Bugfix: SMB share no longer mis-loads local paths after volume switch

A stale `onPathChange` arriving after a volume switch was poisoning the new
volume's state: `applyPathChange` only guarded the virtual `network` volume, so
for real SMB/MTP volumes the foreign path landed via `pushPath` and
`saveLastUsedPathForVolume`, corrupting tab state and persisted last-used-path.
On the next switch to the same SMB share, `determineNavigationPath` read the
poisoned value back and `applyVolumePathCorrection` "corrected" the pane to a
local path on the SMB volume, surfacing as `STATUS_OBJECT_PATH_NOT_FOUND` on
`Create`. The volume breadcrumb then resolved the local path back to "Macintosh
HD" via `resolvePathVolume`, making the UI look schizophrenic.

- Extend the `applyPathChange` stale-guard from "network only" to "any volume" via a new `isPathOnVolume` helper.
- Filter `determineNavigationPath`'s `lastUsedPath` lookup through `isPathOnVolume` so older corruption can't re-trigger the bug.
- Update the gotcha note in `file-explorer/CLAUDE.md` to match the universal guard.
- Add unit tests for `isPathOnVolume` and the foreign-`lastUsedPath` case.

Author: vdavid

apps/desktop/src/lib/file-explorer/CLAUDE.md

@@ -362,12 +362,17 @@ layout component re-evaluation). If sveltejs/kit#15287 gets fixed, the workaroun
 
 **Stale `onPathChange` from a slow listing can poison a pane after a volume switch.** `FilePane.onPathChange` fires on
 `listing-complete` for whatever path the pane was loading. If the user (or a command like "Copy path between panes")
-flips the pane to a different volume — especially the virtual `network` volume — between `listing-start` and
-`listing-complete`, the stale callback lands on a pane whose `volumeId` no longer matches the path it carries.
-`applyPathChange` in `DualPaneExplorer` guards against the `network` case (drops paths that don't start with `smb://`)
-because `pushPath` inherits the current `volumeId` and would otherwise write a malformed `{network, /Volumes/...}`
-history entry plus a corrupted `lastUsedPathForVolume('network')`. If you introduce another virtual-volume namespace
-with its own non-filesystem prefix, extend the guard.
+flips the pane to a different volume between `listing-start` and `listing-complete`, the stale callback lands on a pane
+whose `volumeId` no longer matches the path it carries. `applyPathChange` in `DualPaneExplorer` guards against this by
+dropping paths that don't belong on the current volume: `smb://`-prefixed for the virtual `network` volume, and via
+`isPathOnVolume(path, volumePath)` for every other (real) volume. Without the guard, `pushPath` and
+`saveLastUsedPathForVolume` would write a foreign path under the new `volumeId`, corrupting in-memory tab state, the nav
+history, and persisted last-used-path state — for example, persisting `/Users/.../project` as the "last used path" for
+an SMB share, which would then cause the next switch to that share to attempt a doomed `Create` against
+`Users\...\project` and surface as `STATUS_OBJECT_PATH_NOT_FOUND`. `determineNavigationPath` applies the same
+`isPathOnVolume` filter when reading back `lastUsedPath` so older corruption from before this guard existed can't
+re-trigger the bug. If you introduce another virtual-volume namespace with its own non-filesystem prefix (something
+`isPathOnVolume` can't match against), extend the explicit network-style branch.
 
 ## Views (`views/`)
 

apps/desktop/src/lib/file-explorer/navigation/path-navigation.test.ts

@@ -12,7 +12,7 @@ vi.mock('$lib/app-status-store', () => ({
 const { pathExists } = await import('$lib/tauri-commands')
 const { getLastUsedPathForVolume } = await import('$lib/app-status-store')
 
-import { withTimeout, determineNavigationPath } from './path-navigation'
+import { withTimeout, determineNavigationPath, isPathOnVolume } from './path-navigation'
 import type { OtherPaneState } from './path-navigation'
 import { resolveValidPath } from './path-resolution'
 
@@ -116,6 +116,23 @@ describe('determineNavigationPath', () => {
     expect(result).toBe('/Users/test/last-used')
   })
 
+  it('ignores last used path that is foreign to the target volume', async () => {
+    // Reproduces the SMB-share-shows-local-path bug: a previously corrupted
+    // `lastUsedPathForVolume('smb-…-naspi') = '/Users/…/vdavid'` must not be
+    // returned just because `pathExists` confirms the local path.
+    mockGetLastUsedPath.mockResolvedValue('/Users/test/local-project')
+    mockPathExists.mockResolvedValue(true)
+
+    const resultPromise = determineNavigationPath('smb-192-168-1-111-445-naspi', '/Volumes/naspi', '/Volumes/naspi', {
+      otherPaneVolumeId: 'root',
+      otherPanePath: '/Users/test/local-project',
+    })
+    await vi.advanceTimersByTimeAsync(500)
+    const result = await resultPromise
+
+    expect(result).toBe('/Volumes/naspi')
+  })
+
   it('returns ~ when volume is DEFAULT_VOLUME_ID and no better option', async () => {
     mockPathExists.mockResolvedValue(false)
     mockGetLastUsedPath.mockResolvedValue(undefined)
@@ -183,6 +200,34 @@ describe('determineNavigationPath', () => {
   })
 })
 
+describe('isPathOnVolume', () => {
+  it('accepts an exact match', () => {
+    expect(isPathOnVolume('/Volumes/naspi', '/Volumes/naspi')).toBe(true)
+  })
+
+  it('accepts a descendant path', () => {
+    expect(isPathOnVolume('/Volumes/naspi/photos/2024', '/Volumes/naspi')).toBe(true)
+  })
+
+  it('rejects a sibling whose name shares a prefix', () => {
+    expect(isPathOnVolume('/Volumes/naspi-backup', '/Volumes/naspi')).toBe(false)
+  })
+
+  it('rejects a foreign path', () => {
+    expect(isPathOnVolume('/Users/test/project', '/Volumes/naspi')).toBe(false)
+  })
+
+  it('treats root volume `/` as matching any absolute path', () => {
+    expect(isPathOnVolume('/Users/test', '/')).toBe(true)
+    expect(isPathOnVolume('/', '/')).toBe(true)
+  })
+
+  it('handles a volumePath that already ends in `/`', () => {
+    expect(isPathOnVolume('smb://host/share/foo', 'smb://')).toBe(true)
+    expect(isPathOnVolume('/Users/test', 'smb://')).toBe(false)
+  })
+})
+
 describe('resolveValidPath', () => {
   beforeEach(() => {
     vi.useFakeTimers()

apps/desktop/src/lib/file-explorer/navigation/path-navigation.ts

@@ -18,6 +18,18 @@ export interface OtherPaneState {
   otherPanePath: string
 }
 
+/**
+ * True when `path` equals `volumePath` or is a descendant of it. Used to drop
+ * stale or corrupted paths that don't belong on the given volume — for example
+ * a local `/Users/...` path that ended up persisted under an SMB volumeId from
+ * a previous bug.
+ */
+export function isPathOnVolume(path: string, volumePath: string): boolean {
+  if (path === volumePath) return true
+  const prefix = volumePath.endsWith('/') ? volumePath : volumePath + '/'
+  return path.startsWith(prefix)
+}
+
 /**
  * Determines which path to navigate to when switching volumes.
  * Runs checks in parallel with 500ms frontend timeouts per check.
@@ -46,7 +58,9 @@ export async function determineNavigationPath(
       ? withTimeout(pathExists(otherPane.otherPanePath), pathExistsTimeoutMs, false)
       : Promise.resolve(false),
     getLastUsedPathForVolume(volumeId).then((p) =>
-      p ? withTimeout(pathExists(p), pathExistsTimeoutMs, false).then((ok) => (ok ? p : null)) : null,
+      p && isPathOnVolume(p, volumePath)
+        ? withTimeout(pathExists(p), pathExistsTimeoutMs, false).then((ok) => (ok ? p : null))
+        : null,
     ),
   ])
 

apps/desktop/src/lib/file-explorer/pane/DualPaneExplorer.svelte

@@ -45,7 +45,7 @@
     } from '../types'
     import { defaultSortOrders } from '../types'
     import { ensureFontMetricsLoaded } from '$lib/font-metrics'
-    import { determineNavigationPath } from '../navigation/path-navigation'
+    import { determineNavigationPath, isPathOnVolume } from '../navigation/path-navigation'
     import { resolveValidPath } from '../navigation/path-resolution'
 
     import {
@@ -464,15 +464,26 @@
 
     /** Applies a path change to the active tab in-place (the normal non-pinned flow). */
     function applyPathChange(pane: 'left' | 'right', path: string) {
-        // Drop stale `onPathChange` events that arrive after the pane was
-        // switched to the virtual `network` volume. Without this gate, a
-        // listing-complete from the previous SMB folder lands after the user
-        // (or a command like "Copy path between panes") flips to Network, and
-        // `pushPath` inherits `volumeId='network'` while writing a real path
-        // — corrupting both `pane.path` and `lastUsedPathForVolume('network')`.
+        // Drop stale `onPathChange` events that arrive after the pane was switched
+        // to a different volume. Without this gate, a `listing-complete` from the
+        // previous folder lands after the user (or a command like "Copy path between
+        // panes") flips volumes, and `pushPath` / `saveLastUsedPathForVolume` end up
+        // writing a foreign path under the new `volumeId` — corrupting `pane.path`,
+        // navigation history, and persisted last-used-path state. Network is checked
+        // separately because its mount path is the `smb://` scheme, not a filesystem
+        // prefix that `isPathOnVolume` can match against.
         const currentVolumeId = getPaneVolumeId(pane)
-        if (currentVolumeId === 'network' && !path.startsWith('smb://')) {
-            log.debug('Dropping stale onPathChange on network pane: {path}', { path })
+        const currentVolumePath = getPaneVolumePath(pane)
+        if (currentVolumeId === 'network') {
+            if (!path.startsWith('smb://')) {
+                log.debug('Dropping stale onPathChange on network pane: {path}', { path })
+                return
+            }
+        } else if (!isPathOnVolume(path, currentVolumePath)) {
+            log.debug(
+                'Dropping stale onPathChange: {path} is not on volume {volumeId} ({volumePath})',
+                { path, volumeId: currentVolumeId, volumePath: currentVolumePath },
+            )
             return
         }
         setPanePath(pane, path)