mcp-memory-bucket 0.10.11 → 0.10.13

package/dist/client/index.html

@@ -33,7 +33,7 @@
       z-index: 2147483000;
     }
   </style>
-  <script type="module" crossorigin src="/assets/index-BWDogxb1.js"></script>
+  <script type="module" crossorigin src="/assets/index-BuS9zM5d.js"></script>
 </head>
 <body>
   <mem-bucket-app></mem-bucket-app>

package/dist/src/config.js

@@ -13,10 +13,14 @@ function isRemoteEntry(entry) {
  * get mistaken for one another (see identity.ts) - a mirror connected while
  * logged into "dev" as "anatoli" lands at
  * .memory-bucket-remote-cache/dev_anatoli/<name>/, distinct from the same
- * folder name connected under "cloud" or a different username.
+ * folder name connected under "cloud" or a different username. `owner`, when
+ * this source is a folder someone ELSE shared (see RemoteFolder.owner),
+ * folds into the identity segment too - otherwise a shared folder connected
+ * under the same `name` as one of the caller's own folders would collide on
+ * the same mirror directory.
  */
-export function mirrorDirFor(baseDir, mode, username, name) {
-    const identitySegment = sanitizeFolderName(`${mode}_${username}`);
+export function mirrorDirFor(baseDir, mode, username, name, owner) {
+    const identitySegment = sanitizeFolderName(owner ? `${mode}_${username}_shared-by-${owner}` : `${mode}_${username}`);
     return path.join(baseDir, '.memory-bucket-remote-cache', identitySegment, sanitizeFolderName(name));
 }
 function memoryDirFlag(argv) {
@@ -65,7 +69,7 @@ function resolveFolders(entries, baseDir) {
             return { name: nameFromPath(entry), path: path.resolve(baseDir, entry) };
         }
         if (isRemoteEntry(entry)) {
-            const mirrorDir = mirrorDirFor(baseDir, entry.remote.mode, entry.remote.username, entry.name);
+            const mirrorDir = mirrorDirFor(baseDir, entry.remote.mode, entry.remote.username, entry.name, entry.remote.owner);
             remoteFolders.push({ name: entry.name, ...entry.remote, mirrorDir });
             return { name: entry.name, path: mirrorDir };
         }
@@ -159,6 +163,7 @@ export function saveRemoteFolder(config, kind, entry) {
                     folderPath: entry.folderPath,
                     mode: entry.mode,
                     username: entry.username,
+                    ...(entry.owner ? { owner: entry.owner } : {}),
                 },
             },
         ],

package/dist/src/memory/repository.js

@@ -84,9 +84,9 @@ export class MemoryRepository {
         const remote = this.remoteFor(folderName);
         if (!remote || !this.credentialsBaseDir)
             return;
-        await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, folderName);
+        await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, folderName, remote.owner);
         const dirRelPath = joinRemoteFolderPath(remote.folderPath, path.relative(remote.mirrorDir, path.dirname(attachmentFilePath)));
-        await writeRemoteBinaryFile(remote.server, this.credentialsBaseDir, remote.tenantId, dirRelPath, path.basename(attachmentFilePath), data, mimeType);
+        await writeRemoteBinaryFile(remote.server, this.credentialsBaseDir, remote.tenantId, dirRelPath, path.basename(attachmentFilePath), data, mimeType, remote.owner);
     }
     /**
      * Trashes one attachment's remote copy on folderfoo, if `folderName` resolves to a remote source
@@ -102,9 +102,9 @@ export class MemoryRepository {
         const remote = this.remoteFor(folderName);
         if (!remote || !this.credentialsBaseDir)
             return;
-        await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, folderName);
+        await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, folderName, remote.owner);
         const dirRelPath = joinRemoteFolderPath(remote.folderPath, path.relative(remote.mirrorDir, path.dirname(attachmentFilePath)));
-        await trashRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dirRelPath, path.basename(attachmentFilePath));
+        await trashRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dirRelPath, path.basename(attachmentFilePath), remote.owner);
     }
     /** Attaches the live chokidar watcher so addFolder/removeFolder can mutate it without a restart. */
     setWatcher(watcher) {
@@ -190,6 +190,11 @@ export class MemoryRepository {
      * perform the initial pull itself — the caller (the web route) does one
      * immediate poll right after this returns, so content shows up without
      * waiting for the first interval tick.
+     *
+     * `remote.name` (and `remote.mirrorDir`, derived from it) must already be the FINAL, resolved
+     * name — see resolveAvailableName, which the web route calls first (before it derives mirrorDir)
+     * so a possibly-auto-suffixed name is settled before anything touches disk, rather than this
+     * method renaming out from under an already-computed mirrorDir.
      */
     registerRemoteFolder(remote) {
         if (this.folders.some((f) => f.name === remote.name)) {
@@ -197,11 +202,61 @@ export class MemoryRepository {
         }
         fs.mkdirSync(remote.mirrorDir, { recursive: true });
         this.remoteFolders.push(remote);
-        this.addFolder({ name: remote.name, path: remote.mirrorDir });
+        this.addFolder({ name: remote.name, path: remote.mirrorDir }, { skipCollisionCheck: true });
     }
-    /** Registers a new folder: appends it, scans it once, and starts watching it live. */
-    addFolder(folder) {
-        if (this.folders.some((f) => f.name === folder.name)) {
+    /**
+     * `name` must stay globally unique across EVERY identity this process has ever seen, not just
+     * currently-visible folders — `folder` is the sole key used everywhere a doc/skill addresses which
+     * folder it lives in (the memory_docs.folder/skills.folder DB columns, every `folder = ?` SQL
+     * filter, MCP tool `folder` params, the web UI's folder-chip clicks). Two folders sharing a name
+     * would make all of those ambiguous the instant both became visible in the same request. Called by
+     * the web route BEFORE deriving mirrorDir/calling registerRemoteFolder, so the name is fully
+     * settled before anything touches disk or the config file.
+     *
+     * Two different cases, handled differently:
+     *  - Collides with a folder the SAME identity already has (own or shared) → a genuine naming
+     *    mistake (e.g. reusing a name they already picked themselves) → rejected.
+     *  - Collides with a folder a DIFFERENT identity owns (e.g. two different folderfoo logins each
+     *    naturally wanting "bbbmemz") → auto-suffixed with " (<connecting username>)" instead of
+     *    rejected, since forcing every user to invent an arbitrary alternate name for their OWN
+     *    folder just because someone else's login already used the obvious one is exactly the friction
+     *    this exists to avoid. The suffixed form is still checked for its own (now vanishingly
+     *    unlikely, but not impossible — e.g. two different usernames on two different modes) collision
+     *    and suffixed further with an incrementing counter if needed, so this always terminates with a
+     *    genuinely available name rather than looping forever or erroring on a contrived edge case.
+     */
+    resolveAvailableName(requestedName, connectingUsername) {
+        const takenByOwnIdentity = (name) => this.folders.some((f) => f.name === name) && this.isFolderNameVisible(name);
+        const taken = (name) => this.folders.some((f) => f.name === name);
+        if (!taken(requestedName))
+            return requestedName;
+        if (takenByOwnIdentity(requestedName)) {
+            throw new Error(`a memory folder named "${requestedName}" already exists`);
+        }
+        // Collides with a DIFFERENT identity's folder — auto-suffix rather than reject (see this
+        // method's own doc comment). Re-checks the suffixed candidate too: astronomically unlikely to
+        // still collide, but not impossible (e.g. someone literally named a folder "bbbmemz (bbb)"), so
+        // this keeps incrementing until it lands on a name nobody's using yet, rather than assuming the
+        // first suffix attempt always works.
+        let candidate = `${requestedName} (${connectingUsername})`;
+        let suffix = 2;
+        while (taken(candidate)) {
+            if (takenByOwnIdentity(candidate)) {
+                throw new Error(`a memory folder named "${candidate}" already exists`);
+            }
+            candidate = `${requestedName} (${connectingUsername}) ${suffix}`;
+            suffix++;
+        }
+        return candidate;
+    }
+    /**
+     * Registers a new folder: appends it, scans it once, and starts watching it live. A purely LOCAL
+     * folder (no folderfoo login involved) has no "different identity" to auto-suffix against — any
+     * collision here is unconditionally a plain rejection, unlike registerRemoteFolder's own
+     * resolveAvailableName.
+     */
+    addFolder(folder, options) {
+        if (!options?.skipCollisionCheck && this.folders.some((f) => f.name === folder.name)) {
             throw new Error(`a memory folder named "${folder.name}" already exists`);
         }
         this.folders.push(folder);
@@ -349,17 +404,30 @@ export class MemoryRepository {
         }
         params.push(limit, offset);
         try {
+            // shared_items is LEFT JOINed on m.source_path (== mirror_path for an item-level share —
+            // see remote/shared-items.ts) to surface owner/role on any hit that came from a share, since
+            // a shared item's own `folder` column is always '' (its mirror path is outside every
+            // configured source directory, so folderForFile can't attribute it to one) and would
+            // otherwise look identical to any other unfoldered local doc.
             const rows = this.db
                 .prepare(`SELECT m.source_path, m.key, m.description, m.doc_type, m.folder,
                   snippet(search_index, 3, '<<', '>>', '…', 20) AS snippet,
-                  -bm25(search_index) AS score
+                  -bm25(search_index) AS score,
+                  si.owner AS shared_owner,
+                  si.role AS shared_role
            FROM search_index
            JOIN memory_docs m ON m.source_path = search_index.ref_id
+           LEFT JOIN shared_items si ON si.status = 'active' AND si.mirror_path = m.source_path
            WHERE search_index.ref_table = 'memory_docs' AND search_index MATCH ? ${conditions.map((c) => `AND ${c}`).join(' ')}
            ORDER BY bm25(search_index)
            LIMIT ? OFFSET ?`)
                 .all(...params);
-            return rows.map(({ source_path, ...rest }) => ({ ...rest, filename: path.basename(source_path) }));
+            return rows.map(({ source_path, shared_owner, shared_role, ...rest }) => ({
+                ...rest,
+                filename: path.basename(source_path),
+                shared_owner: shared_owner ?? undefined,
+                shared_role: shared_role ?? undefined,
+            }));
         }
         catch (err) {
             throw new SearchQueryError(query, err);
@@ -399,7 +467,7 @@ export class MemoryRepository {
         // edits). Must parse it exactly like a local file read would.
         let raw;
         try {
-            raw = await readRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name);
+            raw = await readRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name, remote.owner);
         }
         catch (err) {
             // Also try the LEGACY extensionless remote name — a doc pushed before the
@@ -409,7 +477,7 @@ export class MemoryRepository {
             // FolderfooAuthError or any other failure, which must surface as-is.
             if (!(err instanceof FolderfooRequestError) || err.status !== 404 || !name.endsWith('.md'))
                 throw err;
-            raw = await readRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name.slice(0, -3));
+            raw = await readRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name.slice(0, -3), remote.owner);
         }
         const liveBody = matter(raw).content.trim();
         return { ...doc, body: liveBody };
@@ -498,7 +566,7 @@ export class MemoryRepository {
             // Confirms the remote folder still exists before writing — folderfoo's own save endpoint
             // would otherwise silently recreate a deleted folder rather than failing (see
             // assertRemoteFolderExists's doc comment).
-            await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, targetFolder.name);
+            await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, targetFolder.name, remote.owner);
             // The remote filename keeps the SAME name (including .md) as the local mirror file — no
             // extension stripping. Historically this stripped ".md" to match the old opaque id (which
             // never carried an extension), which meant a memory doc's OWN remote file was named
@@ -511,7 +579,7 @@ export class MemoryRepository {
             const relPath = path.relative(remote.mirrorDir, filePath);
             const dir = joinRemoteFolderPath(remote.folderPath, path.dirname(relPath));
             const name = path.basename(relPath);
-            await writeRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name, fileContents);
+            await writeRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name, fileContents, remote.owner);
         }, () => {
             fs.mkdirSync(targetDir, { recursive: true });
             fs.writeFileSync(filePath, fileContents, 'utf-8');
@@ -556,12 +624,12 @@ export class MemoryRepository {
         await writeRemoteThenLocal(async () => {
             if (!remote || !this.credentialsBaseDir)
                 return;
-            await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, existing.folder);
+            await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, existing.folder, remote.owner);
             // No .md stripping — see create()'s comment.
             const relPath = path.relative(remote.mirrorDir, existing.source_path);
             const dir = joinRemoteFolderPath(remote.folderPath, path.dirname(relPath));
             const name = path.basename(relPath);
-            await writeRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name, fileContents);
+            await writeRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name, fileContents, remote.owner);
         }, () => fs.writeFileSync(existing.source_path, fileContents, 'utf-8'));
         upsertFile(this.db, this.syncSpec, existing.source_path);
         return { ...merged, body: newBody, paused: existingPaused };
@@ -636,11 +704,11 @@ export class MemoryRepository {
         // recoverable if the delete was a mistake.
         const remote = this.remoteFor(existing.folder);
         if (remote && this.credentialsBaseDir) {
-            await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, existing.folder);
+            await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, existing.folder, remote.owner);
             const relPath = path.relative(remote.mirrorDir, existing.source_path);
             const dir = joinRemoteFolderPath(remote.folderPath, path.dirname(relPath));
             const name = path.basename(relPath);
-            await trashRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name);
+            await trashRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name, remote.owner);
         }
         // The sibling wrapper directory exists solely to hold attachments/ for this doc (memory docs
         // are otherwise flat files), so remove the whole wrapper — not just attachments/ — to avoid
@@ -678,13 +746,13 @@ export class MemoryRepository {
         await writeRemoteThenLocal(async () => {
             if (!remote || !this.credentialsBaseDir)
                 return;
-            await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, existing.folder);
+            await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, existing.folder, remote.owner);
             const oldRelPath = path.relative(remote.mirrorDir, existing.source_path);
             const dir = joinRemoteFolderPath(remote.folderPath, path.dirname(oldRelPath));
             const oldName = path.basename(oldRelPath);
             const newName = path.basename(newPath);
             try {
-                await renameRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, oldName, newName);
+                await renameRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, oldName, newName, remote.owner);
             }
             catch (err) {
                 // Same legacy-extensionless fallback as get() above: a doc pushed before the
@@ -694,7 +762,7 @@ export class MemoryRepository {
                 // failure, which must surface as-is.
                 if (!(err instanceof FolderfooRequestError) || err.status !== 404 || !oldName.endsWith('.md'))
                     throw err;
-                await renameRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, oldName.slice(0, -3), newName);
+                await renameRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, oldName.slice(0, -3), newName, remote.owner);
             }
         }, () => {
             fs.renameSync(existing.source_path, newPath);

package/dist/src/remote/folderfoo-client.js

@@ -96,22 +96,81 @@ function folderQuery(tenantId, folderPath, extra) {
     const params = new URLSearchParams({ folderPath, ...extra });
     return params.toString();
 }
-export async function getLastChanged(server, baseDir, tenantId, folderPath) {
-    return withAuth(server, baseDir, (jwt) => fetch(`${server}/folders/last-changed?${folderQuery(tenantId, folderPath)}`, {
+/**
+ * `owner`, when passed, addresses a folder in someone ELSE's tree via a direct-username share —
+ * every folderfoo route below that takes `owner` gates it through the same resolveUserDir/
+ * hasAccess check the file-level `owner` param in filenameParam does (see that function's own
+ * comment). Omitted entirely (not just falsy) for an own-folder call, matching folderfoo's own
+ * `owner ? ... : caller's own dir` branching server-side.
+ */
+export async function getLastChanged(server, baseDir, tenantId, folderPath, owner) {
+    return withAuth(server, baseDir, (jwt) => fetch(`${server}/folders/last-changed?${folderQuery(tenantId, folderPath, owner ? { owner } : undefined)}`, {
         headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId },
     }), async (res) => (await res.json()).lastChanged);
 }
 /**
- * Lists the caller's own folderfoo folders (flat list of full paths, each
- * with a createdAt timestamp - folderfoo's own GET /folders response
- * shape) via folderfoo's existing GET /folders — used by the "connect a
- * folderfoo folder" UI to offer a picker instead of requiring the user to
- * type a raw folder path. Own folders only (no owner param) - browsing
- * INTO a shared folder someone else owns is a separate, not-yet-exposed
- * flow.
+ * Lists folderfoo folders via GET /folders — the caller's own when `owner`/`rootFolder` are
+ * omitted, or a subtree someone else shared with the caller when both are passed (folderfoo gates
+ * this via the same hasAccess check every other shared read uses, requiring `rootFolder` to be a
+ * folder actually shared with the caller). Used by the "connect a folderfoo folder" UI's picker.
+ */
+export async function listFolders(server, baseDir, tenantId, options) {
+    const params = new URLSearchParams();
+    if (options?.owner)
+        params.set('owner', options.owner);
+    if (options?.rootFolder)
+        params.set('rootFolder', options.rootFolder);
+    const qs = params.toString();
+    return withAuth(server, baseDir, (jwt) => fetch(`${server}/folders${qs ? `?${qs}` : ''}`, { headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId } }), (res) => res.json());
+}
+/**
+ * Lists everything (files and folders, from every owner) shared with the
+ * current user via folderfoo's direct-username `shares` mechanism — see
+ * folderfoo's GET /shared-with-me. Used ONLY by an explicit refresh action
+ * (see remote/shared-items.ts's refreshSharedItems) — never polled on a
+ * timer, per the settled "refresh is a UI-only concept" design. role/
+ * originId/kind are null for a plain (non-mcp-memory-bucket) share, e.g. one
+ * created before this feature existed or shared by a different app.
+ */
+export async function getSharedWithMe(server, baseDir, tenantId) {
+    return withAuth(server, baseDir, (jwt) => fetch(`${server}/shared-with-me`, { headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId } }), (res) => res.json());
+}
+/**
+ * Grants another folderfoo user direct access to one of the caller's own memory docs/skills, via
+ * folderfoo's POST /share/:filename — the immediate, no-link-needed half of Phase 4's share UX
+ * (paired with createShareLink/createPublicLink below for the out-of-band half). `kind` tags the
+ * grant so a recipient's shared_items row (see shared-items.ts) never has to guess memory-vs-skill
+ * from content — see folderfoo's shares.js v6->v7 migration for why this exists at all.
  */
-export async function listFolders(server, baseDir, tenantId) {
-    return withAuth(server, baseDir, (jwt) => fetch(`${server}/folders`, { headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId } }), (res) => res.json());
+export async function shareWithUser(server, baseDir, tenantId, folderPath, name, targetUsername, kind, role) {
+    await withAuth(server, baseDir, (jwt) => fetch(`${server}/share/${filenameParam(folderPath, name)}`, {
+        method: 'POST',
+        headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId, 'content-type': 'application/json' },
+        body: JSON.stringify({ username: targetUsername, kind, role }),
+    }), async () => undefined);
+}
+/** Revokes a specific recipient's direct access via folderfoo's DELETE /share/:filename/:username. */
+export async function unshareWithUser(server, baseDir, tenantId, folderPath, name, targetUsername) {
+    await withAuth(server, baseDir, (jwt) => fetch(`${server}/share/${filenameParam(folderPath, name)}/${encodeURIComponent(targetUsername)}`, {
+        method: 'DELETE',
+        headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId },
+    }), async () => undefined);
+}
+/** Creates an out-of-band, login-required collaborator share link via folderfoo's POST /share-links. */
+export async function createShareLink(server, baseDir, tenantId, folderPath, name, kind) {
+    return withAuth(server, baseDir, (jwt) => fetch(`${server}/share-links`, {
+        method: 'POST',
+        headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId, 'content-type': 'application/json' },
+        body: JSON.stringify({ path: joinRemoteFolderPath(folderPath, name), type: 'file', kind }),
+    }), (res) => res.json());
+}
+/** Creates an anonymous, no-login-required public view link via folderfoo's POST /public-links. */
+export async function createPublicLink(server, baseDir, tenantId, folderPath, name, kind) {
+    return withAuth(server, baseDir, (jwt) => fetch(`${server}/public-links`, {
+        method: 'POST',
+        headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId, 'content-type': 'application/json' },
+        body: JSON.stringify({ path: joinRemoteFolderPath(folderPath, name), kind }),
+    }), (res) => res.json());
 }
 /** Thrown when a write targets a remote folder that no longer exists on folderfoo (deleted server-side since the last connect/UI-open sync). */
 export class RemoteFolderGoneError extends Error {
@@ -130,16 +189,26 @@ export class RemoteFolderGoneError extends Error {
  * folder — the user may have deleted it deliberately. `folderPath === ''` (a source's own root) is
  * never gone (the user's account root always exists), so this only ever checks a non-root path.
  */
-export async function assertRemoteFolderExists(server, baseDir, tenantId, folderPath, folderName) {
+export async function assertRemoteFolderExists(server, baseDir, tenantId, folderPath, folderName, owner) {
     if (!folderPath)
         return;
+    // A shared folder's OWN path never appears in listFolders' own-tree result (it isn't a
+    // subdirectory of the caller's root) - list the owner's tree rooted at folderPath instead and
+    // check for a non-empty (i.e. accessible) result, same "does this still resolve" intent as the
+    // own-folder branch below, just via the owner-aware GET /folders shape (see listFolders' comment).
+    if (owner) {
+        await listFolders(server, baseDir, tenantId, { owner, rootFolder: folderPath }).catch(() => {
+            throw new RemoteFolderGoneError(folderName);
+        });
+        return;
+    }
     const folders = await listFolders(server, baseDir, tenantId);
     if (!folders.some((f) => f.path === folderPath)) {
         throw new RemoteFolderGoneError(folderName);
     }
 }
-export async function getChangedSince(server, baseDir, tenantId, folderPath, since) {
-    return withAuth(server, baseDir, (jwt) => fetch(`${server}/folders/changed-since?${folderQuery(tenantId, folderPath, { since: String(since) })}`, {
+export async function getChangedSince(server, baseDir, tenantId, folderPath, since, owner) {
+    return withAuth(server, baseDir, (jwt) => fetch(`${server}/folders/changed-since?${folderQuery(tenantId, folderPath, { since: String(since), ...(owner ? { owner } : {}) })}`, {
         headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId },
     }), async (res) => (await res.json()).files);
 }
@@ -151,7 +220,15 @@ export async function getChangedSince(server, baseDir, tenantId, folderPath, sin
 // itself uses this same form in its own sharing tests for exactly this
 // reason. Always use it here rather than only for the single-segment case,
 // so this client doesn't need to special-case folder depth.
-function filenameParam(folderPath, name) {
+//
+// `owner`, when passed, addresses a path in someone ELSE's directory (a
+// direct-username share, resolved via folderfoo's shares table rather than
+// the caller's own files) - see resolveUserDir on the server side, which
+// treats a bare (owner-less) filename as always the CALLER's own directory.
+// Every other caller of this function addresses its own files and omits it.
+function filenameParam(folderPath, name, owner) {
+    if (owner)
+        return `${encodeURIComponent(owner)}:${folderPath ? encodeURIComponent(folderPath) : ''}:${name}`;
     return folderPath ? `:${encodeURIComponent(folderPath)}:${name}` : name;
 }
 /**
@@ -169,13 +246,24 @@ export function joinRemoteFolderPath(remoteFolderPath, mirrorRelativeDir) {
         return remoteFolderPath;
     return remoteFolderPath ? `${remoteFolderPath}/${mirrorRelativeDir}` : mirrorRelativeDir;
 }
-/** Reads one file's raw content via GET /data/:filename. */
-export async function readFile(server, baseDir, tenantId, folderPath, name) {
-    return withAuth(server, baseDir, (jwt) => fetch(`${server}/data/${filenameParam(folderPath, name)}`, { headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId } }), (res) => res.text());
+/**
+ * Reads one file's raw content via GET /data/:filename. `owner`, when passed, reads a file from
+ * someone ELSE's directory via a direct-username share (see filenameParam's own comment) - used by
+ * shared-items.ts to pull a shared item's content, since the caller here is the share's RECIPIENT,
+ * not the file's owner.
+ */
+export async function readFile(server, baseDir, tenantId, folderPath, name, owner) {
+    return withAuth(server, baseDir, (jwt) => fetch(`${server}/data/${filenameParam(folderPath, name, owner)}`, { headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId } }), (res) => res.text());
 }
-/** Writes one file's raw content via POST /save/:filename. */
-export async function writeFile(server, baseDir, tenantId, folderPath, name, content) {
-    await withAuth(server, baseDir, (jwt) => fetch(`${server}/save/${filenameParam(folderPath, name)}`, {
+/**
+ * Writes one file's raw content via POST /save/:filename. `owner`, when passed, writes into
+ * someone ELSE's directory via a direct-username share (see filenameParam's own comment) — this is
+ * gated 'editor'-role-only server-side (see folderfoo's resolveUserDir(..., 'editor') on this
+ * route), so a 'member' (read-only) shared folder correctly 403s here rather than silently
+ * succeeding against the caller's own directory instead.
+ */
+export async function writeFile(server, baseDir, tenantId, folderPath, name, content, owner) {
+    await withAuth(server, baseDir, (jwt) => fetch(`${server}/save/${filenameParam(folderPath, name, owner)}`, {
         method: 'POST',
         headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId, 'content-type': 'text/markdown' },
         body: content,
@@ -190,8 +278,8 @@ export async function writeFile(server, baseDir, tenantId, folderPath, name, con
  * write those callers already do locally, now also propagated as a real rename remotely, instead
  * of write-new (create) + never delete-old.
  */
-export async function renameFile(server, baseDir, tenantId, folderPath, name, newName) {
-    await withAuth(server, baseDir, (jwt) => fetch(`${server}/rename/${filenameParam(folderPath, name)}`, {
+export async function renameFile(server, baseDir, tenantId, folderPath, name, newName, owner) {
+    await withAuth(server, baseDir, (jwt) => fetch(`${server}/rename/${filenameParam(folderPath, name, owner)}`, {
         method: 'POST',
         headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId, 'content-type': 'application/json' },
         body: JSON.stringify({ newName }),
@@ -206,8 +294,8 @@ export async function renameFile(server, baseDir, tenantId, folderPath, name, ne
  * remote file was never touched at all, so the NEXT poll would pull it right back in, making a
  * "deleted" doc silently reappear.
  */
-export async function trashFile(server, baseDir, tenantId, folderPath, name) {
-    await withAuth(server, baseDir, (jwt) => fetch(`${server}/trash/${filenameParam(folderPath, name)}`, {
+export async function trashFile(server, baseDir, tenantId, folderPath, name, owner) {
+    await withAuth(server, baseDir, (jwt) => fetch(`${server}/trash/${filenameParam(folderPath, name, owner)}`, {
         method: 'POST',
         headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId },
     }), async () => undefined);
@@ -221,8 +309,9 @@ export async function trashFile(server, baseDir, tenantId, folderPath, name) {
  * it as a wildcard path segment, unlike every other folderPath-bearing endpoint in this client
  * (which use a `?folderPath=` query param), because folderfoo's own route is DELETE /folders/*.
  */
-export async function trashFolder(server, baseDir, tenantId, folderPath) {
-    await withAuth(server, baseDir, (jwt) => fetch(`${server}/folders/${folderPath.split('/').map(encodeURIComponent).join('/')}`, {
+export async function trashFolder(server, baseDir, tenantId, folderPath, owner) {
+    const qs = owner ? `?owner=${encodeURIComponent(owner)}` : '';
+    await withAuth(server, baseDir, (jwt) => fetch(`${server}/folders/${folderPath.split('/').map(encodeURIComponent).join('/')}${qs}`, {
         method: 'DELETE',
         headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId },
     }), async () => undefined);
@@ -238,11 +327,11 @@ export async function trashFolder(server, baseDir, tenantId, folderPath) {
  * "memz/old-skill-name" / "memz/new-skill-name"), sent as JSON body fields per folderfoo's own
  * route (unlike the wildcard-path DELETE /folders/* trashFolder uses).
  */
-export async function renameFolder(server, baseDir, tenantId, folderPath, newFolderPath) {
+export async function renameFolder(server, baseDir, tenantId, folderPath, newFolderPath, owner) {
     await withAuth(server, baseDir, (jwt) => fetch(`${server}/folders/rename`, {
         method: 'POST',
         headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId, 'content-type': 'application/json' },
-        body: JSON.stringify({ folderPath, newFolderPath }),
+        body: JSON.stringify({ folderPath, newFolderPath, owner }),
     }), async () => undefined);
 }
 /**
@@ -260,8 +349,8 @@ export async function renameFolder(server, baseDir, tenantId, folderPath, newFol
  * (attach a dotted/hyphenated filename to a doc in a remote folder, then check the folderfoo UI
  * shows it unmangled) before relying on this for anything beyond best-effort.
  */
-export async function writeBinaryFile(server, baseDir, tenantId, folderPath, name, data, mimeType) {
-    await withAuth(server, baseDir, (jwt) => fetch(`${server}/save/${filenameParam(folderPath, name)}`, {
+export async function writeBinaryFile(server, baseDir, tenantId, folderPath, name, data, mimeType, owner) {
+    await withAuth(server, baseDir, (jwt) => fetch(`${server}/save/${filenameParam(folderPath, name, owner)}`, {
         method: 'POST',
         headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId, 'content-type': mimeType },
         body: data,

package/dist/src/remote/remote-sync.js

@@ -71,7 +71,7 @@ function toMirrorRelativeDir(remoteFolderPath, absoluteFolderPath) {
  * missing deletions.
  */
 async function reconcileDeletions(db, spec, folder, credentialsBaseDir) {
-    const remoteFiles = await getChangedSince(folder.server, credentialsBaseDir, folder.tenantId, folder.folderPath, 0);
+    const remoteFiles = await getChangedSince(folder.server, credentialsBaseDir, folder.tenantId, folder.folderPath, 0, folder.owner);
     const remoteRelPaths = new Set(remoteFiles.map((f) => {
         const mirrorRelativeDir = toMirrorRelativeDir(folder.folderPath, f.folderPath);
         return mirrorRelativeDir ? path.join(mirrorRelativeDir, f.name) : f.name;
@@ -169,7 +169,7 @@ async function pullFile(db, spec, folder, credentialsBaseDir, changedFile) {
     // correct value to pass straight through to readFile (folderfoo expects
     // that same absolute form for GET /data/:filename), but it must be
     // converted to mirror-relative before joining onto folder.mirrorDir.
-    const content = await readFile(folder.server, credentialsBaseDir, folder.tenantId, changedFile.folderPath, changedFile.name);
+    const content = await readFile(folder.server, credentialsBaseDir, folder.tenantId, changedFile.folderPath, changedFile.name, folder.owner);
     const mirrorRelativeDir = toMirrorRelativeDir(folder.folderPath, changedFile.folderPath);
     const localFilename = spec.remoteFilename.toLocal(changedFile.name);
     const relPath = mirrorRelativeDir ? path.join(mirrorRelativeDir, localFilename) : localFilename;
@@ -192,9 +192,21 @@ async function pullFile(db, spec, folder, credentialsBaseDir, changedFile) {
  * source's local content cache. All remote sources share one credentials
  * file at credentialsBaseDir, keyed by server URL (see credentials.ts).
  */
-export async function pollOne(db, spec, folder, credentialsBaseDir, options = {}) {
+export async function pollOne(db, spec, folder, credentialsBaseDir, options = {}, 
+// Called when this poll discovers the stored credential is dead (refresh failed, or a second
+// 401 after refresh) — server.ts wires this to identity.clearUsername(). Without it, a dead JWT
+// (e.g. revoked server-side, or expired past its refresh window) leaves IdentityTracker still
+// reporting the OLD username as logged in forever, since nothing previously told it the
+// credential folderfoo-client.ts already gave up on and cleared. That mismatch is exactly what
+// let a remote folder keep showing as visible (isFolderVisible checks identity.current(), not
+// whether the credential still works) even though every real read/write against it was already
+// failing loudly with its own FolderfooAuthError — the folder list and the actual login state
+// silently disagreed until the user manually re-logged-in. Only called once per poll failure,
+// not per retry inside withAuth itself, since pollOne is the layer that already decides to
+// swallow-and-log rather than propagate.
+onAuthExpired) {
     try {
-        const lastChanged = await getLastChanged(folder.server, credentialsBaseDir, folder.tenantId, folder.folderPath);
+        const lastChanged = await getLastChanged(folder.server, credentialsBaseDir, folder.tenantId, folder.folderPath, folder.owner);
         const localWatermark = readLocalWatermark(folder.mirrorDir);
         // force (manual resync, or rebuild-cache) always does real work,
         // including reconcileDeletions - a user explicitly asking to resync
@@ -202,7 +214,7 @@ export async function pollOne(db, spec, folder, credentialsBaseDir, options = {}
         // to equal what we last saw; the whole point of a manual resync is to
         // re-verify against the live state, not trust the cheap check alone.
         if (!options.force && lastChanged <= localWatermark)
-            return; // cheap path: nothing changed since our last sync, no listing call
+            return { ok: true }; // cheap path: nothing changed since our last sync, no listing call
         // force must query since=0, not localWatermark - getChangedSince filters strictly by
         // mtime > since, so a file whose mtime happens to equal (or predate) the local watermark -
         // e.g. a rename/move on folderfoo that doesn't bump mtime, or a file that was wrongly deleted
@@ -210,12 +222,13 @@ export async function pollOne(db, spec, folder, credentialsBaseDir, options = {}
         // be silently invisible to EVERY future poll, forced or not, forever. A real "force resync"
         // has to mean "re-verify everything against the live listing," matching what
         // reconcileDeletions already does unconditionally below.
-        const changed = await getChangedSince(folder.server, credentialsBaseDir, folder.tenantId, folder.folderPath, options.force ? 0 : localWatermark);
+        const changed = await getChangedSince(folder.server, credentialsBaseDir, folder.tenantId, folder.folderPath, options.force ? 0 : localWatermark, folder.owner);
         for (const file of changed) {
             await pullFile(db, spec, folder, credentialsBaseDir, file);
         }
         await reconcileDeletions(db, spec, folder, credentialsBaseDir);
         writeLocalWatermark(folder.mirrorDir, lastChanged);
+        return { ok: true };
     }
     catch (err) {
         if (err instanceof FolderfooAuthError) {
@@ -225,7 +238,14 @@ export async function pollOne(db, spec, folder, credentialsBaseDir, options = {}
             // this source will surface its own FolderfooAuthError directly to
             // the caller regardless of poller state).
             console.error(`[memory-bucket] ${err.message}`);
-            return;
+            onAuthExpired?.();
+            // { ok: false } tells pollAndNotify to skip onSynced for this folder this tick — onSynced
+            // (server.ts's onAttachmentSync) calls memoryRepo.get()/skillRepo.get(), which are gated by
+            // isFolderNameVisible/identity.current(). Calling onAuthExpired above can flip that gate to
+            // "invisible" in this exact tick, so firing onSynced right after would make a perfectly
+            // real, still-on-disk doc look "not found" (a confusing symptom of the SAME auth failure,
+            // not a second bug) rather than the original, more informative FolderfooAuthError.
+            return { ok: false };
         }
         throw err;
     }
@@ -246,11 +266,21 @@ onSynced,
 // fetch/ECONNREFUSED (or worse, succeed against a DIFFERENT server that happens to be listening on
 // that host:port right now) for a source nothing can currently see anyway. Defaults to "always
 // visible" so existing callers/tests that don't care about identity keep working unchanged.
-isVisible = () => true) {
+isVisible = () => true, 
+// Forwarded straight through to every pollOne call this handle makes — see pollOne's own doc
+// comment for why this exists. server.ts wires this to identity.clearUsername().
+onAuthExpired) {
     const byName = new Map(remoteFolders.map((f) => [f.name, f]));
     async function pollAndNotify(folder, options) {
-        await pollOne(db, spec, folder, credentialsBaseDir, options);
-        await onSynced?.(folder);
+        const { ok } = await pollOne(db, spec, folder, credentialsBaseDir, options, onAuthExpired);
+        // Matches this function's own long-standing doc comment above ("NOT called on a failed poll")
+        // — previously not actually enforced, since pollOne swallowed a FolderfooAuthError internally
+        // and returned normally either way, so onSynced fired even on a failed poll. Surfaced as a
+        // real bug once onAuthExpired started clearing identity mid-tick (see pollOne's { ok: false }
+        // comment) — onSynced's memoryRepo.get()/skillRepo.get() calls are gated by that same identity,
+        // so firing it right after a just-failed poll could report a perfectly real doc as "not found".
+        if (ok)
+            await onSynced?.(folder);
     }
     const interval = setInterval(() => {
         for (const folder of remoteFolders) {