feat(desktop): link Markdown files and folders alongside Vault copies

[Kechos23]

Desktop Linked Workspace: original files, folder workflows and draft protection

This updates the reviewed Linked Workspace proposal with the requested hierarchy, actions and safety behavior. It depends on the separately proposed shared persistence/reliability changes; those are not presented as defects introduced by Linked Workspace.

User-facing behavior

• Group Vault, Linked Workspace and Secret Workspace under WORKSPACES. Use file-symlink / folder-symlink for real linked sources, keeping normal Vault icons unchanged.
• Provide Link file, Link folder and Create new linked file actions in the desktop toolbar and Linked Workspace menu. Keep creation separated from linking existing sources.
• Show source paths on hover instead of crowding file names. Use compact, distinct conflict/missing-source indicators with explanatory tooltips.
• Keep local recovery drafts separate from Vault storage, preserving linked-folder hierarchy. Saving the original is explicit; automatic persistence does not write the source.
• Support layout-independent Ctrl+S. Save As appends .md when needed and proposes the document name. A Vault export keeps its Vault document and focuses the new linked document; a linked Save As keeps both linked documents.
• Support linked file/folder conversion to independent Vault copies, including existing sidebar HTML dragging. Preserve folder hierarchy and original external files. Vault folder Save As creates a separate linked folder without merging into an existing destination.
• Keep conversions independent: reopening/rescanning the original can create a linked entry without consuming a Vault copy. Explicit rescan can restore entries previously excluded by removal/conversion.
• Use consistent status toasts and centered confirmations for consequential choices. Original-save confirmation has a preference to skip subsequent ordinary confirmations; conflict protection remains active.
• Keep the default Vault Welcome content unchanged. Identify unmodified built-in guides using metadata and use book-open-text for both guides. Update only the Linked Workspace guide.
• Allow middle-button tab closing in the shared web/desktop interface.

Safety and failure handling

• Capture live primary/split editor input before refresh, save, conversion and workspace maintenance, rather than relying on the debounce having finished.
• Preserve a local draft when a source changes, disappears or returns. Recheck relevant draft/source state after confirmation; cancelling does not discard the draft.
• Establish watchers for newly saved linked files. Persist bulk-removal exclusions before discarding records, and fail without a success message when persistence fails.
• Treat imported backup paths as data, not authorization to write external files or create watchers. Restored drafts need explicit relinking.
• Bound native file reads and folder scans; serialize relevant operations and report partial export/conversion results accurately.

Platform and limits

Linked-source actions require desktop native APIs and are hidden/disabled in the web app, including Docker-served deployments. Browser recovery content remains usable without reconnecting local paths. Native development/manual evidence is Windows-based; macOS/Linux native behavior is not claimed verified.

This branch uses the official Neutralino 6.5.0 runtime/client pins. Standard external HTML file drops remain Vault-copy imports. Native path drops, single-instance integration and the experimental pointer fallback are proposed separately in draft #269.

Scan limits: 10,000 Markdown files, 40,000 entries, 2,000 directories, depth 32, 20 MiB per Markdown source, 200 MiB staged content and a 60-second scan budget. Recovery is not a backup. Native APIs do not provide an atomic compare-and-write/no-overwrite guarantee, so a race with another process cannot be completely eliminated by application-side checks.

Validation

• 117 unit tests passed.
• Full Chromium run: 495/495 passed after the Media/Table focus-race fixes, before final locale completion. After completing the catalogs, 16 focused Chromium tests passed for localization/typography, desktop Save, action icons and web isolation; static validation also passed.
• Locale audit passed: 15 catalogs × 1,580 keys, with aligned placeholders and reviewed finite exceptions for legitimate unchanged terms. Actual English fallback labels were translated and internal toast IDs/search tokens/selectors were removed from extraction. Native-language quality still benefits from native-speaker review.
• The user accepted Windows smoke tests on the final official-runtime review executable: language switching/document preservation, Save/Save As, external conflict handling and folder conversion. Native macOS/Linux, Firefox/WebKit and comprehensive native failure/race testing remain unverified.

Review dependency

Depends on shared safety/reliability PR #279. Because this cross-fork PR still targets upstream main, its full diff currently includes that baseline. For the Linked Workspace-only changes, use the incremental comparison. After #279 merges, I will rebase onto the resulting upstream baseline.

[Kechos23]

Thanks for the detailed review. I have separated the shared persistence fixes from this desktop feature and rebuilt the proposal on that baseline.

1. Linked Workspace menu: added linking existing files/folders and a clearly separated Create new linked file action. Desktop-only native actions do not appear in the browser build.
2. Guide icon: I used book-open-text for both built-in guides, identified through metadata rather than title alone. The Linked guide is an internal instructional document, not an externally linked source, so using a symlink icon there would imply a source-file relationship it does not have. Real linked sources use the requested symlink icons.
3. Physical hierarchy: linked recovery uses a separate storage root and retains the linked directory hierarchy. Conversion persists an independent Vault copy; originals are not deleted. Backup restore does not reactivate external-path authority.
4. Save confirmation: saving an original uses the application's centered confirmation styling with the ordinary-confirmation opt-out. Source conflicts still prevent an ordinary save from silently overwriting a changed original.

The four safety notes are also covered: live primary/split drafts are captured before refresh; returning missing sources do not overwrite dirty drafts; Save As links receive watchers; and bulk removal persists exclusions before removing records. Regression tests cover success, cancellation, changing state during confirmation, persistence failure and partial folder operations.

Additional related improvements include folder conversion/export, sidebar conversion using the existing HTML drag mechanism, less crowded source-path presentation, status-icon consistency and layout-independent saving. Remaining native atomicity limits are documented rather than represented as fully solved. If the desktop feature direction is not suitable for the project, I am happy to narrow or withdraw the feature proposal.

The shared safety baseline is now proposed separately in #279; the description links the incremental Linked Workspace diff for easier review.

[ThisIs-Developer]

Thanks for the detailed review. I have separated the shared persistence fixes from this desktop feature and rebuilt the proposal on that baseline.

1. Linked Workspace menu: added linking existing files/folders and a clearly separated Create new linked file action. Desktop-only native actions do not appear in the browser build.
2. Guide icon: I used book-open-text for both built-in guides, identified through metadata rather than title alone. The Linked guide is an internal instructional document, not an externally linked source, so using a symlink icon there would imply a source-file relationship it does not have. Real linked sources use the requested symlink icons.
3. Physical hierarchy: linked recovery uses a separate storage root and retains the linked directory hierarchy. Conversion persists an independent Vault copy; originals are not deleted. Backup restore does not reactivate external-path authority.
4. Save confirmation: saving an original uses the application's centered confirmation styling with the ordinary-confirmation opt-out. Source conflicts still prevent an ordinary save from silently overwriting a changed original.

The four safety notes are also covered: live primary/split drafts are captured before refresh; returning missing sources do not overwrite dirty drafts; Save As links receive watchers; and bulk removal persists exclusions before removing records. Regression tests cover success, cancellation, changing state during confirmation, persistence failure and partial folder operations.

Additional related improvements include folder conversion/export, sidebar conversion using the existing HTML drag mechanism, less crowded source-path presentation, status-icon consistency and layout-independent saving. Remaining native atomicity limits are documented rather than represented as fully solved. If the desktop feature direction is not suitable for the project, I am happy to narrow or withdraw the feature proposal.

The shared safety baseline is now proposed separately in #279; the description links the incremental Linked Workspace diff for easier review.

Hi, I've been busy with a few things lately, so I haven't had enough time to review the code thoroughly.

I requested a Copilot review in the meantime, but I don't fully rely on Copilot's reviews, as they aren't always accurate or reliable. I prefer to review the code myself before making any decisions.

I've taken an initial look at the changes, and there are a few things I'd like to point out. However, I need a little more time to go through everything properly.

I'll get back to you with my feedback as soon as possible. Thanks for your patience and understanding!