@rubytech/create-maxy-code 0.1.488 → 0.1.490

package/payload/platform/plugins/cloudflare/bin/portal-index-push.mjs

@@ -57,14 +57,23 @@ export async function readExposeFolders(accountDir) {
 }
 
 /**
- * Files under `exposed` dirs, at any depth. Dot-prefixed entries are skipped at
- * every level: `.uploads-tmp/` holds in-flight upload partials (files.ts:25) and
- * must never be published as a deliverable.
+ * Files AND directories under `exposed` dirs, at any depth, each row carrying
+ * `isDir`. Directories are published rather than left to be derived from file
+ * prefixes, because a folder holding no files at any depth has no prefix to be
+ * derived from and would not exist to the client at all.
+ *
+ * A directory row is emitted only after its own `readdir` succeeds, so an
+ * exposed name that is absent or unreadable on disk still contributes nothing
+ * and the portal never renders a folder the device does not have.
+ *
+ * Dot-prefixed entries are skipped at every level: `.uploads-tmp/` holds
+ * in-flight upload partials (files.ts:25) and must never be published as a
+ * deliverable, as a file row or as a folder.
  * @param {string} accountDir @param {string[]} exposed
- * @returns {Promise<{relPath: string, sizeBytes: number, modifiedAt: string}[]>}
+ * @returns {Promise<{relPath: string, sizeBytes: number, modifiedAt: string, isDir: boolean}[]>}
  */
 export async function walkExposed(accountDir, exposed) {
-  /** @type {{relPath: string, sizeBytes: number, modifiedAt: string}[]} */
+  /** @type {{relPath: string, sizeBytes: number, modifiedAt: string, isDir: boolean}[]} */
   const out = []
 
   /** @param {string} rel */
@@ -75,6 +84,14 @@ export async function walkExposed(accountDir, exposed) {
     } catch {
       return // absent or unreadable dir contributes nothing
     }
+    try {
+      const st = await stat(join(accountDir, rel))
+      // sizeBytes 0 rather than the directory inode's own size: the column
+      // means "bytes a client can fetch", and a folder has none.
+      out.push({ relPath: rel, sizeBytes: 0, modifiedAt: st.mtime.toISOString(), isDir: true })
+    } catch {
+      // vanished between the readdir and the stat; the next cycle settles it
+    }
     for (const e of entries) {
       if (e.name.startsWith('.')) continue
       const childRel = `${rel}/${e.name}`
@@ -83,7 +100,12 @@ export async function walkExposed(accountDir, exposed) {
       } else if (e.isFile()) {
         try {
           const st = await stat(join(accountDir, childRel))
-          out.push({ relPath: childRel, sizeBytes: st.size, modifiedAt: st.mtime.toISOString() })
+          out.push({
+            relPath: childRel,
+            sizeBytes: st.size,
+            modifiedAt: st.mtime.toISOString(),
+            isDir: false,
+          })
         } catch {
           // vanished mid-walk; the next cycle settles it
         }
@@ -156,22 +178,71 @@ export async function pushAccount(opts) {
 
   const rows = await walkExposed(accountDir, r.exposed)
 
-  await client.query('DELETE FROM directory WHERE accountId = ?', [accountId])
+  // Stage, flip, then sweep (Task 1910, superseding backlog Task 1842).
+  //
+  // The replace used to be DELETE-then-INSERT, which left the account's tree
+  // empty or half-built for the whole insert run. A client listing inside that
+  // window saw a portal with nothing in it. At sixty-second cadence that window
+  // is hit sixty times more often than it was hourly, which is what turned a
+  // known defect into a blocking one.
+  //
+  // Now every row is written at the NEXT generation, one statement moves the
+  // pointer, and only then are superseded rows removed. The flip is the atomic
+  // point: a reader sees the old tree or the new one, never a mixture. The
+  // sweep afterwards need not be atomic, because nothing reads a generation the
+  // pointer does not name.
+  const state = await client.query(
+    'SELECT currentGeneration FROM directory_state WHERE accountId = ?',
+    [accountId],
+  )
+  const current = Number(state[0]?.currentGeneration ?? 0)
+  const next = current + 1
+
   for (const row of rows) {
     await client.query(
-      'INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt) VALUES (?, ?, ?, ?, ?)',
-      [accountId, row.relPath, row.sizeBytes, row.modifiedAt, nowIso],
+      'INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt, isDir, generation) ' +
+        'VALUES (?, ?, ?, ?, ?, ?, ?)',
+      [accountId, row.relPath, row.sizeBytes, row.modifiedAt, nowIso, row.isDir ? 1 : 0, next],
+    )
+  }
+  log(`${TAG} op=stage account=${accountId} generation=${next} inserted=${rows.length}`)
+
+  // THE atomic point. Upsert rather than insert-or-update, so an account
+  // publishing for the first time and one republishing take the same path.
+  await client.query(
+    'INSERT INTO directory_state (accountId, currentGeneration) VALUES (?, ?) ' +
+      'ON CONFLICT (accountId) DO UPDATE SET currentGeneration = excluded.currentGeneration',
+    [accountId, next],
+  )
+  log(`${TAG} op=flip account=${accountId} generation=${next}`)
+
+  // Housekeeping only. A failure here leaves stale rows nothing reads, which is
+  // waste rather than incorrectness — so it must not fail the publish that has
+  // already succeeded.
+  try {
+    await client.query('DELETE FROM directory WHERE accountId = ? AND generation != ?', [
+      accountId,
+      next,
+    ])
+  } catch (err) {
+    log(
+      `${TAG} op=sweep account=${accountId} generation=${next} result=failed ` +
+        `err="${err instanceof Error ? err.message : String(err)}"`,
     )
   }
-  log(`${TAG} op=replace account=${accountId} deleted=all inserted=${rows.length}`)
 
   // Read back rather than trusting the write: "issued the inserts" is not "the
-  // rows are there", and a half-applied batch is otherwise invisible.
-  const check = await client.query('SELECT COUNT(*) AS n FROM directory WHERE accountId = ?', [accountId])
+  // rows are there", and a half-applied batch is otherwise invisible. Counted
+  // through the pointer, so this measures what a client would actually see.
+  const check = await client.query(
+    'SELECT COUNT(*) AS n FROM directory d JOIN directory_state s ' +
+      'ON s.accountId = d.accountId AND s.currentGeneration = d.generation WHERE d.accountId = ?',
+    [accountId],
+  )
   const after = Number(check[0]?.n ?? -1)
   log(`${TAG} op=verify account=${accountId} rowsAfter=${after} expected=${rows.length}`)
 
-  return { exposed: r.exposed, rows: rows.length, schemaPresent: true }
+  return { exposed: r.exposed, rows: rows.length, schemaPresent: true, generation: next }
 }
 
 /**
@@ -301,39 +372,44 @@ function resolveCloudflareCredentials(platformRoot) {
   return { cfAccountId: house.CLOUDFLARE_ACCOUNT_ID, token }
 }
 
-async function main() {
-  const platformRoot = process.env.PLATFORM_ROOT
-  if (!platformRoot) {
-    console.error(`${TAG} op=usage reason=no-platform-root PLATFORM_ROOT is required`)
-    process.exit(1)
-  }
+/**
+ * Publish every portal-serving account's index.
+ *
+ * Exported so the admin server's 60s loop and this script's CLI entry run the
+ * SAME code (Task 1910). The loop replaced an hourly heartbeat spawn whose own
+ * header recorded it had never been observed running on a device; two
+ * implementations of the publish would have reintroduced exactly that class of
+ * problem one layer along.
+ *
+ * Returns a summary rather than exiting, so a caller inside a long-lived
+ * process can report it. Throwing is reserved for a genuine break — an absent
+ * house credential where portals exist — which the loop registry surfaces as a
+ * failed run rather than a silent one.
+ *
+ * @param {string} platformRoot
+ * @returns {Promise<{accounts: number, pushed: number, failed: number}>}
+ */
+export async function pushAllAccounts(platformRoot) {
+  const accountsRoot = resolve(platformRoot, '..', 'data', 'accounts')
+  const targets = await portalAccounts(accountsRoot)
+  console.error(`${TAG} op=enumerate accountsRoot="${accountsRoot}" accounts=${targets.length}`)
+  // Before minting a credential, exactly as the pull and the audit do: most
+  // installs have neither a portal nor a house credential, and minting
+  // unconditionally would make this loop report an error on every one forever.
+  if (targets.length === 0) return { accounts: 0, pushed: 0, failed: 0 }
 
   const cred = resolveCloudflareCredentials(platformRoot)
   if ('error' in cred) {
-    console.error(`${TAG} op=skip reason=${cred.error}`)
-    process.exit(1)
-  }
-
-  /** @type {{accountDir: string, accountId: string, dbName: string, exposeFolders: string[]}[]} */ let targets
-  if (process.argv.includes('--all-accounts')) {
-    // Same derivation as the platform's own DATA_ROOT (data-path.ts:19), from
-    // the PLATFORM_ROOT the heartbeat already passes.
-    const accountsRoot = resolve(platformRoot, '..', 'data', 'accounts')
-    targets = await portalAccounts(accountsRoot)
-    console.error(`${TAG} op=enumerate accountsRoot="${accountsRoot}" accounts=${targets.length}`)
-  } else {
-    const accountDir = arg('--account-dir')
-    const accountId = arg('--account')
-    const dbName = arg('--db')
-    if (!accountDir || !accountId || !dbName) {
-      console.error(`${TAG} op=usage --account-dir <dir> --account <id> --db <name>`)
-      process.exit(1)
-    }
-    targets = [{ accountDir, accountId, dbName, exposeFolders: await readExposeFolders(accountDir) }]
+    throw new Error(cred.error)
   }
+  return runTargets(platformRoot, cred, targets)
+}
 
+/** @returns {Promise<{accounts: number, pushed: number, failed: number}>} */
+async function runTargets(platformRoot, cred, targets) {
   const state = readState(platformRoot)
   let failed = 0
+  let pushed = 0
   for (const t of targets) {
     try {
       // cfAccountId addresses the D1 endpoint; t.accountId scopes the rows.
@@ -360,6 +436,7 @@ async function main() {
           exposed: r.exposed,
         })
       }
+      pushed++
       console.error(`${TAG} op=done account=${t.accountId} rows=${r.rows}`)
     } catch (err) {
       // One account's failure must not stop the rest, and it must never be
@@ -370,10 +447,53 @@ async function main() {
       )
     }
   }
-  if (failed > 0) process.exit(1)
+  return { accounts: targets.length, pushed, failed }
+}
+
+async function main() {
+  const platformRoot = process.env.PLATFORM_ROOT
+  if (!platformRoot) {
+    console.error(`${TAG} op=usage reason=no-platform-root PLATFORM_ROOT is required`)
+    process.exit(1)
+  }
+
+  if (process.argv.includes('--all-accounts')) {
+    try {
+      const r = await pushAllAccounts(platformRoot)
+      if (r.failed > 0) process.exit(1)
+    } catch (err) {
+      console.error(`${TAG} op=skip reason=${err instanceof Error ? err.message : String(err)}`)
+      process.exit(1)
+    }
+    return
+  }
+
+  const accountDir = arg('--account-dir')
+  const accountId = arg('--account')
+  const dbName = arg('--db')
+  if (!accountDir || !accountId || !dbName) {
+    console.error(`${TAG} op=usage --account-dir <dir> --account <id> --db <name>`)
+    process.exit(1)
+  }
+  const cred = resolveCloudflareCredentials(platformRoot)
+  if ('error' in cred) {
+    console.error(`${TAG} op=skip reason=${cred.error}`)
+    process.exit(1)
+  }
+  const r = await runTargets(platformRoot, cred, [
+    { accountDir, accountId, dbName, exposeFolders: await readExposeFolders(accountDir) },
+  ])
+  if (r.failed > 0) process.exit(1)
 }
 
 // Only when invoked directly, so the module stays importable by tests.
-if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) {
+// The basename check is what survives the UI bundler inlining this file into
+// server.js: when bundled, `process.argv[1]` (server.js) and `import.meta.url`
+// (server.js after esbuild's transform) resolve to the same path, and a pure
+// path-equality guard fires main() at server boot, exiting the payload before
+// its first line served. Matching on the mjs basename keeps this cheap CLI
+// entry point from tripping in-process.
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : ''
+if (invokedPath && invokedPath.endsWith('/portal-index-push.mjs') && invokedPath === resolve(fileURLToPath(import.meta.url))) {
   void main()
 }

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-delete-withdraw.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, it } from 'vitest'
+import { processDelete } from '../../skills/data-portal/template/functions/api/delete'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+/** `row` is what the manifest holds for the key under test, or null when the
+ *  key is unknown. The fake tracks which of the three writes actually happened
+ *  so a test can assert the R2 object was never touched. */
+function harness(row: { devicePath: string } | null) {
+  const state = { objectDeleted: false, rowDeleted: false, marked: false }
+  const lines: string[] = []
+
+  const env = {
+    BUCKET: {
+      async delete() {
+        state.objectDeleted = true
+      },
+      async head() {
+        return state.objectDeleted ? null : { size: 1 }
+      },
+    },
+    DB: {
+      prepare(sql: string) {
+        return {
+          bind() {
+            return {
+              async first() {
+                if (sql.includes('FROM sessions')) {
+                  return { ownerId: 'alice', accountId: 'acct', folders: '' }
+                }
+                if (sql.includes('SELECT devicePath')) return row
+                if (sql.includes('SELECT deleted')) return { deleted: state.marked ? 1 : 0 }
+                if (sql.includes('SELECT fileId FROM manifest')) {
+                  return state.rowDeleted || !row ? null : { fileId: 'f1' }
+                }
+                return null
+              },
+              async run() {
+                if (/^UPDATE manifest/.test(sql)) state.marked = true
+                if (/^DELETE FROM manifest/.test(sql)) state.rowDeleted = true
+              },
+            }
+          },
+        }
+      },
+    },
+  } as unknown as PortalEnv
+
+  return { env, state, lines, log: (l: string) => lines.push(l) }
+}
+
+describe('delete branches on whether the file has moved', () => {
+  it('deletes object and row outright when the file is still in transit', async () => {
+    const h = harness({ devicePath: '' })
+    const res = await processDelete('s', 'alice/a.pdf', h.env, h.log, () => 1)
+    expect(res.status).toBe(200)
+    expect(h.state.objectDeleted).toBe(true)
+    expect(h.state.rowDeleted).toBe(true)
+    expect(h.state.marked).toBe(false)
+  })
+
+  it('marks a moved file for withdrawal instead of touching R2', async () => {
+    // The bytes are on the device and the R2 object is already gone. Deleting
+    // here would report success while the client's file stayed on the device
+    // forever — the exact failure this branch exists to prevent.
+    const h = harness({ devicePath: 'jobs/a.pdf' })
+    const res = await processDelete('s', 'alice/jobs/a.pdf', h.env, h.log, () => 1)
+    expect(res.status).toBe(200)
+    expect(h.state.marked).toBe(true)
+    expect(h.state.rowDeleted).toBe(false)
+    expect(h.state.objectDeleted).toBe(false)
+    expect(h.lines.some((l) => l.includes('op=withdraw') && l.includes('result=marked'))).toBe(true)
+  })
+
+  it('tells the client the withdrawal is pending, not complete', async () => {
+    const h = harness({ devicePath: 'jobs/a.pdf' })
+    const res = await processDelete('s', 'alice/jobs/a.pdf', h.env, h.log, () => 1)
+    expect(res.payload).toMatchObject({ ok: true, pending: true })
+  })
+
+  it('reports an unknown key as not found without writing anything', async () => {
+    const h = harness(null)
+    const res = await processDelete('s', 'alice/nope.pdf', h.env, h.log, () => 1)
+    expect(res.status).toBe(404)
+    expect(h.state.objectDeleted).toBe(false)
+    expect(h.state.marked).toBe(false)
+    expect(h.state.rowDeleted).toBe(false)
+  })
+
+  it('still refuses another person key before reading anything', async () => {
+    const h = harness({ devicePath: '' })
+    const res = await processDelete('s', 'bob/a.pdf', h.env, h.log, () => 1)
+    expect(res.status).toBe(403)
+    expect(h.state.objectDeleted).toBe(false)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-directory-listing.test.ts

@@ -2,19 +2,28 @@ import { describe, it, expect } from 'vitest'
 import { processFiles, entriesUnder } from '../../skills/data-portal/template/functions/api/files'
 import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
 
+// Mirrors what the push writes: a row per folder as well as per file. `jobs` is
+// exposed and holds nothing, which is the case that had no row at all before.
 const DIRECTORY = [
-  { accountId: 'acc-a', relPath: 'output/report.pdf', sizeBytes: 10, modifiedAt: '2026-07-20T10:00:00.000Z' },
-  { accountId: 'acc-a', relPath: 'quotes/CR2969/quote.pdf', sizeBytes: 20, modifiedAt: '2026-07-20T11:00:00.000Z' },
-  { accountId: 'acc-a', relPath: 'quotes/CR2974/quote.pdf', sizeBytes: 30, modifiedAt: '2026-07-20T12:00:00.000Z' },
-  { accountId: 'acc-b', relPath: 'output/secret.pdf', sizeBytes: 40, modifiedAt: '2026-07-20T13:00:00.000Z' },
+  { accountId: 'acc-a', relPath: 'output', sizeBytes: 0, modifiedAt: '2026-07-20T10:00:00.000Z', isDir: 1 },
+  { accountId: 'acc-a', relPath: 'output/report.pdf', sizeBytes: 10, modifiedAt: '2026-07-20T10:00:00.000Z', isDir: 0 },
+  { accountId: 'acc-a', relPath: 'quotes', sizeBytes: 0, modifiedAt: '2026-07-20T12:00:00.000Z', isDir: 1 },
+  { accountId: 'acc-a', relPath: 'quotes/CR2969', sizeBytes: 0, modifiedAt: '2026-07-20T11:00:00.000Z', isDir: 1 },
+  { accountId: 'acc-a', relPath: 'quotes/CR2969/quote.pdf', sizeBytes: 20, modifiedAt: '2026-07-20T11:00:00.000Z', isDir: 0 },
+  { accountId: 'acc-a', relPath: 'quotes/CR2974', sizeBytes: 0, modifiedAt: '2026-07-20T12:00:00.000Z', isDir: 1 },
+  { accountId: 'acc-a', relPath: 'quotes/CR2974/quote.pdf', sizeBytes: 30, modifiedAt: '2026-07-20T12:00:00.000Z', isDir: 0 },
+  { accountId: 'acc-a', relPath: 'jobs', sizeBytes: 0, modifiedAt: '2026-07-20T14:00:00.000Z', isDir: 1 },
+  { accountId: 'acc-b', relPath: 'output/secret.pdf', sizeBytes: 40, modifiedAt: '2026-07-20T13:00:00.000Z', isDir: 0 },
 ]
 
 function makeEnv(
   sessions: Record<string, { ownerId: string; accountId: string; folders?: string }>,
+  onQuery: (query: string) => void = () => {},
 ) {
   return {
     DB: {
       prepare(query: string) {
+        onQuery(query)
         let bound: unknown[] = []
         const stmt = {
           bind(...v: unknown[]) {
@@ -47,9 +56,9 @@ type Entry = { name: string; kind: string; relPath: string; sizeBytes: number |
 describe('entriesUnder', () => {
   const rows = DIRECTORY.filter((d) => d.accountId === 'acc-a')
 
-  it('synthesises top-level folders from row paths', () => {
+  it('lists top-level folders, including one holding no files', () => {
     const e = entriesUnder(rows, '')
-    expect(e.map((x) => x.name)).toEqual(['output', 'quotes'])
+    expect(e.map((x) => x.name)).toEqual(['jobs', 'output', 'quotes'])
     expect(e.every((x) => x.kind === 'directory')).toBe(true)
   })
 
@@ -57,6 +66,42 @@ describe('entriesUnder', () => {
     expect(entriesUnder(rows, 'quotes').map((x) => x.name)).toEqual(['CR2969', 'CR2974'])
   })
 
+  // An empty folder must open, not read as missing. Its own row is what puts it
+  // in the parent listing; inside it there is nothing to show.
+  it('opens an empty folder to an empty listing', () => {
+    expect(entriesUnder(rows, 'jobs')).toEqual([])
+  })
+
+  // The explicit row and the row implied by a nested file name the same folder.
+  // Two entries for one folder would render it twice.
+  it('collapses an explicit folder row and one implied by a nested file', () => {
+    const both = [
+      { relPath: 'quotes', sizeBytes: 0, modifiedAt: '2026-07-20T12:00:00.000Z', isDir: 1 },
+      { relPath: 'quotes/CR2969/quote.pdf', sizeBytes: 20, modifiedAt: '2026-07-20T11:00:00.000Z', isDir: 0 },
+    ]
+    const e = entriesUnder(both, '')
+    expect(e.length).toBe(1)
+    expect(e[0]).toEqual({
+      name: 'quotes',
+      kind: 'directory',
+      relPath: 'quotes',
+      sizeBytes: null,
+      modifiedAt: null,
+    })
+  })
+
+  // Without the isDir check a folder row has no slash left after the prefix and
+  // lands in the file list, where clicking it would try to download a folder.
+  it('never renders a folder row as a file', () => {
+    const e = entriesUnder(
+      [{ relPath: 'jobs', sizeBytes: 0, modifiedAt: '2026-07-20T14:00:00.000Z', isDir: 1 }],
+      '',
+    )
+    expect(e).toEqual([
+      { name: 'jobs', kind: 'directory', relPath: 'jobs', sizeBytes: null, modifiedAt: null },
+    ])
+  })
+
   it('lists files inside a leaf folder with size and time', () => {
     expect(entriesUnder(rows, 'quotes/CR2969')).toEqual([
       {
@@ -71,9 +116,9 @@ describe('entriesUnder', () => {
 
   it('puts folders before files and files newest first', () => {
     const mixed = [
-      { relPath: 'output/old.pdf', sizeBytes: 1, modifiedAt: '2026-01-01T00:00:00.000Z' },
-      { relPath: 'output/new.pdf', sizeBytes: 1, modifiedAt: '2026-09-01T00:00:00.000Z' },
-      { relPath: 'output/sub/x.pdf', sizeBytes: 1, modifiedAt: '2026-05-01T00:00:00.000Z' },
+      { relPath: 'output/old.pdf', sizeBytes: 1, modifiedAt: '2026-01-01T00:00:00.000Z', isDir: 0 },
+      { relPath: 'output/new.pdf', sizeBytes: 1, modifiedAt: '2026-09-01T00:00:00.000Z', isDir: 0 },
+      { relPath: 'output/sub/x.pdf', sizeBytes: 1, modifiedAt: '2026-05-01T00:00:00.000Z', isDir: 0 },
     ]
     expect(entriesUnder(mixed, 'output').map((x) => x.name)).toEqual(['sub', 'new.pdf', 'old.pdf'])
   })
@@ -85,9 +130,18 @@ describe('entriesUnder', () => {
 })
 
 describe('processFiles directory listing', () => {
-  it('returns synthesised folders for the session account', async () => {
+  it('returns the account folders, including one holding no files', async () => {
     const r = await processFiles('sess-a', makeEnv(SESSIONS), () => {}, 0, '')
-    expect((r.payload.entries as Entry[]).map((e) => e.name)).toEqual(['output', 'quotes'])
+    expect((r.payload.entries as Entry[]).map((e) => e.name)).toEqual(['jobs', 'output', 'quotes'])
+  })
+
+  // The column is what tells a folder row from a file row; a SELECT that drops
+  // it renders every folder as an unopenable file.
+  it('reads isDir in the directory select', async () => {
+    const queries: string[] = []
+    const env = makeEnv(SESSIONS, (q) => queries.push(q))
+    await processFiles('sess-a', env, () => {}, 0, '')
+    expect(queries.some((q) => /FROM directory/i.test(q) && /isDir/.test(q))).toBe(true)
   })
 
   it('never leaks another account rows', async () => {
@@ -129,15 +183,23 @@ describe('processFiles directory listing', () => {
   it('an empty grant shows the full set', async () => {
     const env = makeEnv({ 'sess-a': { ownerId: 'alice', accountId: 'acc-a', folders: '' } })
     const r = await processFiles('sess-a', env, () => {}, 0, '')
-    expect((r.payload.entries as Entry[]).map((e) => e.name)).toEqual(['output', 'quotes'])
+    expect((r.payload.entries as Entry[]).map((e) => e.name)).toEqual(['jobs', 'output', 'quotes'])
   })
 
   it('a grant naming an absent folder shows nothing', async () => {
-    const env = makeEnv({ 'sess-a': { ownerId: 'alice', accountId: 'acc-a', folders: 'jobs' } })
+    const env = makeEnv({ 'sess-a': { ownerId: 'alice', accountId: 'acc-a', folders: 'parts' } })
     const r = await processFiles('sess-a', env, () => {}, 0, '')
     expect(r.payload.entries).toEqual([])
   })
 
+  // The grant narrows the account's exposed set, and an empty folder is inside
+  // that set like any other: outside the grant it stays hidden.
+  it('an empty folder outside the grant stays hidden', async () => {
+    const env = makeEnv({ 'sess-a': { ownerId: 'alice', accountId: 'acc-a', folders: 'quotes' } })
+    const r = await processFiles('sess-a', env, () => {}, 0, '')
+    expect((r.payload.entries as Entry[]).map((e) => e.name)).not.toContain('jobs')
+  })
+
   it('the grant holds when browsing into a granted folder', async () => {
     const env = makeEnv({ 'sess-a': { ownerId: 'alice', accountId: 'acc-a', folders: 'quotes' } })
     const r = await processFiles('sess-a', env, () => {}, 0, 'quotes')