fix(client): New folder did nothing — prompt() throws in the desktop client

The same `static/` tree is the web page and the application, and Electron does
not implement `window.prompt`: Chromium leaves it to the embedder and Electron
declines. It does not return null — it **throws**. The call sat above its own
try, so clicking produced no folder, no error and nothing on screen to react
to. A dead button, which is exactly how it was reported.

Measured against this repo's own Electron 44 rather than assumed, because the
first two diagnoses this session were reasoned and wrong:

    prompt('name?')  ->  Error: prompt() is not supported.
    confirm('sure?') ->  opens a real modal
    alert('hi')      ->  opens a real modal

So `confirm` and `alert` stay — a dozen call sites depend on them — and only
`prompt` is banned. `test_no_prompt_in_the_spa.py` holds the whole tree to it,
with the near-misses it must not flag (`mkdir_prompt`, `promptForName`).

The name now comes from a field in the toolbar, which works in both clients and
can show the node's refusal beside the input instead of after a dialog has
closed. Navigating away drops a half-typed name: it would otherwise create the
folder somewhere the person is no longer looking.

The rest of the chain was verified end to end and was sound: `dir_create`
{dir,name} → the node's handler → `dir_create_ack`, and `list_dirs` walks the
filesystem rather than the index, so a folder with nothing in it appears on the
very fetch that follows. The field itself was then driven inside a real
Electron window — typing, Enter, the click, and the icon rendering.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pvMdvLBG92jyhvD5pD6us

14 files changed, 192 insertions, 22 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/files-app.js b/packages/meshbay-hub/src/meshbay_hub/static/files-app.js
index fb57a0f..4947f8c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/files-app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/files-app.js
@@ -104,19 +104,47 @@ function FilesPanel({
     }
   }, [applyIndex, currentPath]);
 
-  const makeDirectory = useCallback(async () => {
+  // `null` while not creating one; a draft string while the field is open.
+  const [newDirName, setNewDirName] = useState(null);
+  const [creatingDir, setCreatingDir] = useState(false);
+
+  /**
+   * Create a folder in the directory being browsed.
+   *
+   * The name comes from a field in the toolbar rather than `window.prompt`,
+   * which **throws** in Electron — "prompt() is not supported" — and threw
+   * outside this function's try, so clicking the button did nothing at all:
+   * no folder, no error, nothing in the interface to react to. `confirm()` and
+   * `alert()` do work there and are used elsewhere; `prompt` is the one
+   * Chromium leaves to the embedder and Electron declines to implement.
+   *
+   * An inline field is better anyway — it can show the refusal next to the
+   * input instead of after the dialog has closed.
+   */
+  useEffect(() => { setNewDirName(null); }, [currentPath]);
+
+  const makeDirectory = useCallback(async (rawName) => {
     const transport = transportRef.current;
-    if (!transport || !transport.connected) return;
-    const name = prompt(t('group.mkdir_prompt'));
-    if (!name || !name.trim()) return;
+    const name = (rawName || '').trim();
+    if (!name) return;
+    if (!transport || !transport.connected) {
+      setError(t('group.mkdir_offline'));
+      return;
+    }
+    setCreatingDir(true);
     try {
-      await transport.createDirectory(currentPath, name.trim());
+      await transport.createDirectory(currentPath, name);
+      // `list_dirs` walks the filesystem rather than the index, so a folder
+      // with nothing in it is here on this very fetch.
       const indexMsg = await transport.fetchIndex();
       if (indexMsg.entries) setEntries(indexMsg.entries);
       if (indexMsg.dirs) setNodeDirs(indexMsg.dirs);
       if (indexMsg.roots) setNodeRoots(indexMsg.roots);
+      setNewDirName(null);
     } catch (err) {
       setError(err.message);
+    } finally {
+      setCreatingDir(false);
     }
   }, [currentPath]);
 
@@ -374,12 +402,35 @@ function FilesPanel({
                 width a breadcrumb trail needs. The name lives in the tooltip
                 and in aria-label, so it is not lost to anyone reading with
                 something other than their eyes. */''}
-          ${canCreateDir && html`
-          <button class="tb-btn tb-btn-icon" onClick=${makeDirectory}
+          ${canCreateDir && newDirName === null && html`
+          <button class="tb-btn tb-btn-icon" onClick=${() => setNewDirName('')}
             title=${t('group.mkdir')} aria-label=${t('group.mkdir')}>
             <${Icon} name="folder-plus" />
           </button>
           `}
+          ${canCreateDir && newDirName !== null && html`
+          <span class="tb-mkdir">
+            <input type="text" class="tb-mkdir-input" autofocus
+              value=${newDirName} disabled=${creatingDir}
+              placeholder=${t('group.mkdir_prompt')}
+              aria-label=${t('group.mkdir')}
+              onInput=${(e) => setNewDirName(e.target.value)}
+              onKeyDown=${(e) => {
+                if (e.key === 'Enter') makeDirectory(newDirName);
+                if (e.key === 'Escape') setNewDirName(null);
+              }} />
+            <button class="tb-btn tb-btn-icon" title=${t('group.mkdir')}
+              disabled=${creatingDir || !newDirName.trim()}
+              onClick=${() => makeDirectory(newDirName)}>
+              <${Icon} name="check" />
+            </button>
+            <button class="tb-btn tb-btn-icon" title=${t('settings.cancel')}
+              disabled=${creatingDir}
+              onClick=${() => setNewDirName(null)}>
+              <${Icon} name="close" />
+            </button>
+          </span>
+          `}
         </div>
 
         <div class="breadcrumbs">
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index 2e7d3c5..c6d0331 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -154,7 +154,8 @@ export default {
     + 'diese Gruppe hostet.',
   'group.upload': 'Hochladen',
   'group.mkdir': 'Neuer Ordner',
-  'group.mkdir_prompt': 'Name des neuen Ordners:',
+  'group.mkdir_prompt': 'Name des neuen Ordners',
+  'group.mkdir_offline': 'Nicht mit dem Node verbunden.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index 350a597..0831aa3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -154,7 +154,8 @@ export default {
   'group.offline_hint': 'Files will appear when a node hosting this group connects.',
   'group.upload': 'Upload',
   'group.mkdir': 'New folder',
-  'group.mkdir_prompt': 'Name of the new folder:',
+  'group.mkdir_prompt': 'New folder name',
+  'group.mkdir_offline': 'Not connected to the node.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 22a9461..18570cc 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -152,7 +152,8 @@ export default {
     + 'este grupo.',
   'group.upload': 'Subir',
   'group.mkdir': 'Nueva carpeta',
-  'group.mkdir_prompt': 'Nombre de la nueva carpeta:',
+  'group.mkdir_prompt': 'Nombre de la nueva carpeta',
+  'group.mkdir_offline': 'Sin conexión con el nodo.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 3da68b2..65021e3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -153,7 +153,8 @@ export default {
     + 'groupe se connectera.',
   'group.upload': 'Envoyer',
   'group.mkdir': 'Nouveau dossier',
-  'group.mkdir_prompt': 'Nom du nouveau dossier :',
+  'group.mkdir_prompt': 'Nom du nouveau dossier',
+  'group.mkdir_offline': 'Non connecté au nœud.',
   'device.add_title': 'Ce navigateur n’est pas encore lié à ce nœud',
   'device.add_hint': 'Votre compte est connu ici, mais ce navigateur détient une autre clé. Approuvez-le depuis un appareil déjà lié — sans passer par l’opérateur.',
   'device.add_btn': 'Obtenir un code de liaison',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 335ed68..7f58764 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -153,7 +153,8 @@ export default {
     + 'questo gruppo.',
   'group.upload': 'Carica',
   'group.mkdir': 'Nuova cartella',
-  'group.mkdir_prompt': 'Nome della nuova cartella:',
+  'group.mkdir_prompt': 'Nome della nuova cartella',
+  'group.mkdir_offline': 'Non connesso al nodo.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 4dd2f30..0e2dd42 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -151,7 +151,8 @@ export default {
     + 'ファイルが表示されます。',
   'group.upload': 'アップロード',
   'group.mkdir': '新しいフォルダー',
-  'group.mkdir_prompt': '新しいフォルダーの名前：',
+  'group.mkdir_prompt': '新しいフォルダー名',
+  'group.mkdir_offline': 'ノードに接続していません。',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index cb36d38..9f74e19 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -154,7 +154,8 @@ export default {
     + 'die deze groep host.',
   'group.upload': 'Uploaden',
   'group.mkdir': 'Nieuwe map',
-  'group.mkdir_prompt': 'Naam van de nieuwe map:',
+  'group.mkdir_prompt': 'Naam van de nieuwe map',
+  'group.mkdir_offline': 'Niet verbonden met de node.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index 91d0d90..083d72d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -157,7 +157,8 @@ export default {
   'group.offline_hint': 'Pliki pojawią się, gdy połączy się node hostujący tę grupę.',
   'group.upload': 'Wyślij',
   'group.mkdir': 'Nowy folder',
-  'group.mkdir_prompt': 'Nazwa nowego folderu:',
+  'group.mkdir_prompt': 'Nazwa nowego folderu',
+  'group.mkdir_offline': 'Brak połączenia z węzłem.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 2b26a0b..bdc6c3b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -154,7 +154,8 @@ export default {
     + 'se conectar.',
   'group.upload': 'Enviar',
   'group.mkdir': 'Nova pasta',
-  'group.mkdir_prompt': 'Nome da nova pasta:',
+  'group.mkdir_prompt': 'Nome da nova pasta',
+  'group.mkdir_offline': 'Sem conexão com o nó.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index f1d7f9c..0a1fe1a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -150,7 +150,8 @@ export default {
   'group.offline_hint': '当托管此群组的 node 连接后，文件就会出现。',
   'group.upload': '上传',
   'group.mkdir': '新建文件夹',
-  'group.mkdir_prompt': '新文件夹的名称：',
+  'group.mkdir_prompt': '新文件夹名称',
+  'group.mkdir_offline': '未连接到节点。',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/style.css b/packages/meshbay-hub/src/meshbay_hub/static/style.css
index 4647209..c5d5ce3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/style.css
+++ b/packages/meshbay-hub/src/meshbay_hub/static/style.css
@@ -837,6 +837,18 @@ button:disabled { opacity: 0.5; cursor: not-allowed; }
    beside it. The horizontal padding goes; the height does not, so it lines up
    with the labelled buttons next to it. */
 .tb-btn-icon { padding: 0; width: 32px; justify-content: center; gap: 0; }
+
+/* Naming a new folder, in the toolbar. Not `window.prompt`, which throws in
+   Electron — and an inline field can put the node's refusal next to the input
+   rather than after a dialog has closed. */
+.tb-mkdir { display: inline-flex; align-items: center; gap: 6px; }
+.tb-mkdir-input {
+  height: 32px; width: 170px; padding: 0 9px;
+  border: 1px solid var(--border-focus); border-radius: 6px;
+  background: var(--bg-surface); color: var(--text);
+  font-family: inherit; font-size: 0.83em;
+}
+.tb-mkdir-input:focus { outline: none; }
 .tb-btn.primary {
   background: var(--accent);
   border-color: var(--accent);
diff --git a/packages/meshbay-hub/tests/test_no_prompt_in_the_spa.py b/packages/meshbay-hub/tests/test_no_prompt_in_the_spa.py
new file mode 100644
index 0000000..d126a05
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_no_prompt_in_the_spa.py
@@ -0,0 +1,90 @@
+"""
+`window.prompt` does not exist in the desktop client.
+
+The same `static/` tree is the web page and the application (CLAUDE.md's "one
+UI source"), and Electron does not implement `prompt` — Chromium leaves it to
+the embedder and Electron declines. It does not return null: it **throws**,
+`Error: prompt() is not supported.`
+
+That made the Files toolbar's New folder button do nothing whatsoever. The call
+sat above its own try, so the click produced no folder, no error, and nothing
+on screen to react to — the failure looks exactly like a dead button, which is
+what it was reported as.
+
+Measured rather than assumed, against this repo's own Electron 44:
+
+    prompt('name?')  ->  Error: prompt() is not supported.
+    confirm('sure?') ->  opens a real modal
+    alert('hi')      ->  opens a real modal
+
+So `confirm` and `alert` stay allowed and are used in a dozen places; only
+`prompt` is banned. Anything that needs typed input needs a field.
+"""
+
+import re
+from pathlib import Path
+
+import pytest
+
+STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
+
+pytestmark = pytest.mark.skipif(not STATIC.exists(),
+                                reason="SPA sources unavailable")
+
+# `prompt(` as a call, not `window.prompt` inside a comment or a longer
+# identifier like `mkdir_prompt` / `promptForName`.
+CALL = re.compile(r"(?<![\w.$])(?:window\.)?prompt\s*\(")
+
+
+def _code_only(source: str) -> str:
+    source = re.sub(r"/\*.*?\*/", "", source, flags=re.S)
+    return re.sub(r"^\s*//.*$", "", source, flags=re.M)
+
+
+def test_nothing_calls_prompt():
+    offenders = []
+    for path in sorted(STATIC.glob("*.js")):
+        if path.name == "sw.js":
+            continue
+        for i, line in enumerate(_code_only(
+                path.read_text(encoding="utf-8")).splitlines(), 1):
+            if CALL.search(line):
+                offenders.append(f"{path.name}:{i}: {line.strip()}")
+
+    assert not offenders, (
+        "prompt() throws in the desktop client, and the click that reaches it "
+        "does nothing at all:\n  " + "\n  ".join(offenders))
+
+
+def test_the_pattern_would_catch_a_real_call():
+    """
+    A guard that matches nothing passes over an empty set, which looks exactly
+    like success. Both spellings, and the near-misses it must not flag.
+    """
+    assert CALL.search("const n = prompt('x');")
+    assert CALL.search("const n = window.prompt('x');")
+    assert not CALL.search("t('group.mkdir_prompt')")
+    assert not CALL.search("promptForName();")
+    assert not CALL.search("this.prompt(1);")
+
+
+def test_creating_a_folder_uses_a_field():
+    """
+    The control the ban is about. A typed name needs somewhere to type it, and
+    an inline field can show the node's refusal beside the input rather than
+    after a dialog has closed.
+    """
+    source = (STATIC / "files-app.js").read_text(encoding="utf-8")
+    assert "tb-mkdir-input" in source
+    assert "newDirName" in source
+    assert "group.mkdir_prompt" in source, "the field has no label or placeholder"
+
+
+def test_leaving_the_folder_drops_a_half_typed_name():
+    """
+    Otherwise the folder is created where the person is no longer looking —
+    they navigated away, the draft came along, and the name lands in a
+    directory they were not thinking about.
+    """
+    source = (STATIC / "files-app.js").read_text(encoding="utf-8")
+    assert "useEffect(() => { setNewDirName(null); }, [currentPath]);" in source
diff --git a/packages/meshbay-hub/tests/test_upload_controls_hidden.py b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
index a61de1f..bdba373 100644
--- a/packages/meshbay-hub/tests/test_upload_controls_hidden.py
+++ b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
@@ -94,13 +94,20 @@ def test_an_icon_only_button_still_says_what_it_is():
     The name moved into a tooltip to save toolbar width. A `title` is invisible
     to a screen reader on a button with no text, so the label has to be there
     as well — otherwise the control is simply unnamed for anyone not reading
-    with their eyes.
+    with their eyes. The same goes for the field it opens, which has a
+    placeholder and no visible label.
     """
     page = _component(FILES_APP.read_text(encoding="utf-8"), "FilesPanel")
-    block = page[page.index("canCreateDir && html`"):]
-    block = block[:block.index("</button>")]
-    assert "title=" in block and "aria-label=" in block
-    assert "group.mkdir" in block
+    opener = page[page.index("canCreateDir && newDirName === null"):]
+    opener = opener[:opener.index("</button>")]
+    assert "title=" in opener and "aria-label=" in opener
+    assert "group.mkdir" in opener
+
+    field = page[page.index("canCreateDir && newDirName !== null"):]
+    field = field[:field.index("</span>")]
+    assert "aria-label=" in field, (
+        "the name field is labelled by a placeholder alone, which a screen "
+        "reader does not announce as a name")
 
 
 def test_the_chat_composer_hides_its_paperclip():