fix(folders): large-scale audit fixes across locking engine and folder orchestration

- resource-lock.ts: fix ancestor-walk short-circuit that let a locked ancestor
  go unnoticed when bypassing a direct lock on the target itself (affects
  assertFolderMutableUnlessUnlocking/assertResourceMutableUnlessUnlocking)
- workflow.ts: thread the inherited flag through WorkflowLockedError (was
  always false)
- folders/orchestration.ts: recheck cycle-freedom inside the transaction for
  kb/table folder reparents (was only checked against a stale pre-tx read);
  add missing recordAudit + 409-on-duplicate-name for kb/table folder
  create/update
- workflows/persistence/duplicate.ts: assertTargetFolderMutable now scopes by
  resourceType='workflow' and row-locks the ancestor chain (was letting a
  workflow duplicate reparent into a file/kb/table folder)
- table/service.ts: wrap renameTable's lock checks and write in a transaction
  (was running with no transaction and no FOR UPDATE recheck)
- workflow-lifecycle.ts: wrap performUpdateWorkflow in a transaction with an
  in-tx lock recheck (was relying solely on a non-transactional route
  pre-check)
- knowledge/service.ts: recheck updateKnowledgeBase's lock inside the
  transaction after acquiring the row lock
- workflows/orchestration/folder-lifecycle.ts: check the target folder's own
  lock before cascading into children (was checking only after)
- workspace-files/orchestration/file-folder-lifecycle.ts: propagate the real
  errorCode from performRestoreFolder instead of hardcoding not_found
- uploads/contexts/workspace/workspace-file-folder-manager.ts: fix missing
  import of assertFolderMutableUnlessUnlocking (broke typecheck)
- hooks/queries/folders.ts: invalidate the correct resource-type-scoped list
  on folder delete/restore instead of always invalidating workflow lists
- knowledge.tsx: folder rows now honor the active sort column/direction
- background/cleanup-soft-deletes.ts: hard-delete retention now covers
  file/table/knowledge_base folders, not just workflow folders
- workspace-vfs.ts: surface archived table/knowledge_base folders under
  recently-deleted/ so they can be discovered and restored
- table API routes: include folderId/locked in create and detail responses
- schema.mock.ts: add missing folderId/locked to workspaceFiles/knowledgeBase/
  userTableDefinitions mocks
- add regression test coverage for the resource-lock ancestor-walk fix and
  update table service tests for the new transactional renameTable call shape

Author: waleedlatif1

apps/sim/app/api/table/[tableId]/route.ts

@@ -67,6 +67,7 @@ export const GET = withRouteHandler(async (request: NextRequest, { params }: Tab
           metadata: table.metadata ?? null,
           rowCount: table.rowCount,
           maxRows: maxRowsPerTable,
+          folderId: table.folderId,
           locked: table.locked,
           createdAt:
             table.createdAt instanceof Date

apps/sim/app/api/table/route.ts

@@ -129,6 +129,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           },
           rowCount: table.rowCount,
           maxRows: table.maxRows,
+          folderId: table.folderId,
+          locked: table.locked,
           createdAt:
             table.createdAt instanceof Date
               ? table.createdAt.toISOString()

apps/sim/app/workspace/[workspaceId]/knowledge/knowledge.tsx

@@ -324,8 +324,20 @@ export function Knowledge() {
           folder.name.toLowerCase().includes(debouncedSearchQuery.toLowerCase())
         )
       : siblings
-    return [...searched].sort((a, b) => a.name.localeCompare(b.name))
-  }, [folders, currentFolderId, debouncedSearchQuery])
+    const col = activeSort?.column ?? 'name'
+    const dir = activeSort?.direction ?? 'asc'
+    return [...searched].sort((a, b) => {
+      let cmp = 0
+      if (col === 'updated') {
+        cmp = new Date(a.updatedAt).getTime() - new Date(b.updatedAt).getTime()
+      } else if (col === 'created') {
+        cmp = new Date(a.createdAt).getTime() - new Date(b.createdAt).getTime()
+      } else {
+        cmp = a.name.localeCompare(b.name)
+      }
+      return dir === 'asc' ? cmp : -cmp
+    })
+  }, [folders, currentFolderId, debouncedSearchQuery, activeSort])
 
   const processedKBs = useMemo(() => {
     let result = filterKnowledgeBases(knowledgeBases, debouncedSearchQuery).filter(

apps/sim/background/cleanup-soft-deletes.ts

@@ -139,11 +139,34 @@ const CLEANUP_TARGETS = [
     table: workflowFolder,
     softDeleteCol: workflowFolder.deletedAt,
     wsCol: workflowFolder.workspaceId,
-    // `folder` is now a polymorphic table shared with file/knowledge_base/table
-    // folders — scope hard-delete to workflow folders only.
+    // `folder` is now a polymorphic table shared across all four resourceTypes --
+    // each resourceType gets its own CLEANUP_TARGETS entry (below) scoped by
+    // `extraPredicate` so every resourceType's soft-deleted folders eventually get
+    // purged, not just workflow's.
     extraPredicate: eq(workflowFolder.resourceType, 'workflow'),
     name: 'workflowFolder',
   },
+  {
+    table: workflowFolder,
+    softDeleteCol: workflowFolder.deletedAt,
+    wsCol: workflowFolder.workspaceId,
+    extraPredicate: eq(workflowFolder.resourceType, 'file'),
+    name: 'fileFolder',
+  },
+  {
+    table: workflowFolder,
+    softDeleteCol: workflowFolder.deletedAt,
+    wsCol: workflowFolder.workspaceId,
+    extraPredicate: eq(workflowFolder.resourceType, 'knowledge_base'),
+    name: 'knowledgeBaseFolder',
+  },
+  {
+    table: workflowFolder,
+    softDeleteCol: workflowFolder.deletedAt,
+    wsCol: workflowFolder.workspaceId,
+    extraPredicate: eq(workflowFolder.resourceType, 'table'),
+    name: 'tableFolder',
+  },
   {
     table: knowledgeBase,
     softDeleteCol: knowledgeBase.deletedAt,

apps/sim/hooks/queries/folders.ts

@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
+import type { QueryClient } from '@tanstack/react-query'
 import { keepPreviousData, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { requestJson } from '@/lib/api/client/request'
 import {
@@ -13,17 +14,44 @@ import {
   restoreFolderContract,
   updateFolderContract,
 } from '@/lib/api/contracts'
+import { knowledgeKeys } from '@/hooks/queries/kb/knowledge'
 import { getFolderMap } from '@/hooks/queries/utils/folder-cache'
 import { type FolderQueryScope, folderKeys } from '@/hooks/queries/utils/folder-keys'
 import { invalidateWorkflowLists } from '@/hooks/queries/utils/invalidate-workflow-lists'
 import {
   createOptimisticMutationHandlers,
   generateTempId,
 } from '@/hooks/queries/utils/optimistic-mutation'
+import { tableKeys } from '@/hooks/queries/utils/table-keys'
 import { getTopInsertionSortOrder } from '@/hooks/queries/utils/top-insertion-sort-order'
 import { getWorkflows } from '@/hooks/queries/utils/workflow-cache'
+import { workspaceFilesKeys } from '@/hooks/queries/workspace-files'
 import type { Folder } from '@/stores/folders/types'
 
+/**
+ * A folder delete/restore cascades to the resources it contains -- invalidate the
+ * resource-type-scoped list (not just the folder list itself) so those cascaded
+ * changes show up without a manual refetch.
+ */
+function invalidateResourceListsForFolder(
+  queryClient: QueryClient,
+  workspaceId: string,
+  resourceType: FolderResourceType = DEFAULT_FOLDER_RESOURCE_TYPE
+) {
+  switch (resourceType) {
+    case 'workflow':
+      return invalidateWorkflowLists(queryClient, workspaceId, ['active', 'archived'])
+    case 'table':
+      return queryClient.invalidateQueries({ queryKey: tableKeys.lists() })
+    case 'knowledge_base':
+      return queryClient.invalidateQueries({ queryKey: knowledgeKeys.lists() })
+    case 'file':
+      return queryClient.invalidateQueries({ queryKey: workspaceFilesKeys.lists() })
+    default:
+      return Promise.resolve()
+  }
+}
+
 const logger = createLogger('FolderQueries')
 
 export const FOLDER_LIST_STALE_TIME = 60 * 1000
@@ -268,7 +296,11 @@ export function useDeleteFolderMutation() {
     },
     onSettled: (_data, _error, variables) => {
       queryClient.invalidateQueries({ queryKey: folderKeys.lists() })
-      return invalidateWorkflowLists(queryClient, variables.workspaceId, ['active', 'archived'])
+      return invalidateResourceListsForFolder(
+        queryClient,
+        variables.workspaceId,
+        variables.resourceType
+      )
     },
   })
 }
@@ -291,7 +323,11 @@ export function useRestoreFolder() {
     },
     onSettled: (_data, _error, variables) => {
       queryClient.invalidateQueries({ queryKey: folderKeys.lists() })
-      return invalidateWorkflowLists(queryClient, variables.workspaceId, ['active', 'archived'])
+      return invalidateResourceListsForFolder(
+        queryClient,
+        variables.workspaceId,
+        variables.resourceType
+      )
     },
   })
 }

apps/sim/lib/copilot/vfs/workspace-vfs.ts

@@ -2235,6 +2235,8 @@ export class WorkspaceVFS {
         archivedFiles,
         archivedFileFolders,
         archivedKBs,
+        archivedTableFolders,
+        archivedKnowledgeBaseFolders,
       ] = await Promise.all([
         listWorkflows(workspaceId, { scope: 'archived' }),
         db
@@ -2255,6 +2257,38 @@ export class WorkspaceVFS {
         listWorkspaceFiles(workspaceId, { scope: 'archived' }),
         listWorkspaceFileFolders(workspaceId, { scope: 'archived' }),
         getKnowledgeBases(userId, workspaceId, 'archived'),
+        // `table`/`knowledge_base` folders live in the same polymorphic `folder`
+        // table as workflow folders -- without these, an archived table/KB folder
+        // is invisible under `recently-deleted/` and the agent has no way to
+        // discover it in order to restore it.
+        db
+          .select({
+            id: workflowFolder.id,
+            name: workflowFolder.name,
+            archivedAt: workflowFolder.deletedAt,
+          })
+          .from(workflowFolder)
+          .where(
+            and(
+              eq(workflowFolder.workspaceId, workspaceId),
+              eq(workflowFolder.resourceType, 'table'),
+              isNotNull(workflowFolder.deletedAt)
+            )
+          ),
+        db
+          .select({
+            id: workflowFolder.id,
+            name: workflowFolder.name,
+            archivedAt: workflowFolder.deletedAt,
+          })
+          .from(workflowFolder)
+          .where(
+            and(
+              eq(workflowFolder.workspaceId, workspaceId),
+              eq(workflowFolder.resourceType, 'knowledge_base'),
+              isNotNull(workflowFolder.deletedAt)
+            )
+          ),
       ])
 
       for (const wf of archivedWorkflows) {
@@ -2294,6 +2328,40 @@ export class WorkspaceVFS {
         )
       }
 
+      for (const folder of archivedTableFolders) {
+        const safeName = sanitizeName(folder.name)
+        this.files.set(
+          `recently-deleted/table-folders/${safeName}/meta.json`,
+          JSON.stringify(
+            {
+              id: folder.id,
+              name: folder.name,
+              archivedAt: folder.archivedAt,
+              type: 'table_folder',
+            },
+            null,
+            2
+          )
+        )
+      }
+
+      for (const folder of archivedKnowledgeBaseFolders) {
+        const safeName = sanitizeName(folder.name)
+        this.files.set(
+          `recently-deleted/knowledgebase-folders/${safeName}/meta.json`,
+          JSON.stringify(
+            {
+              id: folder.id,
+              name: folder.name,
+              archivedAt: folder.archivedAt,
+              type: 'knowledge_base_folder',
+            },
+            null,
+            2
+          )
+        )
+      }
+
       for (const folder of archivedFileFolders) {
         const safePath = folder.path
           .split('/')

apps/sim/lib/folders/orchestration.ts

@@ -765,6 +765,16 @@ export async function performCreateFolder(
       return row
     })
 
+    recordAudit({
+      workspaceId: params.workspaceId,
+      actorId: params.userId,
+      action: AuditAction.FOLDER_CREATED,
+      resourceType: AuditResourceType.FOLDER,
+      resourceId: created.id,
+      resourceName: created.name,
+      description: `Created ${cascadeResourceLabel(params.resourceType)} folder "${created.name}"`,
+    })
+
     return { success: true, folder: created }
   } catch (error) {
     // Propagate uncaught so the route's ResourceLockedError -> 423 handling applies.
@@ -774,6 +784,13 @@ export async function performCreateFolder(
     if (error instanceof FolderParentNotFoundError) {
       return { success: false, error: error.message, errorCode: 'validation' }
     }
+    if (getPostgresErrorCode(error) === '23505') {
+      return {
+        success: false,
+        error: 'A folder with this name already exists in this location',
+        errorCode: 'conflict',
+      }
+    }
     throw error
   }
 }
@@ -862,6 +879,21 @@ export async function performUpdateFolder(
         if (!targetParent) {
           throw new FolderParentNotFoundError('Parent folder not found')
         }
+
+        // The cycle check above (`checkFolderCircularReference`) ran against an
+        // unlocked pre-transaction snapshot -- a concurrent reparent could form a
+        // cycle in the window between that read and this transaction (the batch
+        // reorder path was hardened against exactly this race). Re-run it here
+        // against `tx` so it observes the same FOR-UPDATE-locked parent chain this
+        // transaction is about to write.
+        const wouldCreateCycleInTx = await checkFolderCircularReference(
+          params.folderId,
+          params.parentId,
+          tx
+        )
+        if (wouldCreateCycleInTx) {
+          throw new FolderCycleError('Cannot create circular folder reference')
+        }
       }
 
       const [row] = await tx
@@ -880,6 +912,17 @@ export async function performUpdateFolder(
     })
 
     if (!updated) return { success: false, error: 'Folder not found', errorCode: 'not_found' }
+
+    recordAudit({
+      workspaceId: params.workspaceId,
+      actorId: params.userId,
+      action: AuditAction.FOLDER_UPDATED,
+      resourceType: AuditResourceType.FOLDER,
+      resourceId: updated.id,
+      resourceName: updated.name,
+      description: `Updated ${cascadeResourceLabel(params.resourceType)} folder "${updated.name}"`,
+    })
+
     return { success: true, folder: updated }
   } catch (error) {
     // Propagate uncaught so the route's ResourceLockedError -> 423 handling applies.
@@ -889,6 +932,16 @@ export async function performUpdateFolder(
     if (error instanceof FolderParentNotFoundError) {
       return { success: false, error: error.message, errorCode: 'validation' }
     }
+    if (error instanceof FolderCycleError) {
+      return { success: false, error: error.message, errorCode: 'validation' }
+    }
+    if (getPostgresErrorCode(error) === '23505') {
+      return {
+        success: false,
+        error: 'A folder with this name already exists in this location',
+        errorCode: 'conflict',
+      }
+    }
     throw error
   }
 }
@@ -935,7 +988,7 @@ class FolderParentNotFoundError extends Error {}
 /** Marks a concurrent-deletion race caught inside the reorder transaction as a 404, not a 500. */
 class FolderReorderNotFoundError extends Error {}
 /** Marks a cycle caught inside the reorder transaction as a 400, not a 500. */
-class FolderReorderCycleError extends Error {}
+class FolderCycleError extends Error {}
 /** Marks a closure that went stale between discovery and locking, caught inside the reorder transaction, as a 409, not a 500. */
 class FolderReorderStaleClosureError extends Error {}
 
@@ -1111,7 +1164,7 @@ export async function performReorderFolders(params: PerformReorderFoldersParams)
         let cursor: string | null = update.id
         while (cursor) {
           if (visited.has(cursor)) {
-            throw new FolderReorderCycleError('Cannot create circular folder reference')
+            throw new FolderCycleError('Cannot create circular folder reference')
           }
           visited.add(cursor)
           cursor = lockedParentById.get(cursor) ?? null
@@ -1148,7 +1201,7 @@ export async function performReorderFolders(params: PerformReorderFoldersParams)
     if (error instanceof FolderReorderNotFoundError) {
       return { success: false, updated: 0, error: error.message, errorCode: 'not_found' }
     }
-    if (error instanceof FolderReorderCycleError) {
+    if (error instanceof FolderCycleError) {
       return { success: false, updated: 0, error: error.message, errorCode: 'validation' }
     }
     if (error instanceof FolderReorderStaleClosureError) {