fix: verify selected folder identity

Signed-off-by: Zeid Diez <zeidalidiez@gmail.com>

Author: zeidalidiez

AI.md

@@ -87,7 +87,7 @@ The core domain in `packages/core/src/domain/` covers the entities the plan call
 - the shared shell wraps routes in `ToastProvider`; route code should use `useToast()` for short-lived feedback and keep blocking or recoverable errors in `InlineAlert`
 - the shared shell exposes explicit project actions next to the save-state indicator: `Save now` / `Retry save` routes through the active `ProjectStoreAdapter.save()` plus `markSaving()` / `markSaved()` / `markSaveFailed()`, records a launcher recent from successful browser/folder save metadata, `Switch project` navigates to `/projects`, and `Close project` returns to the launcher immediately only for clean saved projects; dirty projects and unsaved in-memory imports/demos must confirm `Close without saving` before `closeProject()` runs
 - `StorageSettings` is the active-project storage-location surface, not a read-only trust report: a browser-local or unsaved web project can `Save to local folder`, while a folder-backed web project can `Change folder` or `Use browser storage`; each successful transition serializes the bundle with the intended trust, saves through the installed `window.__gph_store` adapter, calls `markSaved()` with returned metadata, and replaces the same-key launcher recent
-- storage-location transitions deliberately pass a null expected revision because the current revision belongs to the old target rather than the newly selected backend; folder selection checks `listFolderProjects()` and refuses to overwrite a same-ID `.pms.json` unless it is the already-active folder target, then calls the adapter's optional `restorePreviousFolder()` rollback after collisions, scan errors, failed writes, or an active-project switch so an unsuccessful transition cannot leave future folder operations bound to the unaccepted directory
+- storage-location transitions deliberately pass a null expected revision because the current revision belongs to the old target rather than the newly selected backend; folder selection checks `listFolderProjects()` and refuses to overwrite a same-ID `.pms.json` unless the adapter proves the selected directory is the same filesystem entry as the previous active binding through optional `isSelectedFolderSameAsPrevious()` semantics—display names and saved path strings are never folder identities. A confirmed re-selection of the current folder is a no-op rather than a blind rewrite, while collisions, scan errors, failed writes, and active-project switches call `restorePreviousFolder()` so an unsuccessful transition cannot leave future folder operations bound to the unaccepted directory
 - switching storage locations is copy-first and non-destructive: the old folder file or browser recovery copy remains in place, changing back to browser storage does not clear the shared browser folder handle needed by other folder-backed recents, and an `AbortError` from the native directory picker is a normal dismissal that does not mark the project save as failed
 - manual storage transitions serialize one target-trust snapshot before writing, then compare that snapshot with the latest active bundle normalized to the same target trust; the returned metadata still activates the new location, but a divergent latest bundle is immediately left dirty via `markUnsaved()` so edits made during the in-flight write are not falsely reported as saved and can auto-save next
 - web and desktop auto-save success and failure completions must verify that `latest.storageTrust` still matches the target they wrote before applying returned metadata or save-error state; this prevents an in-flight save to the previous location from reverting the active trust/path/revision or marking the newly active target as failed after a storage transition. Folder-to-folder moves are also disabled while the current folder project is dirty, because choosing a new browser folder handle changes the adapter target immediately.
@@ -726,6 +726,10 @@ The core domain in `packages/core/src/domain/` covers the entities the plan call
   - extending `ProjectStoreAdapter` with optional `restorePreviousFolder()` rollback semantics for consumers that validate a directory after the native picker returns
   - checkpointing the prior web `FileSystemDirectoryHandle` before each accepted pick and restoring both the active in-memory handle and best-effort IndexedDB binding when Settings rejects a same-ID collision
   - invoking rollback before showing the collision warning and after any scan/save failure or active-project switch, with web-adapter coverage proving scans return to the accepted folder plus Settings coverage for collision, picker cancellation, and failed-write behavior
+- addressed the follow-up Greptile same-name folder identity finding by:
+  - removing the `StorageSettings` path-suffix/display-name heuristic that could mistake two distinct directories with the same basename for one folder target
+  - adding optional `ProjectStoreAdapter.isSelectedFolderSameAsPrevious()` semantics and implementing the web comparison with `FileSystemHandle.isSameEntry()`; unavailable or failed identity checks conservatively remain collisions
+  - covering same-name distinct handle comparisons in the web adapter plus both Settings outcomes: distinct directories retain the collision warning and restore the accepted binding, while a confirmed re-selection of the current directory performs no write
 
 ## Open follow-on planning
 

Readme.md

@@ -83,7 +83,7 @@ Important behavior:
 
 - New folder-backed projects write their initial `.pm-suite/<project-id>.pms.json` immediately.
 - An open browser-local project can move to a chosen folder from **Settings -> Storage** without being recreated; a folder-backed project can change folders or switch back to browser storage from the same panel.
-- Changing storage locations writes and activates the new copy first. The previous browser or folder copy is retained as a recovery point, and a collision or failed move restores the previously accepted folder binding instead of leaving later saves pointed at a rejected directory.
+- Changing storage locations writes and activates the new copy first. The previous browser or folder copy is retained as a recovery point, and a collision or failed move restores the previously accepted folder binding instead of leaving later saves pointed at a rejected directory. Folder identity is checked by the browser's filesystem handles, so two different folders with the same name cannot bypass the same-project collision guard; reselecting the actual current folder is recognized without rewriting its file.
 - If an edit arrives while that location change is still writing, Grillo activates the new destination but keeps the newer edit marked unsaved so the next auto-save includes it.
 - Auto-save results belong to the storage target that started them. If the user changes targets while a save is in flight, its later success or failure cannot overwrite the new target's saved state.
 - Folder-backed browser saves keep a browser-local recovery copy so reloads are recoverable when the browser cannot restore folder access.

apps/web/src/platform/storage/web-storage.test.ts

@@ -45,6 +45,7 @@ function createFakeFolder(name: string, seed: Record<string, string> = {}): Fake
     name,
     queryPermission: async () => "granted",
     requestPermission: async () => "granted",
+    isSameEntry: async (other: FileSystemHandle) => other === handle,
     getDirectoryHandle: async (dirname: string, options?: FileSystemGetDirectoryOptions) => {
       if (dirname === ".pm-suite") return projectDir;
       if (options?.create) throw new Error("Only .pm-suite is supported by this test handle");
@@ -147,6 +148,28 @@ describe("WebStorageAdapter folder mode", () => {
     await expect(adapter.listFolderProjects?.()).resolves.toEqual(["accepted.pms.json"]);
   });
 
+  it("compares folder picks by handle identity instead of their display names", async () => {
+    const accepted = createFakeFolder("Shared Name");
+    const different = createFakeFolder("Shared Name");
+    Object.defineProperty(window, "showDirectoryPicker", {
+      configurable: true,
+      value: vi.fn()
+        .mockResolvedValueOnce(accepted.handle)
+        .mockResolvedValueOnce(accepted.handle)
+        .mockResolvedValueOnce(different.handle)
+    });
+    const adapter = await getAdapter();
+
+    await adapter.chooseFolder?.();
+    await expect(adapter.isSelectedFolderSameAsPrevious?.()).resolves.toBe(false);
+
+    await adapter.chooseFolder?.();
+    await expect(adapter.isSelectedFolderSameAsPrevious?.()).resolves.toBe(true);
+
+    await adapter.chooseFolder?.();
+    await expect(adapter.isSelectedFolderSameAsPrevious?.()).resolves.toBe(false);
+  });
+
   it("rejects a stale folder save after the project file changes externally", async () => {
     const bundle = buildProjectFromTemplate("software-project", "Original");
     const originalJson = exportProjectJson(bundle);

apps/web/src/platform/storage/web-storage.ts

@@ -375,6 +375,24 @@ class WebLocalStorageAdapter implements ProjectStoreAdapter {
       // durable handle persistence remains best-effort, matching chooseFolder().
     }
   }
+  async isSelectedFolderSameAsPrevious(): Promise<boolean> {
+    const selectedHandle = activeFolderHandle;
+    const previousHandle = this.previousFolderHandle;
+    if (!selectedHandle || !previousHandle) return false;
+    const isSameEntry = (
+      selectedHandle as FileSystemDirectoryHandle & {
+        isSameEntry?: (other: FileSystemHandle) => Promise<boolean>;
+      }
+    ).isSameEntry;
+    if (!isSameEntry) return false;
+    try {
+      return await isSameEntry.call(selectedHandle, previousHandle);
+    } catch {
+      // Display names are not identities. If the browser cannot compare handles,
+      // callers must conservatively treat an existing same-ID file as a collision.
+      return false;
+    }
+  }
   async getCurrentFolderDisplay(): Promise<string | null> {
     const handle = await readStoredFolderHandle();
     return handle?.name ?? null;

packages/core/src/storage/store.ts

@@ -65,6 +65,8 @@ export type ProjectStoreAdapter = {
   chooseFolder?(): Promise<string | null>;
   /** Optional rollback for the most recent successful folder pick when validation rejects it. */
   restorePreviousFolder?(): Promise<void>;
+  /** Optional identity check for the latest folder pick against the binding it replaced. */
+  isSelectedFolderSameAsPrevious?(): Promise<boolean>;
   /** Optional human-readable display name for the currently selected folder. */
   getCurrentFolderDisplay?(): Promise<string | null>;
   /** Optional reset that makes subsequent explicitly browser-local saves ignore a selected folder. */

packages/ui/src/views/settings/SettingsView.test.tsx

@@ -399,6 +399,104 @@ describe("SettingsView", () => {
     expect(useProjectStore.getState()).toMatchObject({ storageTrust: "browser", saveError: null });
   });
 
+  it("does not trust a matching folder name when a different folder contains the same project id", async () => {
+    const bundle = useProjectStore.getState().bundle!;
+    const storagePath = `Shared Name/.pm-suite/${bundle.project.id}.pms.json`;
+    useProjectStore.setState({
+      storagePath,
+      storageTrust: "folder",
+      isDirty: false,
+      saveStatus: "saved"
+    });
+    const save = vi.fn();
+    const restorePreviousFolder = vi.fn(async () => undefined);
+    const isSelectedFolderSameAsPrevious = vi.fn(async () => false);
+    const adapter: ProjectStoreAdapter = {
+      capabilities: { folderBacked: true, fileWatch: false, attachments: true },
+      list: async () => [],
+      has: async () => true,
+      load: async () => null,
+      save,
+      delete: async () => undefined,
+      chooseFolder: async () => "Shared Name",
+      restorePreviousFolder,
+      isSelectedFolderSameAsPrevious,
+      listFolderProjects: async () => [`${bundle.project.id}.pms.json`]
+    };
+    (window as typeof window & { __gph_store?: ProjectStoreAdapter }).__gph_store = adapter;
+
+    render(
+      <ThemeProvider>
+        <MemoryRouter>
+          <SettingsView />
+        </MemoryRouter>
+      </ThemeProvider>
+    );
+
+    await userEvent.click(screen.getByRole("tab", { name: "Storage" }));
+    const panel = screen.getByRole("tabpanel", { name: "Storage" });
+    await userEvent.click(within(panel).getByRole("button", { name: "Change folder" }));
+
+    expect(await within(panel).findByText(/already contains .*\.pms\.json/i)).toBeInTheDocument();
+    expect(isSelectedFolderSameAsPrevious).toHaveBeenCalledOnce();
+    expect(save).not.toHaveBeenCalled();
+    expect(restorePreviousFolder).toHaveBeenCalledOnce();
+    expect(useProjectStore.getState()).toMatchObject({
+      storagePath,
+      storageTrust: "folder",
+      saveStatus: "saved"
+    });
+  });
+
+  it("treats a confirmed re-selection of the active folder as a no-op", async () => {
+    const bundle = useProjectStore.getState().bundle!;
+    const storagePath = `Client Work/.pm-suite/${bundle.project.id}.pms.json`;
+    useProjectStore.setState({
+      storagePath,
+      storageTrust: "folder",
+      isDirty: false,
+      saveStatus: "saved"
+    });
+    const save = vi.fn();
+    const restorePreviousFolder = vi.fn(async () => undefined);
+    const isSelectedFolderSameAsPrevious = vi.fn(async () => true);
+    const adapter: ProjectStoreAdapter = {
+      capabilities: { folderBacked: true, fileWatch: false, attachments: true },
+      list: async () => [],
+      has: async () => true,
+      load: async () => null,
+      save,
+      delete: async () => undefined,
+      chooseFolder: async () => "Client Work",
+      restorePreviousFolder,
+      isSelectedFolderSameAsPrevious,
+      listFolderProjects: async () => [`${bundle.project.id}.pms.json`]
+    };
+    (window as typeof window & { __gph_store?: ProjectStoreAdapter }).__gph_store = adapter;
+
+    render(
+      <ThemeProvider>
+        <MemoryRouter>
+          <SettingsView />
+        </MemoryRouter>
+      </ThemeProvider>
+    );
+
+    await userEvent.click(screen.getByRole("tab", { name: "Storage" }));
+    const panel = screen.getByRole("tabpanel", { name: "Storage" });
+    await userEvent.click(within(panel).getByRole("button", { name: "Change folder" }));
+
+    expect(await within(panel).findByText(/already saved in Client Work\. No files were changed/i)).toBeInTheDocument();
+    expect(isSelectedFolderSameAsPrevious).toHaveBeenCalledOnce();
+    expect(save).not.toHaveBeenCalled();
+    expect(restorePreviousFolder).not.toHaveBeenCalled();
+    expect(useProjectStore.getState()).toMatchObject({
+      storagePath,
+      storageTrust: "folder",
+      saveStatus: "saved"
+    });
+  });
+
   it("restores the previous folder when saving to a newly selected folder fails", async () => {
     const restorePreviousFolder = vi.fn(async () => undefined);
     const adapter: ProjectStoreAdapter = {

packages/ui/src/views/settings/StorageSettings.tsx

@@ -36,17 +36,6 @@ function isFolderPickerDismissal(error: unknown): boolean {
   return error instanceof DOMException && error.name === "AbortError";
 }
 
-function isCurrentFolderTarget(
-  storagePath: string | null,
-  folderName: string,
-  projectKey: string
-): boolean {
-  if (!storagePath) return false;
-  const normalized = storagePath.replace(/\\/g, "/");
-  const expected = `${folderName}/.pm-suite/${projectKey}.pms.json`;
-  return normalized === expected || normalized.endsWith(`/${expected}`);
-}
-
 export function StorageSettings() {
   const bundle = useProjectStore((state) => state.bundle);
   const storagePath = useProjectStore((state) => state.storagePath);
@@ -172,8 +161,19 @@ export function StorageSettings() {
       const projectAlreadyExists = folderFiles?.some(
         (filename) => filename.toLowerCase() === `${key}.pms.json`.toLowerCase()
       );
-      const currentTarget = current.storageTrust === "folder" && isCurrentFolderTarget(current.storagePath, folderName, key);
-      if (projectAlreadyExists && !currentTarget) {
+      const currentTarget = Boolean(
+        projectAlreadyExists
+        && current.storageTrust === "folder"
+        && await adapter.isSelectedFolderSameAsPrevious?.()
+      );
+      if (projectAlreadyExists && currentTarget) {
+        setFeedback({
+          message: `This project is already saved in ${folderName}. No files were changed.`,
+          tone: "info"
+        });
+        return;
+      }
+      if (projectAlreadyExists) {
         await restoreRejectedFolder();
         setFeedback({
           message: `That folder already contains ${key}.pms.json. Grillo did not overwrite it; open that project from the workspace launcher or choose a different folder.`,