SMB: Auto-upgrade mounts to direct connections

- Auto-upgrade all pre-existing SMB mounts at startup (background, after mDNS resolves)
- Auto-upgrade newly detected SMB mounts via the `/Volumes` watcher
- Poll for mDNS `Active` state before startup upgrade (Keychain lookup needs hostname resolution)
- Emit `volumes-changed` after background upgrades so the frontend indicator updates
- Add `network.directSmbConnection` setting (default: on) to control auto-upgrade behavior
- Expose `register_smb_volume`, `get_keychain_password`, `resolve_ip_to_hostname` as `pub(crate)`

Author: vdavid

apps/desktop/src-tauri/src/commands/network.rs

@@ -323,7 +323,7 @@ pub async fn mount_network_share(
 ///
 /// Best-effort: logs a warning and returns quietly on failure. The FSEvents
 /// watcher will register a `LocalPosixVolume` as fallback.
-async fn register_smb_volume(
+pub(crate) async fn register_smb_volume(
     server: &str,
     share: &str,
     mount_path: &str,
@@ -419,9 +419,10 @@ pub async fn upgrade_to_smb_volume(volume_id: String) -> Result<String, String>
 
     // Check if it worked
     if let Some(vol) = manager.get(&volume_id)
-        && vol.smb_connection_state().is_some() {
-            return Ok("direct".to_string());
-        }
+        && vol.smb_connection_state().is_some()
+    {
+        return Ok("direct".to_string());
+    }
 
     Err(format!(
         "Failed to establish direct smb2 connection to {}/{}",
@@ -432,7 +433,7 @@ pub async fn upgrade_to_smb_volume(volume_id: String) -> Result<String, String>
 /// Looks up the mDNS hostname for an IP address from discovered hosts.
 ///
 /// Returns the hostname (like "naspolya") without `.local` suffix.
-fn resolve_ip_to_hostname(ip: &str) -> Option<String> {
+pub(crate) fn resolve_ip_to_hostname(ip: &str) -> Option<String> {
     let hosts = get_discovered_hosts();
     for host in &hosts {
         if host.ip_address.as_deref() == Some(ip) {
@@ -447,7 +448,7 @@ fn resolve_ip_to_hostname(ip: &str) -> Option<String> {
 ///
 /// Tries multiple keys: by IP (from statfs), by hostname (from mDNS discovery),
 /// at both share-level and server-level.
-async fn get_keychain_password(
+pub(crate) async fn get_keychain_password(
     server_ip: &str,
     hostname: Option<&str>,
     share: &str,
@@ -479,12 +480,7 @@ async fn get_keychain_password(
             }
         }
 
-        log::debug!(
-            "No Keychain credentials for {:?} / {} / {}",
-            hostname,
-            server_ip,
-            share
-        );
+        log::debug!("No Keychain credentials for {:?} / {} / {}", hostname, server_ip, share);
         None
     })
     .await

apps/desktop/src-tauri/src/file_system/mod.rs

@@ -18,6 +18,7 @@ pub mod volume;
 pub(crate) mod watcher;
 pub(crate) mod write_operations;
 
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, LazyLock};
 
 // Re-export public types from the listing module
@@ -66,6 +67,20 @@ pub use write_operations::{
 /// Global volume manager instance
 static VOLUME_MANAGER: LazyLock<VolumeManager> = LazyLock::new(VolumeManager::new);
 
+/// Whether to auto-upgrade SMB mounts to direct smb2 connections.
+/// Set from the `network.directSmbConnection` setting at startup.
+static DIRECT_SMB_ENABLED: AtomicBool = AtomicBool::new(true);
+
+/// Sets the direct SMB connection preference. Call from app setup after loading settings.
+pub fn set_direct_smb_enabled(enabled: bool) {
+    DIRECT_SMB_ENABLED.store(enabled, Ordering::Relaxed);
+}
+
+/// Returns whether direct SMB connection is enabled.
+pub fn is_direct_smb_enabled() -> bool {
+    DIRECT_SMB_ENABLED.load(Ordering::Relaxed)
+}
+
 /// Initializes the global volume manager with all discovered volumes.
 ///
 /// This should be called during app startup (after init_watcher_manager).
@@ -126,5 +141,112 @@ pub fn get_volume_manager() -> &'static VolumeManager {
     &VOLUME_MANAGER
 }
 
+/// Upgrades all existing SMB mounts to direct smb2 connections (background task).
+///
+/// Scans all registered volumes, finds those on `smbfs`, and tries to establish
+/// a parallel smb2 session for each. Non-blocking: failures are logged and skipped.
+#[cfg(any(target_os = "macos", target_os = "linux"))]
+pub fn upgrade_existing_smb_mounts() {
+    if !is_direct_smb_enabled() {
+        log::debug!("Direct SMB connections disabled, skipping startup upgrade");
+        return;
+    }
+
+    // Collect SMB volume paths to upgrade (don't hold the manager lock during async work)
+    let volumes_to_upgrade: Vec<(String, String)> = {
+        let all_volumes = VOLUME_MANAGER.list_volumes();
+        all_volumes
+            .into_iter()
+            .map(|(id, _name)| id)
+            .filter_map(|id| {
+                let vol = VOLUME_MANAGER.get(&id)?;
+                // Skip volumes that are already SmbVolume
+                if vol.smb_connection_state().is_some() {
+                    return None;
+                }
+                let path = vol.root().to_string_lossy().to_string();
+                // Check if it's an SMB mount
+                let info = crate::volumes::get_smb_mount_info(&path)?;
+                let _ = info; // We just need to know it's SMB
+                Some((id, path))
+            })
+            .collect()
+    };
+
+    if volumes_to_upgrade.is_empty() {
+        log::debug!("No SMB mounts to upgrade at startup");
+        return;
+    }
+
+    log::info!(
+        "Found {} SMB mount(s) to upgrade to direct connections",
+        volumes_to_upgrade.len()
+    );
+
+    // Use tauri's runtime spawn — this runs during setup() before Tokio is fully available.
+    // Wait for mDNS discovery to reach Active state (initial burst complete) so hostname
+    // resolution is available for Keychain lookup.
+    tauri::async_runtime::spawn(async move {
+        wait_for_mdns_ready().await;
+
+        let mut any_upgraded = false;
+        for (_volume_id, mount_path) in volumes_to_upgrade {
+            let info = match crate::volumes::get_smb_mount_info(&mount_path) {
+                Some(info) => info,
+                None => continue,
+            };
+
+            // Resolve hostname from mDNS for Keychain lookup
+            let hostname = crate::commands::network::resolve_ip_to_hostname(&info.server);
+
+            // Try Keychain creds
+            let creds =
+                crate::commands::network::get_keychain_password(&info.server, hostname.as_deref(), &info.share).await;
+
+            let (username, password) = match &creds {
+                Some((u, p)) => (Some(u.as_str()), Some(p.as_str())),
+                None => (None, None),
+            };
+
+            crate::commands::network::register_smb_volume(
+                &info.server,
+                &info.share,
+                &mount_path,
+                username,
+                password,
+                445,
+            )
+            .await;
+            any_upgraded = true;
+        }
+
+        // Notify frontend to refresh volume list so indicators update from yellow to green
+        if any_upgraded {
+            crate::volume_broadcast::emit_volumes_changed();
+        }
+    });
+}
+
+/// Waits until mDNS discovery reaches the `Active` state (initial burst complete).
+///
+/// Polls every 500ms for up to 15 seconds. If discovery never reaches Active,
+/// proceeds anyway — the upgrade will try without hostname resolution and may
+/// fall back to guest access.
+#[cfg(any(target_os = "macos", target_os = "linux"))]
+async fn wait_for_mdns_ready() {
+    use crate::network::{DiscoveryState, get_discovery_state_value};
+
+    for _ in 0..30 {
+        match get_discovery_state_value() {
+            DiscoveryState::Active => {
+                log::debug!("mDNS discovery is Active, proceeding with SMB upgrades");
+                return;
+            }
+            _ => tokio::time::sleep(std::time::Duration::from_millis(500)).await,
+        }
+    }
+    log::debug!("mDNS discovery didn't reach Active within 15s, proceeding anyway");
+}
+
 #[cfg(test)]
 mod watcher_test;

apps/desktop/src-tauri/src/lib.rs

@@ -353,6 +353,13 @@ pub fn run() {
             // Load persisted settings to initialize menu with correct state
             let saved_settings = settings::load_settings(app.handle());
 
+            // Apply direct SMB connection setting (default: true)
+            file_system::set_direct_smb_enabled(saved_settings.direct_smb_connection.unwrap_or(true));
+
+            // Upgrade existing SMB mounts to direct smb2 connections (background, non-blocking)
+            #[cfg(any(target_os = "macos", target_os = "linux"))]
+            file_system::upgrade_existing_smb_mounts();
+
             // Check if there's an existing license (for menu text)
             let has_existing_license = licensing::get_license_info(app.handle()).is_some();
 

apps/desktop/src-tauri/src/settings/loader.rs

@@ -49,6 +49,8 @@ pub struct Settings {
     #[serde(alias = "developer.verboseLogging", default)]
     #[allow(dead_code, reason = "Included in crash reports for feature correlation")]
     pub verbose_logging: Option<bool>,
+    #[serde(alias = "network.directSmbConnection", default)]
+    pub direct_smb_connection: Option<bool>,
 }
 
 fn default_show_hidden() -> bool {
@@ -66,6 +68,7 @@ impl Default for Settings {
             crash_reports_enabled: None,
             ai_provider: None,
             verbose_logging: None,
+            direct_smb_connection: None,
         }
     }
 }
@@ -112,6 +115,7 @@ fn parse_settings(contents: &str) -> Result<Settings, serde_json::Error> {
     let crash_reports_enabled = json.get("updates.crashReports").and_then(|v| v.as_bool());
     let ai_provider = json.get("ai.provider").and_then(|v| v.as_str()).map(String::from);
     let verbose_logging = json.get("developer.verboseLogging").and_then(|v| v.as_bool());
+    let direct_smb_connection = json.get("network.directSmbConnection").and_then(|v| v.as_bool());
 
     Ok(Settings {
         show_hidden_files,
@@ -122,5 +126,6 @@ fn parse_settings(contents: &str) -> Result<Settings, serde_json::Error> {
         crash_reports_enabled,
         ai_provider,
         verbose_logging,
+        direct_smb_connection,
     })
 }

apps/desktop/src-tauri/src/volumes/watcher.rs

@@ -157,6 +157,10 @@ fn emit_volume_mounted(volume_path: &str) {
     // Register the new volume with VolumeManager so it can be used for file operations
     register_volume_with_manager(volume_path);
 
+    // If it's an SMB mount and direct connections are enabled, try to upgrade
+    #[cfg(any(target_os = "macos", target_os = "linux"))]
+    try_upgrade_smb_mount(volume_path);
+
     if let Some(app) = APP_HANDLE.get() {
         let payload = VolumeEventPayload {
             volume_path: volume_path.to_string(),
@@ -276,6 +280,36 @@ fn spawn_mount_settle_watcher(volume_path: String) {
     });
 }
 
+/// Tries to upgrade an SMB mount to a direct smb2 connection in the background.
+///
+/// Best-effort: if the upgrade fails, the volume stays as a `LocalPosixVolume`.
+#[cfg(any(target_os = "macos", target_os = "linux"))]
+fn try_upgrade_smb_mount(volume_path: &str) {
+    use crate::file_system::is_direct_smb_enabled;
+    use crate::volumes::get_smb_mount_info;
+
+    if !is_direct_smb_enabled() {
+        return;
+    }
+
+    let Some(info) = get_smb_mount_info(volume_path) else {
+        return; // Not an SMB mount
+    };
+
+    let mount_path = volume_path.to_string();
+    tokio::spawn(async move {
+        let hostname = crate::commands::network::resolve_ip_to_hostname(&info.server);
+        let creds =
+            crate::commands::network::get_keychain_password(&info.server, hostname.as_deref(), &info.share).await;
+        let (username, password) = match &creds {
+            Some((u, p)) => (Some(u.as_str()), Some(p.as_str())),
+            None => (None, None),
+        };
+        crate::commands::network::register_smb_volume(&info.server, &info.share, &mount_path, username, password, 445)
+            .await;
+    });
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

apps/desktop/src/lib/settings/sections/NetworkSection.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
     import SettingsSection from '../components/SettingsSection.svelte'
     import SettingRow from '../components/SettingRow.svelte'
+    import SettingSwitch from '../components/SettingSwitch.svelte'
     import SettingSelect from '../components/SettingSelect.svelte'
     import SettingRadioGroup from '../components/SettingRadioGroup.svelte'
     import SettingNumberInput from '../components/SettingNumberInput.svelte'
@@ -16,11 +17,23 @@
     const shouldShow = $derived(createShouldShow(searchQuery))
 
     const defaultDef = { label: '', description: '' }
+    const directSmbDef = getSettingDefinition('network.directSmbConnection') ?? defaultDef
     const cacheDurationDef = getSettingDefinition('network.shareCacheDuration') ?? defaultDef
     const timeoutModeDef = getSettingDefinition('network.timeoutMode') ?? defaultDef
 </script>
 
 <SettingsSection title="SMB/Network shares">
+    {#if shouldShow('network.directSmbConnection')}
+        <SettingRow
+            id="network.directSmbConnection"
+            label={directSmbDef.label}
+            description={directSmbDef.description}
+            {searchQuery}
+        >
+            <SettingSwitch id="network.directSmbConnection" />
+        </SettingRow>
+    {/if}
+
     {#if shouldShow('network.shareCacheDuration')}
         <SettingRow
             id="network.shareCacheDuration"

apps/desktop/src/lib/settings/settings-registry.ts

@@ -249,6 +249,17 @@ export const settingsRegistry: SettingDefinition[] = [
   // ========================================================================
   // Network › SMB/Network shares
   // ========================================================================
+  {
+    id: 'network.directSmbConnection',
+    section: ['Network', 'SMB/Network shares'],
+    label: 'Connect directly to SMB shares',
+    description:
+      'When enabled, Cmdr establishes a direct connection to SMB shares for faster file operations. The system mount stays for Finder and other apps.',
+    keywords: ['smb', 'direct', 'fast', 'connection', 'network', 'performance', 'smb2'],
+    type: 'boolean',
+    default: true,
+    component: 'switch',
+  },
   {
     id: 'network.shareCacheDuration',
     section: ['Network', 'SMB/Network shares'],

apps/desktop/src/lib/settings/types.ts

@@ -109,6 +109,7 @@ export interface SettingsValues {
   'updates.crashReports': boolean
 
   // Network
+  'network.directSmbConnection': boolean
   'network.shareCacheDuration': number
   'network.timeoutMode': NetworkTimeoutMode
   'network.customTimeout': number