u

src/api/openapi.js

@@ -1780,6 +1780,178 @@
  *         isPdf:
  *           type: boolean
  *           description: True if file is a PDF document
+ *     BackupFileDetail:
+ *       type: object
+ *       required: [name, sizeBytes, sourceExists]
+ *       properties:
+ *         name:
+ *           type: string
+ *         sizeBytes:
+ *           type: integer
+ *         sourceExists:
+ *           type: boolean
+ *     BackupDatabaseDetail:
+ *       type: object
+ *       required: [name, sizeBytes, backedUp]
+ *       properties:
+ *         name:
+ *           type: string
+ *           nullable: true
+ *         sizeBytes:
+ *           type: integer
+ *         backedUp:
+ *           type: boolean
+ *         reason:
+ *           type: string
+ *           nullable: true
+ *     BackupManifest:
+ *       type: object
+ *       required: [id, timestamp, dateKey, monthKey, dbProvider, manual, files, totalSizeBytes, durationMs]
+ *       properties:
+ *         id:
+ *           type: string
+ *         timestamp:
+ *           type: string
+ *           format: date-time
+ *         dateKey:
+ *           type: string
+ *         monthKey:
+ *           type: string
+ *         dbProvider:
+ *           type: string
+ *         manual:
+ *           type: boolean
+ *         files:
+ *           type: object
+ *           required: [vfs, storage, database]
+ *           properties:
+ *             vfs:
+ *               $ref: '#/components/schemas/BackupFileDetail'
+ *             storage:
+ *               $ref: '#/components/schemas/BackupFileDetail'
+ *             database:
+ *               $ref: '#/components/schemas/BackupDatabaseDetail'
+ *         totalSizeBytes:
+ *           type: integer
+ *         durationMs:
+ *           type: integer
+ *     BackupEntry:
+ *       type: object
+ *       required: [name, path, totalSizeBytes, timestamp]
+ *       properties:
+ *         name:
+ *           type: string
+ *         path:
+ *           type: string
+ *         totalSizeBytes:
+ *           type: integer
+ *         timestamp:
+ *           type: string
+ *           format: date-time
+ *           nullable: true
+ *         manifest:
+ *           $ref: '#/components/schemas/BackupManifest'
+ *           nullable: true
+ *     BackupTierCounts:
+ *       type: object
+ *       required: [hourly, daily, monthly]
+ *       properties:
+ *         hourly:
+ *           type: integer
+ *         daily:
+ *           type: integer
+ *         monthly:
+ *           type: integer
+ *     BackupRetentionConfig:
+ *       type: object
+ *       required: [hourlyMax, dailyMax, monthly]
+ *       properties:
+ *         hourlyMax:
+ *           type: integer
+ *         dailyMax:
+ *           type: integer
+ *         monthly:
+ *           type: string
+ *     BackupStatus:
+ *       type: object
+ *       required: [enabled, isRunning, dbProvider, mssqlWarning, backupDir, retention, counts]
+ *       properties:
+ *         enabled:
+ *           type: boolean
+ *         isRunning:
+ *           type: boolean
+ *         dbProvider:
+ *           type: string
+ *         mssqlWarning:
+ *           type: boolean
+ *         backupDir:
+ *           type: string
+ *         retention:
+ *           $ref: '#/components/schemas/BackupRetentionConfig'
+ *         counts:
+ *           $ref: '#/components/schemas/BackupTierCounts'
+ *         latestHourly:
+ *           $ref: '#/components/schemas/BackupEntry'
+ *           nullable: true
+ *         latestDaily:
+ *           $ref: '#/components/schemas/BackupEntry'
+ *           nullable: true
+ *         latestMonthly:
+ *           $ref: '#/components/schemas/BackupEntry'
+ *           nullable: true
+ *     BackupListing:
+ *       type: object
+ *       required: [counts, hourly, daily, monthly]
+ *       properties:
+ *         counts:
+ *           $ref: '#/components/schemas/BackupTierCounts'
+ *         hourly:
+ *           type: array
+ *           items:
+ *             $ref: '#/components/schemas/BackupEntry'
+ *         daily:
+ *           type: array
+ *           items:
+ *             $ref: '#/components/schemas/BackupEntry'
+ *         monthly:
+ *           type: array
+ *           items:
+ *             $ref: '#/components/schemas/BackupEntry'
+ *     BackupOverviewResponse:
+ *       type: object
+ *       required: [status, backups]
+ *       properties:
+ *         status:
+ *           $ref: '#/components/schemas/BackupStatus'
+ *         backups:
+ *           $ref: '#/components/schemas/BackupListing'
+ *     BackupRunResult:
+ *       type: object
+ *       required: [success, id, timestamp, promotedDaily, promotedMonthly, totalSizeBytes, pruneResult, manifest]
+ *       properties:
+ *         success:
+ *           type: boolean
+ *         id:
+ *           type: string
+ *         timestamp:
+ *           type: string
+ *           format: date-time
+ *         promotedDaily:
+ *           type: boolean
+ *         promotedMonthly:
+ *           type: boolean
+ *         totalSizeBytes:
+ *           type: integer
+ *         pruneResult:
+ *           type: object
+ *           required: [hourlyPruned, dailyPruned]
+ *           properties:
+ *             hourlyPruned:
+ *               type: integer
+ *             dailyPruned:
+ *               type: integer
+ *         manifest:
+ *           $ref: '#/components/schemas/BackupManifest'
  */
 
 export {};

src/api/routes/backup.js

@@ -19,14 +19,13 @@ export function register(app, basePath = '') {
      *         content:
      *           application/json:
      *             schema:
-     *               type: object
-     *               properties:
-     *                 status:
-     *                   type: object
-     *                 backups:
-     *                   type: object
+     *               $ref: '#/components/schemas/BackupOverviewResponse'
      *       500:
      *         description: Internal error
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
      */
     // #region GET /backup
     // MARK: handles GET /backup to list backups and service status
@@ -54,9 +53,13 @@ export function register(app, basePath = '') {
      *         content:
      *           application/json:
      *             schema:
-     *               type: object
+     *               $ref: '#/components/schemas/BackupRunResult'
      *       500:
      *         description: Backup execution failure
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
      */
     // #region POST /backup/run
     // MARK: handles POST /backup/run to trigger manual backup

src/api/routes/events.js

@@ -53,6 +53,8 @@ export function register(app, basePath = '') {
      *       | `modelconversation` | `{}` | `POST /modelconversation`, `DELETE /modelconversation/{id}` |
      *       | `modelconversation-<id>` | `{}` | Conversation-specific updates on the same model conversation thread; the concrete ID is used in the event name |
      *       | `brand` | `{ sender, brandId }` | `POST /brand`, `PATCH /brand/{id}`, `DELETE /brand/{id}`, `POST /brand/{id}/image`, `DELETE /brand/{id}/image` |
+     *       | `draft` | `{ sender, action, name, content }` | Draft update on `drafts/quote`, `drafts/order`, `drafts/delivery` (`sender` echoes the caller's `x-client-id`) |
+     *       | `draft:request` | `{ requestId, action, name, target, sender }` | Server request to frontend to read a draft or list drafts |
      *
      *       The `brand` payload is `{ sender, brandId }`: `sender` echoes the
      *       caller's `x-client-id` header (empty string if absent) so the sender
@@ -95,6 +97,10 @@ export function register(app, basePath = '') {
      *         payload: "{}"
      *       - name: brand
      *         payload: "{ sender, brandId }"
+     *       - name: draft
+     *         payload: "{ sender, action, name, content }"
+     *       - name: draft:request
+     *         payload: "{ requestId, action, name, target, sender }"
      *     responses:
      *       200:
      *         description: |
@@ -157,5 +163,6 @@ export function handleSse(req, res) {
     // Send an initial ping to establish frame
     res.write(': ping\n\n');
 
-    subscribe(res, { companyId, userId: req.user?.id }, req);
+    const clientId = req.query?.cid || req.headers?.['x-client-id'] || null;
+    subscribe(res, { companyId, userId: req.user?.id, clientId }, req);
 }

src/api/routes/vfs.js

@@ -4,6 +4,13 @@ import multer from 'multer';
 import { emit } from '../sse.js';
 import { prepareVfs, resolveVfsRoot, isReadOnlyDatabasePath, getMimeType } from '../../tools/vfs.js';
 import sharp from 'sharp';
+import {
+    parseDraftPath,
+    requestDraftRead,
+    requestDraftList,
+    handleDraftResponse,
+    notifyDraftUpdate,
+} from '../../services/draftManager.js';
 
 // #region Helpers
 
@@ -465,7 +472,18 @@ export function register(app, basePath = '') {
                 }
                 return list;
             }
-            const files = walk(vfsRoot).sort((a, b) => a.name.localeCompare(b.name));
+            const diskFiles = walk(vfsRoot);
+            let drafts = [];
+            try {
+                drafts = await requestDraftList({
+                    companyId: selected.companyId,
+                    userId: req.user.id,
+                    clientId: req.headers?.['x-client-id'],
+                });
+            } catch (err) {
+                console.error('Failed to request drafts from frontend:', err);
+            }
+            const files = [...diskFiles, ...drafts].sort((a, b) => a.name.localeCompare(b.name));
             return res.json({ files });
         } catch (error) {
             const status = vfsFileErrorStatus(error);
@@ -580,6 +598,7 @@ export function register(app, basePath = '') {
                 const parsed = parseVfsRef(relPath);
                 if (parsed.error) continue;
                 if (isReadOnlyDatabasePath(parsed.name)) continue;
+                if (parseDraftPath(parsed.name).isFolder || parseDraftPath(parsed.name).isDraft) continue;
 
                 const absPath = path.resolve(vfsRoot, parsed.name);
                 if (!absPath.startsWith(vfsRoot)) continue;
@@ -680,6 +699,9 @@ export function register(app, basePath = '') {
         if (isReadOnlyDatabasePath(parsed.name)) {
             return res.status(403).json({ error: 'Cannot create directories in read-only database paths' });
         }
+        if (parseDraftPath(parsed.name).isFolder || parseDraftPath(parsed.name).isDraft) {
+            return res.status(403).json({ error: 'Cannot create directories in virtual drafts folder' });
+        }
 
         try {
             const vfsRoot = await resolveVfsRoot(req.user.id);
@@ -788,6 +810,14 @@ export function register(app, basePath = '') {
         if (isReadOnlyDatabasePath(parsedOld.name) || isReadOnlyDatabasePath(parsedNew.name)) {
             return res.status(403).json({ error: 'Cannot rename read-only database paths' });
         }
+        if (
+            parseDraftPath(parsedOld.name).isFolder ||
+            parseDraftPath(parsedOld.name).isDraft ||
+            parseDraftPath(parsedNew.name).isFolder ||
+            parseDraftPath(parsedNew.name).isDraft
+        ) {
+            return res.status(403).json({ error: 'Cannot rename virtual draft files or folders' });
+        }
 
         try {
             const vfsRoot = await resolveVfsRoot(req.user.id);
@@ -931,6 +961,50 @@ export function register(app, basePath = '') {
             return res.status(403).json({ error: 'Cannot modify read-only database files' });
         }
 
+        const draftInfo = parseDraftPath(parsed.name);
+        if (draftInfo.isFolder) {
+            return res.status(400).json({ error: 'Cannot write directly to directory' });
+        }
+        if (draftInfo.isDraft) {
+            let strContent;
+            if (typeof req.body?.content === 'string') {
+                strContent = req.body.content;
+            } else if (req.body && typeof req.body === 'object' && !Buffer.isBuffer(req.body)) {
+                strContent = req.body.content !== undefined
+                    ? (typeof req.body.content === 'string' ? req.body.content : JSON.stringify(req.body.content))
+                    : JSON.stringify(req.body);
+            } else if (Buffer.isBuffer(req.body)) {
+                strContent = req.body.toString('utf8');
+            } else if (typeof req.body === 'string') {
+                strContent = req.body;
+            } else {
+                return res.status(400).json({ error: 'No content provided' });
+            }
+
+            let parsedContent = strContent;
+            try {
+                parsedContent = JSON.parse(strContent);
+            } catch {}
+
+            const updated = notifyDraftUpdate({
+                companyId: selected.companyId,
+                userId: req.user.id,
+                clientId: req.headers?.['x-client-id'],
+                name: draftInfo.name,
+                content: parsedContent,
+            });
+
+            return res.json({
+                success: true,
+                file: {
+                    name: `drafts/${draftInfo.name}`,
+                    size: updated.size,
+                    mime: 'application/json; charset=utf-8',
+                    updated_at: updated.updatedAt,
+                },
+            });
+        }
+
         let buffer;
         let mime = parsed.mime;
         if (typeof req.body?.content === 'string') {
@@ -1043,6 +1117,10 @@ export function register(app, basePath = '') {
         if (isReadOnlyDatabasePath(parsed.name)) {
             return res.status(403).json({ error: 'Cannot delete read-only database files' });
         }
+        const draftDeleteInfo = parseDraftPath(parsed.name);
+        if (draftDeleteInfo.isFolder || draftDeleteInfo.isDraft) {
+            return res.status(403).json({ error: 'Cannot delete virtual draft files' });
+        }
 
         try {
             const vfsRoot = await resolveVfsRoot(req.user.id);
@@ -1210,6 +1288,35 @@ export function register(app, basePath = '') {
             return res.status(400).json({ error: parsed.error });
         }
 
+        const draftGetInfo = parseDraftPath(parsed.name);
+        if (draftGetInfo.isFolder) {
+            return res.status(400).json({ error: 'Cannot download a directory directly' });
+        }
+        if (draftGetInfo.isDraft) {
+            try {
+                const content = await requestDraftRead({
+                    companyId: selected.companyId,
+                    userId: req.user.id,
+                    clientId: req.headers?.['x-client-id'],
+                    name: draftGetInfo.name,
+                });
+                const strContent = typeof content === 'string' ? content : JSON.stringify(content ?? {}, null, 2);
+                const buffer = Buffer.from(strContent, 'utf8');
+                const effectiveMime = 'application/json; charset=utf-8';
+                const fallbackName = `${draftGetInfo.name}.json`;
+
+                res.setHeader('Content-Type', effectiveMime);
+                res.setHeader('Content-Length', String(buffer.length));
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                res.setHeader('Cache-Control', 'private, max-age=0, must-revalidate');
+                res.setHeader('Content-Disposition', `inline; filename="${fallbackName}"`);
+                return res.status(200).send(buffer);
+            } catch (err) {
+                const status = err.message?.includes('timed out') ? 504 : 404;
+                return res.status(status).json({ error: err.message });
+            }
+        }
+
         try {
             const vfsRoot = await resolveVfsRoot(req.user.id);
             const absPath = path.resolve(vfsRoot, parsed.name);
@@ -1284,4 +1391,77 @@ export function register(app, basePath = '') {
     });
 
     // #endregion
+
+    /**
+     * @openapi
+     * /vfs/drafts/response:
+     *   post:
+     *     tags: [Vfs]
+     *     summary: Respond to a frontend draft request
+     *     description: |
+     *       Used by the frontend to answer a server-initiated `draft:request` SSE event
+     *       when reading or listing virtual drafts (`drafts/quote`, `drafts/order`, `drafts/delivery`).
+     *     security:
+     *       - cookieAuth: []
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [requestId]
+     *             properties:
+     *               requestId:
+     *                 type: string
+     *                 description: Unique request ID from the draft:request SSE event
+     *               content:
+     *                 description: File content when action was read
+     *               error:
+     *                 type: string
+     *                 description: Error message if draft retrieval failed on frontend
+     *               files:
+     *                 type: array
+     *                 description: File listing when action was list
+     *     responses:
+     *       200:
+     *         description: Response received and resolved
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 success:
+     *                   type: boolean
+     *       400:
+     *         description: Missing requestId or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Request ID not found or already timed out
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    // #region POST /vfs/drafts/response
+
+    app.post(`${basePath}/vfs/drafts/response`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+        const { requestId, content, error, files } = req.body || {};
+        if (!requestId) {
+            return res.status(400).json({ error: 'requestId is required' });
+        }
+        const result = handleDraftResponse({ requestId, content, error, files });
+        if (!result.handled) {
+            return res.status(404).json({ error: result.error || 'Request expired or not found' });
+        }
+        return res.json({ success: true });
+    });
+
+    // #endregion
 }

src/api/sse.js

@@ -3,7 +3,7 @@
  * after a successful mutation so other tabs/users can refetch.
  */
 
-/** @typedef {{ res: import('express').Response, companyId: number, userId: number, keepAlive: NodeJS.Timeout }} SseClient */
+/** @typedef {{ res: import('express').Response, companyId: number, userId: number, clientId: string|null, keepAlive: NodeJS.Timeout }} SseClient */
 
 /** @type {Set<SseClient>} */
 const clients = new Set();
@@ -13,16 +13,18 @@ const KEEP_ALIVE_MS = 20_000;
 /**
  * Register an open SSE response. Caller must write the initial headers.
  * @param {import('express').Response} res
- * @param {{ companyId: number, userId: number }} meta
+ * @param {{ companyId: number, userId: number, clientId?: string|null }} meta
  * @param {import('express').Request} [req]
  * @returns {() => void} unsubscribe
  */
-export function subscribe(res, { companyId, userId }, req) {
+export function subscribe(res, { companyId, userId, clientId }, req) {
+    const resolvedClientId = clientId || req?.headers?.['x-client-id'] || req?.query?.cid || null;
     /** @type {SseClient} */
     const client = {
         res,
         companyId,
         userId,
+        clientId: resolvedClientId ? String(resolvedClientId) : null,
         keepAlive: setInterval(() => {
             if (res.writableEnded) return;
             res.write(': heartbeat\n\n');
@@ -55,15 +57,59 @@ export function closeAll() {
 }
 
 /**
- * Broadcast a named signal to subscribers of the given company.
- * @param {string} signal - SSE event name (e.g. `category`)
- * @param {{ companyId: number, data?: string|object }} options
+ * Checks whether an active SSE client connection exists matching the given criteria.
+ * @param {{ companyId?: number, userId?: number, clientId?: string }} [options]
+ * @returns {boolean}
  */
-export function emit(signal, { companyId, data }) {
+export function hasActiveClient({ companyId, userId, clientId } = {}) {
+    for (const client of clients) {
+        if (companyId != null && client.companyId !== companyId) continue;
+        if (userId != null && client.userId !== userId) continue;
+        if (clientId != null && client.clientId !== clientId) continue;
+        if (!client.res.writableEnded) return true;
+    }
+    return false;
+}
+
+/**
+ * Broadcast or target a named signal to subscribers.
+ * If `targetClientId` or `targetUserId` is specified, sends only to matching clients of that user.
+ *
+ * @param {string} signal - SSE event name (e.g. `category`, `draft`, `draft:request`)
+ * @param {{ companyId: number, data?: string|object, targetClientId?: string, targetUserId?: number }} options
+ */
+export function emit(signal, { companyId, data, targetClientId, targetUserId }) {
     if (companyId == null) return;
 
     const payload = data == null ? '{}' : (typeof data === 'string' ? data : JSON.stringify(data));
     const frame = `event: ${signal}\ndata: ${payload}\n\n`;
+
+    if (targetClientId || targetUserId != null) {
+        let sent = false;
+        if (targetClientId) {
+            for (const client of clients) {
+                if (client.companyId !== companyId) continue;
+                if (targetUserId != null && client.userId !== targetUserId) continue;
+                if (client.clientId === targetClientId && !client.res.writableEnded) {
+                    client.res.write(frame);
+                    sent = true;
+                }
+            }
+        }
+        if (!sent && targetUserId != null) {
+            for (const client of clients) {
+                if (client.companyId !== companyId) continue;
+                if (client.userId === targetUserId && !client.res.writableEnded) {
+                    client.res.write(frame);
+                    sent = true;
+                }
+            }
+        }
+        if (sent) return;
+        // Targeted to a specific user but no active client was found: do not blast to other users
+        if (targetUserId != null) return;
+    }
+
     for (const client of clients) {
         if (client.companyId !== companyId) continue;
         if (client.res.writableEnded) continue;

src/services/draftManager.js

@@ -0,0 +1,316 @@
+import { emit, hasActiveClient } from '../api/sse.js';
+import { getStore } from '../db/store.js';
+
+export const DRAFT_NAMES = new Set(['quote', 'order', 'delivery']);
+
+/**
+ * Checks and parses a VFS path to determine if it points to the drafts directory or a draft file.
+ * Accepts paths like:
+ * - 'drafts', '/drafts', 'drafts/'
+ * - 'drafts/quote', 'drafts/quote.json', '/api/vfs/drafts/order', 'vfs://drafts/delivery'
+ *
+ * @param {string} filePath
+ * @returns {{ isFolder: boolean, isDraft: boolean, name?: 'quote'|'order'|'delivery', filename?: string }}
+ */
+export function parseDraftPath(filePath) {
+    if (typeof filePath !== 'string' || !filePath.trim()) {
+        return { isFolder: false, isDraft: false };
+    }
+    let clean = filePath.trim().replace(/^vfs:\/+/i, '').replace(/^([a-zA-Z]:|\/)+/, '').replace(/^\.\/+/, '');
+    clean = clean.replace(/^api\//i, '').replace(/^vfs\//i, '');
+    const segments = clean.split('/').filter(Boolean);
+    if (segments.length === 0) return { isFolder: false, isDraft: false };
+
+    if (segments[0].toLowerCase() === 'drafts') {
+        if (segments.length === 1) {
+            return { isFolder: true, isDraft: false };
+        }
+        if (segments.length === 2) {
+            const rawName = segments[1];
+            const lower = rawName.toLowerCase();
+            const withoutExt = lower.endsWith('.json') ? lower.slice(0, -5) : lower;
+            if (DRAFT_NAMES.has(withoutExt)) {
+                return { isFolder: false, isDraft: true, name: withoutExt, filename: rawName };
+            }
+        }
+    }
+    return { isFolder: false, isDraft: false };
+}
+
+/**
+ * In-memory cache for drafts: key: `${companyId}:${userId}:${name}` -> { content, updatedAt, size }
+ */
+const draftCache = new Map();
+
+function cacheKey(companyId, userId, name) {
+    return `${companyId}:${userId}:${name}`;
+}
+
+export function getCachedDraft({ companyId, userId, name }) {
+    return draftCache.get(cacheKey(companyId, userId, name)) || null;
+}
+
+export function setCachedDraft({ companyId, userId, name, content }) {
+    const updatedAt = new Date().toISOString();
+    const str = typeof content === 'string' ? content : JSON.stringify(content ?? {}, null, 2);
+    const entry = {
+        content,
+        updatedAt,
+        size: Buffer.byteLength(str, 'utf8'),
+    };
+    draftCache.set(cacheKey(companyId, userId, name), entry);
+    return entry;
+}
+
+/**
+ * Resolves the selected company ID for a given googleAuth ID if needed.
+ * @param {number} googleAuthId
+ * @returns {Promise<number|null>}
+ */
+export async function resolveCompanyForUser(googleAuthId) {
+    if (!googleAuthId) return null;
+    try {
+        const store = await getStore();
+        const row = await store.google_auth.getById(googleAuthId);
+        return row?.selectedCompanyId ?? null;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Pending requests map: requestId -> { resolve, reject, timer, companyId, userId, action, name }
+ */
+const pendingRequests = new Map();
+
+/**
+ * Request a draft content from the frontend via SSE and wait for its response.
+ *
+ * @param {{ companyId?: number, userId: number, clientId?: string, name: string, timeoutMs?: number }} options
+ * @returns {Promise<any>}
+ */
+export async function requestDraftRead({ companyId, userId, clientId, name, timeoutMs = 15000 }) {
+    const effectiveCompanyId = companyId != null ? companyId : await resolveCompanyForUser(userId);
+    if (effectiveCompanyId == null) {
+        throw new Error('No company selected');
+    }
+
+    // Check if client is active; if not and we have cache, return cache immediately
+    const hasClient = hasActiveClient({ companyId: effectiveCompanyId, userId, clientId });
+    if (!hasClient) {
+        const cached = getCachedDraft({ companyId: effectiveCompanyId, userId, name });
+        if (cached) {
+            return cached.content;
+        }
+    }
+
+    const requestId = `draft_req_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            pendingRequests.delete(requestId);
+            // Fallback to cache if available
+            const cached = getCachedDraft({ companyId: effectiveCompanyId, userId, name });
+            if (cached) {
+                return resolve(cached.content);
+            }
+            reject(new Error(`Frontend draft response timed out for "${name}"`));
+        }, timeoutMs);
+
+        pendingRequests.set(requestId, {
+            resolve,
+            reject,
+            timer,
+            companyId: effectiveCompanyId,
+            userId,
+            action: 'read',
+            name,
+        });
+
+        // Emit request over SSE
+        emit('draft:request', {
+            companyId: effectiveCompanyId,
+            targetUserId: userId,
+            targetClientId: clientId,
+            data: {
+                requestId,
+                action: 'read',
+                name,
+                target: name,
+                sender: clientId || '',
+            },
+        });
+    });
+}
+
+/**
+ * Request draft listing from the frontend via SSE.
+ * If frontend doesn't respond or times out, returns default metadata for all 3 drafts.
+ *
+ * @param {{ companyId?: number, userId: number, clientId?: string, timeoutMs?: number }} options
+ * @returns {Promise<Array<object>>}
+ */
+export async function requestDraftList({ companyId, userId, clientId, timeoutMs = 2500 }) {
+    const effectiveCompanyId = companyId != null ? companyId : await resolveCompanyForUser(userId);
+    if (effectiveCompanyId == null) {
+        return [];
+    }
+
+    const defaultDrafts = () => {
+        const now = new Date().toISOString();
+        return Array.from(DRAFT_NAMES).map((name) => {
+            const cached = getCachedDraft({ companyId: effectiveCompanyId, userId, name });
+            return {
+                name: `drafts/${name}`,
+                size: cached ? cached.size : 0,
+                mime: 'application/json; charset=utf-8',
+                updated_at: cached ? cached.updatedAt : now,
+                created_at: cached ? cached.updatedAt : now,
+                isText: true,
+                isImage: false,
+                isPdf: false,
+                isDraft: true,
+            };
+        });
+    };
+
+    // If no client is connected, return defaults immediately without delaying listing
+    const hasClient = hasActiveClient({ companyId: effectiveCompanyId, userId, clientId });
+    if (!hasClient) {
+        return defaultDrafts();
+    }
+
+    const requestId = `draft_list_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            pendingRequests.delete(requestId);
+            resolve(defaultDrafts());
+        }, timeoutMs);
+
+        pendingRequests.set(requestId, {
+            resolve: (filesOrList) => {
+                if (Array.isArray(filesOrList)) {
+                    const now = new Date().toISOString();
+                    const normalized = filesOrList.map((item) => {
+                        const rawName = typeof item === 'string' ? item : (item.name || item.filename || '');
+                        const parsed = parseDraftPath(rawName.startsWith('drafts/') ? rawName : `drafts/${rawName}`);
+                        const nameKey = parsed.name || rawName;
+                        const cached = getCachedDraft({ companyId: effectiveCompanyId, userId, name: nameKey });
+                        return {
+                            name: `drafts/${nameKey}`,
+                            size: typeof item === 'object' && item.size != null ? item.size : (cached ? cached.size : 0),
+                            mime: 'application/json; charset=utf-8',
+                            updated_at: typeof item === 'object' && item.updated_at ? item.updated_at : (cached ? cached.updatedAt : now),
+                            created_at: typeof item === 'object' && item.created_at ? item.created_at : (cached ? cached.updatedAt : now),
+                            isText: true,
+                            isImage: false,
+                            isPdf: false,
+                            isDraft: true,
+                        };
+                    });
+                    resolve(normalized);
+                } else {
+                    resolve(defaultDrafts());
+                }
+            },
+            reject: () => {
+                resolve(defaultDrafts());
+            },
+            timer,
+            companyId: effectiveCompanyId,
+            userId,
+            action: 'list',
+        });
+
+        emit('draft:request', {
+            companyId: effectiveCompanyId,
+            targetUserId: userId,
+            targetClientId: clientId,
+            data: {
+                requestId,
+                action: 'list',
+                sender: clientId || '',
+            },
+        });
+    });
+}
+
+/**
+ * Handle frontend response to a previous draft:request.
+ *
+ * @param {{ requestId: string, content?: any, error?: string, files?: any[] }} payload
+ * @returns {{ handled: boolean, error?: string }}
+ */
+export function handleDraftResponse({ requestId, content, error, files }) {
+    if (!requestId || !pendingRequests.has(requestId)) {
+        return { handled: false, error: 'Unknown or expired requestId' };
+    }
+
+    const pending = pendingRequests.get(requestId);
+    pendingRequests.delete(requestId);
+    clearTimeout(pending.timer);
+
+    if (error) {
+        pending.reject(new Error(error));
+        return { handled: true };
+    }
+
+    if (pending.action === 'list') {
+        pending.resolve(files !== undefined ? files : content);
+        return { handled: true };
+    }
+
+    // action === 'read'
+    setCachedDraft({
+        companyId: pending.companyId,
+        userId: pending.userId,
+        name: pending.name,
+        content,
+    });
+    pending.resolve(content);
+    return { handled: true };
+}
+
+/**
+ * Notify frontend about a draft update via the normal /events SSE endpoint.
+ *
+ * @param {{ companyId: number, userId: number, clientId?: string, name: string, content: any }} options
+ * @returns {{ name: string, size: number, updatedAt: string }}
+ */
+export function notifyDraftUpdate({ companyId, userId, clientId, name, content }) {
+    const entry = setCachedDraft({ companyId, userId, name, content });
+
+    emit('draft', {
+        companyId,
+        targetUserId: userId,
+        targetClientId: clientId,
+        data: {
+            sender: clientId || '',
+            action: 'update',
+            name,
+            content,
+        },
+    });
+
+    return {
+        name: `drafts/${name}`,
+        size: entry.size,
+        updatedAt: entry.updatedAt,
+    };
+}
+
+/**
+ * Synchronous/fire-and-forget version of notifyDraftUpdate for sync writes.
+ *
+ * @param {{ googleAuthId: number, clientId?: string, name: string, content: any }} options
+ */
+export function notifyDraftUpdateSync({ googleAuthId, clientId, name, content }) {
+    resolveCompanyForUser(googleAuthId).then((companyId) => {
+        if (companyId != null) {
+            notifyDraftUpdate({ companyId, userId: googleAuthId, clientId, name, content });
+        }
+    }).catch((err) => {
+        console.error('[draftManager] notifyDraftUpdateSync error:', err);
+    });
+}

src/tools/find-files.js

@@ -4,6 +4,7 @@ import { defineTool, ToolError } from 'libllmorbiter';
 import { isSkillPath, listSkillFiles, SKILL_EXT } from './skill.js';
 import { prepareVfs } from './vfs.js';
 import { TOOL_DESCRIPTIONS, TOOL_PARAMETER_DESCRIPTIONS } from './prompts.js';
+import { DRAFT_NAMES } from '../services/draftManager.js';
 
 /**
  * find_files — lists the contents of the virtual filesystem (VFS).
@@ -173,6 +174,31 @@ export function createFindFilesTool({ googleAuthId }) {
                 );
             }
 
+            if (cleanDir.replace(/\/+$/, '').toLowerCase() === 'drafts') {
+                const draftEntries = Array.from(DRAFT_NAMES).map((name) => ({
+                    path: `drafts/${name}`,
+                    name,
+                    type: 'file',
+                    size: null,
+                    modified: null,
+                }));
+                const page = draftEntries.slice(seek, seek + vfsLimit);
+                const truncated = Math.max(0, draftEntries.length - (seek + page.length));
+                const result = {
+                    kind: 'files',
+                    dirname: 'drafts',
+                    recursive: recursive === true,
+                    total: draftEntries.length,
+                    returned: page.length,
+                    seek,
+                    entries: page,
+                };
+                if (truncated > 0) {
+                    result.truncated = truncated;
+                }
+                return result;
+            }
+
             const absDir = path.resolve(vfsRoot, cleanDir);
             const rel = path.relative(vfsRoot, absDir);
             if (rel.startsWith('..') || path.isAbsolute(rel)) {
@@ -187,6 +213,16 @@ export function createFindFilesTool({ googleAuthId }) {
             }
 
             const all = walkVfs(absDir, vfsRoot, recursive === true, 0, maxDepth);
+            if (cleanDir === '.') {
+                if (!all.some((e) => e.path === 'drafts/')) {
+                    all.push({ path: 'drafts/', name: 'drafts', type: 'dir', size: null, modified: null });
+                }
+                if (recursive === true) {
+                    for (const name of DRAFT_NAMES) {
+                        all.push({ path: `drafts/${name}`, name, type: 'file', size: null, modified: null });
+                    }
+                }
+            }
             // Directories first, then alphabetical — makes a truncated listing predictable
             // instead of arbitrary.
             all.sort((a, b) => (a.type === b.type ? a.path.localeCompare(b.path) : a.type === 'dir' ? -1 : 1));

src/tools/patch.js

@@ -5,6 +5,8 @@ import { isReadOnlyDatabasePath } from './vfs.js';
 import { isSkillPath, renderSkill, parseSkill, SKILL_EXT, skillFileName } from './skill.js';
 import { prepareVfs, syncVfsToDb } from './vfs.js';
 import { TOOL_DESCRIPTIONS, PATCH_PARAMETER_DESCRIPTIONS } from './prompts.js';
+import { getStore } from '../db/store.js';
+import { parseDraftPath, requestDraftRead, notifyDraftUpdate, getCachedDraft } from '../services/draftManager.js';
 
 /**
  * patch — applies edit operations to files in the virtual filesystem (VFS).
@@ -175,7 +177,12 @@ export function createPatchTool({ googleAuthId }) {
                     );
                 }
 
-                validated.push({ index: i, op, clean, abs, isSkill: looksSkillByExt, skillBody });
+                const draftInfo = parseDraftPath(clean);
+                if (draftInfo.isFolder) {
+                    throw new ToolError(`Operation at index ${i}: "${clean}" is a directory and cannot be patched.`);
+                }
+
+                validated.push({ index: i, op, clean, abs, isSkill: looksSkillByExt, skillBody, draftInfo });
             }
 
             // ── Apply ──────────────────────────────────────────────────────
@@ -183,7 +190,57 @@ export function createPatchTool({ googleAuthId }) {
             const touchedSkills = new Set();
 
             for (const v of validated) {
-                const { op, clean, abs, isSkill } = v;
+                const { op, clean, abs, isSkill, draftInfo } = v;
+
+                if (draftInfo?.isDraft) {
+                    const isCreate = op.search === null || op.search === undefined || op.search === '';
+                    let original = '';
+                    if (!isCreate) {
+                        try {
+                            const readVal = await requestDraftRead({ userId: googleAuthId, name: draftInfo.name });
+                            original = typeof readVal === 'string' ? readVal : JSON.stringify(readVal ?? {}, null, 2);
+                        } catch (err) {
+                            const cached = getCachedDraft({ userId: googleAuthId, name: draftInfo.name });
+                            if (cached) {
+                                original = typeof cached.content === 'string' ? cached.content : JSON.stringify(cached.content ?? {}, null, 2);
+                            } else {
+                                throw new ToolError(`Cannot read draft "${clean}" before patching: ${err.message}`);
+                            }
+                        }
+                    }
+
+                    let draftUpdated;
+                    if (isCreate) {
+                        draftUpdated = typeof op.replace === 'string' ? op.replace : JSON.stringify(op.replace, null, 2);
+                    } else {
+                        const haystack = original.includes('\r\n') ? original.replace(/\r\n/g, '\n') : original;
+                        const needle = typeof op.search === 'string' ? op.search.replace(/\r\n/g, '\n') : '';
+                        if (!needle) {
+                            throw new ToolError(`Operation at index ${v.index} ("${clean}") has an empty "search". Use "search": null to overwrite.`);
+                        }
+                        const at = haystack.indexOf(needle);
+                        if (at === -1) {
+                            throw new ToolError(`SEARCH/REPLACE failed in "${clean}": the search text was not found. Read the draft again with read_file.`);
+                        }
+                        const replacement = typeof op.replace === 'string' ? op.replace : JSON.stringify(op.replace, null, 2);
+                        draftUpdated = haystack.slice(0, at) + replacement + haystack.slice(at + needle.length);
+                    }
+
+                    let parsed = draftUpdated;
+                    try { parsed = JSON.parse(draftUpdated); } catch {}
+                    const store = await getStore();
+                    const row = await store.google_auth.getById(googleAuthId);
+                    const companyId = row?.selectedCompanyId;
+                    notifyDraftUpdate({
+                        companyId,
+                        userId: googleAuthId,
+                        name: draftInfo.name,
+                        content: parsed,
+                    });
+                    applied.push(`PATCH ${clean}`);
+                    continue;
+                }
+
                 const isCreate = op.search === null || op.search === undefined || op.search === '';
                 const exists = fs.existsSync(abs);
 
@@ -260,16 +317,19 @@ export function createPatchTool({ googleAuthId }) {
                 if (isSkill) touchedSkills.add(clean);
             }
 
-            // Persist immediately — unlike javascript_execute, there is no trailing sync, so a
+            // Persist immediately for disk files — unlike javascript_execute, there is no trailing sync, so a
             // text edit would otherwise live only in the on-disk cache until some other tool ran.
-            try {
-                await syncVfsToDb({ googleAuthId, vfsRoot });
-            } catch (err) {
-                console.error('[patch] failed to sync VFS to db:', err.message);
-                throw new ToolError(
-                    `Patch applied to disk but could not be persisted: ${err.message}. ` +
-                    `Files changed: ${applied.join(', ')}.`
-                );
+            const hasDiskWrites = validated.some((v) => !v.draftInfo?.isDraft);
+            if (hasDiskWrites) {
+                try {
+                    await syncVfsToDb({ googleAuthId, vfsRoot });
+                } catch (err) {
+                    console.error('[patch] failed to sync VFS to db:', err.message);
+                    throw new ToolError(
+                        `Patch applied to disk but could not be persisted: ${err.message}. ` +
+                        `Files changed: ${applied.join(', ')}.`
+                    );
+                }
             }
 
             const result = {

src/tools/read-file.js

@@ -5,6 +5,7 @@ import { isSkillPath, parseSkill, SKILL_EXT } from './skill.js';
 import { getApiRouteSkill } from './routes-skills.js';
 import { prepareVfs } from './vfs.js';
 import { TOOL_DESCRIPTIONS, TOOL_PARAMETER_DESCRIPTIONS } from './prompts.js';
+import { parseDraftPath, requestDraftRead } from '../services/draftManager.js';
 
 const DEFAULT_LIMIT = 400;
 const MAX_LIMIT = 5000;
@@ -108,18 +109,37 @@ export function createReadFileTool({ googleAuthId }) {
                 throw new ToolError(`Access denied: path "${filename}" escapes virtual filesystem boundary.`);
             }
 
-            const virtualSkill = !fs.existsSync(absPath) && isSkillPath(clean) ? getApiRouteSkill(clean) : null;
-            if (!virtualSkill && !fs.existsSync(absPath)) {
-                throw new ToolError(
-                    `File not found in virtual filesystem: "${clean}". ` +
-                    'Call find_files to see what is stored, or find_files({ skills: true }) for SKILL files.'
-                );
-            }
-            if (!virtualSkill && !fs.statSync(absPath).isFile()) {
-                throw new ToolError(`"${clean}" is not a file. Use find_files to list directories.`);
+            const draftInfo = parseDraftPath(clean);
+            if (draftInfo.isFolder) {
+                throw new ToolError('"drafts" is a directory. Use find_files to list its contents.');
             }
 
-            const raw = virtualSkill ? Buffer.from(virtualSkill.content, 'utf8') : fs.readFileSync(absPath);
+            let raw;
+            let virtualSkill = null;
+            if (draftInfo.isDraft) {
+                try {
+                    const content = await requestDraftRead({
+                        userId: googleAuthId,
+                        name: draftInfo.name,
+                    });
+                    const str = typeof content === 'string' ? content : JSON.stringify(content ?? {}, null, 2);
+                    raw = Buffer.from(str, 'utf8');
+                } catch (err) {
+                    throw new ToolError(`Failed to read draft "${draftInfo.name}": ${err.message}`);
+                }
+            } else {
+                virtualSkill = !fs.existsSync(absPath) && isSkillPath(clean) ? getApiRouteSkill(clean) : null;
+                if (!virtualSkill && !fs.existsSync(absPath)) {
+                    throw new ToolError(
+                        `File not found in virtual filesystem: "${clean}". ` +
+                        'Call find_files to see what is stored, or find_files({ skills: true }) for SKILL files.'
+                    );
+                }
+                if (!virtualSkill && !fs.statSync(absPath).isFile()) {
+                    throw new ToolError(`"${clean}" is not a file. Use find_files to list directories.`);
+                }
+                raw = virtualSkill ? Buffer.from(virtualSkill.content, 'utf8') : fs.readFileSync(absPath);
+            }
             if (looksBinary(raw)) {
                 const ext = path.extname(clean).toLowerCase();
                 throw new ToolError(

src/tools/vfs.js

@@ -4,6 +4,14 @@ import { getStore } from '../db/store.js';
 import env from '../config/env.js';
 import { getDefaultSkills } from './skill.js';
 import { getDefaultApplets, DEFAULT_APPLETS_VERSION, APPLET_EXT } from './applet.js';
+import {
+    parseDraftPath,
+    requestDraftRead,
+    notifyDraftUpdate,
+    notifyDraftUpdateSync,
+    getCachedDraft,
+    DRAFT_NAMES,
+} from '../services/draftManager.js';
 
 const FULL_HASH_REGEX = /^[a-zA-Z0-9]{8}$/;
 const VIRTUAL_IMAGE_FOLDERS = new Set(['image', 'images']);
@@ -300,6 +308,16 @@ export function createVfs(vfsRoot, options = {}) {
 
     const vfs = {
         readFileSync: (p, opt) => {
+            const draftInfo = parseDraftPath(p);
+            if (draftInfo.isDraft) {
+                const cached = getCachedDraft({ userId: googleAuthId, name: draftInfo.name });
+                if (cached) {
+                    const str = typeof cached.content === 'string' ? cached.content : JSON.stringify(cached.content ?? {}, null, 2);
+                    const encoding = typeof opt === 'string' ? opt : opt?.encoding;
+                    return encoding ? str : Buffer.from(str, 'utf8');
+                }
+                throw new Error(`Virtual draft "${draftInfo.name}" is not cached in memory. Use vfs.promises.readFile() to fetch it asynchronously.`);
+            }
             const hash = extractFullHash(p);
             if (hash) {
                 const buf = syncFetchImage(hash);
@@ -342,6 +360,19 @@ export function createVfs(vfsRoot, options = {}) {
         },
 
         writeFileSync: (p, data, opt) => {
+            const draftInfo = parseDraftPath(p);
+            if (draftInfo.isDraft) {
+                let str = typeof data === 'string' ? data : Buffer.isBuffer(data) ? data.toString('utf8') : JSON.stringify(data);
+                let parsed = str;
+                try { parsed = JSON.parse(str); } catch {}
+                notifyDraftUpdateSync({
+                    googleAuthId,
+                    clientId: options.clientId,
+                    name: draftInfo.name,
+                    content: parsed,
+                });
+                return;
+            }
             assertNotReadOnlyDatabasePath(p);
             const diskPath = safeResolve(p);
             fs.mkdirSync(path.dirname(diskPath), { recursive: true });
@@ -382,6 +413,8 @@ export function createVfs(vfsRoot, options = {}) {
             }
         },
         existsSync: (p) => {
+            const draftInfo = parseDraftPath(p);
+            if (draftInfo.isFolder || draftInfo.isDraft) return true;
             const hash = extractFullHash(p);
             if (hash) {
                 const buf = syncFetchImage(hash);
@@ -396,6 +429,31 @@ export function createVfs(vfsRoot, options = {}) {
         },
 
         statSync: (p, opt) => {
+            const draftInfo = parseDraftPath(p);
+            if (draftInfo.isFolder) {
+                const now = new Date();
+                return {
+                    isFile: () => false,
+                    isDirectory: () => true,
+                    size: 0,
+                    mtime: now,
+                    ctime: now,
+                    atime: now,
+                };
+            }
+            if (draftInfo.isDraft) {
+                const cached = getCachedDraft({ userId: googleAuthId, name: draftInfo.name });
+                const now = cached?.updatedAt ? new Date(cached.updatedAt) : new Date();
+                const size = cached?.size ?? 0;
+                return {
+                    isFile: () => true,
+                    isDirectory: () => false,
+                    size,
+                    mtime: now,
+                    ctime: now,
+                    atime: now,
+                };
+            }
             const hash = extractFullHash(p);
             if (hash) {
                 const buf = syncFetchImage(hash);
@@ -418,36 +476,62 @@ export function createVfs(vfsRoot, options = {}) {
         lstatSync: (p, opt) => vfs.statSync(p, opt),
 
         readdirSync: (p = '.', opt) => {
+            const draftInfo = parseDraftPath(p);
+            if (draftInfo.isFolder) {
+                return Array.from(DRAFT_NAMES);
+            }
             const clean = typeof p === 'string' ? p.trim().replace(/^([a-zA-Z]:|\/)+/, '') : '';
             if (VIRTUAL_IMAGE_FOLDERS.has(clean.toLowerCase())) {
                 return [];
             }
             const diskPath = safeResolve(p);
-            return fs.readdirSync(diskPath, opt);
+            const entries = fs.readdirSync(diskPath, opt);
+            if ((clean === '' || clean === '.') && Array.isArray(entries)) {
+                if (!entries.some((e) => (typeof e === 'string' ? e : e.name) === 'drafts')) {
+                    entries.push('drafts');
+                }
+            }
+            return entries;
         },
 
         mkdirSync: (p, opt) => {
-      assertNotReadOnlyDatabasePath(p);
-  const diskPath = safeResolve(p);
-        try {
-       return fs.mkdirSync(diskPath, opt);
-    } catch (err) {
-      throw sanitizeFsError(err, p);
-       }
-   },
+            const draftInfo = parseDraftPath(p);
+            if (draftInfo.isFolder || draftInfo.isDraft) {
+                throw new Error(`Access denied: "${p}" is a virtual draft and cannot be created on disk.`);
+            }
+            assertNotReadOnlyDatabasePath(p);
+            const diskPath = safeResolve(p);
+            try {
+                return fs.mkdirSync(diskPath, opt);
+            } catch (err) {
+                throw sanitizeFsError(err, p);
+            }
+        },
         unlinkSync: (p) => {
+            const draftInfo = parseDraftPath(p);
+            if (draftInfo.isFolder || draftInfo.isDraft) {
+                throw new Error(`Access denied: "${p}" is a virtual draft and cannot be unlinked on disk.`);
+            }
             assertNotReadOnlyDatabasePath(p);
             const diskPath = safeResolve(p);
             return fs.unlinkSync(diskPath);
         },
 
         rmdirSync: (p, opt) => {
-      assertNotReadOnlyDatabasePath(p);
+            const draftInfo = parseDraftPath(p);
+            if (draftInfo.isFolder || draftInfo.isDraft) {
+                throw new Error(`Access denied: "${p}" is a virtual draft and cannot be removed on disk.`);
+            }
+            assertNotReadOnlyDatabasePath(p);
             const diskPath = safeResolve(p);
             return fs.rmdirSync(diskPath, opt);
         },
 
-  rmSync: (p, opt) => {
+        rmSync: (p, opt) => {
+            const draftInfo = parseDraftPath(p);
+            if (draftInfo.isFolder || draftInfo.isDraft) {
+                throw new Error(`Access denied: "${p}" is a virtual draft and cannot be removed on disk.`);
+            }
             assertNotReadOnlyDatabasePath(p);
             const diskPath = safeResolve(p);
             return fs.rmSync(diskPath, opt);
@@ -455,6 +539,17 @@ export function createVfs(vfsRoot, options = {}) {
 
         promises: {
             readFile: async (p, opt) => {
+                const draftInfo = parseDraftPath(p);
+                if (draftInfo.isDraft) {
+                    const content = await requestDraftRead({
+                        userId: googleAuthId,
+                        clientId: options.clientId,
+                        name: draftInfo.name,
+                    });
+                    const str = typeof content === 'string' ? content : JSON.stringify(content ?? {}, null, 2);
+                    const encoding = typeof opt === 'string' ? opt : opt?.encoding;
+                    return encoding ? str : Buffer.from(str, 'utf8');
+                }
                 const hash = extractFullHash(p);
                 if (hash) {
                     const buf = syncFetchImage(hash);
@@ -482,7 +577,29 @@ export function createVfs(vfsRoot, options = {}) {
                 }
                 return vfs.readFileSync(p, opt);
             },
-            writeFile: async (p, data, opt) => vfs.writeFileSync(p, data, opt),
+            writeFile: async (p, data, opt) => {
+                const draftInfo = parseDraftPath(p);
+                if (draftInfo.isDraft) {
+                    let str = typeof data === 'string' ? data : Buffer.isBuffer(data) ? data.toString('utf8') : JSON.stringify(data);
+                    let parsed = str;
+                    try { parsed = JSON.parse(str); } catch {}
+                    let companyId = options.companyId;
+                    if (companyId == null && googleAuthId) {
+                        const store = await getStore();
+                        const row = await store.google_auth.getById(googleAuthId);
+                        companyId = row?.selectedCompanyId;
+                    }
+                    notifyDraftUpdate({
+                        companyId,
+                        userId: googleAuthId,
+                        clientId: options.clientId,
+                        name: draftInfo.name,
+                        content: parsed,
+                    });
+                    return;
+                }
+                return vfs.writeFileSync(p, data, opt);
+            },
             appendFile: async (p, data, opt) => vfs.appendFileSync(p, data, opt),
             stat: async (p, opt) => vfs.statSync(p, opt),
             readdir: async (p, opt) => vfs.readdirSync(p, opt),