fix(explorer): align directory mentions with workspace-root grammar

[bulingbuling688]

Fixes #479

The explorer inserts complete directory references such as @src/ and @"my dir/", and derives file and directory tokens from the host-confirmed workspace root. Earlier fixes already added quoted file mentions, structured file chips, and directory trailing slashes; this PR addresses the two remaining gaps identified by the maintainer. It also fixes the missing separator between consecutive directory and file insertions discovered during real-host verification.

The old callback interpolated directories directly and called relativeTo(sessionCwd, path), whose outside-cwd fallback returns an absolute path. The callback now shares a validated workspace-relative insertion path. File chips retain their payload and quoted plain-text fallback. Directories retain plain-text completion behavior: normalize separators to /, place the trailing slash inside the closing quote, and reject embedded quotes and control characters. Referencing the workspace itself remains @./.

Workspace authority is the public, read-only ctx.get('workspaces').list.getSnapshot(): match the current session ID in WorkspaceView.sessionIds, then read its canonical path. This is the membership lookup used by the native conversation shell, without guessing a root from cwd or parent directories. The structural mirror follows published rc.1 declarations without adding a dependency or runtime import:

• IWorkspaces.list and WorkspaceSource
• WorkspaceView.path and sessionIds
• Native conversation membership lookup

The snapshot is read on each click. Missing service/membership, pending/loading/error snapshots, outside-workspace entries and unsafe path projections leave the draft unchanged and log the reason. There is no absolute-mention fallback. Windows drive/UNC comparisons tolerate casing and mixed separators while preserving target spelling; POSIX comparisons remain case-sensitive. The existing copy-relative-path helper is unchanged.

The rc.1 native picker uses plain text for directory drill and supports folder chips on explicit selection. Its drill formatter leaves a quote open for completion; the sidebar inserts a complete closed token as requested in #479. The host's insertReference adds space after a file chip but not before it. Completed directory insertions therefore add a separator outside the token, preventing @"my dir/"@"docs/my notes.md". Plain-text joins reuse existing whitespace. insertFileReference itself remains byte-for-byte unchanged from the original parent commit.

Regression coverage includes ordinary/spaced/nested directories, Windows drive/UNC/mixed separators, root self-reference, quotes/control characters, cwd equal to or below workspace root, a file outside cwd but inside workspace, unavailable workspace data and recovery, structured file payloads, unhandled-chip fallback, and consecutive-reference separation. Tests exercise pure functions and the rendered Sidebar callback without copying production logic or asserting source strings.

Actual local validation on latest commit 1ad9ac75068261ffcf4e595d7e2d71dfde7808bb (Linux/WSL2, Node 24.20.0):

Check	Result
Complete reference-mention + paths files	43 passed
Complete sidebar-workspace-reference file	16 passed
Complete conversation-draft file	27 passed
Above four complete files after restoring the production fix	86 passed
New separator regressions before implementation	5 failed / 38 passed across two complete files
Withdraw separator production fix and rerun only the five new cases	All 5 failed; restoring it passes
Full pnpm test	124 files passed, 1358 passed / 9 skipped / 0 failed
pnpm typecheck, pnpm lint, pnpm build, pnpm check:consumer-types, git diff --check	Passed

The original issue regressions also failed before implementation (44 failed / 12 passed when all original production changes were withdrawn), and passed after restoration. The missing system build tools were installed earlier (GNU Make 4.3, GCC/G++ 13.3), and pnpm rebuild node-pty succeeded. All 31 earlier node-pty failures disappeared after repairing the environment; prior branch/baseline runs had the same 31 failing test names. No test exclusions or dependency changes were used to mask the environment problem.

Latest-commit real UI validation on 2026-09-07: 9 checks passed on Linux and 9 on native Windows, using the packed plugin installed by the official DSH CLI into isolated profiles. DSH was 0.1.2-rc.1 on both; Linux Node 24.20.0, Windows Node 24.19.0 / process.platform=win32 / Windows 10.0.26200 x64. Browser automation ran in Chromium on each OS, with no host/session mocks:

• Actual file-tree @ clicks produced ordinary, spaced, nested and root directory tokens, each followed by an insertion separator.
• Moving the caret before the closing quote displayed the native nested-directory completion candidate.
• Consecutive directory clicks serialized with a single separator.
• Directory followed by file, without manually typing whitespace, serialized @"my dir/" @"docs/my notes.md" and retained one native file chip.
• Sending that combination persisted both separated complete tokens in a real user/message and cleared the composer; screenshots record the resulting message display.
• Removing the workspace registration through the public API made @ insertion a no-op with draft KEEP unchanged; registration was restored.
• No page errors occurred. Runtime records, screenshots and structured event evidence are retained locally; generated artifacts are not committed.

The latest combined sends used keyless profiles and establish host acceptance/rendering, not successful model execution. Earlier on commit cb271e0, after the user configured credentials, deepseek-official / deepseek-v4-flash successfully ran two real browser-submitted checks: read returned a random verification value from a spaced-path file, and glob returned two random child filenames from a spaced directory. Final replies exactly matched values not supplied in the prompts; both turns completed and fixture contents were unchanged. Those two model calls were not repeated on the separator follow-up commit. No API key was read or recorded.

Remaining live-contract limitation: the local discovery provider searches from session header cwd, and the workspace registry filters membership to canonical cwd equality. Actual rc.1 API attempts rejected workspaceId plus child cwd with gateway/bad-request, and rejected adopting an existing child-cwd session into a parent workspace with session/conflict. Thus the differing-cwd case is covered by authoritative workspace snapshot fixtures; it is not claimed as a reproduced live rc.1 configuration. No DSH source was modified or patched to manufacture one.

CI for latest commit 1ad9ac7:

• Fork CI: success. Linux: 124 files passed, 1358 passed / 9 skipped. Windows: 124 files passed, 1364 passed / 3 skipped. Both lanes passed typecheck, lint, build and consumer types. Real DSH mount smoke: 18 passed; aggregate double-mount regression: passed.
• Upstream PR workflow: action_required, awaiting maintainer approval.

The PR is ready for review, open and unmerged. Fork CI does not replace upstream approval or review. Version, dependencies, lockfile and release configuration are unchanged; the worktree is clean. These UI checks are browser automation, not a human manual walkthrough.