feat(client): bring back New folder, icon-only — and close the hole it opened

The control was hidden and its `canCreateDir` left computed and unused. It is
back in the Files toolbar as an icon: the toolbar already carries one labelled
primary action, and a second beside it competes for the width the breadcrumb
trail needs. The name is in `title` *and* `aria-label` — a title is invisible
to a screen reader on a button with no text, so an icon-only control without
both is simply unnamed for anyone not reading with their eyes.

Its gate changes. It required `isNodeAdmin`, which contradicted the node's own
rule — "making a directory is not a privileged act; a member who can add a file
can organise where it goes" — and hid the control from everyone who could have
used it. It now follows the Upload button: a writable root, and not at the top
of a group, where the level is the set of roots rather than a directory on
anyone's disk.

Restoring it surfaced a real gap. `_do_dir_create` never learned about RO/RW:
`_do_file_upload` gained the `writable` check with the model and this one did
not, so a member refused a file in a published library could still leave empty
directories all through it, and could write to a drive mid-eject. Read-only has
to mean read-only for every way of writing, not just for files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pvMdvLBG92jyhvD5pD6us

1 files changed, 30 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_upload_controls_hidden.py b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
index 7b8b0e3..a61de1f 100644
--- a/packages/meshbay-hub/tests/test_upload_controls_hidden.py
+++ b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
@@ -73,6 +73,36 @@ def test_the_files_upload_button_is_not_offered_at_the_top_of_a_group():
     assert "currentPath &&" in toolbar
 
 
+def test_the_new_folder_button_follows_the_same_rule_as_upload():
+    """
+    Both write to the operator's disk, so both need a writable root — the node
+    refuses either otherwise. It used to require `isNodeAdmin`, which
+    contradicted the node ("a member who can add a file can organise where it
+    goes") and hid the control from everyone who could have used it.
+    """
+    page = _component(FILES_APP.read_text(encoding="utf-8"), "FilesPanel")
+    decl = page[page.index("const canCreateDir"):]
+    decl = decl[:decl.index(";") + 1]
+    assert "currentRootWritable" in decl
+    assert "currentPath" in decl, (
+        "the top of a group is the set of roots, not a directory to create in")
+    assert "isNodeAdmin" not in decl
+
+
+def test_an_icon_only_button_still_says_what_it_is():
+    """
+    The name moved into a tooltip to save toolbar width. A `title` is invisible
+    to a screen reader on a button with no text, so the label has to be there
+    as well — otherwise the control is simply unnamed for anyone not reading
+    with their eyes.
+    """
+    page = _component(FILES_APP.read_text(encoding="utf-8"), "FilesPanel")
+    block = page[page.index("canCreateDir && html`"):]
+    block = block[:block.index("</button>")]
+    assert "title=" in block and "aria-label=" in block
+    assert "group.mkdir" in block
+
+
 def test_the_chat_composer_hides_its_paperclip():
     chat = _component(CHAT_APP.read_text(encoding="utf-8"), "ChatPanel")
     composer = chat[chat.index("chat-input-row"):]