[Maya-Kid]

Why

A WebDAV base URL such as https://cloud.example.com/remote.php/dav/files/alice already contains a path prefix. When the server returns /remote.php/dav/files/alice/docs/a.txt, the client appends that entire path to the base again. Files are skipped after a 404, or a collection's own entry is revisited and the sync fails.

What changes

Strip the configured base pathname from path-absolute and proxy-rewritten hrefs at path-segment boundaries. Use the request path as well as the document identity to recognize a collection's own entry, while keeping URL escapes and existing document identity formats.

Extend the existing HTTP fixture with prefixed path, absolute URL and proxy URL cases. It checks nested traversal, collection self-entries, escaped filenames, document identities and the exact request sequence. A small unit test protects prefix boundaries such as alice versus alice2.

How it was checked

macOS arm64, Rust 1.98.1, commit 74b4b131 based on dev at 70bf7a7f:

• cargo +1.98.1 fmt --all --check
• cargo +1.98.1 clippy --locked --offline --workspace --all-targets -- -D warnings
• cargo +1.98.1 test --locked --offline --workspace: 1,534 reported passed, 0 failed, 6 ignored.
• Ran the final HTTP regression against unchanged dev production code: it fails with a duplicated-path PROPFIND 404. It passes with the fix.

Database-backed tests skip locally because UTOPIA_DATABASE_URL is unset; the optional real-WebDAV smoke test also skips without its endpoint. The regression uses a local HTTP server and runs in the normal workspace suite.

Before review

• Every commit is signed off (git commit -s).
• Format, workspace Clippy and workspace tests pass locally, with the environment-dependent skips noted above.

[WaylandYang]

Thank you, this matches what Nextcloud sends: hrefs are absolute paths that already contain the base's path, so appending them to the base repeated it, and the collection's own entry was queued again and 404'd. Stripping only at a segment boundary and comparing request paths in their escaped form keeps %-escapes and the existing proxy key shape intact. The fixture across the four href shapes is a good guard.

Two small things for a follow-up if you like: the note on why the proxy case falls back to the URL's path was lost, and a line on why the self-entry check compares both the identity and the request path would help (proxy identities keep the prefix, the root's identity does not). Thanks again.