fix(web): dropped folders no longer become failed attachments

[devin-ai-integration]

Fixes pingdotgg#11961

What Changed

makeWorkspaceFileDropHandlers.onDrop now reads dataTransfer.items when the browser exposes it and skips any item whose webkitGetAsEntry() reports a directory; only real files reach host.addFiles. When items is unavailable it falls back to the old dataTransfer.files path. The shared handler covers both the composer drop zone and sidebar thread drops.

function droppedFiles(dataTransfer): File[] {
  if (dataTransfer.items === undefined) return Array.from(dataTransfer.files);
  // items: skip kind !== "file", skip webkitGetAsEntry()?.isDirectory, keep getAsFile() !== null
}

Tests: mixed folder + file drop forwards only the file; folder-only drop forwards []; existing files-only fallback still covered.

Why

Chromium surfaces a dropped folder in dataTransfer.files as a File with an empty type and no readable contents. The composer treated it as a real attachment, which produced a failed/blocking attachment (or, with the current image-only composer, an "Unsupported file type for 'sample-folder'" error). Dropping a folder should just be a no-op for that entry rather than staging something that can never upload. This does not add folder references or a toast — it only stops folders from being treated as files.

Reproduce

1. vp run dev, pair the browser, open a new thread in any project.
2. Drag a folder from the OS file manager onto the composer.
3. Before: an error banner (Unsupported file type for 'sample-folder'…) appears and nothing usable is attached. After: the drop is ignored; dropping a real image still attaches it.

UI Changes

Before (folder drop):

After (folder drop is ignored):

After (regular image drop still attaches):

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Verified with vp test run apps/web/src/components/chat/workspaceFileDrop.test.ts, web typecheck, and targeted lint.

Written by Claude (Devin harness).

Link to Devin session: https://app.devin.ai/sessions/f8f4775e52774156bee9327338af577f
Open in Devin Desktop: https://app.devin.ai/desktop/session/f8f4775e52774156bee9327338af577f?variant=devin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 11bca9cf-462d-4232-96b5-a7741823893e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Evidence for upstream pingdotgg#12001 (revised behavior):

[devin-ai-integration]

Evidence for upstream pingdotgg#12001 (browser, local environment):