fix(folders): close the findings from the full-diff audit

Migration 0274 reconciles instead of catching up
- The deployed manager writes `workspace_file_folders` EXCLUSIVELY, so `folder`'s file rows
  are frozen at the 0272 snapshot: every rename, move, delete, and restore since then lives
  only in the legacy table. An insert-only catch-up left all of that diverged — renames
  reverted, deleted folders came back as active phantoms, and a stale-active row could hold
  the name a newer folder legitimately took
- That last case was silent: the bare `ON CONFLICT DO NOTHING` swallows a NAME violation as
  readily as an id one, so the newer folder was discarded and every file inside it stranded.
  The conflict target is now `(id)`, so a name collision — which would mean the source
  violated its own unique index — fails loudly instead
- Reconciles by parking mirrored names first, then upserting, so no transient state can
  collide with the partial unique index. Both statements are idempotent, and the header says
  what nothing else would: this has to be run again after the deploy drains, because old pods
  keep writing the legacy table until they are gone

`/api/folders` no longer serves file folders
- Adding `'file'` to `servedFolderResourceTypeSchema` opened a second writer over the same
  rows. It bypassed the `workspace_file_folders:${workspaceId}` advisory lock that makes the
  manager's check-then-write pairs atomic, and it accepted names containing `/`, `\`, `.` and
  `..`, which the file surface forbids because a folder name becomes a path segment — a
  folder named `a/b` is then unreachable by path forever, and breadcrumbs resolve it as two
  segments. The storage cutover never needed a second API, so there isn't one

Conflicts that returned 500
- `v1/admin/workspaces/[id]/import` created its folder with an unserialized SELECT-then-
  INSERT, so two imports sharing a folder path failed the whole import. The name is
  server-chosen, so it now adopts whichever folder won, like `ensureWorkspaceFileFolderPath`
- Folder duplicate never caught 23505. `newId` is client-supplied, so replaying a duplicate
  whose response was lost hit the primary key and returned 500 instead of a 409 the caller
  can act on

Performance
- `knowledgeKeys` moved to `hooks/queries/utils/knowledge-keys.ts`. Reading it from
  `hooks/queries/kb/knowledge` pulled a ~1000-line hook module — and the `@sim/emcn` barrel
  behind it — into `hooks/queries/folders`, which three server prefetches import. That is the
  same import edge the navigation-speed audit measured at 11.8MB per workspace route;
  `tableKeys` already lived in a keys-only module for exactly this reason

Merge drop
- Knowledge never got the chrome Tables did: its prefetch now fetches the folder tree
  alongside the bases, so the list does not paint ungrouped and a `?folderId=` deep link does
  not render an empty breadcrumb, and its loading fallback declares the "New folder" action so
  the header does not shift on hydration

Comments corrected to match reality
- The shared folder row and context menu claimed Files as a consumer; Files still builds its
  own row and routes folders through `FileRowContextMenu`, which the TSDoc now says
- `schema.ts` prescribed a row COUNT comparison before dropping the legacy table. The
  divergence 0274 repairs is in row CONTENTS, which a count check passes straight through

Author: waleedlatif1

apps/sim/app/api/folders/[id]/duplicate/route.ts

@@ -3,6 +3,7 @@ import { db } from '@sim/db'
 import { folder as folderTable, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { FolderLockedError } from '@sim/platform-authz/workflow'
+import { getPostgresErrorCode } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { and, eq, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
@@ -200,6 +201,20 @@ export const POST = withRouteHandler(
         return NextResponse.json({ error: error.message }, { status: error.status })
       }
 
+      /**
+       * `newId` is client-supplied, so replaying a duplicate whose response was lost hits the
+       * primary key rather than the name index. A name collision is equally reachable: dedup
+       * runs before the INSERT, but a concurrent create can take the name in between. Either
+       * way this is a conflict the caller can act on, not a server fault.
+       */
+      if (getPostgresErrorCode(error) === '23505') {
+        logger.warn(`[${requestId}] Folder duplication conflicted`, { sourceFolderId })
+        return NextResponse.json(
+          { error: 'A folder with this name already exists in this location' },
+          { status: 409 }
+        )
+      }
+
       if (error instanceof FolderDuplicationError) {
         logger.warn(`[${requestId}] Folder duplication rejected: ${error.message}`, {
           sourceFolderId,

apps/sim/app/api/v1/admin/workspaces/[id]/import/route.ts

@@ -26,7 +26,7 @@
 import { db } from '@sim/db'
 import { folder as folderTable, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { getErrorMessage } from '@sim/utils/errors'
+import { getErrorMessage, getPostgresErrorCode } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { and, eq, isNull } from 'drizzle-orm'
 import { NextResponse } from 'next/server'
@@ -108,16 +108,42 @@ async function ensureImportFolder(
   if (existing) return existing.id
 
   const folderId = generateId()
-  await db.insert(folderTable).values({
-    id: folderId,
-    resourceType: 'workflow',
-    name,
-    userId,
-    workspaceId,
-    parentId,
-    createdAt: new Date(),
-    updatedAt: new Date(),
-  })
+  try {
+    await db.insert(folderTable).values({
+      id: folderId,
+      resourceType: 'workflow',
+      name,
+      userId,
+      workspaceId,
+      parentId,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    })
+  } catch (error) {
+    /**
+     * The SELECT above is not serialized against this INSERT, so two imports sharing a folder
+     * path race here. The name is server-chosen, not user-chosen, so the right resolution is
+     * to adopt whichever folder won rather than fail the whole import with a 500 — the same
+     * reuse-on-conflict `ensureWorkspaceFileFolderPath` already does.
+     */
+    if (getPostgresErrorCode(error) !== '23505') throw error
+
+    const [concurrent] = await db
+      .select({ id: folderTable.id })
+      .from(folderTable)
+      .where(
+        and(
+          eq(folderTable.workspaceId, workspaceId),
+          eq(folderTable.resourceType, 'workflow'),
+          eq(folderTable.name, name),
+          parentId ? eq(folderTable.parentId, parentId) : isNull(folderTable.parentId),
+          isNull(folderTable.deletedAt)
+        )
+      )
+      .limit(1)
+    if (!concurrent) throw error
+    return concurrent.id
+  }
   return folderId
 }
 

apps/sim/app/workspace/[workspaceId]/components/folders/folder-context-menu.tsx

@@ -32,8 +32,12 @@ interface FolderContextMenuProps {
 }
 
 /**
- * Row context menu for a folder, shared across every foldered resource list so a folder
- * offers the same actions on Knowledge, Tables, and Files.
+ * Row context menu for a folder, shared by the resource lists built on the generic folder
+ * engine — Knowledge and Tables — so a folder offers the same actions on both.
+ *
+ * Files is deliberately not a consumer: its rows carry multi-select and bulk actions, so a
+ * folder there routes through `FileRowContextMenu` alongside the file rows it is selected
+ * with. Converging the two is follow-up work.
  *
  * Mirrors the resource-row menus (`KnowledgeBaseContextMenu`, `FileRowContextMenu`): a
  * `DropdownMenu` anchored to a one-pixel fixed trigger at the cursor, non-modal so the list

apps/sim/app/workspace/[workspaceId]/components/folders/folder-row.tsx

@@ -27,8 +27,10 @@ export interface FolderRowOptions {
 }
 
 /**
- * Builds the canonical folder `ResourceRow` shared by every foldered list, so a folder looks
- * and behaves identically on Knowledge, Tables, and Files. The row id is namespaced by
+ * Builds the canonical folder `ResourceRow` for the lists built on the generic folder engine
+ * (Knowledge and Tables), so a folder looks and behaves identically on both. Files still
+ * builds its own row — it carries a size roll-up and a distinct row-id scheme that also
+ * namespaces file ids. The row id here is namespaced by
  * {@link folderRowId}, so the caller's click/context-menu handlers distinguish a folder from
  * a resource with `parseFolderedRowId` rather than a second lookup.
  *

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-registry.tsx

@@ -22,12 +22,12 @@ import type {
   MothershipResourceType,
 } from '@/app/workspace/[workspaceId]/home/types'
 import { getBareIconStyle, type StyleableIcon } from '@/blocks/icon-color'
-import { knowledgeKeys } from '@/hooks/queries/kb/knowledge'
 import { logKeys } from '@/hooks/queries/logs'
 import { mothershipChatKeys } from '@/hooks/queries/mothership-chats'
 import { scheduleKeys } from '@/hooks/queries/schedules'
 import { folderKeys } from '@/hooks/queries/utils/folder-keys'
 import { invalidateWorkflowLists } from '@/hooks/queries/utils/invalidate-workflow-lists'
+import { knowledgeKeys } from '@/hooks/queries/utils/knowledge-keys'
 import { tableKeys } from '@/hooks/queries/utils/table-keys'
 import { workspaceFileFolderKeys } from '@/hooks/queries/workspace-file-folders'
 import { workspaceFilesKeys } from '@/hooks/queries/workspace-files'

apps/sim/app/workspace/[workspaceId]/knowledge/hooks/use-knowledge-upload.ts

@@ -19,7 +19,7 @@ import {
   WHOLE_FILE_PARALLEL_UPLOADS,
 } from '@/lib/uploads/client/direct-upload'
 import { getFileContentType, isAbortError, isNetworkError } from '@/lib/uploads/utils/file-utils'
-import { knowledgeKeys } from '@/hooks/queries/kb/knowledge'
+import { knowledgeKeys } from '@/hooks/queries/utils/knowledge-keys'
 
 const logger = createLogger('KnowledgeUpload')
 

apps/sim/app/workspace/[workspaceId]/knowledge/loading.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import { Plus } from '@sim/emcn'
-import { Database } from '@sim/emcn/icons'
+import { Database, FolderPlus } from '@sim/emcn/icons'
 import {
   type ChromeActionSpec,
   ResourceChromeFallback,
@@ -17,7 +17,10 @@ const COLUMNS = [
   { id: 'updated', header: 'Last Updated' },
 ]
 
-const ACTIONS: ChromeActionSpec[] = [{ text: 'New base', icon: Plus, variant: 'primary' }]
+const ACTIONS: ChromeActionSpec[] = [
+  { text: 'New folder', icon: FolderPlus },
+  { text: 'New base', icon: Plus, variant: 'primary' },
+]
 
 export default function KnowledgeLoading() {
   return (

apps/sim/app/workspace/[workspaceId]/knowledge/prefetch.ts

@@ -1,28 +1,49 @@
 import type { QueryClient } from '@tanstack/react-query'
+import type { FolderApi } from '@/lib/api/contracts/folders'
 import type { KnowledgeBaseData } from '@/lib/api/contracts/knowledge'
 import { prefetchInternalJson } from '@/app/workspace/[workspaceId]/lib/prefetch-internal-fetch'
-import { KNOWLEDGE_BASE_LIST_STALE_TIME, knowledgeKeys } from '@/hooks/queries/kb/knowledge'
+import { FOLDER_LIST_STALE_TIME, mapFolder } from '@/hooks/queries/folders'
+import { KNOWLEDGE_BASE_LIST_STALE_TIME } from '@/hooks/queries/kb/knowledge'
+import { folderKeys } from '@/hooks/queries/utils/folder-keys'
+import { knowledgeKeys } from '@/hooks/queries/utils/knowledge-keys'
 
 /**
- * Prefetches the workspace's knowledge-bases list under the same query key the
- * client `useKnowledgeBasesQuery` hook uses (scope `active`), so the list paints
- * populated on first render.
+ * Prefetches the workspace's knowledge-bases list AND its knowledge-base folder tree under
+ * the same query keys the client `useKnowledgeBasesQuery` / `useFolders` hooks use (scope
+ * `active`), so the list paints populated on first render.
  *
- * The list carries `Date` fields, so it goes through the `/api/knowledge` route
- * and caches the serialized wire shape — see {@link prefetchInternalJson}.
+ * Both are needed: a base row is only placed correctly relative to the folder rows it sits
+ * beside, so prefetching one without the other still flashes an ungrouped list — and a
+ * `?folderId=` deep link renders an empty breadcrumb until the folders arrive.
+ *
+ * The list carries `Date` fields, so it goes through the `/api/knowledge` route and caches the
+ * serialized wire shape — see {@link prefetchInternalJson}. Folders are mapped with the same
+ * `mapFolder` the hook applies, so the hydrated entry matches a client fetch exactly.
  */
 export async function prefetchKnowledgeBases(
   queryClient: QueryClient,
   workspaceId: string
 ): Promise<void> {
-  await queryClient.prefetchQuery({
-    queryKey: knowledgeKeys.list(workspaceId, 'active'),
-    queryFn: async () => {
-      const result = await prefetchInternalJson<{ data: KnowledgeBaseData[] }>(
-        `/api/knowledge?workspaceId=${workspaceId}&scope=active`
-      )
-      return result.data
-    },
-    staleTime: KNOWLEDGE_BASE_LIST_STALE_TIME,
-  })
+  await Promise.all([
+    queryClient.prefetchQuery({
+      queryKey: knowledgeKeys.list(workspaceId, 'active'),
+      queryFn: async () => {
+        const result = await prefetchInternalJson<{ data: KnowledgeBaseData[] }>(
+          `/api/knowledge?workspaceId=${workspaceId}&scope=active`
+        )
+        return result.data
+      },
+      staleTime: KNOWLEDGE_BASE_LIST_STALE_TIME,
+    }),
+    queryClient.prefetchQuery({
+      queryKey: folderKeys.list(workspaceId, 'active', 'knowledge_base'),
+      queryFn: async () => {
+        const { folders } = await prefetchInternalJson<{ folders?: FolderApi[] }>(
+          `/api/folders?workspaceId=${workspaceId}&scope=active&resourceType=knowledge_base`
+        )
+        return (folders ?? []).map(mapFolder)
+      },
+      staleTime: FOLDER_LIST_STALE_TIME,
+    }),
+  ])
 }

apps/sim/app/workspace/[workspaceId]/lib/prefetch.test.ts

@@ -20,8 +20,8 @@ import { prefetchFilesBrowser } from '@/app/workspace/[workspaceId]/files/prefet
 import { prefetchHomeLists } from '@/app/workspace/[workspaceId]/home/prefetch'
 import { prefetchKnowledgeBases } from '@/app/workspace/[workspaceId]/knowledge/prefetch'
 import { prefetchTables } from '@/app/workspace/[workspaceId]/tables/prefetch'
-import { knowledgeKeys } from '@/hooks/queries/kb/knowledge'
 import { folderKeys } from '@/hooks/queries/utils/folder-keys'
+import { knowledgeKeys } from '@/hooks/queries/utils/knowledge-keys'
 import { tableKeys } from '@/hooks/queries/utils/table-keys'
 import { workspaceFileFolderKeys } from '@/hooks/queries/workspace-file-folders'
 import { workspaceFilesKeys } from '@/hooks/queries/workspace-files'

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/knowledge-base-selector/knowledge-base-selector.tsx

@@ -13,7 +13,8 @@ import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/c
 import { useActiveSearchTarget } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/providers/active-search-target-provider'
 import type { SubBlockConfig } from '@/blocks/types'
 import { useKnowledgeBasesList } from '@/hooks/kb/use-knowledge'
-import { fetchKnowledgeBase, knowledgeKeys } from '@/hooks/queries/kb/knowledge'
+import { fetchKnowledgeBase } from '@/hooks/queries/kb/knowledge'
+import { knowledgeKeys } from '@/hooks/queries/utils/knowledge-keys'
 
 interface KnowledgeBaseSelectorProps {
   blockId: string