Default priority 0 lock displaced the shipped picker; clearing it left workspaces unselectable and blocked Session create in the DSH UI. Deny open-workspace with CSS and click guards only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give admin the same permissions as super/fallback, occupy directoryFlow at priority 1 so the button renders without colliding with the native picker, and inject uiWorkspace for pickDirectory.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove directory-flow reload, only shadow the picker while anonymous, and stop clearing login attrs on AuthBadge unmount so flat↔workspace observers cannot loop.
Co-authored-by: Cursor <cursoragent@cursor.com>
Directory-flow gate was shadowing the native picker; clearing it left an empty hole so Add workspace never rendered. Reload once when permission flips on, and harden canCreateWorkspace detection from role/permissions.
Co-authored-by: Cursor <cursoragent@cursor.com>
super_admin/fallback_admin already could; admin now has canCreateWorkspace, and Host-side creates without browser ALS (IM) are no longer blocked as forbidden.
Co-authored-by: Cursor <cursoragent@cursor.com>
Skip startup /api/me until QR load, stop blocking me on workspace provision, and register the footer login entry before heavy ACL gates so login appears immediately.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire client locale to the DSH host, return stable API error codes with localized messages, and replace bottom refresh with an in-frame retry for expired or offline QR.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move the public auth helper skill under uds-auth/skills and update docs to point there instead of the repo-root skills tree.
Co-authored-by: Cursor <cursoragent@cursor.com>
