@rubytech/create-maxy-code 0.1.488 → 0.1.489

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-index-push.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, unlinkSync } from 'node:fs'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, unlinkSync, utimesSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { walkExposed, pushAccount } from '../../bin/portal-index-push.mjs'
@@ -12,6 +12,10 @@ function file(rel: string, body = 'x') {
   writeFileSync(abs, body)
 }
 
+function emptyDir(rel: string) {
+  mkdirSync(join(dir, rel), { recursive: true })
+}
+
 const SCHEMA = [
   '```allowed-top-level',
   'output',
@@ -71,8 +75,11 @@ const push = (client: unknown, overrides: Record<string, unknown> = {}) =>
   })
 
 describe('walkExposed', () => {
-  it('returns files only from exposed dirs, at any depth', async () => {
-    const paths = (await walkExposed(dir, ['output', 'quotes'])).map((r) => r.relPath).sort()
+  it('returns files from exposed dirs, at any depth', async () => {
+    const paths = (await walkExposed(dir, ['output', 'quotes']))
+      .filter((r) => !r.isDir)
+      .map((r) => r.relPath)
+      .sort()
     expect(paths).toEqual(['output/report.pdf', 'quotes/CR2969/quote.pdf', 'quotes/CR2974/quote.pdf'])
   })
 
@@ -89,29 +96,90 @@ describe('walkExposed', () => {
   })
 
   it('carries size and an iso modified time', async () => {
-    const row = (await walkExposed(dir, ['output']))[0]
+    const row = (await walkExposed(dir, ['output'])).find((r) => !r.isDir)!
     expect(row.sizeBytes).toBe(1)
     expect(row.modifiedAt).toMatch(/^\d{4}-\d{2}-\d{2}T/)
   })
+
+  // An exposed folder holding no files at any depth is the case the client
+  // could not see at all: nothing derived a folder name from a file prefix.
+  it('emits exactly one row for an exposed dir holding no files, marked isDir', async () => {
+    emptyDir('jobs')
+    const rows = await walkExposed(dir, ['jobs'])
+    expect(rows.length).toBe(1)
+    expect(rows[0].relPath).toBe('jobs')
+    expect(rows[0].isDir).toBe(true)
+    expect(rows[0].sizeBytes).toBe(0)
+    expect(rows[0].modifiedAt).toMatch(/^\d{4}-\d{2}-\d{2}T/)
+  })
+
+  it('emits the dir row and the file row for a dir holding a nested file', async () => {
+    const rows = await walkExposed(dir, ['quotes'])
+    const byPath = new Map(rows.map((r) => [r.relPath, r]))
+    expect(byPath.get('quotes')?.isDir).toBe(true)
+    expect(byPath.get('quotes/CR2969')?.isDir).toBe(true)
+    expect(byPath.get('quotes/CR2969/quote.pdf')?.isDir).toBe(false)
+  })
+
+  // The dir row's time is the directory's own, not the walk's: a folder whose
+  // contents changed is what the operator reads, and `new Date()` here would
+  // make every row look freshly touched every cycle.
+  it('takes the dir mtime rather than the time of the walk', async () => {
+    emptyDir('jobs')
+    const past = new Date('2020-03-04T05:06:07.000Z')
+    utimesSync(join(dir, 'jobs'), past, past)
+    const rows = await walkExposed(dir, ['jobs'])
+    expect(rows[0].modifiedAt).toBe('2020-03-04T05:06:07.000Z')
+  })
+
+  it('emits no row for a dot-prefixed dir at any level', async () => {
+    const paths = (await walkExposed(dir, ['output'])).map((r) => r.relPath)
+    expect(paths).not.toContain('output/.uploads-tmp')
+  })
 })
 
 describe('pushAccount', () => {
+  // 7 rows: the 3 files plus output/, quotes/, quotes/CR2969/, quotes/CR2974/.
   it('deletes the account rows then inserts the current walk', async () => {
     const c = fakeClient()
     const r = await push(c)
     expect(r.exposed).toEqual(['output', 'quotes'])
-    expect(r.rows).toBe(3)
+    expect(r.rows).toBe(7)
     expect(/DELETE FROM directory/i.test(c.calls[0].sql)).toBe(true)
     expect(c.calls[0].params).toEqual(['acc-1'])
-    expect(c.calls.filter((x) => /INSERT INTO directory/i.test(x.sql)).length).toBe(3)
+    expect(c.calls.filter((x) => /INSERT INTO directory/i.test(x.sql)).length).toBe(7)
   })
 
+  // The folder itself survives its last file: emptied is not the same as gone,
+  // and the client still needs somewhere to put the next one.
   it('converges on a delete: a removed file leaves no stale row', async () => {
     const c = fakeClient()
     await push(c)
     unlinkSync(join(dir, 'quotes/CR2974/quote.pdf'))
+    // The fake accumulates calls across pushes; only the second one is the
+    // converged state.
+    const before = c.calls.length
     const second = await push(c)
-    expect(second.rows).toBe(2)
+    expect(second.rows).toBe(6)
+    const inserted = c.calls
+      .slice(before)
+      .filter((x) => /INSERT INTO directory/i.test(x.sql))
+      .map((x) => String(x.params[1]))
+    expect(inserted).toContain('quotes/CR2974')
+    expect(inserted).not.toContain('quotes/CR2974/quote.pdf')
+  })
+
+  it('marks each inserted row as a directory or not', async () => {
+    const c = fakeClient()
+    await push(c)
+    const byPath = new Map(
+      c.calls
+        .filter((x) => /INSERT INTO directory/i.test(x.sql))
+        .map((x) => [String(x.params[1]), x.params[5]]),
+    )
+    expect(byPath.get('quotes')).toBe(1)
+    expect(byPath.get('quotes/CR2969')).toBe(1)
+    expect(byPath.get('quotes/CR2969/quote.pdf')).toBe(0)
   })
 
   it('binds every value as a param rather than interpolating it', async () => {
@@ -138,8 +206,8 @@ describe('pushAccount', () => {
     const c = fakeClient()
     await push(c, { log: (l: string) => lines.push(l) })
     expect(lines.some((l) => l.includes('op=resolve') && l.includes('exposed=output,quotes'))).toBe(true)
-    expect(lines.some((l) => l.includes('op=replace') && l.includes('inserted=3'))).toBe(true)
-    expect(lines.some((l) => l.includes('op=verify') && l.includes('rowsAfter=3') && l.includes('expected=3'))).toBe(true)
+    expect(lines.some((l) => l.includes('op=replace') && l.includes('inserted=7'))).toBe(true)
+    expect(lines.some((l) => l.includes('op=verify') && l.includes('rowsAfter=7') && l.includes('expected=7'))).toBe(true)
   })
 
   it('reports an exposed-set change only when it actually changes', async () => {

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-indexed-download.test.ts

@@ -10,14 +10,17 @@ function makeEnv(
     secret?: string
     origin?: string
     paths?: string[]
+    dirPaths?: string[]
     folders?: string
+    onQuery?: (query: string) => void
   } = {},
 ) {
-  const { accountId = 'acc-a', paths = [PATH] } = opts
+  const { accountId = 'acc-a', paths = [PATH], dirPaths = [], onQuery = () => {} } = opts
   const folders = 'folders' in opts ? opts.folders : ''
   return {
     DB: {
       prepare(query: string) {
+        onQuery(query)
         let bound: unknown[] = []
         const stmt = {
           bind(...v: unknown[]) {
@@ -37,7 +40,9 @@ function makeEnv(
                 : null) as T | null
             }
             if (/FROM directory/i.test(query)) {
-              return (paths.includes(bound[1] as string) ? { relPath: bound[1] } : null) as T | null
+              const rel = bound[1] as string
+              if (dirPaths.includes(rel)) return { relPath: rel, isDir: 1 } as T
+              return (paths.includes(rel) ? { relPath: rel, isDir: 0 } : null) as T | null
             }
             return null as T | null
           },
@@ -100,6 +105,37 @@ describe('processIndexedDownload', () => {
     expect(touched).toBe(false)
   })
 
+  // Folders are in the index now, so a client can name one here. A folder has
+  // no bytes and must never mint a signed link. result=is-directory separates
+  // it from result=not-granted and result=absent, the only readings before.
+  it('refuses a directory rather than signing a link for it', async () => {
+    let touched = false
+    const spy = async () => {
+      touched = true
+      return { ok: true, status: 200 }
+    }
+    const lines: string[] = []
+    const r = await processIndexedDownload(
+      'sess-a',
+      'quotes/CR2969',
+      makeEnv({ paths: [PATH], dirPaths: ['quotes/CR2969'] }),
+      (l) => lines.push(l),
+      1000,
+      spy as never,
+    )
+    expect(r.status).toBe(404)
+    expect(r.url).toBeUndefined()
+    expect(touched).toBe(false)
+    expect(lines.some((l) => l.includes('result=is-directory'))).toBe(true)
+  })
+
+  it('reads isDir in the directory select', async () => {
+    const queries: string[] = []
+    const env = makeEnv({ onQuery: (q) => queries.push(q) })
+    await processIndexedDownload('sess-a', PATH, env, () => {}, 1000, okHead as never)
+    expect(queries.some((q) => /FROM directory/i.test(q) && /isDir/.test(q))).toBe(true)
+  })
+
   it('401s without a session', async () => {
     const r = await processIndexedDownload('nope', PATH, makeEnv(), () => {}, 1000, okHead as never)
     expect(r.status).toBe(401)

package/payload/platform/plugins/cloudflare/mcp/__tests__/template-config.test.ts

@@ -143,6 +143,16 @@ describe('device binding', () => {
     expect(text).toMatch(/UNIQUE \(accountId, relPath\)/)
     expect(text).toMatch(/accountId\s+TEXT NOT NULL DEFAULT ''/)
   })
+
+  // IF NOT EXISTS is a no-op on an existing table, so a portal deployed before
+  // this column will NOT gain it from a re-apply. The push names isDir in its
+  // INSERT, so such a table fails loudly rather than silently publishing
+  // nothing — the ALTER has to be findable at the point that happens.
+  it('declares isDir and carries the ALTER for a table that predates it', () => {
+    const text = schema()
+    expect(text).toMatch(/isDir\s+INTEGER NOT NULL DEFAULT 0/)
+    expect(text).toContain('ALTER TABLE directory ADD COLUMN isDir INTEGER NOT NULL DEFAULT 0')
+  })
 })
 
 const portalJs = () => readFileSync(join(TEMPLATE, 'portal.js'), 'utf8')
@@ -170,3 +180,65 @@ describe('login error surfacing and passcode reveal (Task 1872)', () => {
     expect(portalJs()).toMatch(/dp-reveal/)
   })
 })
+
+// Task 1900. The device pushes a new tree hourly, so a client who stays signed
+// in reads an index frozen at sign-in. These assertions pin the control that
+// re-reads it: the button in the pinned header, and the click that drives it.
+describe('refresh control', () => {
+  it('puts a refresh button inside the pinned header', () => {
+    const header = indexHtml().match(/<header class="dp-header">[\s\S]*?<\/header>/)
+    expect(header).not.toBeNull()
+    expect(header![0]).toMatch(/id="dp-refresh"/)
+    expect(header![0]).toMatch(/class="dp-iconbtn"/)
+    expect(header![0]).toMatch(/aria-label="Refresh"/)
+  })
+
+  it('sits between the crumbs and the upload control', () => {
+    const text = indexHtml()
+    expect(text.indexOf('id="dp-crumbs"')).toBeLessThan(text.indexOf('id="dp-refresh"'))
+    expect(text.indexOf('id="dp-refresh"')).toBeLessThan(text.indexOf('id="dp-upload-open"'))
+  })
+
+  it('binds a click on it', () => {
+    expect(portalJs()).toMatch(/refreshEl\.addEventListener\('click'/)
+  })
+
+  it('drives refresh() rather than reloading the page', () => {
+    expect(portalJs()).not.toMatch(/location\.reload/)
+  })
+
+  // The status line has to survive a failed re-read. refresh() catches its own
+  // failure, so the promise resolves either way; only a reported outcome tells
+  // the handler whether clearing the status would erase an error.
+  it('has refresh() report its outcome on all three exits', () => {
+    const body = portalJs().match(/function refresh\(\)[\s\S]*?\n  }\n/)
+    expect(body).not.toBeNull()
+    expect(body![0]).toMatch(/return true/)
+    expect((body![0].match(/return false/g) || []).length).toBe(2)
+  })
+
+  // No timer, no focus handler. A poll against an hourly tree is waste.
+  it('never polls', () => {
+    expect(portalJs()).not.toMatch(/setInterval|visibilitychange/)
+  })
+})
+
+// refresh() now writes its own failure text, which would bury the outcome of
+// the delete or upload the client just asked for. Both callers compose instead,
+// so a stale list is reported without losing what happened to the file.
+describe('an action that outlives its re-list', () => {
+  it('keeps the delete and upload outcome when the re-list fails', () => {
+    const text = portalJs()
+    expect((text.match(/The list could not be reloaded\./g) || []).length).toBe(2)
+  })
+
+  it('has both callers read the boolean refresh() returns', () => {
+    const text = portalJs()
+    const removeBody = text.match(/function remove\(key\)[\s\S]*?\n  }\n/)
+    const uploadBody = text.match(/function uploadFile\(file\)[\s\S]*?\n  }\n/)
+    expect(removeBody).not.toBeNull()
+    expect(uploadBody).not.toBeNull()
+    expect(removeBody![0]).toMatch(/refresh\(\)\.then\(function \(ok\)/)
+    expect(uploadBody![0]).toMatch(/refresh\(\)\.then\(function \(ok\)/)
+  })
+})

package/payload/platform/plugins/cloudflare/skills/data-portal/SKILL.md

@@ -13,9 +13,11 @@ references with `plugin-read` before issuing their commands.
 ## What this skill produces, and what it does not
 
 It produces a Pages project on a custom domain, an R2 bucket holding one prefix per enrolled person,
-and a D1 database holding the manifest, the enrolment records, and the sessions. It does not ingest
-the dropped files: a separate device-side sweep reads un-ingested manifest rows and pulls them into
-the graph. This skill delivers the manifest that sweep consumes.
+and a D1 database holding the manifest, the enrolment records, and the sessions. It does not carry a
+dropped file onto the device: the `portal-uploads-pull` loop in the admin server does that, every
+minute, writing each un-ingested manifest row's object to `uploads/<ownerName>/` and setting
+`ingested = 1` only once the bytes are on disk at the right size. This skill delivers the manifest
+that loop consumes. Nothing here or there ingests a pulled file into the graph.
 
 ## Why the portal is on Pages and not the install
 
@@ -110,6 +112,17 @@ with the same `bin/cf-store-name.sh` scheme as the bucket, and apply
 `platform/plugins/cloudflare/skills/data-portal/schema.sql` to the remote database from there. It is
 `IF NOT EXISTS` throughout, so re-applying is safe.
 
+Safe, but not a migration: `IF NOT EXISTS` adds no column to a table that already exists. A portal
+whose `directory` table predates the `isDir` column keeps failing every index push, because the push
+names the column in its `INSERT`. Add it once by hand against that database:
+
+```bash
+npx wrangler d1 execute <portalDbName> --remote \
+  --command "ALTER TABLE directory ADD COLUMN isDir INTEGER NOT NULL DEFAULT 0"
+```
+
+No backfill follows it. The push replaces every row for the account each cycle.
+
 The copied `portal.css` carries the template's default palette, which is nobody's brand. Apply the
 install's before handing the tree to the deploy:
 
@@ -164,7 +177,7 @@ anyway. That check is what contains a stale index or a compromised project, and
 
 ## Publish the folder index
 
-The device publishes file metadata — names, sizes, times, never bytes:
+The device publishes file and folder metadata — names, sizes, times, never bytes:
 
 ```bash
 node platform/plugins/cloudflare/bin/portal-index-push.mjs \
@@ -178,6 +191,13 @@ brand with a different vertical publishes different folders with no change to th
 data (`documents/`, `contacts/`, `projects/`), the client's own `uploads/`, plugin workspaces and
 everything platform-internal are in neither source and are never published.
 
+Every walked folder gets a row of its own, not only the files inside it. An exposed folder holding
+nothing at any depth is therefore a real entry: it renders in the tree and opens to an empty listing,
+rather than reading as absent to the person who has to put the first file into it. A folder row
+carries no bytes, so the download path refuses it and logs `result=is-directory`. A folder named in
+the schema but absent from the device's disk still publishes nothing, so the tree never offers a
+folder the device does not have.
+
 An account with no `SCHEMA.md` publishes nothing at all. That is deliberate and it is the opposite of
 what the write-path guard does — the guard fails open so an unseeded account is not write-blocked,
 while a surface facing a client must fail closed.
@@ -208,9 +228,25 @@ operator requested in `exposeFolders`; a non-zero `extraFolders` with none of th
 
 Signed in, the panel has a pinned header that stays put while the file lists
 scroll under it. The header carries the folder breadcrumbs, an up control that
-moves to the parent folder (disabled at the root), and an upload icon. Filenames
-render on one line: the stem truncates with an ellipsis and the extension stays
-pinned, so `.pdf` and `.html` on two same-named orders are still told apart.
+moves to the parent folder (disabled at the root), a refresh control, and an
+upload icon. Filenames render on one line: the stem truncates with an ellipsis
+and the extension stays pinned, so `.pdf` and `.html` on two same-named orders
+are still told apart.
+
+Refresh re-reads the index in the folder that is already open, so a client who
+stays signed in sees files the device pushed after they arrived without
+reloading the page. It is a click and never a timer: the device pushes hourly,
+so polling would be waste. The button is inert while its request is in flight,
+and the status line clears on success or keeps the failure message on screen.
+Each click is one further `op=list` line carrying the same account and prefix,
+so a click with no line is the handler not firing and two lines is the in-flight
+guard not holding.
+
+Delete and upload both re-read the list when they finish. If that re-read
+fails, the status keeps the outcome and adds to it, so a client reads
+`Deleted. The list could not be reloaded.` rather than a bare load error that
+would leave them unsure whether the file went. The rows on screen are then
+known to be stale, and refresh is how they clear that.
 
 A shared (device-held) file downloads three ways, all through the same signed
 `/api/download?path=` route: a left click, a right-click that opens a one-item

package/payload/platform/plugins/cloudflare/skills/data-portal/schema.sql

@@ -58,9 +58,10 @@ CREATE TABLE IF NOT EXISTS sessions (
 
 CREATE INDEX IF NOT EXISTS sessions_owner ON sessions (ownerId);
 
--- One row per stored object. `ingested` is the claim flag the device-side
--- sweep (a separate task) reads and sets; a row stays 0 until its file has
--- been pulled into the graph, so the backlog survives the device being offline.
+-- One row per stored object. `ingested` is the claim flag the admin server's
+-- `portal-uploads-pull` loop reads and sets; a row stays 0 until its object is
+-- on the device at the size recorded here, so the backlog survives the device
+-- being offline and a half-finished transfer never reads as delivered.
 CREATE TABLE IF NOT EXISTS manifest (
   id         INTEGER PRIMARY KEY AUTOINCREMENT,
   fileId     TEXT UNIQUE NOT NULL,
@@ -88,16 +89,29 @@ CREATE TABLE IF NOT EXISTS auth_attempts (
 
 CREATE UNIQUE INDEX IF NOT EXISTS auth_attempts_scope_window ON auth_attempts (scope, windowStart);
 
--- One row per file the device has published to this portal. Metadata only: the
--- bytes stay on the device and are fetched on demand through a short-lived
--- signed link, which is what lets the folder tree render while the device is
--- offline.
+-- One row per file OR folder the device has published to this portal. Metadata
+-- only: the bytes stay on the device and are fetched on demand through a
+-- short-lived signed link, which is what lets the folder tree render while the
+-- device is offline.
 --
 -- Written by a full replace per account (delete-all, then insert the current
 -- walk), which is why there is no tombstone column: a file deleted or renamed on
 -- the device simply stops being inserted on the next cycle. The UNIQUE key is
 -- what makes that replace safe to retry — a double insert of the same path
 -- fails loudly instead of silently doubling the row.
+--
+-- `isDir` marks a folder row. Folders are stored rather than derived from file
+-- path prefixes, because a folder holding no files at any depth has no prefix
+-- to derive it from and would not exist to the client at all. A folder row
+-- carries sizeBytes 0 and the folder's own modified time, and the download path
+-- refuses to mint a signed link for one.
+--
+-- Like `people.accountId` and `people.folders`, IF NOT EXISTS will NOT add this
+-- column to a `directory` table that predates it, and the push names `isDir` in
+-- its INSERT, so such a table fails loudly on the next cycle. Add it by hand in
+-- that case:
+--   ALTER TABLE directory ADD COLUMN isDir INTEGER NOT NULL DEFAULT 0;
+-- No backfill follows it: the push full-replaces every row each cycle.
 CREATE TABLE IF NOT EXISTS directory (
   id         INTEGER PRIMARY KEY AUTOINCREMENT,
   accountId  TEXT NOT NULL,
@@ -105,6 +119,7 @@ CREATE TABLE IF NOT EXISTS directory (
   sizeBytes  INTEGER NOT NULL,
   modifiedAt TEXT NOT NULL,
   indexedAt  TEXT NOT NULL,
+  isDir      INTEGER NOT NULL DEFAULT 0,
   UNIQUE (accountId, relPath)
 );
 

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/download.ts

@@ -83,15 +83,27 @@ export async function processIndexedDownload(
     return { status: 404, payload: { ok: false, error: 'not found' } }
   }
 
-  const row = await env.DB.prepare('SELECT relPath FROM directory WHERE accountId = ? AND relPath = ?')
+  const row = await env.DB.prepare(
+    'SELECT relPath, isDir FROM directory WHERE accountId = ? AND relPath = ?',
+  )
     .bind(session.accountId, relPath)
-    .first<{ relPath: string }>()
+    .first<{ relPath: string; isDir: number }>()
   if (!row) {
     log(
       `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} result=absent`,
     )
     return { status: 404, payload: { ok: false, error: 'not found' } }
   }
+  if (row.isDir) {
+    // Folders are in the index, so a client can name one here. A folder has no
+    // bytes: minting a link would send the device a path it cannot serve, and
+    // the browser an opaque failure. Refused before the probe, and reported
+    // distinguishably from not-granted and absent.
+    log(
+      `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} result=is-directory`,
+    )
+    return { status: 404, payload: { ok: false, error: 'not found' } }
+  }
 
   const secret = env.PORTAL_FETCH_SECRET
   const origin = env.PORTAL_INSTALL_ORIGIN

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/files.ts

@@ -6,6 +6,7 @@ interface DirRow {
   relPath: string
   sizeBytes: number
   modifiedAt: string
+  isDir: number
 }
 
 export interface DirEntry {
@@ -19,10 +20,12 @@ export interface DirEntry {
 /**
  * Collapse the flat `directory` rows into one level of listing under `prefix`.
  *
- * Folders are synthesised from path segments rather than stored, so the device
- * publishes files alone and an empty folder simply does not exist. The prefix
- * matches on a whole segment (`quotes/`, not `quotes`), so a partial name can
- * never reach a sibling folder's contents.
+ * The device publishes a row per folder as well as per file, so a folder
+ * holding no files at any depth is a real entry that opens and reads as empty.
+ * Folders are ALSO derived from the path segments of deeper rows, and the two
+ * sources collapse onto one entry per name. The prefix matches on a whole
+ * segment (`quotes/`, not `quotes`), so a partial name can never reach a
+ * sibling folder's contents.
  */
 export function entriesUnder(rows: DirRow[], prefix: string): DirEntry[] {
   const base = prefix ? `${prefix}/` : ''
@@ -34,6 +37,21 @@ export function entriesUnder(rows: DirRow[], prefix: string): DirEntry[] {
     if (!rest) continue
     const slash = rest.indexOf('/')
     if (slash === -1) {
+      // A folder's own row has nothing left after the prefix, exactly like a
+      // file's. `isDir` is the only thing separating them; without it a folder
+      // lands in the file list and a click tries to download it.
+      if (row.isDir) {
+        if (!dirs.has(rest)) {
+          dirs.set(rest, {
+            name: rest,
+            kind: 'directory',
+            relPath: row.relPath,
+            sizeBytes: null,
+            modifiedAt: null,
+          })
+        }
+        continue
+      }
       files.push({
         name: rest,
         kind: 'file',
@@ -89,7 +107,7 @@ export async function processFiles(
   const grant = session.folders
   if (session.accountId) {
     const dir = await env.DB.prepare(
-      'SELECT relPath, sizeBytes, modifiedAt FROM directory WHERE accountId = ?',
+      'SELECT relPath, sizeBytes, modifiedAt, isDir FROM directory WHERE accountId = ?',
     )
       .bind(session.accountId)
       .all<DirRow>()

package/payload/platform/plugins/cloudflare/skills/data-portal/template/index.html

@@ -46,6 +46,9 @@
             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m5 12 7-7 7 7"/><path d="M12 19V5"/></svg>
           </button>
           <nav id="dp-crumbs" class="dp-crumbs" aria-label="Folder path"></nav>
+          <button class="dp-iconbtn" id="dp-refresh" type="button" aria-label="Refresh">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8"/><path d="M21 3v5h-5"/><path d="M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16"/><path d="M8 16H3v5"/></svg>
+          </button>
           <button class="dp-iconbtn" id="dp-upload-open" type="button" aria-label="Upload a file">
             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" x2="12" y1="3" y2="15"/></svg>
           </button>

package/payload/platform/plugins/cloudflare/skills/data-portal/template/portal.js

@@ -20,6 +20,7 @@
   var crumbsEl = document.getElementById('dp-crumbs');
   var entriesEl = document.getElementById('dp-entries');
   var upEl = document.getElementById('dp-up');
+  var refreshEl = document.getElementById('dp-refresh');
   var uploadOpenEl = document.getElementById('dp-upload-open');
   var modalEl = document.getElementById('dp-modal');
   var modalCloseEl = document.getElementById('dp-modal-close');
@@ -269,13 +270,22 @@
       });
   }
 
+  /* Resolves true when the list was re-rendered, false when it was not. The
+     boolean exists for the refresh control: this function catches its own
+     failure, so the promise resolves either way, and a caller that cleared the
+     status on resolve would erase the message written a moment earlier. The
+     `!d.ok` branch used to return silently, which left a failed re-list
+     indistinguishable from an unchanged one. */
   function refresh() {
     return api('/api/files?prefix=' + encodeURIComponent(prefix))
       .then(function (r) {
         return r.json();
       })
       .then(function (d) {
-        if (!d.ok) return;
+        if (!d.ok) {
+          say('Could not load your files.');
+          return false;
+        }
         render(d.files || []);
         var entries = d.entries || [];
         // Hidden at the root only: once inside a folder the section stays put,
@@ -283,9 +293,11 @@
         // vanishing.
         sharedEl.hidden = prefix === '' && entries.length === 0;
         renderEntries(entries);
+        return true;
       })
       .catch(function () {
         say('Could not load your files.');
+        return false;
       });
   }
 
@@ -300,8 +312,15 @@
         return r.json();
       })
       .then(function (d) {
-        say(d.ok ? 'Deleted.' : 'Could not delete that.');
-        return refresh();
+        var done = d.ok ? 'Deleted.' : 'Could not delete that.';
+        say(done);
+        // refresh() writes its own failure text, which would otherwise bury what
+        // just happened to the file. Compose the two, so a list that did not
+        // reload is reported without the client losing the delete's outcome and
+        // reading a load error as though the delete itself had failed.
+        return refresh().then(function (ok) {
+          if (!ok) { say(done + ' The list could not be reloaded.'); }
+        });
       })
       .catch(function () {
         say('Could not delete that.');
@@ -370,6 +389,21 @@
     refresh();
   });
 
+  /* Re-read the index in the folder that is already open. refresh() reads the
+     current prefix, so this does not reset to the root. The status clears only
+     on a reported success, otherwise refresh()'s own error text stays up.
+     refresh() returns false from its catch rather than rejecting, so the button
+     cannot be left stuck disabled and needs no catch here. `disabled` in flight
+     is what stops a double click issuing two reads. */
+  refreshEl.addEventListener('click', function () {
+    refreshEl.disabled = true;
+    say('Refreshing…');
+    refresh().then(function (ok) {
+      refreshEl.disabled = false;
+      if (ok) { say(''); }
+    });
+  });
+
   /* The upload modal. Hidden via the `hidden` attribute so
      [hidden]{display:none!important} stays authoritative over .dp-modal's
      display:flex. It dismisses three ways: the close button, a click on the
@@ -406,8 +440,15 @@
         return r.json();
       })
       .then(function (d) {
-        say(d.ok ? 'Uploaded.' : 'Upload failed.');
-        return refresh().then(function () { return { responded: true, ok: !!d.ok }; });
+        var done = d.ok ? 'Uploaded.' : 'Upload failed.';
+        say(done);
+        // Same composition as remove(): a list that did not reload must not cost
+        // the client the upload's own outcome. The resolved shape is unchanged,
+        // so the submit and drop handlers still read `responded` and `ok`.
+        return refresh().then(function (ok) {
+          if (!ok) { say(done + ' The list could not be reloaded.'); }
+          return { responded: true, ok: !!d.ok };
+        });
       })
       .catch(function () {
         say('Upload failed.');

package/payload/platform/plugins/docs/references/calendar-booking.md

@@ -49,10 +49,14 @@ This usually completes within a couple of minutes of the booking.
 Bookings are reconciled on a cycle and the system audits itself each run. In the device logs:
 
 - `[calendar-booking]` lines trace one booking through submit, write, notify, and done.
-- `[calendar-reconcile]` lines report three health numbers per account: `eligibleExamined` (bookings the check looked at), `pendingUnreconciled` (bookings captured but not yet turned into meetings) and `orphanMeetings` (booking meetings with no matching saved booking). Entries that only block out a slot are not counted — they are not bookings and never become meetings.
+- `[calendar-reconcile]` lines report four health numbers per account: `eligibleExamined` (bookings the check looked at), `pendingUnreconciled` (bookings captured but not yet turned into meetings), `pendingOldestAgeMin` (how many minutes the longest-waiting of those has been waiting) and `orphanMeetings` (booking meetings with no matching saved booking). Entries that only block out a slot are not counted — they are not bookings and never become meetings.
 
 A `pendingUnreconciled` number that stays above zero across several runs means those bookings are failing to turn into meetings, and the `attempt=` number on the matching `[calendar-booking]` lines says how many times each has been tried. A booking whose meeting is deleted is picked up again automatically on the next run. To read them: `journalctl --user -u <brand-service> | grep -E '\[calendar-booking\]|\[calendar-reconcile\]'`, then filter by one booking id for its full story. The edge half of a booking (before your device sees it) is in the Cloudflare Pages function logs.
 
+A count on its own cannot tell a short lag from a long one: five bookings waiting two minutes and five waiting nine hours are both `pendingUnreconciled=5`. `pendingOldestAgeMin` is what separates them. It reads `0` when nothing is waiting, and also when something is waiting but for under a minute, so read it together with the count beside it.
+
+A separate `op=liveness` line is printed every ten minutes by your device's own server, whether or not anything is wrong. `stale=false` means the booking check has run recently. `stale=true` means it has not run in over six minutes, which is the case nothing else can tell you about: a check that has stopped cannot report that it has stopped. `lastSkipReason` names the last account whose check finished without looking at any bookings, and reads `none` when every account it got to was checked. If you run more than one account, a check can both look at one account and skip another, so seeing a recent check time next to a skip reason is normal and means two different accounts.
+
 ## When your real calendar lives elsewhere
 
 The booking page publishes open slots from the internal calendar, the one Maxy keeps in its own graph.