Workspace picker ignores typed paths and lacks a server-owned default

[RaresKeY]

Prerequisites

• I searched open and closed issues, open pull requests, and discussions for workspace selection, folder picking, typed paths, Docker-visible folders, workspace persistence, and sandbox workspaces. Clarify agent workspace picker scope for Docker bind-mounted host folders #3104 owns Docker bind-mount wording, Discussion How to setup workspace #4438 records setup confusion, and Sandbox agent process execution behind one constrained Linux boundary #6091 owns the process-sandbox boundary; none owns this picker validation, default-directory, creation, and persistence contract.
• This is not a security vulnerability. It is a workspace-selection and persistence bug at a security-sensitive boundary.
• I confirmed the deterministic source behavior on current dev at 032967af and reproduced the affected states with focused route and frontend-contract regressions.

Odysseus Revision

032967a (2026-08-17)

Install Method

Docker (docker compose up)

Operating System

Linux

Steps to Reproduce

1. Open Agent mode and open Select workspace in a deployment where the server home resolves to a missing or unusable path such as /home/worker.
2. Type an existing server-visible folder such as /runtime/data/agent_workspace into the path field.
3. Click Use this folder without pressing Enter first.
4. Observe that the previously browsed path is selected instead of the typed value.
5. Reopen the picker and enter a missing or invalid path. Observe that browsing silently falls back to the home path instead of explaining that the folder does not exist.
6. Open the same Odysseus account in another browser or on another computer. Observe that the workspace choice is missing because it is stored only in browser-local storage.

Expected Behaviour

Typing or choosing a folder and clicking Use this folder should make the server validate the current input, safely create it only when it is a missing child of the managed workspace root and the user confirms creation, select the canonical path, persist the selection for the signed-in user, and refresh the folder list without requiring Enter. Startup should create one named default workspace directory under the application data root, and the picker should open there, list its folders, provide a New folder action, and display an inline reason whenever selection is unavailable.

Actual Behaviour

The button persists the last path loaded into the picker rather than the current input value. The input placeholder is the only Enter hint; invalid paths fall back to the expanded server home; the default home can be missing; unavailable selection is explained only by a hover tooltip; there is no managed folder-creation flow; and the active selection is stored per browser. The picker also says shell commands are not sandboxed even when the process-sandbox boundary from #5818 is present.

Logs / Screenshots

Current dev source boundaries:
- static/js/workspace.js: the Use button calls setWorkspace(_curPath), while typed input updates _curPath only after Enter triggers navigation
- routes/workspace_routes.py: a missing browse target silently resets to expanduser("~")
- static/js/workspace.js: workspace state is read from and written to browser-local storage

The button/input mismatch is visible at static/js/workspace.js:166, the silent fallback is at routes/workspace_routes.py:33, and browser-local persistence starts at static/js/workspace.js:18.

Model / Backend (if relevant)

Not model-specific. Agent workspace picker and server-owned process-sandbox workspace state.

Are you willing to submit a fix?

Yes — I can open a focused PR.

Additional Information

Parent issue: #6091. Broader tracker: #5815. Related UX/deployment context: #3104 and Discussion #4438. The Windows path/execution failure in #5914 is a separate platform contract.

A focused candidate should keep the existing admin/single-user gate, reject cross-site mutations, expose exact validation failures, use a named workspace constant, create the default directory defensively at startup/setup, permit creation only below that managed root, protect against symlink swaps and sensitive/application-data paths, persist only after the refreshed folder listing succeeds, preserve an explicit cleared state, and synchronize the server-owned selection before chat or slash-command execution. Regression coverage should include existing, missing, invalid, file, root, sensitive, cross-site, cross-browser, refresh-failure, and first-send states. Running-app desktop/mobile evidence remains required for the UI change.