fix(files): resolve an overwrite target by id, not a joined reference

A slash-delimited reference cannot express a folder whose own name contains a
slash. `Q3/Q4` joins to two segments and re-reads as two levels, so the overwrite
lookup never found the existing file and the write landed as a duplicate beside
it. The guard on folder id and name meant it could not overwrite the WRONG file,
which is why this was bounded rather than dangerous.

I introduced it: before this branch the segments came only from splitting the
file name, so no segment could contain a slash. Prepending the picked folder's
decoded segments is what made one able to.

When a folder was picked its canonical path is unambiguous, so the target is
found inside that folder by name and resolved by id — the same route the named
append now takes, using the same authorized expansion. A typed path with no
picked folder keeps the joined reference, which is exactly as expressive as the
name it came from.

Author: mzxchandra

apps/sim/lib/internal/file/operations.test.ts

@@ -458,6 +458,52 @@ describe('file manage folder wiring', () => {
     expect(String(body.error)).toContain('No file named notes.md in /Reports')
   })
 
+  /*
+   * A folder genuinely named `Q3/Q4` is one level, but the joined reference the
+   * overwrite lookup used re-read it as two — so the existing file was never
+   * found and the write landed as a duplicate beside it.
+   */
+  it('overwrites inside a folder whose name contains a slash', async () => {
+    mockListWorkspaceFileFolders.mockResolvedValue({
+      folders: [
+        {
+          id: 'folder-slashy',
+          parentId: null,
+          name: 'Q3/Q4',
+          path: 'Q3\\/Q4',
+          createdAt: CONTENT_UPDATED_AT,
+          updatedAt: CONTENT_UPDATED_AT,
+        },
+      ],
+    })
+    mockListAllWorkspaceFiles.mockResolvedValue({
+      files: [
+        { ...workspaceFile('existing-in-slashy'), name: 'notes.md', folderId: 'folder-slashy' },
+      ],
+    })
+    mockEnsureWorkspaceFileFolderPath.mockResolvedValue({
+      folderId: 'folder-slashy',
+      createdFolderIds: [],
+    })
+
+    await POST(
+      createMockRequest('POST', {
+        operation: 'write',
+        workspaceId: 'workspace-1',
+        fileName: 'notes.md',
+        folderPath: '/Q3%2FQ4',
+        content: 'hello',
+        overwrite: true,
+      })
+    )
+
+    // Found by id, not by a reference that would split the folder name in two.
+    expect(mockResolveWorkspaceFileReference).toHaveBeenCalledWith(
+      'workspace-1',
+      'existing-in-slashy'
+    )
+  })
+
   it('lists what a folder holds, folders and files together', async () => {
     const response = await POST(
       createMockRequest('POST', { operation: 'list', workspaceId: 'workspace-1' })

apps/sim/lib/internal/file/operations.ts

@@ -505,17 +505,42 @@ async function resolveWriteOverwriteTarget(options: {
   principal: Principal
   workspaceId: string
   folderId: string | null
+  /** Canonical destination when one was picked; unambiguous where a joined reference is not. */
+  folderPath?: string
   folderSegments: string[]
   leafName: string
 }) {
-  const { principal, workspaceId, folderId, folderSegments, leafName } = options
+  const { principal, workspaceId, folderId, folderPath, folderSegments, leafName } = options
+  /*
+   * A slash-delimited reference cannot express a folder whose own name contains
+   * a slash: `Q3/Q4` joins to two segments and re-reads as two levels, so the
+   * existing file is never found and the write lands as a duplicate. When the
+   * destination came from a picker it arrives as a canonical path, which is
+   * unambiguous, so the target is looked up inside that folder by name and
+   * resolved by the id — the same route a named append takes.
+   */
+  let reference = [...folderSegments, leafName].join('/')
+  if (folderPath) {
+    const scoped = await expandFolderPathsToFiles({
+      principal,
+      workspaceId,
+      folderPaths: [folderPath],
+      includeSubfolders: false,
+    })
+    const match = scoped.find(
+      (file) => file.name === leafName && (file.folderId ?? null) === folderId
+    )
+    if (!match) return null
+    reference = match.id
+  }
+
   let existing: Awaited<ReturnType<typeof resolveWorkspaceFileReference>>
   try {
     existing = await resolveWorkspaceFileReference({
       principal,
       operation: fileOperations.updateContent,
       workspaceId,
-      reference: [...folderSegments, leafName].join('/'),
+      reference,
     })
   } catch (error) {
     if (error instanceof OrchestrationError && error.code === 'not_found') return null
@@ -1016,6 +1041,7 @@ export async function executeFileManageOperation(
             principal,
             workspaceId,
             folderId: folderId ?? null,
+            folderPath,
             folderSegments,
             leafName,
           })