperty(file, 'webkitRelativePath', { value: relativePath });
+  if (absolutePath !== undefined) {
+    Object.defineProperty(file, 'path', { value: absolutePath });
+  }
+  return file;
+}
+
+function fileList(...files: File[]): FileList {
+  const indexed: Record<number, File> = {};
+  files.forEach((file, i) => {
+    indexed[i] = file;
+  });
+  return {
+    ...indexed,
+    length: files.length,
+    item: (i: number) => files[i] ?? null,
+  } as unknown as FileList;
+}
+
+describe('directoryPathFromPickedFiles', () => {
+  it('refuses to produce a path when the renderer does not expose File.path', () => {
+    // THE REGRESSION. The old handler returned 'docs' here. A source stored
+    // with that value produced `folder does not exist: docs` on every sync,
+    // indefinitely, and no absolute path is recoverable from this input.
+    const result = directoryPathFromPickedFiles(fileList(pickedFile('docs/readme.md')));
+
+    expect(result).toEqual({ ok: false, reason: 'no-absolute-path' });
+  });
+
+  it('never returns the bare directory name for any nesting depth', () => {
+    for (const relative of ['docs/a.md', 'docs/deep/b.md', 'docs/deep/deeper/c.md']) {
+      const result = directoryPathFromPickedFiles(fileList(pickedFile(relative)));
+
+      expect(result.ok).toBe(false);
+      // Belt and braces: assert the specific bad value can never come back,
+      // not merely that this input failed.
+      expect(JSON.stringify(result)).not.toContain('"docs"');
+    }
+  });
+
+  it('derives the containing directory when File.path is present', () => {
+    const result = directoryPathFromPickedFiles(
+      fileList(pickedFile('notes/readme.md', '/Users/you/notes/readme.md'))
+    );
+
+    expect(result).toEqual({ ok: true, path: '/Users/you' });
+  });
+
+  it('derives a Windows directory without mangling the separators', () => {
+    const result = directoryPathFromPickedFiles(
+      fileList(pickedFile('notes/readme.md', 'C:\\Users\\you\\notes\\readme.md'))
+    );
+
+    // `webkitRelativePath` is forward-slashed while the absolute path is not,
+    // so the relative portion does not appear verbatim and the whole path is
+    // kept. That is a usable absolute path, which is the property that matters.
+    expect(result).toEqual({ ok: true, path: 'C:\\Users\\you\\notes\\readme.md' });
+  });
+
+  it('treats an empty selection as a cancellation rather than an error', () => {
+    expect(directoryPathFromPickedFiles(null)).toEqual({ ok: false, reason: 'cancelled' });
+    expect(directoryPathFromPickedFiles(fileList())).toEqual({ ok: false, reason: 'cancelled' });
+  });
+});
+
+describe('pickDirectoryNatively', () => {
+  beforeEach(() => {
+    hoisted.invoke.mockReset();
+    hoisted.isTauri.mockReset();
+  });
+
+  it('reports unavailable outside the desktop shell, without invoking', async () => {
+    hoisted.isTauri.mockReturnValue(false);
+
+    await expect(pickDirectoryNatively()).resolves.toEqual({ ok: false, reason: 'unavailable' });
+    expect(hoisted.invoke).not.toHaveBeenCalled();
+  });
+
+  it('returns the absolute path the native dialog chose', async () => {
+    hoisted.isTauri.mockReturnValue(true);
+    hoisted.invoke.mockResolvedValue('/Users/you/notes');
+
+    await expect(pickDirectoryNatively()).resolves.toEqual({ ok: true, path: '/Users/you/notes' });
+    expect(hoisted.invoke).toHaveBeenCalledWith('pick_directory_via_dialog');
+  });
+
+  it('treats a null return as a cancellation', async () => {
+    hoisted.isTauri.mockReturnValue(true);
+    hoisted.invoke.mockResolvedValue(null);
+
+    await expect(pickDirectoryNatively()).resolves.toEqual({ ok: false, reason: 'cancelled' });
+  });
+
+  it('falls back to unavailable when the dialog cannot run', async () => {
+    // Headless Linux with no xdg-desktop portal lands here, and wants the
+    // fallback input rather than an error.
+    hoisted.isTauri.mockReturnValue(true);
+    hoisted.invoke.mockRejectedValue(new Error('no portal'));
+
+    await expect(pickDirectoryNatively()).resolves.toEqual({ ok: false, reason: 'unavailable' });
+  });
+
+  it('refuses a blank path rather than storing it', async () => {
+    hoisted.isTauri.mockReturnValue(true);
+    hoisted.invoke.mockResolvedValue('   ');
+
+    await expect(pickDirectoryNatively()).resolves.toEqual({
+      ok: false,
+      reason: 'no-absolute-path',
+    });
+  });
+});