@rubytech/create-maxy-code 0.1.485 → 0.1.487

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-enrol.test.ts

@@ -31,7 +31,7 @@ function parse(r: { stdout: string; stderr: string }) {
 }
 
 const valuesOf = (sql: string) =>
-  /VALUES \('([^']*)', '((?:[^']|'')*)', '([0-9a-f]+)', '([0-9a-f]+)', '([^']*)', '([^']*)'\)/.exec(
+  /VALUES \('([^']*)', '((?:[^']|'')*)', '([0-9a-f]+)', '([0-9a-f]+)', '([^']*)', '([^']*)', '([^']*)'\)/.exec(
     sql,
   )!
 
@@ -127,14 +127,17 @@ describe('portal-enrol', () => {
   it('writes the row the schema declares, in order', async () => {
     const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
     const { sql } = parse(r)
-    expect(sql).toContain('INSERT INTO people (ownerId, name, salt, hash, createdAt, accountId)')
-    const [, owner, name, salt, hash, createdAt, accountId] = valuesOf(sql!)
+    expect(sql).toContain(
+      'INSERT INTO people (ownerId, name, salt, hash, createdAt, accountId, folders)',
+    )
+    const [, owner, name, salt, hash, createdAt, accountId, folders] = valuesOf(sql!)
     expect(owner).toBe('alice')
     expect(name).toBe('Alice')
     expect(salt).toMatch(/^[0-9a-f]{32}$/)
     expect(hash).toMatch(/^[0-9a-f]{64}$/)
     expect(Number.isNaN(Date.parse(createdAt))).toBe(false)
     expect(accountId).toBe('acc-1')
+    expect(folders).toBe('')
   })
 
   it('refuses enrolment with no --account', async () => {
@@ -250,6 +253,57 @@ describe('portal-enrol', () => {
       expect(await db.query("SELECT relPath FROM directory WHERE accountId='a';")).toBe('output/x.pdf')
     })
 
+    it('lands a folders grant', async () => {
+      const r = await enrol(['--owner', 'alice', '--name', 'Alice', '--folders', 'quotes,output'])
+      const [, , , , , , , folders] = valuesOf(parse(r).sql!)
+      expect(folders).toBe('quotes,output')
+    })
+
+    it('defaults folders to empty when the flag is absent', async () => {
+      const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
+      const [, , , , , , , folders] = valuesOf(parse(r).sql!)
+      expect(folders).toBe('')
+    })
+
+    it('dedupes repeated folder names', async () => {
+      const r = await enrol(['--owner', 'alice', '--name', 'Alice', '--folders', 'quotes,quotes,output'])
+      const [, , , , , , , folders] = valuesOf(parse(r).sql!)
+      expect(folders).toBe('quotes,output')
+    })
+
+    it('rejects a folder name outside the segment charset', async () => {
+      await expect(
+        enrol(['--owner', 'alice', '--name', 'Alice', '--folders', '../etc']),
+      ).rejects.toThrow()
+      await expect(
+        enrol(['--owner', 'alice', '--name', 'Alice', '--folders', 'a/b']),
+      ).rejects.toThrow()
+      await expect(
+        enrol(['--owner', 'alice', '--name', 'Alice', '--folders', "a'b"]),
+      ).rejects.toThrow()
+    })
+
+    it('re-enrolment replaces the grant', async () => {
+      const db = await d1('enrol-folders-replace-')
+      await db.exec(
+        parse(await enrol(['--owner', 'alice', '--name', 'Alice', '--folders', 'quotes'])).sql!,
+      )
+      expect(await db.query("SELECT folders FROM people WHERE ownerId='alice';")).toBe('quotes')
+      await db.exec(
+        parse(await enrol(['--owner', 'alice', '--name', 'Alice', '--folders', 'output'])).sql!,
+      )
+      expect(await db.query("SELECT folders FROM people WHERE ownerId='alice';")).toBe('output')
+      expect(await db.query('SELECT COUNT(*) FROM people;')).toBe('1')
+    })
+
+    it('declares people.folders defaulting to empty', async () => {
+      const db = await d1('enrol-folders-col-')
+      await db.exec(
+        "INSERT INTO people (ownerId, name, salt, hash, createdAt, accountId) VALUES ('alice','Alice','aa','bb','t','acc-a');",
+      )
+      expect(await db.query("SELECT folders FROM people WHERE ownerId='alice';")).toBe('')
+    })
+
     it('stores a crafted name as data rather than executing it', async () => {
       const db = await d1('enrol-inject-')
       const r = await enrol(['--owner', 'alice', '--name', "x'); DROP TABLE people; --"])

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-index-push.test.ts

@@ -173,4 +173,27 @@ describe('pushAccount', () => {
     await push(fakeClient(), { log: (l: string) => lines.push(l) })
     expect(lines.some((l) => l.includes('schemaPresent=false') && l.includes('exposed=none'))).toBe(true)
   })
+
+  it('op=resolve carries extraFolders and the walk includes an operator folder', async () => {
+    // inbound-invoices is NOT in the fixture allowed block, so this also proves
+    // an extra bypasses the ontology/allowed intersection.
+    file('inbound-invoices/INV-42.pdf')
+    const lines: string[] = []
+    const c = fakeClient()
+    await push(c, { log: (l: string) => lines.push(l), exposeFolders: ['inbound-invoices'] })
+    expect(lines.some((l) => /op=resolve .*extraFolders=1/.test(l))).toBe(true)
+    expect(lines.some((l) => /exposed=.*inbound-invoices/.test(l))).toBe(true)
+    const inserted = c.calls.filter((x) => /INSERT INTO directory/i.test(x.sql)).map((x) => String(x.params[1]))
+    expect(inserted).toContain('inbound-invoices/INV-42.pdf')
+  })
+
+  it('with no exposeFolders the operator folder is not walked and extraFolders=0', async () => {
+    file('inbound-invoices/INV-42.pdf')
+    const lines: string[] = []
+    const c = fakeClient()
+    await push(c, { log: (l: string) => lines.push(l) })
+    const inserted = c.calls.filter((x) => /INSERT INTO directory/i.test(x.sql)).map((x) => String(x.params[1]))
+    expect(inserted).not.toContain('inbound-invoices/INV-42.pdf')
+    expect(lines.some((l) => /op=resolve .*extraFolders=0/.test(l))).toBe(true)
+  })
 })

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-indexed-download.test.ts

@@ -5,9 +5,16 @@ import type { PortalEnv } from '../../skills/data-portal/template/functions/api/
 const PATH = 'quotes/CR2969/quote.pdf'
 
 function makeEnv(
-  opts: { accountId?: string; secret?: string; origin?: string; paths?: string[] } = {},
+  opts: {
+    accountId?: string
+    secret?: string
+    origin?: string
+    paths?: string[]
+    folders?: string
+  } = {},
 ) {
   const { accountId = 'acc-a', paths = [PATH] } = opts
+  const folders = 'folders' in opts ? opts.folders : ''
   return {
     DB: {
       prepare(query: string) {
@@ -25,7 +32,9 @@ function makeEnv(
           },
           async first<T>() {
             if (/FROM sessions/i.test(query)) {
-              return (bound[0] === 'sess-a' ? { ownerId: 'alice', accountId } : null) as T | null
+              return (bound[0] === 'sess-a'
+                ? { ownerId: 'alice', accountId, folders }
+                : null) as T | null
             }
             if (/FROM directory/i.test(query)) {
               return (paths.includes(bound[1] as string) ? { relPath: bound[1] } : null) as T | null
@@ -128,4 +137,37 @@ describe('processIndexedDownload', () => {
     await processIndexedDownload('sess-a', PATH, makeEnv(), (l) => lines.push(l), 1000, okHead as never)
     expect(lines.some((l) => l.includes('op=fetch-through') && l.includes('result=ok'))).toBe(true)
   })
+
+  it('refuses a path outside the grant with 404 and no device probe', async () => {
+    let touched = false
+    const spy = async () => {
+      touched = true
+      return { ok: true, status: 200 }
+    }
+    const lines: string[] = []
+    const env = makeEnv({ folders: 'quotes' })
+    const r = await processIndexedDownload(
+      'sess-a',
+      'documents/x.pdf',
+      env,
+      (l) => lines.push(l),
+      1000,
+      spy as never,
+    )
+    expect(r.status).toBe(404)
+    expect(touched).toBe(false)
+    expect(lines.some((l) => l.includes('result=not-granted'))).toBe(true)
+  })
+
+  it('allows an in-grant path', async () => {
+    const env = makeEnv({ folders: 'quotes' })
+    const r = await processIndexedDownload('sess-a', PATH, env, () => {}, 1000, okHead as never)
+    expect(r.status).toBe(200)
+  })
+
+  it('an empty grant allows any indexed path', async () => {
+    const env = makeEnv({ folders: '' })
+    const r = await processIndexedDownload('sess-a', PATH, env, () => {}, 1000, okHead as never)
+    expect(r.status).toBe(200)
+  })
 })

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-session-grant.test.ts

@@ -0,0 +1,67 @@
+import { describe, it, expect } from 'vitest'
+import {
+  grantAllows,
+  resolveSession,
+} from '../../skills/data-portal/template/functions/api/_lib/session'
+import type { D1Database } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+function db(row: Record<string, unknown> | null) {
+  return {
+    prepare() {
+      const stmt = {
+        bind() {
+          return stmt
+        },
+        async first<T>() {
+          return row as T | null
+        },
+        async run() {
+          return { meta: { changes: 0 } }
+        },
+        async all<T>() {
+          return { results: [] as T[] }
+        },
+      }
+      return stmt
+    },
+  } as unknown as D1Database
+}
+
+describe('resolveSession folders', () => {
+  it('splits a comma grant into an array', async () => {
+    const s = await resolveSession(
+      db({ ownerId: 'alice', accountId: 'acc-a', folders: 'quotes,output' }),
+      'sess',
+      1,
+    )
+    expect(s?.folders).toEqual(['quotes', 'output'])
+  })
+
+  it('returns an empty array for an empty grant', async () => {
+    const s = await resolveSession(db({ ownerId: 'alice', accountId: 'acc-a', folders: '' }), 'sess', 1)
+    expect(s?.folders).toEqual([])
+  })
+
+  it('returns an empty array when the column is absent', async () => {
+    const s = await resolveSession(db({ ownerId: 'alice', accountId: 'acc-a' }), 'sess', 1)
+    expect(s?.folders).toEqual([])
+  })
+})
+
+describe('grantAllows', () => {
+  it('admits everything when the grant is empty', () => {
+    expect(grantAllows([], 'documents/secret.pdf')).toBe(true)
+  })
+
+  it('admits a path whose top segment is granted', () => {
+    expect(grantAllows(['quotes'], 'quotes/CR2969/quote.pdf')).toBe(true)
+  })
+
+  it('refuses a path whose top segment is not granted', () => {
+    expect(grantAllows(['quotes'], 'documents/secret.pdf')).toBe(false)
+  })
+
+  it('matches the whole segment, so `quote` does not admit `quotes`', () => {
+    expect(grantAllows(['quote'], 'quotes/x.pdf')).toBe(false)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/schema-exposed-dirs.test.ts

@@ -85,4 +85,47 @@ describe('resolveExposedDirs', () => {
     const r = resolveExposedDirs('# no fence here')
     expect(r.exposed).toEqual([])
   })
+
+  it('unions an operator-named folder into exposed', () => {
+    const r = resolveExposedDirs(schema({ ontology: ONTOLOGY }), ['inbound-invoices'])
+    expect(r.exposed).toEqual(['inbound-invoices', 'output', 'quotes'])
+  })
+
+  it('exposes an extra folder that is absent from the allowed block', () => {
+    // inbound-invoices is deliberately NOT in ALLOWED — extras bypass that intersection.
+    const r = resolveExposedDirs(schema({ ontology: ONTOLOGY }), ['inbound-invoices'])
+    expect(r.exposed).toContain('inbound-invoices')
+  })
+
+  it('drops a system folder named as an extra', () => {
+    const r = resolveExposedDirs(schema({ ontology: ONTOLOGY }), ['secrets'])
+    expect(r.exposed).not.toContain('secrets')
+    expect(r.exposed).toEqual(['output', 'quotes'])
+  })
+
+  it('drops a traversal or dotted extra', () => {
+    const r = resolveExposedDirs(schema({ ontology: ONTOLOGY }), ['jobs/../secrets', '.git', '..'])
+    expect(r.exposed).toEqual(['output', 'quotes'])
+  })
+
+  it('an empty extras list equals today', () => {
+    const base = resolveExposedDirs(schema({ ontology: ONTOLOGY }))
+    expect(resolveExposedDirs(schema({ ontology: ONTOLOGY }), []).exposed).toEqual(base.exposed)
+  })
+
+  it('never applies extras when the schema is missing', () => {
+    const r = resolveExposedDirs(null, ['inbound-invoices'])
+    expect(r.exposed).toEqual([])
+    expect(r.schemaPresent).toBe(false)
+  })
+
+  it('never applies extras when the allowed block is absent', () => {
+    const r = resolveExposedDirs('# no fence here', ['inbound-invoices'])
+    expect(r.exposed).toEqual([])
+  })
+
+  it('dedupes an extra that is already an ontology bucket', () => {
+    const r = resolveExposedDirs(schema({ ontology: ONTOLOGY }), ['quotes'])
+    expect(r.exposed).toEqual(['output', 'quotes'])
+  })
 })

package/payload/platform/plugins/cloudflare/skills/data-portal/SKILL.md

@@ -48,7 +48,7 @@ For each person:
 
 ```bash
 node platform/plugins/cloudflare/bin/portal-enrol.mjs --owner <ownerId> --name <name> \
-  --account <accountId> | npx wrangler d1 execute <portalDbName> --remote --file=-
+  --account <accountId> [--folders <a,b,c>] | npx wrangler d1 execute <portalDbName> --remote --file=-
 ```
 
 The script mints the passcode and prints it **once to stderr**, so it reaches the operator's terminal
@@ -66,6 +66,15 @@ a sub-account that genuinely has nothing to share, so the script refuses rather
 fails silently later. Anyone enrolled before this existed has no account bound and sees nothing; run
 enrolment again for them, which the upsert makes a re-run rather than a migration.
 
+`--folders` is optional and narrows what one person sees to a named set of top-level folders, comma
+separated (`--folders quotes,output`). Each name is a folder, never a path, and must match
+`[A-Za-z0-9_-]+`. Omitting it, or passing an empty value, grants the account's full exposed set,
+which is the existing behaviour, so people enrolled before this existed are unaffected. Two people on
+one account can hold different grants and each sees only their own. Re-enrolment replaces the grant,
+the same upsert that rotates the passcode. The grant lives only in the portal's D1, so it narrows
+below the account's exposed set and never widens past it: a portal compromise returns a person to the
+account set, which the install re-derives and enforces regardless.
+
 **A passcode is never stored in plaintext** — not in `data-portal.json`, not in a log line, nowhere
 on the device. The operator conveys it to the person out of band. Rotating a passcode is a re-run of
 the script for that person; there is no separate editor.
@@ -122,8 +131,16 @@ The portal shows the sub-account's deliverable folders as well as what the clien
 folder names and sizes live in D1, so the tree renders whether or not the device is up; the bytes do
 not, so opening a file has to reach the install. That needs two things the template cannot know.
 
-Fill `__PORTAL_INSTALL_ORIGIN__` in `wrangler.toml` with the install's public origin
-(`https://<tunnel-hostname>`), then mint one secret and set it on both ends:
+The shared tree has two row kinds. `renderEntries` in `portal.js` gives a `directory` entry a folder
+icon in the accent colour and a file entry a document icon in the muted grey, both inline lucide SVG,
+so a client tells a folder from a file at a glance.
+
+Fill `__PORTAL_INSTALL_ORIGIN__` in `wrangler.toml` with the install's PUBLIC origin
+(`https://<public-tunnel-hostname>`), never the admin or operator hostname. The admin
+origin is behind the remote-auth gate, so the edge's signed HEAD probe of a device file
+gets a 401 there and every download 503s. The public host admits `/api/portal/fetch` by
+allowlist and the route verifies the signature itself. Then mint one secret and set it on
+both ends:
 
 ```bash
 SECRET="$(node -e 'console.log([...crypto.getRandomValues(new Uint8Array(32))].map(b=>b.toString(16).padStart(2,"0")).join(""))')"
@@ -165,17 +182,49 @@ An account with no `SCHEMA.md` publishes nothing at all. That is deliberate and
 what the write-path guard does — the guard fails open so an unseeded account is not write-blocked,
 while a surface facing a client must fail closed.
 
+An operator can publish extra folders that are not ontology buckets by listing them in
+`exposeFolders` in the account's `data-portal.json`, for example a workflow folder like
+`inbound-invoices`. Each name must be a single folder matching `[A-Za-z0-9_-]+` and is refused if it
+is a system folder (`agents`, `secrets`, `specialists`, `state`, `memory`, `cache`, `logs`, `tmp`) or
+dot-prefixed. These extras are added on top of the schema-derived set and, unlike ontology buckets,
+are not intersected with the `allowed-top-level` block. An empty or absent list behaves exactly as
+before.
+
 The heartbeat runs this hourly for every account carrying a `data-portal.json`. Run it once by hand
 after assembly so the client has something to see on their first sign-in, and check the output names
 the folders you expect:
 
 ```
-[portal-index] op=resolve account=<id> schemaPresent=true allowed=22 domainBuckets=quotes exposed=output,quotes
+[portal-index] op=resolve account=<id> schemaPresent=true allowed=22 domainBuckets=quotes extraFolders=1 exposed=inbound-invoices,output,quotes
 [portal-index] op=verify account=<id> rowsAfter=41 expected=41
 ```
 
 `exposed=none` on an account that has deliverables means the schema was missing or its ontology
-region was absent — not that the walk found nothing.
+region was absent — not that the walk found nothing. `extraFolders=<n>` counts the folders the
+operator requested in `exposeFolders`; a non-zero `extraFolders` with none of those names in
+`exposed=` means the guard dropped every one (a system or dot name, or a bad spelling).
+
+## How a client browses, downloads and uploads
+
+Signed in, the panel has a pinned header that stays put while the file lists
+scroll under it. The header carries the folder breadcrumbs, an up control that
+moves to the parent folder (disabled at the root), and an upload icon. Filenames
+render on one line: the stem truncates with an ellipsis and the extension stays
+pinned, so `.pdf` and `.html` on two same-named orders are still told apart.
+
+A shared (device-held) file downloads three ways, all through the same signed
+`/api/download?path=` route: a left click, a right-click that opens a one-item
+Download menu, and a drag out of the browser onto the desktop. The drag uses
+`/api/download?path=...&redirect=1`, which 302s to the signed link so the browser
+saves the file rather than a JSON body. The three download methods share the one
+`op=fetch-through` log line, so a broken method shows as a missing line under the
+same signal.
+
+Upload opens from the header icon into a dismissable modal holding the file
+picker and Upload button. It posts to `/api/upload` exactly as before; a kept
+upload refreshes the list and closes the modal. Dropping a file onto the modal's
+upload area uploads the same way. The modal dismisses on the close button, a
+click on the backdrop, or Escape.
 
 ## Deploy through site-deploy
 

package/payload/platform/plugins/cloudflare/skills/data-portal/schema.sql

@@ -24,13 +24,22 @@
 -- predates it — but an existing table will NOT gain the column, and a person
 -- whose row has the empty default sees an empty folder list. Re-enrol those
 -- people; the upsert on ownerId makes that a re-run, not a migration.
+--
+-- `folders` is a per-person allowlist of top-level folder names, comma
+-- separated, that narrows what this person sees below the account's exposed
+-- set. Empty (the default) means the full set, so an existing person keeps
+-- today's behaviour. Like `accountId`, IF NOT EXISTS will NOT add this column
+-- to a `people` table that predates it, and enrolment's INSERT names `folders`,
+-- so it fails loudly on such a table. Add it by hand in that case:
+--   ALTER TABLE people ADD COLUMN folders TEXT NOT NULL DEFAULT '';
 CREATE TABLE IF NOT EXISTS people (
   ownerId    TEXT PRIMARY KEY,
   name       TEXT NOT NULL,
   salt       TEXT NOT NULL,
   hash       TEXT NOT NULL,
   createdAt  TEXT NOT NULL,
-  accountId  TEXT NOT NULL DEFAULT ''
+  accountId  TEXT NOT NULL DEFAULT '',
+  folders    TEXT NOT NULL DEFAULT ''
 );
 
 -- `pcCheck` is a short digest of the person's passcode hash at mint time, and

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/session.ts

@@ -54,11 +54,11 @@ export async function resolveSession(
   db: D1Database,
   sessionId: string,
   nowMs: number,
-): Promise<{ ownerId: string; accountId: string } | null> {
+): Promise<{ ownerId: string; accountId: string; folders: string[] } | null> {
   if (!sessionId) return null
   const row = await db
     .prepare(
-      `SELECT s.ownerId AS ownerId, p.accountId AS accountId
+      `SELECT s.ownerId AS ownerId, p.accountId AS accountId, p.folders AS folders
          FROM sessions s
          JOIN people p ON p.ownerId = s.ownerId
         WHERE s.sessionId = ?
@@ -66,12 +66,26 @@ export async function resolveSession(
           AND s.pcCheck = substr(p.hash, 1, 16)`,
     )
     .bind(sessionId, nowMs)
-    .first<{ ownerId: string; accountId: string }>()
+    .first<{ ownerId: string; accountId: string; folders: string }>()
   if (!row || typeof row.ownerId !== 'string') return null
   // A `people` row predating the accountId column resolves it as absent. Treat
-  // that as "no folders", never as "all folders" — the empty string reaches the
+  // that as "no folders", never as "all folders": the empty string reaches the
   // listing, which returns nothing rather than falling back to some default.
-  return { ownerId: row.ownerId, accountId: typeof row.accountId === 'string' ? row.accountId : '' }
+  const accountId = typeof row.accountId === 'string' ? row.accountId : ''
+  // `folders` is a comma-separated allowlist of top-level names. Absent or empty
+  // means no grant, which the two client surfaces read as no filter (full set).
+  const folders =
+    typeof row.folders === 'string' ? row.folders.split(',').map((s) => s.trim()).filter(Boolean) : []
+  return { ownerId: row.ownerId, accountId, folders }
+}
+
+/** Whether a person's folder grant admits `relPath`. An empty grant admits
+ *  everything (the full set, today's behaviour); otherwise the path's top-level
+ *  segment must be named in the grant. The test is on the whole segment, so
+ *  `quote` never matches `quotes`. One definition so the listing and the
+ *  download surface can never disagree on what is granted. */
+export function grantAllows(grant: string[], relPath: string): boolean {
+  return grant.length === 0 || grant.includes(relPath.split('/')[0])
 }
 
 export function readSessionCookie(header: string | null): string | null {

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/download.ts

@@ -1,5 +1,5 @@
 import type { Handler, Logger, PortalEnv, R2ObjectBody } from './_lib/types'
-import { readSessionCookie, resolveSession } from './_lib/session'
+import { grantAllows, readSessionCookie, resolveSession } from './_lib/session'
 import { q } from './_lib/log'
 import { authorizeKey } from './_lib/authorize'
 import { buildSignedUrl, SIGNED_TTL_MS } from './_lib/portal-sign.mjs'
@@ -73,6 +73,16 @@ export async function processIndexedDownload(
     return { status: 404, payload: { ok: false, error: 'not found' } }
   }
 
+  if (!grantAllows(session.folders, relPath)) {
+    // Narrowed below the account set by the person's grant. Refused before the
+    // directory read and the device probe, so an out-of-grant path costs no
+    // work and is distinguishable in the log from a path simply not indexed.
+    log(
+      `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} result=not-granted`,
+    )
+    return { status: 404, payload: { ok: false, error: 'not found' } }
+  }
+
   const row = await env.DB.prepare('SELECT relPath FROM directory WHERE accountId = ? AND relPath = ?')
     .bind(session.accountId, relPath)
     .first<{ relPath: string }>()
@@ -135,7 +145,7 @@ export async function onRequestGet(context: PagesContext): Promise<Response> {
   // below is untouched.
   const indexedPath = params.get('path')
   if (indexedPath) {
-    const { status, payload } = await processIndexedDownload(
+    const { status, payload, url } = await processIndexedDownload(
       sessionId,
       indexedPath,
       context.env,
@@ -143,6 +153,13 @@ export async function onRequestGet(context: PagesContext): Promise<Response> {
       Date.now(),
       fetch as unknown as HeadFetch,
     )
+    // Drag-out cannot read a JSON body: the browser follows a DownloadURL to a
+    // real response. When the file resolved, 302 the drag to the signed url so
+    // the browser downloads it; otherwise fall through to the same JSON the
+    // click path returns. Same op=fetch-through line for every method.
+    if (params.get('redirect') === '1' && status === 200 && url) {
+      return Response.redirect(url, 302)
+    }
     return Response.json(payload, { status })
   }
 

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/files.ts

@@ -1,5 +1,5 @@
 import type { Handler, Logger, PortalEnv } from './_lib/types'
-import { readSessionCookie, resolveSession } from './_lib/session'
+import { grantAllows, readSessionCookie, resolveSession } from './_lib/session'
 import { q } from './_lib/log'
 
 interface DirRow {
@@ -86,17 +86,23 @@ export async function processFiles(
   // means no folders: an enrolment predating that column lands here, and the
   // empty `account=` field in the log line is what says so.
   let entries: DirEntry[] = []
+  const grant = session.folders
   if (session.accountId) {
     const dir = await env.DB.prepare(
       'SELECT relPath, sizeBytes, modifiedAt FROM directory WHERE accountId = ?',
     )
       .bind(session.accountId)
       .all<DirRow>()
-    entries = entriesUnder(dir.results ?? [], prefix)
+    // The grant narrows below the account's exposed set: keep only rows the
+    // grant admits. An empty grant admits everything, which is the full set and
+    // today's behaviour.
+    const rows = (dir.results ?? []).filter((row) => grantAllows(grant, row.relPath))
+    entries = entriesUnder(rows, prefix)
   }
 
   log(
     `[data-portal] op=list owner=${q(session.ownerId)} account=${q(session.accountId)} ` +
+      `granted=${grant.length === 0 ? 'full' : grant.length} ` +
       `prefix=${q(prefix)} files=${files.length} entries=${entries.length} result=ok`,
   )
   return { status: 200, payload: { ok: true, files, entries } }

package/payload/platform/plugins/cloudflare/skills/data-portal/template/index.html

@@ -38,10 +38,19 @@
       </form>
 
       <section id="dp-panel" class="dp-panel" hidden>
-        <form id="dp-upload" class="dp-upload">
-          <input class="dp-file" id="dp-file" type="file" required />
-          <button class="dp-btn" type="submit">Upload</button>
-        </form>
+        <!-- Pinned nav. Stays put while the lists below scroll, so the folder
+             path and the upload control are always in reach. The crumbs live
+             here rather than inside #dp-shared so the header is one row. -->
+        <header class="dp-header">
+          <button class="dp-iconbtn" id="dp-up" type="button" aria-label="Up one level" disabled>
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m5 12 7-7 7 7"/><path d="M12 19V5"/></svg>
+          </button>
+          <nav id="dp-crumbs" class="dp-crumbs" aria-label="Folder path"></nav>
+          <button class="dp-iconbtn" id="dp-upload-open" type="button" aria-label="Upload a file">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" x2="12" y1="3" y2="15"/></svg>
+          </button>
+        </header>
+
         <ul id="dp-files" class="dp-files"></ul>
 
         <!-- Files we have prepared for you, published from the device. Hidden
@@ -49,9 +58,23 @@
              shows the upload list alone rather than an empty second heading. -->
         <section id="dp-shared" class="dp-shared" hidden>
           <h2 class="dp-subtitle">Shared with you</h2>
-          <nav id="dp-crumbs" class="dp-crumbs" aria-label="Folder path"></nav>
           <ul id="dp-entries" class="dp-files"></ul>
         </section>
+
+        <!-- Upload moved off the always-inline row into a modal opened by the
+             header icon, so browsing is not crowded by the picker. Hidden via
+             the `hidden` attribute, which [hidden]{display:none!important} keeps
+             authoritative over .dp-modal's display:flex. -->
+        <div class="dp-modal" id="dp-modal" hidden>
+          <div class="dp-modal-panel" role="dialog" aria-modal="true" aria-label="Upload a file">
+            <button class="dp-modal-close" id="dp-modal-close" type="button" aria-label="Close">&times;</button>
+            <h2 class="dp-subtitle">Upload a file</h2>
+            <form id="dp-upload" class="dp-upload">
+              <input class="dp-file" id="dp-file" type="file" required />
+              <button class="dp-btn" type="submit">Upload</button>
+            </form>
+          </div>
+        </div>
       </section>
     </main>
     <script src="/portal.js"></script>