@kabmo-labs/kabmo 0.6.1 → 0.8.0

package/src/server/lib/updates/shell-release.ts

@@ -2,85 +2,68 @@
  * Which published native-shell artifact a browser or an installed shell should
  * download, and whether the installed one is behind.
  *
- * Neither shell is an npm package (see `.github/workflows/publish-android.yml`
- * and `publish-ios.yml`), so the npm probe that answers for the app and for
- * `omp` cannot answer here. The only record of a published shell is a GitHub
- * release asset, which means one unauthenticated REST read of the release LIST —
- * not `/releases/latest`, which answers the newest release of ANY kind (see
- * `fetchShellRelease`).
+ * No shell is an npm package (see `.github/workflows/publish-{android,ios,macos,
+ * windows,linux}.yml`), so the npm probe that answers for the app and for `omp`
+ * cannot answer here. The only record of a published shell is a GitHub release
+ * asset.
  *
- * ONE module for both shells, because the question is identical and only the
- * asset naming differs. Two copies is how one of them starts reading the release
- * tag, or caching under a slot the other overwrites.
+ * ## Two reads, because one of them has a quota
  *
- * Two facts travel back, and they answer different questions:
+ * The REST API is the precise read and the FIRST one tried. It is also
+ * unauthenticated at 60 requests an hour **per source IP**, and a phone on mobile
+ * data shares that IP with an entire carrier NAT — so `shell-pages` is the second
+ * path, and it is why the button appears at all on a bad day. See that module's
+ * own comment for the measured failure.
  *
- * - `url` is the asset to download. It is resolved from the release's OWN asset
- *   list rather than built as `releases/latest/download/<name>`, because that
- *   path needs the asset name to match exactly and the name carries the tag
- *   (`kabmo-android-v1.2.3.apk`) — a name built here would be a second copy of
- *   the workflow's naming rule, and the first release that renames it 404s.
- * - `latest` is the version that asset ships, read from the asset name. The
- *   release TAG cannot be used: the artifact is attached to the app's release,
- *   whose tag names the SERVER version, and the two move independently.
+ * ## What travels back
  *
- * Failure is a normal answer here (`null`), never a throw: an offline box or a
- * rate-limited GitHub must not take the sidebar down, and a button that appears
- * because a probe failed would offer a download that does not exist.
+ * - `url` is what to download. For the mobile pair it is the artifact itself (an
+ *   APK the shell installs, an IPA the release page explains). For the DESKTOP
+ *   trio it is the RELEASE PAGE, deliberately: every desktop artifact is
+ *   per-architecture (`Kabmo-0.2.0-mac-arm64.zip`), and this server cannot know
+ *   which architecture the window asking is running on — it may be a remote
+ *   console on another machine entirely. Naming one arch's file would hand half
+ *   the readers a build that will not launch.
+ * - `latest` is the version that asset ships, read from the asset NAME (see
+ *   `shell-assets`). The release TAG cannot be used: the artifact is attached to
+ *   the app's release, whose tag names the SERVER version.
+ *
+ * Failure is a normal answer here (`null`), never a throw: an offline box must
+ * not take the sidebar down, and a button that appears because a probe failed
+ * would offer a download that does not exist.
  */
 
 import { REPO } from '@/server/lib/updates/release-url';
+import { SHELL_ASSETS, versionFromAssetName } from '@/server/lib/updates/shell-assets';
+import { findAssetInPages } from '@/server/lib/updates/shell-pages';
 import type { ShellKind } from '@/shared/lib/updates/shell-ua';
 
 /** One published shell artifact, as the console needs it. */
 export interface ShellRelease {
-  /** Asset download URL, or null when the release carries no artifact. */
+  /** Asset download URL, or the release page for a per-arch desktop build. */
   url: string | null;
-  /** Version the asset name declares (`v1.2.3` → `1.2.3`), or null. */
+  /** Version the asset name declares (`Kabmo-1.2.3-android.apk` → `1.2.3`). */
   latest: string | null;
   /** The release page, for a "what changed" link. */
   releaseUrl: string | null;
 }
 
-/** How each shell's asset is named by its publish workflow. */
-export const SHELL_ASSETS: Record<ShellKind, { prefix: string; extension: string }> = {
-  android: { prefix: 'kabmo-android-', extension: '.apk' },
-  ios: { prefix: 'kabmo-ios-', extension: '.ipa' },
-};
-
-/**
- * `kabmo-android-v1.2.3.apk` → `1.2.3` (and the `.ipa` twin).
- *
- * The `v` is optional because a hand-uploaded asset may omit it, and a version
- * that cannot be read is not evidence of an update — the caller treats null as
- * "no new version".
- */
-export function versionFromAssetName(kind: ShellKind, name: string): string | null {
-  const { prefix, extension } = SHELL_ASSETS[kind];
-  if (!name.startsWith(prefix) || !name.endsWith(extension)) return null;
-  const middle = name.slice(prefix.length, -extension.length);
-  const version = middle.startsWith('v') ? middle.slice(1) : middle;
-  return /^\d+\.\d+\.\d+/.test(version) ? version : null;
-}
-
 /**
  * The newest release that actually carries this shell's artifact.
  *
  * NOT `/releases/latest`, which answers the newest release of ANY kind. This
- * repository publishes three artifacts from one push, and the packages are
- * released FIRST (`packages → marketplace → android → apk-build → app` in
+ * repository publishes several artifacts from one push, and the packages are
+ * released FIRST (`packages → marketplace → android → … → app` in
  * `release.yml`), so their `kabmo-sdk/v*` / `kabmo-ui/v*` releases are newer
- * than the app release that carries the shell. `@semantic-release/github` runs
+ * than the app release that carries the shells. `@semantic-release/github` runs
  * in both pipelines, so those are real releases — measured against a stub that
  * answered a package release: `/releases/latest` produced
  * `{url: null, latest: null}` and the sidebar's button disappeared even though
  * the APK sat on the release directly below.
  *
- * One request per shell, cached for five minutes on `globalThis` for the same
- * reason the database handle is anchored there: `bun --hot` re-evaluates this
- * module while the cache it would otherwise hold lives on. GitHub allows 60
- * unauthenticated reads an hour per address, and the sidebar asks on every
- * mount.
+ * Cached for five minutes on `globalThis` for the same reason the database
+ * handle is anchored there: `bun --hot` re-evaluates this module while the cache
+ * it would otherwise hold lives on.
  */
 export async function fetchShellRelease(
   kind: ShellKind,
@@ -90,25 +73,44 @@ export async function fetchShellRelease(
   const now = Date.now();
   if (cache.entry && now - cache.at < CACHE_MS) return cache.entry;
 
+  const headers = gitHubHeaders();
+  const resolved =
+    (await readFromApi(kind, fetchImpl, headers)) ?? (await readFromPages(kind, fetchImpl, headers));
+  if (!resolved) return cache.entry ?? null;
+
+  cache.entry = resolved;
+  cache.at = now;
+  return resolved;
+}
+
+/** How many releases to look back through for the artifact. */
+const RELEASE_SCAN = 20;
+
+/**
+ * The REST read, or null when it did not answer with a usable release list.
+ *
+ * A non-2xx is not an error to report — it is the quota, and the caller has a
+ * second path.
+ */
+async function readFromApi(
+  kind: ShellKind,
+  fetchImpl: typeof fetch,
+  headers: Record<string, string>,
+): Promise<ShellRelease | null> {
   try {
     const response = await fetchImpl(`${githubApiBase()}/repos/${REPO}/releases?per_page=${RELEASE_SCAN}`, {
-      headers: {
-        accept: 'application/vnd.github+json',
-        // GitHub rejects a request with no User-Agent.
-        'user-agent': 'kabmo-console',
-      },
+      headers: { accept: 'application/vnd.github+json', ...headers },
     });
-    if (!response.ok) return cache.entry ?? null;
+    if (!response.ok) return null;
 
     const body = (await response.json()) as unknown;
     // A body that is not the release list is a failed probe, not an empty
     // repository: answering `{url: null, latest: null}` here would be
-    // indistinguishable from "no release carries an artifact", and the caller
-    // would cache that mistake for five minutes.
-    if (!Array.isArray(body)) return cache.entry ?? null;
+    // indistinguishable from "no release carries an artifact".
+    if (!Array.isArray(body)) return null;
 
     // Drafts are not published and prereleases are not what a console offers an
-    // installed shell — the same two the `latest` endpoint excluded.
+    // installed shell.
     const published = body.filter(
       (entry): entry is Record<string, unknown> =>
         entry !== null && typeof entry === 'object' && entry.draft !== true && entry.prerelease !== true,
@@ -118,43 +120,73 @@ export async function fetchShellRelease(
       .map((entry) => ({ entry, asset: shellAsset(kind, entry.assets) }))
       .find((candidate) => candidate.asset !== null);
 
-    if (!release?.asset) {
-      const fallback: ShellRelease = { url: null, latest: null, releaseUrl: null };
-      cache.entry = fallback;
-      cache.at = now;
-      return fallback;
-    }
+    if (!release?.asset) return { url: null, latest: null, releaseUrl: null };
 
-    const resolved: ShellRelease = {
-      url: typeof release.asset.browser_download_url === 'string' ? release.asset.browser_download_url : null,
-      latest: versionFromAssetName(kind, String(release.asset.name)),
+    return resolvedRelease(kind, {
+      name: String(release.asset.name),
+      downloadUrl:
+        typeof release.asset.browser_download_url === 'string' ? release.asset.browser_download_url : null,
       releaseUrl: typeof release.entry.html_url === 'string' ? release.entry.html_url : null,
-    };
-
-    cache.entry = resolved;
-    cache.at = now;
-    return resolved;
+    });
   } catch {
-    // Keep the last good answer rather than replacing it with a failure: a
-    // momentary outage must not remove a download button that was valid.
-    return cache.entry ?? null;
+    return null;
   }
 }
 
-/** How many releases to look back through for the artifact. */
-const RELEASE_SCAN = 20;
+/** The public-pages read, wrapped so a failure is the caller's `null`. */
+async function readFromPages(
+  kind: ShellKind,
+  fetchImpl: typeof fetch,
+  headers: Record<string, string>,
+): Promise<ShellRelease | null> {
+  try {
+    const found = await findAssetInPages(kind, fetchImpl, headers);
+    if (found.kind === 'unreachable') return null;
+    if (found.kind === 'none') return { url: null, latest: null, releaseUrl: null };
+    return resolvedRelease(kind, { ...found.asset, releaseUrl: found.releaseUrl });
+  } catch {
+    return null;
+  }
+}
 
-/** The first asset of a release that names this shell's artifact, or null. */
+/**
+ * The asset of a release that names this shell's artifact, or null.
+ *
+ * The CURRENT scheme wins over the legacy one, and that is not cosmetic. A
+ * release that carries both — which happens the moment a rename lands and
+ * `--clobber` has not yet replaced the old asset, or a hand-upload adds one
+ * beside the other — would otherwise resolve to whichever the asset list
+ * happened to order first. Measured: a release holding both
+ * `kabmo-android-v0.4.0.apk` and `Kabmo-0.6.0-android.apk` answered `0.4.0`,
+ * i.e. the console offered an update to a version it already had and hid the
+ * newer one.
+ */
 function shellAsset(kind: ShellKind, assets: unknown): Record<string, unknown> | null {
   if (!Array.isArray(assets)) return null;
 
-  for (const entry of assets) {
-    if (entry === null || typeof entry !== 'object') continue;
-    const asset = entry as Record<string, unknown>;
-    if (typeof asset.name === 'string' && versionFromAssetName(kind, asset.name) !== null) return asset;
-  }
+  const named = assets.filter(
+    (entry): entry is Record<string, unknown> =>
+      entry !== null &&
+      typeof entry === 'object' &&
+      typeof (entry as Record<string, unknown>).name === 'string' &&
+      versionFromAssetName(kind, String((entry as Record<string, unknown>).name)) !== null,
+  );
 
-  return null;
+  return named.find((asset) => SHELL_ASSETS[kind].current.test(String(asset.name))) ?? named[0] ?? null;
+}
+
+/** Turn one resolved asset into the payload, applying the per-kind link rule. */
+function resolvedRelease(
+  kind: ShellKind,
+  asset: { name: string; downloadUrl: string | null; releaseUrl: string | null },
+): ShellRelease {
+  return {
+    // A per-arch desktop build cannot be named from here — see the module
+    // comment — so the link is the page that lists every architecture.
+    url: SHELL_ASSETS[kind].directDownload ? asset.downloadUrl : asset.releaseUrl,
+    latest: versionFromAssetName(kind, asset.name),
+    releaseUrl: asset.releaseUrl,
+  };
 }
 
 const CACHE_MS = 5 * 60_000;
@@ -172,6 +204,25 @@ function githubApiBase(): string {
   return configured.trim().replace(/\/+$/, '') || 'https://api.github.com';
 }
 
+/**
+ * A token, when the operator has one, which lifts the API quota from 60 an hour
+ * to 5000 — the difference between the precise read working on a shared address
+ * and falling through to the pages every time.
+ *
+ * Read from the environment rather than a setting: it is a deployment fact, it
+ * must never reach the browser, and `kabmo serve` already passes its own
+ * environment through.
+ */
+function gitHubHeaders(): Record<string, string> {
+  const token = (Bun.env.KABMO_GITHUB_TOKEN ?? Bun.env.GITHUB_TOKEN ?? '').trim();
+  const headers: Record<string, string> = {
+    // GitHub rejects a request with no User-Agent.
+    'user-agent': 'kabmo-console',
+  };
+  if (token) headers.authorization = `Bearer ${token}`;
+  return headers;
+}
+
 interface CacheSlot {
   entry: ShellRelease | null;
   at: number;

package/src/server/routes/fs/action-create.test.ts

@@ -6,12 +6,12 @@
 /**
  * The Files panel's "New file" branch.
  *
- * Two rules are load-bearing and neither is visible from the happy path: the
- * name may not carry a path separator (the folder is named by `path`, and a
- * separator would turn a name into an arbitrary write under the root), and an
- * existing file is REFUSED rather than truncated. The second one is the one a
- * naive `Bun.write` gets wrong: `Bun.write` creates or truncates, so a name
- * that collides with a real file would silently blank it.
+ * Two rules are load-bearing and neither is visible from the happy path. The
+ * name may carry SEGMENTS (that is the nested-path grammar, and its refusals
+ * live in `action-nested.test.ts`), and an existing file is REFUSED rather
+ * than truncated — the second is the one a naive `Bun.write` gets wrong:
+ * `Bun.write` creates or truncates, so a name that collides with a real file
+ * would silently blank it.
  */
 
 import { afterEach, describe, expect, test } from 'bun:test';
@@ -34,7 +34,10 @@ async function create(folderPath: string, name: string) {
   form.append('path', folderPath);
   form.append('name', name);
   const res = await action({ request: new Request('http://localhost/api/fs/action', { method: 'POST', body: form }) } as never);
-  return { status: res.status, body: (await res.json()) as { success?: boolean; path?: string; error?: string } };
+  return {
+    status: res.status,
+    body: (await res.json()) as { success?: boolean; kind?: string; path?: string; error?: string },
+  };
 }
 
 describe('fs create', () => {
@@ -43,7 +46,7 @@ describe('fs create', () => {
     const { status, body } = await create('tmp-create-probe', 'notes.md');
 
     expect(status).toBe(200);
-    expect(body).toEqual({ success: true, path: 'tmp-create-probe/notes.md' });
+    expect(body).toEqual({ success: true, kind: 'file', path: 'tmp-create-probe/notes.md' });
     expect(fs.readFileSync(path.join(DIR, 'notes.md'), 'utf8')).toBe('');
   });
 
@@ -67,12 +70,14 @@ describe('fs create', () => {
     expect(fs.readFileSync(path.join(DIR, 'keep.txt'), 'utf8')).toBe('important');
   });
 
-  test('refuses a name carrying a path separator', async () => {
+  test('a path separator is a NESTED path, and `..` is still refused', async () => {
     fs.mkdirSync(DIR, { recursive: true });
-    for (const name of ['../escape.txt', 'sub/escape.txt', 'sub\\escape.txt']) {
-      const { status } = await create('tmp-create-probe', name);
-      expect(status).toBe(400);
-    }
+    // A forward or back separator names a nested destination, which the dialog
+    // is for — the escape itself is the `..` segment, and that stays refused.
+    expect((await create('tmp-create-probe', 'sub/inside.txt')).status).toBe(200);
+    expect((await create('tmp-create-probe', 'sub\\also-inside.txt')).status).toBe(200);
+    expect((await create('tmp-create-probe', '../escape.txt')).status).toBe(400);
+    expect(fs.existsSync(path.join(DIR, 'sub/inside.txt'))).toBe(true);
     expect(fs.existsSync(path.join(process.cwd(), 'escape.txt'))).toBe(false);
   });
 

package/src/server/routes/fs/action-nested.test.ts

@@ -0,0 +1,184 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Nested paths at the route: a create and a rename that name SEGMENTS.
+ *
+ * The Files panel's dialogs used to accept one segment, so `lib/parse.ts` was
+ * unreachable from the UI — the user had to create `lib`, expand it, then the
+ * file. Both actions now take a relative path, and the rules that keep that
+ * inside the folder the user named are asserted here because they are the whole
+ * reason a nested path is safe:
+ *
+ * - a `..` SEGMENT is refused even when it would land back inside the root
+ *   (`a/../b.ts` resolves there), so the refusal is about the path the user
+ *   typed rather than about where it happened to land;
+ * - an ABSOLUTE path is refused, because `path.join(dir, abs)` discards the
+ *   folder the dialog showed;
+ * - a rename resolves against the LISTED root, not the workspace root — a
+ *   rename inside a nested repo used to resolve to a path outside the repo;
+ * - a rename never overwrites an existing destination, and never moves a folder
+ *   into its own subtree.
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { action } from '@/server/routes/fs/action';
+
+/** Probes live in the repo root — the one directory the root allow-list always accepts. */
+const DIR = path.join(process.cwd(), 'tmp-nested-probe');
+
+function reset(files: Record<string, string> = {}): void {
+  fs.rmSync(DIR, { recursive: true, force: true });
+  fs.mkdirSync(DIR, { recursive: true });
+  for (const [rel, content] of Object.entries(files)) {
+    const target = path.join(DIR, rel);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, content);
+  }
+}
+
+afterEach(() => {
+  fs.rmSync(DIR, { recursive: true, force: true });
+});
+
+async function post(fields: Record<string, string>) {
+  const form = new FormData();
+  form.append('root', process.cwd());
+  for (const [key, value] of Object.entries(fields)) form.append(key, value);
+  const res = await action({ request: new Request('http://localhost/api/fs/action', { method: 'POST', body: form }) } as never);
+  return { status: res.status, body: (await res.json()) as { success?: boolean; kind?: string; path?: string; previousPath?: string; error?: string } };
+}
+
+describe('fs create with a nested path', () => {
+  test('creates every directory that leads to the file', async () => {
+    reset();
+
+    const { status, body } = await post({ actionType: 'create', path: 'tmp-nested-probe', name: 'lib/deep/parse.ts' });
+
+    expect(status).toBe(200);
+    expect(body).toEqual({ success: true, kind: 'file', path: 'tmp-nested-probe/lib/deep/parse.ts' });
+    expect(fs.readFileSync(path.join(DIR, 'lib/deep/parse.ts'), 'utf8')).toBe('');
+  });
+
+  test('creates a FOLDER when asked, and reports the kind back', async () => {
+    reset();
+
+    const { status, body } = await post({ actionType: 'create', path: 'tmp-nested-probe', name: 'a/b', kind: 'folder' });
+
+    expect(status).toBe(200);
+    expect(body).toEqual({ success: true, kind: 'folder', path: 'tmp-nested-probe/a/b' });
+    expect(fs.statSync(path.join(DIR, 'a/b')).isDirectory()).toBe(true);
+  });
+
+  test('normalizes a backslash and repeated separators into one path', async () => {
+    reset();
+
+    const { body } = await post({ actionType: 'create', path: 'tmp-nested-probe', name: 'x\\\\y//z.ts' });
+
+    expect(body.path).toBe('tmp-nested-probe/x/y/z.ts');
+    expect(fs.existsSync(path.join(DIR, 'x/y/z.ts'))).toBe(true);
+  });
+
+  test('refuses a .. segment even when it would land inside the root', async () => {
+    reset({ 'keep/.gitkeep': '' });
+
+    // `keep/../escape.ts` resolves inside the probe directory, so a containment
+    // check alone would accept it — the refusal is about the path as typed.
+    const { status, body } = await post({ actionType: 'create', path: 'tmp-nested-probe', name: 'keep/../escape.ts' });
+
+    expect(status).toBe(400);
+    expect(body.error).toContain('..');
+    expect(fs.existsSync(path.join(DIR, 'escape.ts'))).toBe(false);
+  });
+
+  test('refuses an absolute path', async () => {
+    reset();
+
+    for (const name of ['/tmp/absolute.ts', 'C:/absolute.ts', 'C:relative.ts']) {
+      expect((await post({ actionType: 'create', path: 'tmp-nested-probe', name })).status).toBe(400);
+    }
+  });
+
+  test('refuses a nested path whose final entry already exists', async () => {
+    reset({ 'lib/parse.ts': 'keep me' });
+
+    const { status, body } = await post({ actionType: 'create', path: 'tmp-nested-probe', name: 'lib/parse.ts' });
+
+    expect(status).toBe(409);
+    expect(body.error).toContain('already exists');
+    expect(fs.readFileSync(path.join(DIR, 'lib/parse.ts'), 'utf8')).toBe('keep me');
+  });
+});
+
+describe('fs rename with a nested path', () => {
+  test('renames into a new nested folder, creating its parents', async () => {
+    reset({ 'a.ts': 'A' });
+
+    const { status, body } = await post({ actionType: 'rename', path: 'tmp-nested-probe/a.ts', newPath: 'tmp-nested-probe/lib/deep/a.ts' });
+
+    expect(status).toBe(200);
+    expect(body).toEqual({ success: true, path: 'tmp-nested-probe/lib/deep/a.ts', previousPath: 'tmp-nested-probe/a.ts' });
+    expect(fs.existsSync(path.join(DIR, 'a.ts'))).toBe(false);
+    expect(fs.readFileSync(path.join(DIR, 'lib/deep/a.ts'), 'utf8')).toBe('A');
+  });
+
+  test('a plain rename inside one folder keeps its siblings', async () => {
+    reset({ 'src/a.ts': 'A', 'src/b.ts': 'B' });
+
+    const { body } = await post({ actionType: 'rename', path: 'tmp-nested-probe/src/a.ts', newPath: 'tmp-nested-probe/src/c.ts' });
+
+    expect(body.path).toBe('tmp-nested-probe/src/c.ts');
+    expect(fs.existsSync(path.join(DIR, 'src/b.ts'))).toBe(true);
+  });
+
+  test('refuses an existing destination instead of clobbering it', async () => {
+    reset({ 'a.ts': 'A', 'b.ts': 'B' });
+
+    const { status, body } = await post({ actionType: 'rename', path: 'tmp-nested-probe/a.ts', newPath: 'tmp-nested-probe/b.ts' });
+
+    expect(status).toBe(409);
+    expect(body.error).toContain('already exists');
+    expect(fs.readFileSync(path.join(DIR, 'b.ts'), 'utf8')).toBe('B');
+  });
+
+  test('refuses moving a folder into its own subtree', async () => {
+    reset({ 'src/a.ts': 'A' });
+
+    const { status, body } = await post({ actionType: 'rename', path: 'tmp-nested-probe/src', newPath: 'tmp-nested-probe/src/deep' });
+
+    expect(status).toBe(400);
+    expect(body.error).toContain('inside itself');
+    expect(fs.existsSync(path.join(DIR, 'src/a.ts'))).toBe(true);
+  });
+
+  test('refuses a .. segment and an absolute destination', async () => {
+    reset({ 'a.ts': 'A' });
+
+    expect((await post({ actionType: 'rename', path: 'tmp-nested-probe/a.ts', newPath: 'tmp-nested-probe/../out.ts' })).status).toBe(400);
+    expect((await post({ actionType: 'rename', path: 'tmp-nested-probe/a.ts', newPath: '/tmp/out.ts' })).status).toBe(400);
+    expect(fs.existsSync(path.join(DIR, 'a.ts'))).toBe(true);
+  });
+
+  test('renaming to the same path is a no-op that still reports both ends', async () => {
+    reset({ 'a.ts': 'A' });
+
+    const { status, body } = await post({ actionType: 'rename', path: 'tmp-nested-probe/a.ts', newPath: 'tmp-nested-probe/a.ts' });
+
+    expect(status).toBe(200);
+    expect(body.path).toBe('tmp-nested-probe/a.ts');
+    expect(fs.readFileSync(path.join(DIR, 'a.ts'), 'utf8')).toBe('A');
+  });
+
+  test('a missing source is refused rather than creating an empty entry', async () => {
+    reset();
+
+    const { status } = await post({ actionType: 'rename', path: 'tmp-nested-probe/gone.ts', newPath: 'tmp-nested-probe/here.ts' });
+
+    expect(status).toBe(404);
+    expect(fs.existsSync(path.join(DIR, 'here.ts'))).toBe(false);
+  });
+});

package/src/server/routes/fs/action.ts

@@ -3,10 +3,11 @@ import { errorResponse } from '@/server/lib/route-adapter';
 import fs from 'fs';
 import path from 'path';
 import { isMockMode } from '@/server/mock.server';
-import { getDefaultFsRoot, resolveRoot, resolveWithinRoot } from '@/server/lib/fs/root';
+import { getDefaultFsRoot, isWithinRoot, resolveRoot, resolveWithinRoot } from '@/server/lib/fs/root';
 import { runShell } from '@/server/lib/fs/shell';
 import { revealInFileManager } from '@/server/lib/fs/reveal';
-import { duplicateEntry, nextDuplicateName, pasteEntry } from '@/server/lib/fs/transfer';
+import { duplicateEntry, nextDuplicateName, pasteEntry, toRelPath } from '@/server/lib/fs/transfer';
+import { normalizeRelativePath } from '@/server/lib/fs/relative-path';
 import { transferRefusal } from '@/shared/lib/fs/clipboard';
 import { toDiskText } from '@/shared/lib/code/line-endings';
 
@@ -104,13 +105,15 @@ export async function action({ request }: ActionFunctionArgs) {
       await Bun.write(fullPath, content);
       return json({ success: true });
     } else if (actionType === 'create') {
-      // The Files panel's "New file": an empty file beside the folder that was
-      // right-clicked. Only a NAME is accepted, never a path — a separator
-      // would let the panel write anywhere under the root, and the folder is
-      // already named by `path`.
-      const name = ((formData.get('name') as string) ?? '').trim();
-      if (!name || name === '.' || name === '..' || /[/\\\0]/.test(name)) {
-        return json({ error: 'Enter a file name without slashes' }, { status: 400 });
+      // The Files panel's "New file"/"New folder": an empty entry beside the
+      // folder that was right-clicked. The NAME may carry segments
+      // (`lib/parse.ts`), so one dialog creates a nested path and every
+      // intermediate directory with it — the grammar that keeps it inside the
+      // named folder lives in `normalizeRelativePath`, not in a slash test here.
+      const kind = formData.get('kind') === 'folder' ? 'folder' : 'file';
+      const name = normalizeRelativePath((formData.get('name') as string) ?? '');
+      if (!name) {
+        return json({ error: 'Enter a name without .. or a leading slash' }, { status: 400 });
       }
       const target = resolveWithinRoot(scopedRoot, path.join(filePath || '.', name));
       if (!target) {
@@ -122,21 +125,49 @@ export async function action({ request }: ActionFunctionArgs) {
       if ((await Bun.file(target).stat().catch(() => null)) !== null) {
         return json({ error: `${name} already exists` }, { status: 409 });
       }
-      await fs.promises.mkdir(path.dirname(target), { recursive: true });
-      await Bun.write(target, '');
+      if (kind === 'folder') await fs.promises.mkdir(target, { recursive: true });
+      else {
+        await fs.promises.mkdir(path.dirname(target), { recursive: true });
+        await Bun.write(target, '');
+      }
       // Relative to the LISTED root, which is the identity the tree renders by.
-      return json({ success: true, path: path.relative(scopedRoot, target).split(path.sep).join('/') });
+      return json({ success: true, kind, path: toRelPath(scopedRoot, target) });
     } else if (actionType === 'delete') {
       await fs.promises.rm(fullPath, { recursive: true, force: true });
       return json({ success: true });
     } else if (actionType === 'rename') {
-      const newPath = formData.get('newPath') as string;
-      const fullNewPath = path.resolve(rootDir, newPath);
-      if (fullNewPath !== rootDir && !fullNewPath.startsWith(rootDir + path.sep)) {
+      // `newPath` is relative to the LISTED root, exactly like `path` is. It
+      // used to be resolved against `rootDir`, so renaming inside a nested repo
+      // resolved to a path under the workspace root instead of the repo — a
+      // move out of the tree the row belongs to.
+      const newPath = normalizeRelativePath((formData.get('newPath') as string) ?? '');
+      if (!newPath) {
+        return json({ error: 'Enter a name without .. or a leading slash' }, { status: 400 });
+      }
+      const fullNewPath = resolveWithinRoot(scopedRoot, newPath);
+      if (!fullNewPath) {
         return json({ error: 'Invalid new path' }, { status: 403 });
       }
+      if (fullNewPath === fullPath) return json({ success: true, path: newPath, previousPath: filePath });
+      const source = await Bun.file(fullPath).stat().catch(() => null);
+      if (!source) return json({ error: 'That entry no longer exists' }, { status: 404 });
+      // A folder cannot be moved into itself: `rename(a, a/b)` fails with
+      // EINVAL on every platform, but with an errno the panel cannot explain —
+      // and the destination directory may not exist yet, so the check has to be
+      // on the PATHS rather than on the filesystem.
+      if (source.isDirectory() && isWithinRoot(fullPath, fullNewPath)) {
+        return json({ error: 'A folder cannot be moved inside itself' }, { status: 400 });
+      }
+      // `rename` clobbers silently, so an existing destination is refused: the
+      // entry the user meant to keep would otherwise disappear without a word.
+      if ((await Bun.file(fullNewPath).stat().catch(() => null)) !== null) {
+        return json({ error: `${newPath} already exists` }, { status: 409 });
+      }
+      // The destination's parents are created, which is what makes a rename
+      // INTO a new folder work — the same nested grammar the create accepts.
+      await fs.promises.mkdir(path.dirname(fullNewPath), { recursive: true });
       await fs.promises.rename(fullPath, fullNewPath);
-      return json({ success: true });
+      return json({ success: true, path: newPath, previousPath: filePath });
     } else if (actionType === 'open_explorer') {
       const isDir = (await Bun.file(fullPath).stat().catch(() => null))?.isDirectory() ?? false;
       // A file reveals its containing directory — there is no portable "select