@remnic/core 9.3.613 → 9.3.614

package/src/fallback-llm.ts

@@ -1,6 +1,6 @@
 import { log } from "./logger.js";
 import path from "node:path";
-import type { GatewayConfig, ModelProviderConfig, AgentPersona } from "./types.js";
+import type { AgentPersonaModelConfig, GatewayConfig, ModelProviderConfig, PluginConfig } from "./types.js";
 import { extractJsonCandidates } from "./json-extract.js";
 import {
   buildChatCompletionTemperature,
@@ -25,10 +25,34 @@ export interface FallbackLlmOptions {
   signal?: AbortSignal;
   /** Explicit "provider/model" override to try before the configured chain. */
   model?: string;
+  /** Explicit model chain override to use instead of the configured agent/default chain. */
+  modelChain?: AgentPersonaModelConfig;
   /** Override which agent persona's model chain to use (by ID from agents.list[]). */
   agentId?: string;
 }
 
+export interface FallbackLlmAvailabilityOptions {
+  agentId?: string;
+  modelChain?: AgentPersonaModelConfig;
+}
+
+/**
+ * Resolve the gateway routing options Remnic's background tasks should pass to
+ * FallbackLlmClient — extraction, fact/profile/identity consolidation,
+ * summarization, calibration, and causal/semantic consolidation. Single source
+ * of truth so every task path stays consistent and can't diverge (gotcha #22):
+ * in gateway mode an explicit `taskModelChain` wins over the gateway agent
+ * persona; otherwise the persona (if any) is used. Returns `{}` in plugin mode
+ * because the chain resolves through gateway providers only. Issue #1365.
+ */
+export function gatewayTaskChainOptions(
+  config: Pick<PluginConfig, "modelSource" | "taskModelChain" | "gatewayAgentId">,
+): Pick<FallbackLlmOptions, "modelChain" | "agentId"> {
+  if (config.modelSource !== "gateway") return {};
+  if (config.taskModelChain) return { modelChain: config.taskModelChain };
+  return config.gatewayAgentId ? { agentId: config.gatewayAgentId } : {};
+}
+
 export interface FallbackLlmResponse {
   content: string;
   modelUsed: string;
@@ -120,8 +144,11 @@ export class FallbackLlmClient {
   /**
    * Check if fallback is available (gateway config has at least one model).
    */
-  isAvailable(agentId?: string): boolean {
-    const models = this.getModelChain(agentId);
+  isAvailable(agentIdOrOptions?: string | FallbackLlmAvailabilityOptions): boolean {
+    const options = typeof agentIdOrOptions === "string"
+      ? { agentId: agentIdOrOptions }
+      : (agentIdOrOptions ?? {});
+    const models = this.getModelChain(options.agentId, undefined, options.modelChain);
     return models.length > 0;
   }
 
@@ -134,7 +161,7 @@ export class FallbackLlmClient {
     messages: Array<{ role: "system" | "user" | "assistant"; content: string }>,
     options: FallbackLlmOptions = {},
   ): Promise<FallbackLlmResponse | null> {
-    const models = this.getModelChain(options.agentId, options.model);
+    const models = this.getModelChain(options.agentId, options.model, options.modelChain);
     if (models.length === 0) {
       log.warn("fallback LLM: no models configured in gateway");
       return null;
@@ -262,18 +289,30 @@ export class FallbackLlmClient {
    * Get the full model chain from gateway config.
    * Returns array of models in order: [primary, fallback1, fallback2, ...]
    *
-   * When agentId is provided, looks up the matching entry in agents.list[]
-   * and uses that persona's model chain. Falls back to agents.defaults.model
-   * if agentId is not found or not provided.
+   * When modelChainOverride is provided, uses it instead of any configured
+   * agent/default chain. Otherwise, when agentId is provided, looks up the
+   * matching entry in agents.list[] and uses that persona's model chain.
+   * Falls back to agents.defaults.model if agentId is not found or not provided.
    */
-  private getModelChain(agentId?: string, modelOverride?: string): ModelRef[] {
+  private getModelChain(
+    agentId?: string,
+    modelOverride?: string,
+    modelChainOverride?: AgentPersonaModelConfig,
+  ): ModelRef[] {
     const chain: ModelRef[] = [];
     const providers = this.gatewayConfig?.models?.providers ?? {};
 
-    // Resolve the model config: agent persona chain or global defaults
-    let modelConfig: { primary?: string; fallbacks?: string[] } | undefined;
+    // Resolve the model config: explicit task chain, agent persona chain, or global defaults
+    let modelConfig: AgentPersonaModelConfig | undefined;
 
-    if (agentId) {
+    if (modelChainOverride?.primary) {
+      modelConfig = modelChainOverride;
+      log.debug("fallback LLM: using explicit model chain override");
+    } else if (modelChainOverride) {
+      log.warn("fallback LLM: ignoring explicit model chain override without primary model");
+    }
+
+    if (!modelConfig && agentId) {
       const persona = this.gatewayConfig?.agents?.list?.find(
         (a) => a.id === agentId,
       );
@@ -294,21 +333,20 @@ export class FallbackLlmClient {
     // Build list of model strings: primary + fallbacks
     const modelStrings: string[] = [];
 
-    if (typeof modelOverride === "string" && modelOverride.trim().length > 0) {
-      modelStrings.push(modelOverride.trim());
-    }
-
-    if (modelConfig?.primary) {
-      if (!modelStrings.includes(modelConfig.primary)) {
-        modelStrings.push(modelConfig.primary);
+    const addModelString = (value: unknown): void => {
+      if (typeof value !== "string") return;
+      const trimmed = value.trim();
+      if (trimmed.length > 0 && !modelStrings.includes(trimmed)) {
+        modelStrings.push(trimmed);
       }
-    }
+    };
+
+    addModelString(modelOverride);
+    addModelString(modelConfig?.primary);
 
     if (Array.isArray(modelConfig?.fallbacks)) {
       for (const fb of modelConfig.fallbacks) {
-        if (typeof fb === "string" && !modelStrings.includes(fb)) {
-          modelStrings.push(fb);
-        }
+        addModelString(fb);
       }
     }
 
@@ -320,6 +358,37 @@ export class FallbackLlmClient {
       }
     }
 
+    // Implicit last-resort: when a task-specific modelChain override is active,
+    // append the gateway default model so a stale or exhausted taskModelChain
+    // never leaves the chain empty — Remnic should never be the reason a chat is
+    // interrupted by a flush failure. Keyed on `modelChainOverride?.primary` —
+    // the SAME activation condition chain resolution uses above — so a
+    // primary-less override (e.g. {}) that falls through to a persona/default
+    // chain does NOT get the default appended (gotcha #39). Issue #1365 / PR #1370.
+    if (modelChainOverride?.primary && modelStrings.length > 0) {
+      // Append the FULL gateway default chain (primary + fallbacks), not just
+      // the primary — if the default primary is also unreachable, a listed
+      // default fallback may still succeed (cursor review #1425).
+      const defaults = this.gatewayConfig?.agents?.defaults?.model;
+      const defaultStrings: string[] = [
+        ...(typeof defaults?.primary === "string" ? [defaults.primary] : []),
+        ...(Array.isArray(defaults?.fallbacks) ? defaults.fallbacks : []),
+      ];
+      for (const candidate of defaultStrings) {
+        if (typeof candidate !== "string") continue;
+        const trimmed = candidate.trim();
+        if (trimmed.length === 0 || modelStrings.includes(trimmed)) continue;
+        const defaultRef = this.parseModelString(trimmed, providers);
+        if (defaultRef) {
+          chain.push(defaultRef);
+          modelStrings.push(trimmed); // keep dedupe correct for later default fallbacks
+          log.debug(
+            `fallback LLM: appended gateway default model "${trimmed}" as implicit last resort`,
+          );
+        }
+      }
+    }
+
     return chain;
   }
 

package/src/maintenance/memory-governance-cron.ts

@@ -388,40 +388,50 @@ export async function ensureGraphEdgeDecayCron(
 
   const scheduleLabel = graphEdgeDecayScheduleLabel(scheduleExpr);
 
-  return ensureCronJob(jobsPath, GRAPH_EDGE_DECAY_CRON_ID, () => ({
-    id: GRAPH_EDGE_DECAY_CRON_ID,
-    agentId,
-    // Schedule label reflects the actual cron expression (`daily` /
-    // `weekly` / `custom`) so cron dashboards do not show "weekly"
-    // when the schedule is in fact daily — Cursor review on PR #729.
-    name: `Remnic Graph Edge Decay (${scheduleLabel})`,
-    enabled: true,
-    schedule: {
-      kind: "cron",
-      expr: scheduleExpr,
-      tz: options.timezone,
-    },
-    sessionTarget: "isolated",
-    wakeMode: "now",
-    payload: {
-      kind: "agentTurn",
-      timeoutSeconds: 900,
-      thinking: "off",
-      message:
-        "You are OpenClaw automation. Call tool `engram.graph_edge_decay_run` with empty params. " +
-        "If successful output exactly NO_REPLY. On error output one concise line. Do NOT use message tool.",
+  return ensureCronJob(
+    jobsPath,
+    GRAPH_EDGE_DECAY_CRON_ID,
+    () => ({
+      id: GRAPH_EDGE_DECAY_CRON_ID,
+      agentId,
+      // Schedule label reflects the actual cron expression (`daily` /
+      // `weekly` / `custom`) so cron dashboards do not show "weekly"
+      // when the schedule is in fact daily — Cursor review on PR #729.
+      name: `Remnic Graph Edge Decay (${scheduleLabel})`,
+      enabled: true,
+      schedule: {
+        kind: "cron",
+        expr: scheduleExpr,
+        tz: options.timezone,
+      },
+      sessionTarget: "isolated",
+      wakeMode: "now",
+      payload: {
+        kind: "agentTurn",
+        timeoutSeconds: 900,
+        thinking: "off",
+        message:
+          "You are OpenClaw automation. Call tool `engram.graph_edge_decay_run` with empty params. " +
+          "If successful output exactly NO_REPLY. On error output one concise line. Do NOT use message tool.",
+      },
+      delivery: { mode: "none" },
+    }),
+    {
+      updateExisting: true,
+      updateFields: ["name", "schedule"],
     },
-    delivery: { mode: "none" },
-  }));
+  );
 }
 
 /**
  * Pick a cron expression that approximates a cadence in milliseconds.
  *
- * - cadence < 7 days → daily at 04:13 (sub-daily cadence is not natively
- *   expressible in 5-field cron without `*\/N` patterns; daily is the
- *   safe upper bound that won't trip the cron more often than requested).
- * - cadence ≥ 7 days → weekly on Sunday 04:13.
+ * - cadence <= 1 day → daily at 04:13. Sub-daily cadence is not natively
+ *   expressible in 5-field cron without hour/minute step patterns; daily
+ *   preserves the previous conservative behavior for those values.
+ * - cadence > 1 day → weekly on Sunday 04:13. Multi-day intervals like
+ *   2-6 days cannot be represented accurately by a portable 5-field cron
+ *   expression, and daily would run more often than requested.
  *
  * Operators who need finer-grained control should set `scheduleExpr`
  * directly via `ensureGraphEdgeDecayCron`.
@@ -431,7 +441,7 @@ export function graphEdgeDecayCadenceToCronExpr(cadenceMs: number): string {
     return "13 4 * * 0";
   }
   const day = 24 * 60 * 60 * 1000;
-  if (cadenceMs < 7 * day) return "13 4 * * *";
+  if (cadenceMs <= day) return "13 4 * * *";
   return "13 4 * * 0";
 }
 

package/src/mcp-memory-inspector-app.ts

@@ -72,9 +72,7 @@ export function buildChatGptMemoryInspectorActionRequest(
   recall: EngramAccessRecallResponse,
   xray: RecallXraySnapshot | null,
 ): ActionConfidenceRequest {
-  const provenances = xray === null
-    ? recall.results.map(missingRecallProvenance)
-    : xray.results.map((result) => result.provenance ?? missingProvenance(result));
+  const provenances = buildRecallProvenances(recall, xray);
   const hasUnsafeOrMissingProvenance = provenances.some(
     (provenance) => provenance.safeToUse === false || provenance.safety === "blocked",
   ) || provenances.length < recall.count;
@@ -117,15 +115,7 @@ export function buildChatGptMemoryInspectorResult(
   actionConfidence: ActionConfidenceResult,
 ): RemnicChatGptMemoryInspectorResult {
   const xrayUnavailable = xray === null;
-  const xrayById = new Map<string, RecallXrayResult>();
-  const xrayByPath = new Map<string, RecallXrayResult>();
-  for (const result of xray?.results ?? []) {
-    xrayById.set(result.memoryId, result);
-    xrayByPath.set(result.path, result);
-  }
-  const matchXrayResult = (summary: EngramAccessRecallResponse["results"][number]) =>
-    (summary.path ? xrayByPath.get(summary.path) : undefined)
-    ?? xrayById.get(summary.id);
+  const matchXrayResult = buildXrayResultMatcher(xray);
   const matchedXrayResults = recall.results.map(matchXrayResult);
 
   const memories = recall.results.slice(0, 8).map((summary) => {
@@ -375,6 +365,40 @@ function average(values: number[]): number | undefined {
   return values.reduce((sum, value) => sum + value, 0) / values.length;
 }
 
+function buildRecallProvenances(
+  recall: EngramAccessRecallResponse,
+  xray: RecallXraySnapshot | null,
+): RetrievedMemoryProvenance[] {
+  if (xray === null) {
+    return recall.results.map(missingRecallProvenance);
+  }
+  const matchXrayResult = buildXrayResultMatcher(xray);
+  return recall.results.map((summary) => {
+    const result = matchXrayResult(summary);
+    if (result === undefined) {
+      return missingXrayResultProvenance(summary);
+    }
+    return result.provenance ?? missingProvenance(result);
+  });
+}
+
+function buildXrayResultMatcher(
+  xray: RecallXraySnapshot | null,
+): (summary: EngramAccessRecallResponse["results"][number]) => RecallXrayResult | undefined {
+  const xrayById = new Map<string, RecallXrayResult>();
+  const xrayByPath = new Map<string, RecallXrayResult>();
+  for (const result of xray?.results ?? []) {
+    xrayById.set(result.memoryId, result);
+    xrayByPath.set(result.path, result);
+  }
+  return (summary) => {
+    if (summary.path) {
+      return xrayByPath.get(summary.path);
+    }
+    return xrayById.get(summary.id);
+  };
+}
+
 function missingProvenance(result: RecallXrayResult): RetrievedMemoryProvenance {
   return {
     source: "unknown",
@@ -391,6 +415,24 @@ function missingProvenance(result: RecallXrayResult): RetrievedMemoryProvenance
   };
 }
 
+function missingXrayResultProvenance(
+  summary: EngramAccessRecallResponse["results"][number],
+): RetrievedMemoryProvenance {
+  return {
+    source: "unknown",
+    scope: "unknown",
+    userContextScopes: [],
+    retrievalReason: `X-ray result missing for ${summary.path || summary.id}`,
+    confidence: 0,
+    stale: false,
+    corrected: false,
+    correctionState: "none",
+    safeToUse: false,
+    safety: "blocked",
+    safetyReasons: ["X-ray result was missing for this recalled memory."],
+  };
+}
+
 function missingRecallProvenance(
   summary: EngramAccessRecallResponse["results"][number],
 ): RetrievedMemoryProvenance {

package/src/message-parts/index.ts

@@ -143,6 +143,12 @@ export function parseOpenAiMessageParts(
     }
     if (type === "message") {
       for (const block of gatherContentBlocks(item.content)) {
+        if (isOpenAiResponseItem(block)) {
+          parts.push(
+            ...parseOpenAiMessageParts([block]).map(({ ordinal: _ordinal, ...part }) => part),
+          );
+          continue;
+        }
         const text = asNonEmptyString(block.text ?? block.content);
         if (text) parts.push(makePart("text", { type, text }, { filePath: firstFilePath(text) }));
       }

package/src/message-parts/message-parts.test.ts

@@ -46,6 +46,36 @@ describe("message-parts parsers", () => {
     assert.equal(parts[0]!.filePath, "src/config.ts");
   });
 
+  it("preserves OpenAI message content arrays with mixed tool and result blocks", () => {
+    const parts = parseOpenAiMessageParts({
+      type: "message",
+      content: [
+        { type: "output_text", text: "Updated src/a.ts" },
+        {
+          type: "function_call",
+          name: "apply_patch",
+          arguments: JSON.stringify({
+            patch: "*** Begin Patch\n*** Update File: src/a.ts\n*** End Patch",
+          }),
+        },
+        {
+          type: "function_call_output",
+          call_id: "call_1",
+          output: "Patched src/a.ts",
+        },
+      ],
+    });
+
+    assert.equal(parts.length, 3);
+    assert.equal(parts[0]!.kind, "text");
+    assert.equal(parts[0]!.filePath, "src/a.ts");
+    assert.equal(parts[1]!.kind, "patch");
+    assert.equal(parts[1]!.toolName, "apply_patch");
+    assert.equal(parts[1]!.filePath, "src/a.ts");
+    assert.equal(parts[2]!.kind, "tool_result");
+    assert.equal(parts[2]!.filePath, "src/a.ts");
+  });
+
   it("infers top-level OpenAI response item arrays before Anthropic arrays", () => {
     const parts = parseMessageParts([
       {

package/src/migrate/from-engram.ts

@@ -30,6 +30,7 @@ interface RollbackManifestEntry {
   backupPath?: string;
   createdByMigration?: boolean;
   contentHash?: string;
+  mode?: number;
 }
 
 interface RollbackManifest {
@@ -42,6 +43,7 @@ interface ValidatedRollbackManifestEntry extends RollbackManifestEntry {
   targetPath: string;
   backupPath?: string;
   contentHash?: string;
+  mode?: number;
 }
 
 export interface MigrationOptions {
@@ -308,11 +310,19 @@ function parseRollbackManifestEntry(raw: unknown, index: number): RollbackManife
   if (raw.contentHash !== undefined && (typeof raw.contentHash !== "string" || !/^[a-f0-9]{64}$/u.test(raw.contentHash))) {
     throw new Error(`rollback manifest entry ${index} has an invalid contentHash`);
   }
+  const rawMode = raw.mode;
+  if (
+    rawMode !== undefined &&
+    (typeof rawMode !== "number" || !Number.isInteger(rawMode) || rawMode < 0 || rawMode > 0o777)
+  ) {
+    throw new Error(`rollback manifest entry ${index} has an invalid mode`);
+  }
   return {
     targetPath: raw.targetPath,
     ...(raw.backupPath === undefined ? {} : { backupPath: raw.backupPath }),
     ...(raw.createdByMigration === undefined ? {} : { createdByMigration: raw.createdByMigration }),
     ...(raw.contentHash === undefined ? {} : { contentHash: raw.contentHash }),
+    ...(rawMode === undefined ? {} : { mode: rawMode }),
   };
 }
 
@@ -486,6 +496,7 @@ async function validateRollbackManifestEntries(
       ...(backupPath === undefined ? {} : { backupPath }),
       ...(entry.createdByMigration === undefined ? {} : { createdByMigration: entry.createdByMigration }),
       ...(entry.contentHash === undefined ? {} : { contentHash: entry.contentHash }),
+      ...(entry.mode === undefined ? {} : { mode: entry.mode }),
     });
   }
 
@@ -697,14 +708,16 @@ async function backupFile(
   }
   const backupPath = connectorBackupPathForTarget(targetPath, homeDir);
   await ensureParent(backupPath);
+  const originalMode = isRemnicTokenStorePath(targetPath, homeDir)
+    ? TOKEN_STORE_MODE
+    : (await stat(targetPath)).mode & 0o777;
   if (isRemnicTokenStorePath(targetPath, homeDir)) {
     await writeOwnerOnlyFile(backupPath, originalContent);
   } else {
-    const originalMode = (await stat(targetPath)).mode & 0o777;
     await writeFile(backupPath, originalContent, { encoding: "utf8", mode: originalMode });
     await chmod(backupPath, originalMode);
   }
-  manifest.entries.push({ targetPath, backupPath });
+  manifest.entries.push({ targetPath, backupPath, mode: originalMode });
   await persistManifest?.();
 }
 
@@ -990,9 +1003,10 @@ export async function rollbackFromEngramMigration(options?: MigrationOptions): P
       await assertExistingRegularFileNoFollow(entry.backupPath, "rollback manifest backup");
       await ensureParent(entry.targetPath);
       await copyFile(entry.backupPath, entry.targetPath);
-      if (isRemnicTokenStorePath(entry.targetPath, homeDir)) {
-        await secureTokenFilePermissions(entry.targetPath);
-      }
+      const restoreMode = isRemnicTokenStorePath(entry.targetPath, homeDir)
+        ? TOKEN_STORE_MODE
+        : entry.mode ?? ((await lstat(entry.backupPath)).mode & 0o777);
+      await chmod(entry.targetPath, restoreMode);
       restored.push(entry.targetPath);
       continue;
     }

package/src/namespaces/search.test.ts

@@ -8,6 +8,7 @@ class FakeBackend implements SearchBackend {
   updates = 0;
   calls: Array<{ method: string; collection: string | undefined }> = [];
   ensureSignals: Array<AbortSignal | undefined> = [];
+  ensureCollections: Array<string | undefined> = [];
 
   constructor(
     private readonly globalUpdate: boolean,
@@ -64,8 +65,19 @@ class FakeBackend implements SearchBackend {
 
   async embedCollection(): Promise<void> {}
 
-  async ensureCollection(_memoryDir?: string, execution?: { signal?: AbortSignal }): Promise<"present"> {
-    this.ensureSignals.push(execution?.signal);
+  async ensureCollection(
+    _memoryDir?: string,
+    collectionOrExecution?: string | { signal?: AbortSignal },
+    execution?: { signal?: AbortSignal },
+  ): Promise<"present"> {
+    const collection = typeof collectionOrExecution === "string"
+      ? collectionOrExecution
+      : undefined;
+    const effectiveExecution = typeof collectionOrExecution === "string"
+      ? execution
+      : collectionOrExecution ?? execution;
+    this.ensureCollections.push(collection);
+    this.ensureSignals.push(effectiveExecution?.signal);
     return "present";
   }
 }
@@ -191,4 +203,5 @@ test("ensureNamespaceCollection forwards abort signals to backend collection che
 
   assert.equal(state, "present");
   assert.deepEqual(backend.ensureSignals, [controller.signal]);
+  assert.deepEqual(backend.ensureCollections, ["openclaw-engram--ns-6d61696e"]);
 });

package/src/namespaces/search.ts

@@ -203,7 +203,7 @@ export class NamespaceSearchRouter {
       const backend = this.createBackend(scopedConfig);
       const available = await backend.probe().catch(() => false);
       const collectionState = available
-        ? await backend.ensureCollection(storage.dir, execution).catch(() => "unknown" as const)
+        ? await backend.ensureCollection(storage.dir, scopedConfig.qmdCollection, execution).catch(() => "unknown" as const)
         : "unknown";
       return {
         backend,

package/src/network/webdav.ts

@@ -86,7 +86,7 @@ export class WebDavServer {
 
   private constructor(
     options: Required<Omit<WebDavServerOptions, "auth">> & Pick<WebDavServerOptions, "auth">,
-    allowedRoots: AllowedRoot[],
+    allowedRoots: AllowedRoot[]
   ) {
     this.options = options;
     this.allowedRoots = allowedRoots;
@@ -313,7 +313,9 @@ export class WebDavServer {
     return out;
   }
 
-  private async resolvePath(requestPathname: string): Promise<
+  private async resolvePath(
+    requestPathname: string
+  ): Promise<
     | { ok: true; absolutePath: string; displayPath: string; rootAbsolute: string }
     | { ok: false; code: number; message: string }
   > {
@@ -355,11 +357,21 @@ export class WebDavServer {
       if (!this.isPathInside(root.absolute, canonicalCandidate)) {
         return { ok: false, code: 403, message: "path escaped allowlist via symlink" };
       }
-      return { ok: true, absolutePath: canonicalCandidate, displayPath: `/${segments.join("/")}`, rootAbsolute: root.absolute };
+      return {
+        ok: true,
+        absolutePath: canonicalCandidate,
+        displayPath: `/${segments.join("/")}`,
+        rootAbsolute: root.absolute,
+      };
     } catch (err) {
       const code = (err as NodeJS.ErrnoException).code;
       if (code === "ENOENT") {
-        return { ok: true, absolutePath: candidate, displayPath: `/${segments.join("/")}`, rootAbsolute: root.absolute };
+        return {
+          ok: true,
+          absolutePath: candidate,
+          displayPath: `/${segments.join("/")}`,
+          rootAbsolute: root.absolute,
+        };
       }
       if (code === "ENOTDIR" || code === "ELOOP") {
         return { ok: false, code: 400, message: "invalid path" };
@@ -372,7 +384,7 @@ export class WebDavServer {
     method: "GET" | "HEAD",
     absolutePath: string,
     rootAbsolute: string,
-    res: ServerResponse,
+    res: ServerResponse
   ): Promise<void> {
     const revalidated = await this.revalidatePathInsideRoot(absolutePath, rootAbsolute);
     if (!revalidated.ok) {
@@ -410,7 +422,7 @@ export class WebDavServer {
     absolutePath: string,
     rootAbsolute: string,
     displayPath: string,
-    res: ServerResponse,
+    res: ServerResponse
   ): Promise<void> {
     const revalidated = await this.revalidatePathInsideRoot(absolutePath, rootAbsolute);
     if (!revalidated.ok) {
@@ -432,27 +444,58 @@ export class WebDavServer {
     if (info.isDirectory()) {
       const children = await readdir(absolutePath, { withFileTypes: true });
       for (const child of children) {
-        const childHref = toEncodedHref(`${displayPath.replace(/\/$/, "")}/${child.name}`);
-        entries.push(`
-  <d:response>
-    <d:href>${xmlEscape(childHref)}</d:href>
-    <d:propstat><d:prop><d:resourcetype>${child.isDirectory() ? "<d:collection/>" : ""}</d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat>
-  </d:response>`);
+        const entry = await this.renderPropfindChildEntry(absolutePath, rootAbsolute, displayPath, child.name);
+        if (entry) {
+          entries.push(entry);
+        }
       }
     }
 
     const xml = `<?xml version="1.0" encoding="utf-8"?>
 <d:multistatus xmlns:d="DAV:">
-  <d:response>
-    <d:href>${xmlEscape(toEncodedHref(displayPath))}</d:href>
-    <d:propstat><d:prop><d:resourcetype>${info.isDirectory() ? "<d:collection/>" : ""}</d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat>
-  </d:response>${entries.join("")}
+${this.renderPropfindResponse(toEncodedHref(displayPath), info.isDirectory())}${entries.join("")}
 </d:multistatus>`;
 
     res.writeHead(207, { "Content-Type": "application/xml; charset=utf-8" });
     res.end(xml);
   }
 
+  private async renderPropfindChildEntry(
+    parentAbsolutePath: string,
+    rootAbsolute: string,
+    displayPath: string,
+    childName: string
+  ): Promise<string | null> {
+    const childAbsolutePath = path.join(parentAbsolutePath, childName);
+    let revalidated;
+    try {
+      revalidated = await this.revalidatePathInsideRoot(childAbsolutePath, rootAbsolute);
+    } catch {
+      return null;
+    }
+    if (!revalidated.ok) {
+      return null;
+    }
+
+    let info;
+    try {
+      info = await stat(revalidated.absolutePath);
+    } catch {
+      return null;
+    }
+
+    const childHref = toEncodedHref(`${displayPath.replace(/\/$/, "")}/${childName}`);
+    return this.renderPropfindResponse(childHref, info.isDirectory());
+  }
+
+  private renderPropfindResponse(href: string, isDirectory: boolean): string {
+    return `  <d:response>
+    <d:href>${xmlEscape(href)}</d:href>
+    <d:propstat><d:prop><d:resourcetype>${isDirectory ? "<d:collection/>" : ""}</d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat>
+  </d:response>
+`;
+  }
+
   private isPathInside(root: string, target: string): boolean {
     if (target === root) return true;
     if (root === path.parse(root).root) {
@@ -463,11 +506,8 @@ export class WebDavServer {
 
   private async revalidatePathInsideRoot(
     absolutePath: string,
-    rootAbsolute: string,
-  ): Promise<
-    | { ok: true; absolutePath: string }
-    | { ok: false; code: number; message: string }
-  > {
+    rootAbsolute: string
+  ): Promise<{ ok: true; absolutePath: string } | { ok: false; code: number; message: string }> {
     try {
       const canonical = await realpath(absolutePath);
       if (!this.isPathInside(rootAbsolute, canonical)) {