mcp-memory-bucket 0.8.4 → 0.8.7

package/dist/src/store/db.js

@@ -2,9 +2,10 @@ import Database from 'better-sqlite3';
 export function openCache(dbPath) {
     const db = new Database(dbPath);
     db.pragma('journal_mode = WAL');
+    ensureSkillsCompoundKey(db);
     db.exec(`
     CREATE TABLE IF NOT EXISTS skills (
-      id TEXT PRIMARY KEY,            -- == SKILL.md "name" field == parent folder name
+      id TEXT NOT NULL,               -- == SKILL.md "name" field == parent folder name
       description TEXT NOT NULL,      -- required by the agentskills.io spec
       owner TEXT,
       status TEXT NOT NULL,
@@ -18,7 +19,8 @@ export function openCache(dbPath) {
       created_at TEXT,
       attachments TEXT,               -- JSON array of AttachmentEntry, mirrors frontmatter
       body TEXT NOT NULL,
-      mtime_ms INTEGER NOT NULL
+      mtime_ms INTEGER NOT NULL,
+      PRIMARY KEY (folder, id)        -- name is unique PER FOLDER, not globally — see skill_get's folder param
     );
 
     CREATE TABLE IF NOT EXISTS memory_docs (
@@ -45,6 +47,7 @@ export function openCache(dbPath) {
     CREATE VIRTUAL TABLE IF NOT EXISTS search_index USING fts5(
       ref_table UNINDEXED,
       ref_id UNINDEXED,
+      ref_folder UNINDEXED,
       description,
       body,
       tags,
@@ -55,12 +58,14 @@ export function openCache(dbPath) {
     CREATE TABLE IF NOT EXISTS doc_dates (
       ref_table TEXT NOT NULL,
       ref_id TEXT NOT NULL,
+      ref_folder TEXT NOT NULL DEFAULT '',
       date TEXT NOT NULL
     );
 
     CREATE INDEX IF NOT EXISTS idx_doc_dates_date ON doc_dates(date);
-    CREATE INDEX IF NOT EXISTS idx_doc_dates_ref ON doc_dates(ref_table, ref_id);
+    CREATE INDEX IF NOT EXISTS idx_doc_dates_ref ON doc_dates(ref_table, ref_id, ref_folder);
   `);
+    ensureDocDatesHasRefFolderColumn(db);
     ensureColumns(db, 'skills', [
         ['folder', "TEXT NOT NULL DEFAULT ''"],
         ['deprecated', 'INTEGER NOT NULL DEFAULT 0'],
@@ -80,21 +85,26 @@ export function openCache(dbPath) {
     return db;
 }
 /**
- * search_index is an FTS5 virtual table — existing cache files created before the `key` column
- * existed need it added. FTS5 doesn't support ALTER TABLE ADD COLUMN reliably across versions, and
- * search_index is a disposable cache (rebuilt from skills/memory_docs, not the source of truth), so
- * the simplest safe migration is: drop and recreate with the new schema, then let backfillSearchIndex
- * repopulate everything.
+ * search_index is an FTS5 virtual table — existing cache files created before the `key` or
+ * `ref_folder` column existed need it added. `ref_folder` was added alongside skills' compound
+ * (folder, id) key (see ensureSkillsCompoundKey's doc comment): once two different folders can
+ * legitimately have a skill sharing the same `id`, ref_id alone no longer uniquely identifies a
+ * search_index row, so ref_folder joins ref_table/ref_id as part of every lookup/delete on this
+ * table. FTS5 doesn't support ALTER TABLE ADD COLUMN reliably across versions, and search_index is
+ * a disposable cache (rebuilt from skills/memory_docs, not the source of truth), so the simplest
+ * safe migration is: drop and recreate with the new schema, then let backfillSearchIndex repopulate
+ * everything.
  */
 function ensureSearchIndexHasKeyColumn(db) {
     const cols = db.prepare(`PRAGMA table_info(search_index)`).all();
-    if (cols.length === 0 || cols.some((c) => c.name === 'key'))
+    if (cols.length === 0 || (cols.some((c) => c.name === 'key') && cols.some((c) => c.name === 'ref_folder')))
         return; // fresh table, or already migrated
     db.exec(`DROP TABLE search_index`);
     db.exec(`
     CREATE VIRTUAL TABLE search_index USING fts5(
       ref_table UNINDEXED,
       ref_id UNINDEXED,
+      ref_folder UNINDEXED,
       description,
       body,
       tags,
@@ -103,6 +113,34 @@ function ensureSearchIndexHasKeyColumn(db) {
     );
   `);
 }
+/**
+ * Migration for cache files created before doc_dates had a ref_folder column — same reason as
+ * search_index's ref_folder addition above (ensureSearchIndexHasKeyColumn's doc comment). Unlike
+ * search_index, doc_dates is a plain table, so a simple ALTER TABLE ADD COLUMN suffices; no drop
+ * needed. Existing rows backfill to '' (unscoped), which is safe: the only NEW ambiguity ref_folder
+ * resolves is a skill-name collision across folders, and any pre-existing doc_dates row predates
+ * that possibility (skills only just gained a compound key), so nothing has been misattributed yet.
+ */
+function ensureDocDatesHasRefFolderColumn(db) {
+    const cols = db.prepare(`PRAGMA table_info(doc_dates)`).all();
+    if (cols.length === 0 || cols.some((c) => c.name === 'ref_folder'))
+        return; // fresh table, or already migrated
+    db.exec(`ALTER TABLE doc_dates ADD COLUMN ref_folder TEXT NOT NULL DEFAULT ''`);
+}
+/**
+ * Migration for cache files created before `skills` had a compound (folder, id) PRIMARY KEY — name
+ * uniqueness moved from global to per-folder (see relocate's folder-scoping fix), so the old bare-`id`
+ * key must become (folder, id). `skills` is a disposable cache fully rebuilt from SKILL.md files on
+ * disk (initialScan/the file watcher repopulate it), so — same precedent as
+ * ensureSearchIndexHasKeyColumn's search_index migration — the simplest safe migration is to drop and
+ * let the normal scan repopulate, rather than hand-writing a data-preserving ALTER TABLE.
+ */
+function ensureSkillsCompoundKey(db) {
+    const pk = db.prepare(`PRAGMA table_info(skills)`).all().filter((c) => c.pk > 0);
+    if (pk.length === 0 || pk.some((c) => c.name === 'folder'))
+        return; // fresh table, or already migrated to the compound key
+    db.exec(`DROP TABLE skills`);
+}
 /** Migration for cache files created before a given column existed. Safe to call every startup. */
 function ensureColumns(db, table, columns) {
     const existing = new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name));
@@ -116,17 +154,17 @@ function backfillSearchIndex(db) {
     const { count: indexed } = db.prepare(`SELECT COUNT(*) as count FROM search_index`).get();
     if (indexed > 0)
         return;
-    const skillRows = db.prepare(`SELECT id, description, body, tags FROM skills`).all();
+    const skillRows = db.prepare(`SELECT id, folder, description, body, tags FROM skills`).all();
     const memoryRows = db.prepare(`SELECT id, key, description, body, tags FROM memory_docs`).all();
     if (skillRows.length === 0 && memoryRows.length === 0)
         return;
-    const insert = db.prepare(`INSERT INTO search_index (ref_table, ref_id, description, body, tags, key) VALUES (?, ?, ?, ?, ?, ?)`);
+    const insert = db.prepare(`INSERT INTO search_index (ref_table, ref_id, ref_folder, description, body, tags, key) VALUES (?, ?, ?, ?, ?, ?, ?)`);
     const insertAll = db.transaction(() => {
         for (const row of skillRows) {
-            insert.run('skills', row.id, row.description, row.body, flattenTags(row.tags), '');
+            insert.run('skills', row.id, row.folder, row.description, row.body, flattenTags(row.tags), '');
         }
         for (const row of memoryRows) {
-            insert.run('memory_docs', row.id, row.description, row.body, flattenTags(row.tags), row.key);
+            insert.run('memory_docs', row.id, '', row.description, row.body, flattenTags(row.tags), row.key);
         }
     });
     insertAll();

package/dist/src/store/search.js

@@ -93,17 +93,20 @@ export function searchByDate(db, start, end, opts = {}) {
         params.push(table);
     params.push(limit, offset);
     const rows = db
-        .prepare(`SELECT ref_table, ref_id, MIN(date) AS matched_date
+        .prepare(`SELECT ref_table, ref_id, ref_folder, MIN(date) AS matched_date
        FROM doc_dates
        WHERE date BETWEEN ? AND ? ${table ? 'AND ref_table = ?' : ''}
-       GROUP BY ref_table, ref_id
+       GROUP BY ref_table, ref_id, ref_folder
        ORDER BY matched_date
        LIMIT ? OFFSET ?`)
         .all(...params);
     return rows.map((row) => {
-        const bodyRow = db
-            .prepare(`SELECT body FROM ${row.ref_table} WHERE id = ?`)
-            .get(row.ref_id);
+        // Scoped by ref_folder for skills (compound key: a bare `id` can match two different
+        // folders' same-named skills — see doc_dates'/search_index's ref_folder column). memory_docs
+        // ids never collide, so ref_folder is always '' there and the extra condition is a no-op.
+        const bodyRow = (row.ref_table === 'skills'
+            ? db.prepare(`SELECT body FROM skills WHERE id = ? AND folder = ?`).get(row.ref_id, row.ref_folder)
+            : db.prepare(`SELECT body FROM memory_docs WHERE id = ?`).get(row.ref_id));
         return {
             ref_table: row.ref_table,
             ref_id: row.ref_id,
@@ -128,7 +131,7 @@ export function searchCombined(db, query, limit = 20, offset = 0) {
                 snippet(search_index, 3, '<<', '>>', '…', 20) AS snippet,
                 -bm25(search_index) AS score
          FROM search_index
-         LEFT JOIN skills s ON search_index.ref_table = 'skills' AND s.id = search_index.ref_id
+         LEFT JOIN skills s ON search_index.ref_table = 'skills' AND s.id = search_index.ref_id AND s.folder = search_index.ref_folder
          LEFT JOIN memory_docs m ON search_index.ref_table = 'memory_docs' AND m.id = search_index.ref_id
          WHERE search_index MATCH ?
          ORDER BY bm25(search_index)

package/dist/src/store/sync.js

@@ -104,37 +104,50 @@ export function upsertFile(db, spec, filePath) {
         console.error(`[memory-bucket] skipping ${filePath}: missing required id field in frontmatter`);
         return;
     }
-    // id/name is the table's real PRIMARY KEY (used as the sole addressing
-    // handle across the whole public API - skill_get(name), memory_get(id),
-    // etc.), so a DIFFERENT file claiming the same id is a genuine name
-    // collision across configured folders/sources, not a re-scan of the same
-    // file. The ON CONFLICT(id) below would otherwise silently overwrite
-    // whichever row synced first - the first-synced item's row (and its
-    // full content) simply vanishes from the cache with no error and no way
-    // to address it, since id is the only lookup key this schema has.
-    // Refuse the overwrite and warn loudly instead: the first-synced item
-    // keeps working, the colliding one is visibly excluded rather than
-    // invisibly clobbering it.
-    const existingById = db.prepare(`SELECT source_path FROM ${spec.table} WHERE id = ?`).get(id);
+    const row = spec.toRow(frontmatter, filePath, parsed.mtimeMs);
+    const folder = folderForFile(spec.sources, filePath);
+    // `skills` keys on (folder, id): name is unique PER FOLDER, not globally (see skill_get's
+    // folder param) — two different folders each having a same-named skill is legitimate, so the
+    // collision guard and upsert conflict target both scope by folder too. `memory_docs` keeps a
+    // bare `id` PRIMARY KEY: its id already bakes in a random UUID suffix (memory/repository.ts's
+    // create()), so a genuine id collision there is a practically-impossible coincidence, not the
+    // everyday case skills hits from two folders sharing a human-chosen name.
+    const scopedById = spec.table === 'skills';
+    // id/name is (part of) the table's real PRIMARY KEY (the sole addressing handle across the
+    // whole public API - skill_get(name, folder?), memory_get(id), etc.), so a DIFFERENT file
+    // claiming the same id (within the same folder, for skills) is a genuine collision, not a
+    // re-scan of the same file. The ON CONFLICT below would otherwise silently overwrite whichever
+    // row synced first - the first-synced item's row (and its full content) simply vanishes from
+    // the cache with no error and no way to address it. Refuse the overwrite and warn loudly
+    // instead: the first-synced item keeps working, the colliding one is visibly excluded rather
+    // than invisibly clobbering it.
+    const existingById = (scopedById
+        ? db.prepare(`SELECT source_path FROM ${spec.table} WHERE folder = ? AND id = ?`).get(folder, id)
+        : db.prepare(`SELECT source_path FROM ${spec.table} WHERE id = ?`).get(id));
     if (existingById && existingById.source_path !== filePath) {
-        console.error(`[memory-bucket] SKIPPED indexing ${filePath}: id "${id}" already used by ${existingById.source_path} — ` +
-            `names must be unique across every configured folder. Rename one of these two files (or its frontmatter id/name) to resolve the collision.`);
+        console.error(`[memory-bucket] SKIPPED indexing ${filePath}: id "${id}"${scopedById ? ` in folder "${folder}"` : ''} already used by ${existingById.source_path} — ` +
+            `${scopedById ? 'names must be unique within a folder' : 'ids must be unique across every configured folder'}. Rename one of these two files (or its frontmatter id/name) to resolve the collision.`);
         return;
     }
-    const row = spec.toRow(frontmatter, filePath, parsed.mtimeMs);
-    const folder = folderForFile(spec.sources, filePath);
     const cols = [...spec.columns, 'source_path', 'folder', 'body', 'mtime_ms'];
     const values = [...spec.columns.map((c) => row[c]), filePath, folder, parsed.body, parsed.mtimeMs];
     const placeholders = cols.map(() => '?').join(', ');
     const updateClause = cols
-        .filter((c) => c !== 'id')
+        .filter((c) => c !== 'id' && c !== 'folder')
         .map((c) => `${c} = excluded.${c}`)
         .join(', ');
+    const conflictTarget = scopedById ? 'folder, id' : 'id';
     db.prepare(`INSERT INTO ${spec.table} (${cols.join(', ')}) VALUES (${placeholders})
-     ON CONFLICT(id) DO UPDATE SET ${updateClause}`).run(...values);
-    db.prepare(`DELETE FROM search_index WHERE ref_table = ? AND ref_id = ?`).run(spec.table, id);
-    db.prepare(`INSERT INTO search_index (ref_table, ref_id, description, body, tags, key) VALUES (?, ?, ?, ?, ?, ?)`).run(spec.table, id, String(row.description ?? ''), parsed.body, flattenTags(String(row.tags ?? '[]')), String(row.key ?? ''));
-    db.prepare(`DELETE FROM doc_dates WHERE ref_table = ? AND ref_id = ?`).run(spec.table, id);
+     ON CONFLICT(${conflictTarget}) DO UPDATE SET ${updateClause}`).run(...values);
+    // ref_folder scopes these two tables' delete-then-reinsert the same way the skills upsert above
+    // does: two skills in different folders can now legitimately share an `id`, so ref_id alone is
+    // no longer enough to identify "this file's" search_index/doc_dates rows without also clobbering
+    // the other folder's same-named skill's rows. memory_docs ids never collide (see scopedById's
+    // comment above), so '' (unscoped) is safe there.
+    const refFolder = scopedById ? folder : '';
+    db.prepare(`DELETE FROM search_index WHERE ref_table = ? AND ref_id = ? AND ref_folder = ?`).run(spec.table, id, refFolder);
+    db.prepare(`INSERT INTO search_index (ref_table, ref_id, ref_folder, description, body, tags, key) VALUES (?, ?, ?, ?, ?, ?, ?)`).run(spec.table, id, refFolder, String(row.description ?? ''), parsed.body, flattenTags(String(row.tags ?? '[]')), String(row.key ?? ''));
+    db.prepare(`DELETE FROM doc_dates WHERE ref_table = ? AND ref_id = ? AND ref_folder = ?`).run(spec.table, id, refFolder);
     const dates = new Set(extractDates(parsed.body));
     // created_at is a UTC instant; convert to the OS-local calendar date so it
     // lines up with what a user in this timezone would call "today", matching
@@ -142,17 +155,21 @@ export function upsertFile(db, spec, filePath) {
     if (row.created_at)
         dates.add(toLocalDate(String(row.created_at)));
     if (dates.size > 0) {
-        const insertDate = db.prepare(`INSERT INTO doc_dates (ref_table, ref_id, date) VALUES (?, ?, ?)`);
+        const insertDate = db.prepare(`INSERT INTO doc_dates (ref_table, ref_id, ref_folder, date) VALUES (?, ?, ?, ?)`);
         for (const date of dates)
-            insertDate.run(spec.table, id, date);
+            insertDate.run(spec.table, id, refFolder, date);
     }
 }
 export function removeFile(db, table, filePath) {
-    const existing = db.prepare(`SELECT id FROM ${table} WHERE source_path = ?`).get(filePath);
+    const existing = db.prepare(`SELECT id, folder FROM ${table} WHERE source_path = ?`).get(filePath);
     db.prepare(`DELETE FROM ${table} WHERE source_path = ?`).run(filePath);
     if (existing) {
-        db.prepare(`DELETE FROM search_index WHERE ref_table = ? AND ref_id = ?`).run(table, existing.id);
-        db.prepare(`DELETE FROM doc_dates WHERE ref_table = ? AND ref_id = ?`).run(table, existing.id);
+        // Scoped by folder for the same reason upsertFile's ref_folder is (skills' compound key means
+        // ref_id alone can match another folder's same-named skill) - memory_docs ids never collide so
+        // its rows are always stored/looked-up with ref_folder='', matching backfillSearchIndex.
+        const refFolder = table === 'skills' ? existing.folder : '';
+        db.prepare(`DELETE FROM search_index WHERE ref_table = ? AND ref_id = ? AND ref_folder = ?`).run(table, existing.id, refFolder);
+        db.prepare(`DELETE FROM doc_dates WHERE ref_table = ? AND ref_id = ? AND ref_folder = ?`).run(table, existing.id, refFolder);
     }
 }
 /** Full scan of all configured source dirs — used once at startup before the watcher takes over. */

package/dist/src/web/routes.js

@@ -3,7 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import express from 'express';
 import matter from 'gray-matter';
-import { saveFolder, saveRemoteFolder, removeFolder as removeFolderFromConfig, sanitizeFolderName, mirrorDirFor } from '../config.js';
+import { saveFolder, saveRemoteFolder, removeFolder as removeFolderFromConfig, updateRemoteFolderPath as updateRemoteFolderPathInConfig, sanitizeFolderName, mirrorDirFor, } from '../config.js';
 import { stripKey } from '../memory/repository.js';
 import { initialScan } from '../store/sync.js';
 import { sanitizeFtsQuery } from '../store/search.js';
@@ -122,7 +122,15 @@ function queryTable(db, table, filters, restrictToIds) {
         params.push(filters.paused === '1' ? 1 : 0);
     }
     if (restrictToIds) {
-        where += ` AND id IN (${[...restrictToIds].map(() => '?').join(', ')})`;
+        // Skills restrict on the composite (folder, id) pair — see skillKey's comment — since a bare
+        // `id IN (...)` could match the wrong folder's same-named skill once names are folder-scoped.
+        // memory_docs restricts on plain id, unchanged (its ids never collide across folders).
+        if (table === 'skills') {
+            where += ` AND (folder || '${SKILL_KEY_SEP}' || id) IN (${[...restrictToIds].map(() => '?').join(', ')})`;
+        }
+        else {
+            where += ` AND id IN (${[...restrictToIds].map(() => '?').join(', ')})`;
+        }
         params.push(...restrictToIds);
     }
     if (table === 'skills') {
@@ -166,6 +174,15 @@ function queryTable(db, table, filters, restrictToIds) {
         created_at: r.created_at,
     }));
 }
+// Skills key on (folder, id) — two different folders can legitimately share a skill name — so an
+// id-only restriction set can no longer safely identify "this one skill" for filtering (it would
+// either miss a real match or wrongly include the other folder's same-named skill). Skill entries in
+// these restriction sets are therefore composite `folder\0id` strings; memory_docs entries stay
+// plain ids, since memory_docs.id already bakes in a random UUID suffix and never collides.
+const SKILL_KEY_SEP = '';
+function skillKey(folder, id) {
+    return `${folder}${SKILL_KEY_SEP}${id}`;
+}
 /** Combines two optional id-restriction sets (e.g. from `q` and a date range) into one, when both are present. */
 function intersectIds(a, b) {
     if (!a)
@@ -189,10 +206,13 @@ function matchDateRange(db, from, to) {
         params.push(to);
     }
     const rows = db
-        .prepare(`SELECT DISTINCT ref_table, ref_id FROM doc_dates WHERE ${where}`)
+        .prepare(`SELECT DISTINCT ref_table, ref_id, ref_folder FROM doc_dates WHERE ${where}`)
         .all(...params);
     for (const row of rows) {
-        (row.ref_table === 'skills' ? skills : memory_docs).add(row.ref_id);
+        if (row.ref_table === 'skills')
+            skills.add(skillKey(row.ref_folder, row.ref_id));
+        else
+            memory_docs.add(row.ref_id);
     }
     return { skills, memory_docs };
 }
@@ -203,7 +223,7 @@ function matchSearch(db, q) {
     let rows;
     try {
         rows = db
-            .prepare(`SELECT ref_table, ref_id FROM search_index WHERE search_index MATCH ? ORDER BY rank`)
+            .prepare(`SELECT ref_table, ref_id, ref_folder FROM search_index WHERE search_index MATCH ? ORDER BY rank`)
             .all(sanitizeFtsQuery(q));
     }
     catch {
@@ -211,7 +231,10 @@ function matchSearch(db, q) {
         return { skills, memory_docs };
     }
     for (const row of rows) {
-        (row.ref_table === 'skills' ? skills : memory_docs).add(row.ref_id);
+        if (row.ref_table === 'skills')
+            skills.add(skillKey(row.ref_folder, row.ref_id));
+        else
+            memory_docs.add(row.ref_id);
     }
     return { skills, memory_docs };
 }
@@ -627,12 +650,78 @@ export function buildWebRouter(db, config, skillRepo, memoryRepo, skillSpec, mem
     router.get('/api/config', (_req, res) => {
         res.json({ folderfooMode: config.folderfooMode, folderfooHost: config.folderfooHost });
     });
-    router.get('/api/folders', (_req, res) => {
+    router.get('/api/folders', async (_req, res) => {
+        await pruneDeletedRemoteFolders();
         res.json({
             skill: skillRepo.listFoldersWithRemoteInfo().map((f) => ({ ...f, kind: 'skill' })),
             memory: memoryRepo.listFoldersWithRemoteInfo().map((f) => ({ ...f, kind: 'memory' })),
         });
     });
+    /**
+     * Checked on every web UI open/focus (this route is what the client's mount/load fetches) rather
+     * than on every poll tick — a folder deleted server-side on folderfoo otherwise lingers forever
+     * in mem-bucket's config/UI as a permanently-empty source: the poller's own reconcileDeletions
+     * (remote-sync.ts) already correctly empties out a deleted remote folder's mirrored FILES on its
+     * normal cycle, but nothing previously checked whether the folder itself still exists at all, as
+     * opposed to whether its contents changed.
+     *
+     * Reuses folderfoo's existing GET /folders (via listFolderfooFolders) — one bulk call per
+     * distinct folderfoo server returns every currently-existing folder path for that login, cheaper
+     * than a per-folder existence check would be for an account with many connected sources. Sources
+     * sharing one server (the common case — see credentials.ts, one login per server) dedupe to a
+     * single call. A confirmed-gone folder is auto-removed via the same removeFolder()+
+     * removeFolderFromConfig() pair the manual "✕ remove folder" route above already uses — this
+     * never touches a folder's contents, only mem-bucket's own registration of it (see
+     * removeFolder's doc comment: it drops DB rows + the local mirror dir, never anything the
+     * folder's write path would consider "the user's own content" beyond that mirror).
+     *
+     * Deliberately does NOT run at write time: a write against a since-deleted remote folder instead
+     * fails loudly with its own specific error (see repository create()/update()'s remote-push
+     * handling) rather than silently recreating the folder — auto-recreating on write would silently
+     * undo a deletion the user may have made deliberately, with no visibility that it happened.
+     */
+    async function pruneDeletedRemoteFolders() {
+        const byServer = new Map();
+        for (const [kind, repo] of [
+            ['skill', skillRepo],
+            ['memory', memoryRepo],
+        ]) {
+            for (const remote of repo.listRemoteFolders()) {
+                const list = byServer.get(remote.server) ?? [];
+                list.push({ kind, name: remote.name, folderPath: remote.folderPath, tenantId: remote.tenantId });
+                byServer.set(remote.server, list);
+            }
+        }
+        if (byServer.size === 0)
+            return;
+        for (const [server, sources] of byServer) {
+            let livePaths;
+            try {
+                // Every source on one server shares one login/tenant (credentials.ts is keyed by server
+                // alone), so any one source's tenantId is representative for the whole group's GET /folders
+                // call.
+                const folders = await listFolderfooFolders(server, config.baseDir, sources[0].tenantId);
+                livePaths = new Set(folders.map((f) => f.path));
+            }
+            catch {
+                // Not logged in, network blip, etc. — leave every source on this server untouched rather
+                // than treating "couldn't check" as "confirmed gone."
+                continue;
+            }
+            for (const source of sources) {
+                if (livePaths.has(source.folderPath))
+                    continue;
+                const repo = source.kind === 'skill' ? skillRepo : memoryRepo;
+                try {
+                    repo.removeFolder(source.name);
+                    removeFolderFromConfig(config, source.kind, source.name);
+                }
+                catch (err) {
+                    console.error(`[memory-bucket] failed to auto-remove deleted remote folder "${source.name}":`, err);
+                }
+            }
+        }
+    }
     // Resolves a file opened via folderfoo's own File Open dialog
     // (<folderfoo-profile-circle>'s "folderfoo-file-open" event) back to a
     // memory-bucket doc, so the web UI can select it in the right panel —
@@ -751,6 +840,12 @@ export function buildWebRouter(db, config, skillRepo, memoryRepo, skillSpec, mem
         // already-stamped entries become visible.
         identity.setUsername(decodeUsername(token));
         res.json({ connected: true, server });
+        // Force-resyncs every remote source now that this identity's folders are
+        // visible again, rather than leaving them showing whatever was last
+        // synced until the next fixed poll tick or tab-focus resync. Fired after
+        // responding (best-effort, same posture as the rest of this route) so
+        // login doesn't wait on a round trip to every remote source.
+        Promise.all([remotePollers?.skill?.resyncAll(), remotePollers?.memory?.resyncAll()]).catch(() => { });
     });
     // Signals that the browser's folderfoo login session just ended (the page
     // detects folderfoo's own auth-change event going to logged-out) - clears
@@ -900,6 +995,42 @@ export function buildWebRouter(db, config, skillRepo, memoryRepo, skillSpec, mem
             res.status(404).json({ error: err.message });
         }
     });
+    /**
+     * Reacts to the embedded File Open dialog's `folderfoo-folder-changed` event (rename/move, see
+     * the client's mem-bucket-app.ts listener) — repoints any registered remote source whose
+     * folderPath is the renamed folder itself or nested under it, in BOTH repos (a folderPath rename
+     * has no kind of its own; the same folderfoo path could in principle be connected as a skill
+     * source, a memory source, or both, independently). Unlike DELETE /api/folders above, this never
+     * removes anything — same content, same local mirror, just a different remote path going
+     * forward — matching folderfoo's own rename semantics.
+     *
+     * `server` scopes the match: a folderPath string is only meaningful within one folderfoo
+     * deployment, and a source connected to a different server sharing the same path string by
+     * coincidence must not be touched.
+     */
+    router.post('/api/folders/renamed', (req, res) => {
+        const { server, oldPath, newPath } = req.body;
+        if (!server || oldPath === undefined || !newPath) {
+            res.status(400).json({ error: 'server, oldPath, and newPath are required' });
+            return;
+        }
+        const updated = [];
+        for (const [kind, repo] of [
+            ['skill', skillRepo],
+            ['memory', memoryRepo],
+        ]) {
+            for (const remote of repo.listRemoteFolders()) {
+                if (remote.server !== server)
+                    continue;
+                if (remote.folderPath !== oldPath && !(oldPath && remote.folderPath.startsWith(`${oldPath}/`)))
+                    continue;
+                repo.updateRemoteFolderPath(remote.name, oldPath, newPath);
+                updateRemoteFolderPathInConfig(config, kind, remote.name, oldPath, newPath);
+                updated.push({ kind, name: remote.name, folderPath: repo.listRemoteFolders().find((f) => f.name === remote.name).folderPath });
+            }
+        }
+        res.json({ updated });
+    });
     router.get('/api/fs/list', (req, res) => {
         const requested = req.query.path?.trim();
         const dirPath = requested ? path.resolve(requested) : os.homedir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-memory-bucket",
-  "version": "0.8.4",
+  "version": "0.8.7",
   "type": "module",
   "description": "MCP server exposing skill_* (reusable coding patterns) and memory_* (point-in-time working context) tools over a markdown+frontmatter source, cached into SQLite at runtime.",
   "repository": {