fix(desktop): ask before accessing local files

Author: waleedlatif1

apps/desktop/README.md

@@ -188,7 +188,9 @@ Copilot can inspect user-selected local directories through the ordinary VFS too
 - **Bound to a live Copilot call:** before a native read/search or browser action, Electron asks the authenticated Sim origin for the pending tool-call record. Local requests must exactly match its persisted operation, path, and options; browser actions run with the persisted arguments rather than renderer-supplied ones. Completed, failed, and aborted runs are rejected.
 - **Abort-aware and bounded:** stop/cancel propagates to active native scans and reads. File size, aggregate grep bytes, line, result, traversal-depth, and scan-count limits remain enforced in Electron, and unsafe regular expressions are rejected before execution.
 
-Raw local file bytes are never exposed through the preload bridge and cannot be staged or uploaded by a model. Bounded text read/search results are returned to the active Copilot request; a user must use the normal attachment UI when they want the file itself to leave the device.
+The native `read_local_file` and `import_local_files` tools also accept absolute or `~/` paths. Before accessing a new file or folder, Electron displays a bundled, isolated permission dialog showing the resolved path and the connected server. **Allow for this chat** grants access to that file, or that folder and its contents, for the current desktop session. Closing or declining the dialog returns no contents. Grants are scoped to the server, account generation, chat, and operation; import grants also bind the destination workspace and folder. A read grant never authorizes an import. Grants are not persisted and expire on sign-out, server changes, or app restart.
+
+Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates the pending call after consent, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
 
 ## Auto-update, channels, rollout, rollback
 

apps/desktop/e2e/local-files.spec.ts

@@ -1,4 +1,12 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  mkdirSync,
+  mkdtempSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs'
 import { createServer, type Server } from 'node:http'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -8,17 +16,31 @@ import type { DesktopLocalFileRequest, SimDesktopApi } from '@sim/desktop-bridge
 
 const DESKTOP_DIR = fileURLToPath(new URL('..', import.meta.url))
 
-test('native file tools read and import through the installed preload without Sim folder grants', async () => {
+test('native file tools require local consent and reuse only the approved chat and path', async () => {
   const root = mkdtempSync(join(tmpdir(), 'sim-native-files-e2e-'))
   const source = join(root, 'Reports')
+  const outside = join(root, 'Reports-other')
+  mkdirSync(outside)
+  writeFileSync(join(outside, 'private.txt'), 'outside contents')
   mkdirSync(join(source, 'empty'), { recursive: true })
   writeFileSync(join(source, 'report.txt'), 'native file contents')
   const png =
     'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAusB9Y9Zl1sAAAAASUVORK5CYII='
   writeFileSync(join(source, 'image.png'), Buffer.from(png, 'base64'))
-  let claimed = false
-  const calls: Record<string, { toolName: string; args: Record<string, unknown> }> = {
+  const claimed = new Set<string>()
+  const authorizedCalls = new Set<string>()
+  let signedIn = true
+  const calls: Record<
+    string,
+    { toolName: string; args: Record<string, unknown>; chatId?: string } | undefined
+  > = {
+    directory: { toolName: 'read_local_file', args: { path: source } },
     text: { toolName: 'read_local_file', args: { path: join(source, 'report.txt') } },
+    otherChat: {
+      toolName: 'read_local_file',
+      args: { path: join(source, 'report.txt') },
+      chatId: 'other-chat',
+    },
     image: { toolName: 'read_local_file', args: { path: join(source, 'image.png') } },
     import: {
       toolName: 'import_local_files',
@@ -32,32 +54,49 @@ test('native file tools read and import through the installed preload without Si
       const path = new URL(request.url ?? '/', 'http://127.0.0.1').pathname
       if (path === '/api/auth/get-session') {
         response.writeHead(200, { 'Content-Type': 'application/json' }).end(
-          JSON.stringify({
-            user: { id: 'local-file-user' },
-            session: { id: 'local-file-session' },
-          })
+          JSON.stringify(
+            signedIn
+              ? {
+                  user: { id: 'local-file-user' },
+                  session: { id: 'local-file-session' },
+                }
+              : null
+          )
         )
         return
       }
+      if (path === '/api/auth/sign-out') {
+        signedIn = false
+        response
+          .writeHead(200, {
+            'Content-Type': 'application/json',
+            'Set-Cookie': 'better-auth.session_token=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0',
+          })
+          .end('{}')
+        return
+      }
       if (path === '/api/desktop/tool/authorize') {
         let body = ''
         for await (const chunk of request) body += chunk.toString()
         const input = JSON.parse(body)
         const call = calls[input.toolCallId]
-        if (!call || (input.claim && claimed)) {
+        if (!call || (input.claim && claimed.has(input.toolCallId))) {
           response.writeHead(call ? 409 : 403, { 'Content-Type': 'application/json' }).end('{}')
           return
         }
-        if (input.claim) claimed = true
+        authorizedCalls.add(input.toolCallId)
+        if (input.claim) claimed.add(input.toolCallId)
         response
           .writeHead(200, { 'Content-Type': 'application/json' })
-          .end(JSON.stringify({ ...call, chatId: 'org-chat' }))
+          .end(JSON.stringify({ ...call, chatId: call.chatId ?? 'org-chat' }))
         return
       }
       response
         .writeHead(200, {
           'Content-Type': 'text/html',
-          'Set-Cookie': 'better-auth.session_token=fixture; HttpOnly; SameSite=Lax; Path=/',
+          ...(signedIn
+            ? { 'Set-Cookie': 'better-auth.session_token=fixture; HttpOnly; SameSite=Lax; Path=/' }
+            : {}),
         })
         .end('<!doctype html><title>Local file fixture</title><h1>Local files</h1>')
     })
@@ -82,17 +121,121 @@ test('native file tools read and import through the installed preload without Si
         return api.localFiles(request)
       }, input)
     await expect
-      .poll(async () => (await invoke({ operation: 'read', toolCallId: 'text' })).ok)
+      .poll(() =>
+        window.evaluate(async () => {
+          const api = (globalThis as typeof globalThis & { simDesktop: SimDesktopApi }).simDesktop
+          return (await api.localFilesystem?.({ operation: 'list_mounts' }))?.ok
+        })
+      )
       .toBe(true)
-    expect(await invoke({ operation: 'read', toolCallId: 'text' })).toMatchObject({
+    await window.evaluate(async () => {
+      const api = (globalThis as typeof globalThis & { simDesktop: SimDesktopApi }).simDesktop
+      await api.settings.setPreference('browserEnabled', false)
+      await api.settings.setPreference('terminalEnabled', false)
+    })
+    const deniedPrompt = app.waitForEvent('window', { timeout: 10_000 })
+    const deniedRead = invoke({ operation: 'read', toolCallId: 'text' })
+    const denial = await deniedPrompt
+    await expect(denial.getByRole('button', { name: "Don't allow", exact: true })).toBeFocused()
+    await denial.screenshot({
+      path:
+        process.env.DESKTOP_LOCAL_FILES_REPORT_PATH ??
+        test.info().outputPath('local-file-consent.png'),
+    })
+    await denial.getByRole('button', { name: "Don't allow", exact: true }).click()
+    expect(await deniedRead).toMatchObject({ ok: false })
+
+    const folderPrompt = app.waitForEvent('window')
+    const folderRead = invoke({ operation: 'read', toolCallId: 'directory' })
+    const folderConsent = await folderPrompt
+    const queuedRead = invoke({ operation: 'read', toolCallId: 'text' })
+    expect(
+      await folderConsent.evaluate(() => typeof (globalThis as { simDesktop?: unknown }).simDesktop)
+    ).toBe('undefined')
+    await folderConsent.getByRole('button', { name: 'Allow for this chat', exact: true }).click()
+    expect(await folderRead).toMatchObject({ ok: true, data: { representation: 'directory' } })
+    expect(await queuedRead).toMatchObject({ ok: true, data: { text: 'native file contents' } })
+    const canonicalRequest = {
+      operation: 'read' as const,
+      toolCallId: 'text',
+      path: join(outside, 'private.txt'),
+    }
+    expect(await invoke(canonicalRequest)).toMatchObject({
       ok: true,
       data: { representation: 'text', text: 'native file contents' },
     })
     expect(await invoke({ operation: 'read', toolCallId: 'image' })).toMatchObject({
       ok: true,
       data: { observations: [{ mediaType: 'image/png', data: png }] },
     })
-    const result = await invoke({ operation: 'manifest', toolCallId: 'import' })
+    const runningApp = app
+    const requestPermission = async (request: DesktopLocalFileRequest) => {
+      const shown = runningApp.waitForEvent('window', { timeout: 10_000 })
+      const result = invoke(request)
+      void result.catch(() => {})
+      const prompt = await shown
+      await expect(prompt.getByRole('button', { name: "Don't allow", exact: true })).toBeVisible()
+      return { prompt, result }
+    }
+    await test.step('a folder grant does not authorize another chat or a symlink escape', async () => {
+      const otherChat = await requestPermission({ operation: 'read', toolCallId: 'otherChat' })
+      const dismissed = otherChat.prompt.waitForEvent('close')
+      await otherChat.prompt
+        .getByRole('button', { name: "Don't allow", exact: true })
+        .press('Escape')
+        .catch(() => {})
+      await dismissed
+      expect(await otherChat.result).toMatchObject({ ok: false })
+      symlinkSync(join(outside, 'private.txt'), join(source, 'linked.txt'))
+      calls.escape = { toolName: 'read_local_file', args: { path: join(source, 'linked.txt') } }
+      const escapedRead = await requestPermission({ operation: 'read', toolCallId: 'escape' })
+      await expect(escapedRead.prompt.getByRole('dialog')).toContainText(
+        JSON.stringify(realpathSync(join(outside, 'private.txt')))
+      )
+      await escapedRead.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      expect(await escapedRead.result).toMatchObject({ ok: false })
+      rmSync(join(source, 'linked.txt'))
+    })
+    await test.step('cancelled calls and changed arguments cannot acquire a grant', async () => {
+      for (const changed of [false, true]) {
+        calls.stale = { toolName: 'read_local_file', args: { path: join(outside, 'private.txt') } }
+        const stale = await requestPermission({ operation: 'read', toolCallId: 'stale' })
+        if (changed) calls.stale.args.path = join(source, 'report.txt')
+        else calls.stale = undefined
+        await stale.prompt.getByRole('button', { name: 'Allow for this chat', exact: true }).click()
+        expect(await stale.result).toMatchObject({ ok: false })
+      }
+    })
+    await test.step('a queued call is revalidated even when its folder is already approved', async () => {
+      calls.blocker = { toolName: 'read_local_file', args: { path: join(outside, 'private.txt') } }
+      calls.queued = { toolName: 'read_local_file', args: { path: join(source, 'report.txt') } }
+      const blocker = await requestPermission({ operation: 'read', toolCallId: 'blocker' })
+      const queued = invoke({ operation: 'read', toolCallId: 'queued' })
+      void queued.catch(() => {})
+      await expect.poll(() => authorizedCalls.has('queued')).toBe(true)
+      calls.queued = undefined
+      await blocker.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      expect(await blocker.result).toMatchObject({ ok: false })
+      expect(await queued).toMatchObject({ ok: false })
+    })
+    await test.step('replacing the proposed folder during consent does not expose its new target', async () => {
+      const proposed = join(root, 'Proposed')
+      mkdirSync(proposed)
+      calls.retargeted = { toolName: 'read_local_file', args: { path: proposed } }
+      const retargeted = await requestPermission({ operation: 'read', toolCallId: 'retargeted' })
+      renameSync(proposed, join(root, 'Original'))
+      mkdirSync(proposed)
+      writeFileSync(join(proposed, 'unapproved.txt'), 'replacement folder contents')
+      await retargeted.prompt
+        .getByRole('button', { name: 'Allow for this chat', exact: true })
+        .click()
+      expect(await retargeted.result).toMatchObject({ ok: false })
+    })
+    const importPrompt = app.waitForEvent('window')
+    const importing = invoke({ operation: 'manifest', toolCallId: 'import' })
+    const importConsent = await importPrompt
+    await importConsent.getByRole('button', { name: 'Allow for this chat', exact: true }).click()
+    const result = await importing
     if (!result.ok || result.data.kind !== 'manifest') throw new Error(JSON.stringify(result))
     expect(result.data.targetWorkspaceId).toBe('target-workspace')
     expect(result.data.entries.map((entry) => entry.relativePath)).toEqual([
@@ -136,6 +279,38 @@ test('native file tools read and import through the installed preload without Si
       ok: false,
       code: 'ALREADY_STARTED',
     })
+    await test.step('import approval is bound to its destination workspace', async () => {
+      calls.otherImport = {
+        toolName: 'import_local_files',
+        args: { path: source, targetWorkspaceId: 'other-workspace' },
+      }
+      const otherImport = await requestPermission({
+        operation: 'manifest',
+        toolCallId: 'otherImport',
+      })
+      await otherImport.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      expect(await otherImport.result).toMatchObject({ ok: false })
+    })
+
+    await test.step('sign-out revokes chat grants before the next account session', async () => {
+      await window.evaluate(async () => {
+        await fetch('/api/auth/sign-out', { method: 'POST' })
+      })
+      await expect(window).toHaveURL(`http://127.0.0.1:${address.port}/login`)
+      signedIn = true
+      await window.goto(`http://127.0.0.1:${address.port}/`)
+      await expect
+        .poll(() =>
+          window.evaluate(async () => {
+            const api = (globalThis as typeof globalThis & { simDesktop: SimDesktopApi }).simDesktop
+            return (await api.localFilesystem?.({ operation: 'list_mounts' }))?.ok
+          })
+        )
+        .toBe(true)
+      const revoked = await requestPermission({ operation: 'read', toolCallId: 'text' })
+      await revoked.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      expect(await revoked.result).toMatchObject({ ok: false })
+    })
   } finally {
     await app?.close()
     server?.close()

apps/desktop/src/main/ipc.test.ts

@@ -458,71 +458,6 @@ describe('registerIpcHandlers', () => {
     })
   })
 
-  it('reads a native file through canonical IPC arguments without folder grants or user activation', async () => {
-    const { invoke } = collectHandlers()
-    const handler = invoke.get('desktop:local-files')
-    const path = fileURLToPath(import.meta.url)
-    const fetchAuthorization = vi.fn(async () =>
-      Response.json({ chatId: 'chat-1', toolName: 'read_local_file', args: { path, limit: 64 } })
-    )
-    const authorizedEvent = {
-      senderFrame: { url: `${APP}/o/org/home` },
-      sender: { session: { fetch: fetchAuthorization } },
-    }
-    const mounts = vi.spyOn(deps.localFilesystem, 'handle')
-    expect(
-      await handler?.(authorizedEvent, {
-        operation: 'read',
-        toolCallId: 'tool-native',
-        path: '/not/the/canonical/path',
-      })
-    ).toMatchObject({
-      ok: true,
-      data: { kind: 'read', path, text: readFileSync(path, 'utf8').slice(0, 64) },
-    })
-    expect(mounts).not.toHaveBeenCalled()
-    expect(fetchAuthorization).toHaveBeenCalledWith(
-      `${APP}/api/desktop/tool/authorize`,
-      expect.objectContaining({ body: JSON.stringify({ toolCallId: 'tool-native' }) })
-    )
-    expect(
-      await handler?.(evilEvent, { operation: 'read', toolCallId: 'tool-native' })
-    ).toMatchObject({ ok: false })
-  })
-
-  it('claims native imports at IPC before traversal and rejects a replay', async () => {
-    const { invoke } = collectHandlers()
-    const handler = invoke.get('desktop:local-files')
-    const fetchAuthorization = vi
-      .fn()
-      .mockResolvedValueOnce(
-        Response.json({
-          chatId: 'chat-1',
-          toolName: 'import_local_files',
-          args: { path: fileURLToPath(import.meta.url), targetWorkspaceId: 'workspace' },
-        })
-      )
-      .mockResolvedValueOnce(Response.json({ error: 'already started' }, { status: 409 }))
-    const event = {
-      senderFrame: { url: `${APP}/o/org/home` },
-      sender: { session: { fetch: fetchAuthorization } },
-    }
-    const request = { operation: 'manifest', toolCallId: 'tool-import' }
-    expect(await handler?.(event, request)).toMatchObject({
-      ok: true,
-      data: {
-        kind: 'manifest',
-        targetWorkspaceId: 'workspace',
-        entries: [{ relativePath: '', kind: 'file' }],
-      },
-    })
-    expect(fetchAuthorization).toHaveBeenCalledWith(
-      `${APP}/api/desktop/tool/authorize`,
-      expect.objectContaining({ body: JSON.stringify({ toolCallId: 'tool-import', claim: true }) })
-    )
-    expect(await handler?.(event, request)).toMatchObject({ ok: false, code: 'ALREADY_STARTED' })
-  })
-
   it('requires server authorization for every privileged filesystem tool request', async () => {
     const { invoke } = collectHandlers()
     const handler = invoke.get('desktop:local-filesystem')