MCP: log tail, recent listing errors, and state projection

Three additions that close the biggest gaps an MCP-driven smoke test hit
while verifying the previous SMB volume-id fix end-to-end:

- New `cmdr://logs?since=<iso>&filter=<substring>&limit=<n>` resource: tail
  the live `cmdr.log` from MCP without grepping it off disk. `limit` defaults
  to 100, clamped to 1000. `filter` is case-sensitive substring match (no
  regex dep). `since` drops lines whose ISO-8601 prefix is <= the given
  moment; lines without a recognizable timestamp prefix (Rust panics) are
  kept. Reads the last ~5 MB of the file from the end so a 50 MB rotated log
  doesn't blow up memory.

- `recentErrors:` section in `cmdr://state`: bounded ring buffer (capacity 20)
  of the most recent directory-listing failures, populated from both
  `emit_error` sites in `file_system::listing::streaming` right before the
  `listing-error` Tauri event fires, so MCP sees what the FE sees. Lets tests
  assert "no error since timestamp X" without grepping logs. Lives in the new
  `mcp::listing_errors` module with unit tests for capacity, ordering, and
  the `snapshot_since` filter.

- Query params on `cmdr://state`: `?include=panes,volumes,dialogs,listings,recentErrors`
  to project only listed sections (defaults to all), and `?compact=true` to
  drop the per-pane `files:` list (the biggest source of YAML noise when the
  caller only cares about path / volumeId / cursor). Example:
  `cmdr://state?include=listings,recentErrors` is the minimal payload for
  "did the last listing succeed?". The `cursor`, `totalFiles`, and
  `loadedRange` summary still render under `compact`, so direction is clear.

Wiring details:
- `read_resource` now `split_uri`s into base + query before dispatch and
  parses each resource's options.
- `parse_query` is a small flat-map decoder that percent-decodes via the
  existing `urlencoding` crate; no new deps.
- The unit-test-only `snapshot_since` helper is gated behind `#[cfg(test)]`
  to keep `#![deny(unused)]` happy in non-test builds.
- `mcp::CLAUDE.md` updated with the new resource entries, the projection
  examples, and a freshness contract for `recentErrors`.
- The `tests/resource_tests.rs::test_resource_count` and `test_resources_exist`
  updated for 5 resources.

End-to-end verified via MCP against a running `pnpm dev` build:
`cmdr://logs?filter=SmbVolume&limit=3`, `cmdr://logs?since=<iso>&filter=mcp::server`,
`cmdr://state?include=listings,recentErrors`, `cmdr://state?compact=true&include=panes,listings`
all return the expected projections. `recentErrors: []` correctly stays empty
in a healthy session; the unit tests pin the populated case.

`./scripts/check.sh` green: 1914 unit tests (up from 1902 with the 12 new
ones), 32 SMB integration tests, svelte-check, eslint, everything else.

Author: vdavid

apps/desktop/src-tauri/src/file_system/listing/streaming.rs

@@ -336,7 +336,16 @@ pub async fn list_directory_start_streaming(
                 if matches!(&e, VolumeError::PermissionDenied(_)) {
                     crate::restricted_paths::record_denial(&path_for_error);
                 }
-                events_for_error.emit_error(&listing_id_for_cleanup, e.to_string(), Some(friendly));
+                let message = e.to_string();
+                // Record into the MCP recent-errors ring buffer so `cmdr://state`
+                // surfaces what just failed, without callers grepping the log file.
+                crate::mcp::listing_errors::record(
+                    &listing_id_for_cleanup,
+                    &volume_id_owned,
+                    &path_for_error.to_string_lossy(),
+                    &message,
+                );
+                events_for_error.emit_error(&listing_id_for_cleanup, message, Some(friendly));
             }
             Ok(()) => {
                 // Success: listing-complete already emitted. If this path was
@@ -542,7 +551,9 @@ pub(crate) async fn read_directory_with_progress(
         && volume_root_path.as_deref() == Some(path)
         && let Some(friendly) = friendly_error_for_restricted_empty_root(volume_id, path)
     {
-        events.emit_error(listing_id, friendly.raw_detail.clone(), Some(friendly));
+        let message = friendly.raw_detail.clone();
+        crate::mcp::listing_errors::record(listing_id, volume_id, &path.to_string_lossy(), &message);
+        events.emit_error(listing_id, message, Some(friendly));
         return Ok(());
     }
 

apps/desktop/src-tauri/src/mcp/CLAUDE.md

@@ -36,10 +36,11 @@ Expose Cmdr functionality to AI agents via the Model Context Protocol (MCP). Age
 
 ### Resources (`resources.rs`)
 
-- `cmdr://state`: Complete app state in YAML (both panes, volumes, dialogs, active `listings` cache). Includes MTP volumes with `name` and `id`, and per-pane `volumeId`. The `listings` section reflects every entry in `LISTING_CACHE` (id, volumeId, path, entry count, ageMs), useful for triaging orphan listings in error reports.
+- `cmdr://state`: Complete app state in YAML (both panes, volumes, dialogs, active `listings` cache, `recentErrors`). Includes MTP volumes with `name` and `id`, and per-pane `volumeId`. The `listings` section reflects every entry in `LISTING_CACHE` (id, volumeId, path, entry count, ageMs); `recentErrors` is the last 20 directory-listing failures with `atUnixMs`, `listingId`, `volumeId`, `path`, `message` (see `listing_errors.rs` and the freshness contract below). Supports `?include=panes,volumes,dialogs,listings,recentErrors` projection (defaults to all) and `?compact=true` (drops the `files:` list inside each pane while keeping every summary field). Example: `cmdr://state?include=listings,recentErrors` is the minimal payload for "did the last listing succeed?".
 - `cmdr://dialogs/available`: Static metadata about available dialogs
 - `cmdr://indexing`: Drive indexing status in plain text (current phase, timeline history, DB stats). Calls `indexing::get_debug_status()` and formats as human-readable text.
 - `cmdr://settings`: All settings with current values, defaults, types, and constraints. Fetched via round-trip to the frontend (`mcp-get-all-settings` event).
+- `cmdr://logs`: Tail of the live `cmdr.log` file. Query: `?since=<iso>&filter=<substring>&limit=<n>`. `limit` defaults to 100, capped at 1000; `filter` is a case-sensitive substring match (no regex dep); `since` drops lines whose ISO-8601 timestamp prefix is ≤ the given value (lines without a timestamp prefix, like a Rust panic, are kept). Reads the last ~5 MB of the file from the end so a 50 MB rotated log doesn't blow up MCP memory. Returns oldest-first.
 
 ### Executor (`executor/`)
 
@@ -99,6 +100,7 @@ Constants and configuration for the MCP server (port, bind address, transport se
 
 - `PaneStateStore`: Current state of left/right panes (path, files, cursor, selection, tabs, type-to-jump). Includes a monotonic `generation` counter (AtomicU64) bumped on every `set_left`/`set_right`. Exposed in `cmdr://state` as `generation:` and used by the `await` tool's `after_generation` param to avoid matching stale state. The optional `typeToJump` field (buffer, indicatorVisible, indicatorStale, lastMatchedName) mirrors the per-pane type-to-jump state when a buffer or indicator is live, so MCP-driven tests can assert the feature without DOM access.
 - `SoftDialogTracker`: Which dialogs MCP thinks are open (in `dialog_state.rs`)
+- `listing_errors`: Bounded ring buffer (capacity 20) of the most recent `listing-error` events. Populated from `file_system::listing::streaming` at both `emit_error` sites — see the call to `crate::mcp::listing_errors::record(...)` right before the FE event fires, so MCP-visible state matches what the FE saw. Surfaced as `recentErrors:` in `cmdr://state`. **Freshness contract**: the buffer holds the absolute-newest 20 errors process-wide; on a busy session older errors silently drop off, so test scenarios that need older context should snapshot earlier and compare. Cancellations are not recorded — only failures.
 
 Frontend syncs state to these stores via Tauri commands (`update_left_pane_state`, `update_pane_tabs`, etc.). Settings are fetched on-demand via round-trip to the frontend rather than stored in a state store.
 

apps/desktop/src-tauri/src/mcp/listing_errors.rs

@@ -0,0 +1,125 @@
+//! Recent-listing-errors ring buffer for the `cmdr://state` resource.
+//!
+//! Surfaces the last few directory-listing failures (volume not found, permission
+//! denied, I/O error, SMB protocol error) to MCP-driven tests so they can assert
+//! "no error since timestamp X" without grepping the on-disk log file. Populated
+//! from `file_system::listing::streaming` whenever it emits `listing-error`.
+//!
+//! Ring-buffered to 20 entries: enough to triage a problem, small enough that
+//! every `cmdr://state` read pays a bounded YAML cost.
+
+use std::collections::VecDeque;
+use std::sync::{LazyLock, Mutex};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// One recorded listing error.
+#[derive(Debug, Clone)]
+pub struct RecentListingError {
+    /// Wall-clock millis since UNIX epoch; matches the format used by JS `Date.now()`.
+    pub at_unix_ms: u64,
+    pub listing_id: String,
+    pub volume_id: String,
+    pub path: String,
+    /// Raw error text. Matches what the FE sees on the `listing-error` event.
+    pub message: String,
+}
+
+const CAPACITY: usize = 20;
+
+static BUFFER: LazyLock<Mutex<VecDeque<RecentListingError>>> =
+    LazyLock::new(|| Mutex::new(VecDeque::with_capacity(CAPACITY)));
+
+/// Record a listing error. Called from the streaming event sink right after it
+/// emits the `listing-error` Tauri event, so MCP sees what the FE saw.
+pub fn record(listing_id: &str, volume_id: &str, path: &str, message: &str) {
+    let at_unix_ms = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_millis() as u64)
+        .unwrap_or(0);
+    let entry = RecentListingError {
+        at_unix_ms,
+        listing_id: listing_id.to_string(),
+        volume_id: volume_id.to_string(),
+        path: path.to_string(),
+        message: message.to_string(),
+    };
+    let mut buf = match BUFFER.lock() {
+        Ok(b) => b,
+        Err(poisoned) => poisoned.into_inner(),
+    };
+    if buf.len() == CAPACITY {
+        buf.pop_front();
+    }
+    buf.push_back(entry);
+}
+
+/// Returns a snapshot of recorded errors, oldest first. Cheap; clones each entry.
+pub fn snapshot() -> Vec<RecentListingError> {
+    let buf = match BUFFER.lock() {
+        Ok(b) => b,
+        Err(poisoned) => poisoned.into_inner(),
+    };
+    buf.iter().cloned().collect()
+}
+
+/// Returns only entries with `at_unix_ms > since_ms`. Convenience for tests that
+/// want to assert "no errors since I started this scenario." Kept under
+/// `#[cfg(test)]` until a production caller needs it; the unit tests below
+/// pin the semantics.
+#[cfg(test)]
+pub fn snapshot_since(since_ms: u64) -> Vec<RecentListingError> {
+    snapshot().into_iter().filter(|e| e.at_unix_ms > since_ms).collect()
+}
+
+#[cfg(test)]
+pub fn clear_for_test() {
+    if let Ok(mut buf) = BUFFER.lock() {
+        buf.clear();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn record_pushes_to_buffer_and_snapshot_returns_in_order() {
+        clear_for_test();
+        record("l1", "v1", "/a", "boom");
+        record("l2", "v1", "/b", "kaboom");
+        let snap = snapshot();
+        assert_eq!(snap.len(), 2);
+        assert_eq!(snap[0].listing_id, "l1");
+        assert_eq!(snap[1].listing_id, "l2");
+    }
+
+    #[test]
+    fn buffer_drops_oldest_past_capacity() {
+        clear_for_test();
+        for i in 0..(CAPACITY + 5) {
+            record(&format!("l{i}"), "v", "/p", "err");
+        }
+        let snap = snapshot();
+        assert_eq!(snap.len(), CAPACITY);
+        // First retained entry should be `l5` (5 oldest dropped).
+        assert_eq!(snap.first().unwrap().listing_id, "l5");
+        // Last retained entry should be the newest push.
+        assert_eq!(snap.last().unwrap().listing_id, format!("l{}", CAPACITY + 4));
+    }
+
+    #[test]
+    fn snapshot_since_filters_by_timestamp() {
+        clear_for_test();
+        record("l1", "v", "/p", "err");
+        let mid = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_millis() as u64;
+        // Sleep just past the millisecond boundary so the next `record` definitely
+        // gets a strictly later timestamp than `mid` (otherwise the test is flaky
+        // on machines where SystemTime resolution is coarse enough that two
+        // back-to-back calls land in the same millisecond).
+        std::thread::sleep(std::time::Duration::from_millis(2));
+        record("l2", "v", "/p", "err");
+        let recent = snapshot_since(mid);
+        assert_eq!(recent.len(), 1);
+        assert_eq!(recent[0].listing_id, "l2");
+    }
+}

apps/desktop/src-tauri/src/mcp/mod.rs

@@ -6,6 +6,7 @@
 pub mod config;
 pub mod dialog_state;
 mod executor;
+pub mod listing_errors;
 pub mod pane_state;
 mod protocol;
 pub mod resources;