fix(desktop): remember folder permissions across chats

Author: waleedlatif1

apps/desktop/README.md

@@ -182,15 +182,15 @@ Copilot can inspect user-selected local directories through the ordinary VFS too
 
 - **Explicit and read-only:** only a user click may open the native folder picker or revoke a grant; model tool calls cannot do either. There are no write/delete/execute/upload operations.
 - **Remembered securely:** grants are encrypted in Electron's private app data with OS-backed `safeStorage` and restored with the same opaque URI after a normal app restart. (A security-scoped bookmark is stored alongside each grant, but it is a no-op in the current Developer ID build — only the macOS App Sandbox consumes it — and is kept purely for forward-compatibility should a sandboxed/MAS build ever ship.) There is no plaintext fallback: when secure storage is unavailable, the returned mount has `remembered: false` and lasts only for that app session.
-- **Revocable:** Desktop settings removes one grant. All grants are removed on explicit sign-out or server-origin change so another Sim account or server cannot inherit them. Normal app quit only releases active OS handles and keeps the encrypted grants.
+- **Revocable:** File → Folder Access adds folders and removes individual grants. All grants are removed on explicit sign-out or server-origin change so another Sim account or server cannot inherit them. Normal app quit only releases active OS handles and keeps the encrypted grants.
 - **Opaque:** the model sees canonical paths such as `user-local/Project--<mount-id>/README.md`, never host paths or internal `localfs://` URIs. Electron resolves every request, checks lexical and realpath containment, and refuses symlink escapes.
 - **Desktop-only:** the web app advertises `desktopCapabilities.localFilesystem` only when the Electron bridge is present. Mothership adds the `user-local/` prompt surface and per-call client routing only for that capability, including delegated and resumed work.
 - **Bound to a live Copilot call:** before a native read/search or browser action, Electron asks the authenticated Sim origin for the pending tool-call record. Local requests must exactly match its persisted operation, path, and options; browser actions run with the persisted arguments rather than renderer-supplied ones. Completed, failed, and aborted runs are rejected.
 - **Abort-aware and bounded:** stop/cancel propagates to active native scans and reads. File size, aggregate grep bytes, line, result, traversal-depth, and scan-count limits remain enforced in Electron, and unsafe regular expressions are rejected before execution.
 
-The native `read_local_file` and `import_local_files` tools also accept absolute or `~/` paths. Before accessing a new file or folder, Electron displays a bundled, isolated permission dialog showing the resolved path and the connected server. **Allow for this chat** grants access to that file, or that folder and its contents, for the current desktop session. Closing or declining the dialog returns no contents. Grants are scoped to the server, account generation, chat, and operation; import grants also bind the destination workspace and folder. A read grant never authorizes an import. Grants are not persisted and expire on sign-out, server changes, or app restart.
+The native `read_local_file` and `import_local_files` tools also accept absolute or `~/` paths. They reuse the same remembered folder grants as the VFS tools. For an unapproved path, Electron displays a bundled, isolated dialog showing the canonical folder and connected server. **Allow folder** grants read and import access to that folder and its subfolders across chats and normal app restarts. A file request proposes its containing folder explicitly; no wider folder is approved silently. Closing or declining the dialog returns no contents. Users can add or forget folders through **File → Folder Access**. As with VFS grants, sign-out and server changes clear access, and unavailable secure storage limits persistence to the app session. New consent prompts are serialized, but reads of approved folders proceed independently.
 
-Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates the pending call after consent, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
+Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates every pending call before using a grant, including remembered grants, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
 
 ## Auto-update, channels, rollout, rollback
 

apps/desktop/e2e/local-files.spec.ts

@@ -16,7 +16,7 @@ import type { DesktopLocalFileRequest, SimDesktopApi } from '@sim/desktop-bridge
 
 const DESKTOP_DIR = fileURLToPath(new URL('..', import.meta.url))
 
-test('native file tools require local consent and reuse only the approved chat and path', async () => {
+test('native file tools remember folder consent across chats and restarts until revoked', async () => {
   const root = mkdtempSync(join(tmpdir(), 'sim-native-files-e2e-'))
   const source = join(root, 'Reports')
   const outside = join(root, 'Reports-other')
@@ -28,7 +28,7 @@ test('native file tools require local consent and reuse only the approved chat a
     'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAusB9Y9Zl1sAAAAASUVORK5CYII='
   writeFileSync(join(source, 'image.png'), Buffer.from(png, 'base64'))
   const claimed = new Set<string>()
-  const authorizedCalls = new Set<string>()
+  const expireAfterAuthorization = new Set<string>()
   let signedIn = true
   const calls: Record<
     string,
@@ -84,11 +84,11 @@ test('native file tools require local consent and reuse only the approved chat a
           response.writeHead(call ? 409 : 403, { 'Content-Type': 'application/json' }).end('{}')
           return
         }
-        authorizedCalls.add(input.toolCallId)
         if (input.claim) claimed.add(input.toolCallId)
         response
           .writeHead(200, { 'Content-Type': 'application/json' })
           .end(JSON.stringify({ ...call, chatId: call.chatId ?? 'org-chat' }))
+        if (expireAfterAuthorization.has(input.toolCallId)) calls[input.toolCallId] = undefined
         return
       }
       response
@@ -98,21 +98,27 @@ test('native file tools require local consent and reuse only the approved chat a
             ? { 'Set-Cookie': 'better-auth.session_token=fixture; HttpOnly; SameSite=Lax; Path=/' }
             : {}),
         })
-        .end('<!doctype html><title>Local file fixture</title><h1>Local files</h1>')
+        .end(`<!doctype html><title>Local file fixture</title><h1>Local files</h1>
+          <button id="forget" onclick="window.simDesktop.localFilesystem({operation:'list_mounts'}).then(async result => {
+            for (const mount of result.data.mounts) await window.simDesktop.localFilesystem({operation:'forget_mount', uri:mount.uri});
+            this.textContent='Forgotten';
+          })">Forget folders</button>`)
     })
     await new Promise<void>((resolve) => server?.listen(0, '127.0.0.1', resolve))
     const address = server.address()
     if (!address || typeof address === 'string') throw new Error('Missing fixture address')
-    app = await electron.launch({
-      args: ['.'],
-      cwd: DESKTOP_DIR,
-      env: {
-        ...process.env,
-        SIM_DESKTOP_ORIGIN: `http://127.0.0.1:${address.port}`,
-        SIM_DESKTOP_USER_DATA: join(root, 'profile'),
-      },
-    })
-    const window = await app.firstWindow()
+    const launch = () =>
+      electron.launch({
+        args: ['.', '--use-mock-keychain'],
+        cwd: DESKTOP_DIR,
+        env: {
+          ...process.env,
+          SIM_DESKTOP_ORIGIN: `http://127.0.0.1:${address.port}`,
+          SIM_DESKTOP_USER_DATA: join(root, 'profile'),
+        },
+      })
+    app = await launch()
+    let window = await app.firstWindow()
     await expect(window.getByRole('heading')).toHaveText('Local files')
     const invoke = (input: DesktopLocalFileRequest) =>
       window.evaluate(async (request) => {
@@ -135,6 +141,7 @@ test('native file tools require local consent and reuse only the approved chat a
     })
     const deniedPrompt = app.waitForEvent('window', { timeout: 10_000 })
     const deniedRead = invoke({ operation: 'read', toolCallId: 'text' })
+    void deniedRead.catch(() => {})
     const denial = await deniedPrompt
     await expect(denial.getByRole('button', { name: "Don't allow", exact: true })).toBeFocused()
     await denial.screenshot({
@@ -147,12 +154,14 @@ test('native file tools require local consent and reuse only the approved chat a
 
     const folderPrompt = app.waitForEvent('window')
     const folderRead = invoke({ operation: 'read', toolCallId: 'directory' })
+    void folderRead.catch(() => {})
     const folderConsent = await folderPrompt
     const queuedRead = invoke({ operation: 'read', toolCallId: 'text' })
+    void queuedRead.catch(() => {})
     expect(
       await folderConsent.evaluate(() => typeof (globalThis as { simDesktop?: unknown }).simDesktop)
     ).toBe('undefined')
-    await folderConsent.getByRole('button', { name: 'Allow for this chat', exact: true }).click()
+    await folderConsent.getByRole('button', { name: 'Allow folder', exact: true }).click()
     expect(await folderRead).toMatchObject({ ok: true, data: { representation: 'directory' } })
     expect(await queuedRead).toMatchObject({ ok: true, data: { text: 'native file contents' } })
     const canonicalRequest = {
@@ -168,29 +177,36 @@ test('native file tools require local consent and reuse only the approved chat a
       ok: true,
       data: { observations: [{ mediaType: 'image/png', data: png }] },
     })
-    const runningApp = app
     const requestPermission = async (request: DesktopLocalFileRequest) => {
-      const shown = runningApp.waitForEvent('window', { timeout: 10_000 })
+      if (!app) throw new Error('Desktop app is not running')
+      const shown = app.waitForEvent('window', { timeout: 10_000 })
       const result = invoke(request)
       void result.catch(() => {})
       const prompt = await shown
       await expect(prompt.getByRole('button', { name: "Don't allow", exact: true })).toBeVisible()
       return { prompt, result }
     }
-    await test.step('a folder grant does not authorize another chat or a symlink escape', async () => {
-      const otherChat = await requestPermission({ operation: 'read', toolCallId: 'otherChat' })
-      const dismissed = otherChat.prompt.waitForEvent('close')
-      await otherChat.prompt
-        .getByRole('button', { name: "Don't allow", exact: true })
-        .press('Escape')
-        .catch(() => {})
-      await dismissed
-      expect(await otherChat.result).toMatchObject({ ok: false })
+    await test.step('a folder grant works in another chat but does not permit symlink escapes', async () => {
+      expect(await invoke({ operation: 'read', toolCallId: 'otherChat' })).toMatchObject({
+        ok: true,
+        data: { text: 'native file contents' },
+      })
+      writeFileSync(join(source, 'empty', 'new.txt'), 'new file in a subfolder')
+      calls.nested = {
+        toolName: 'read_local_file',
+        args: { path: join(source, 'empty', 'new.txt') },
+        chatId: 'another-chat',
+      }
+      expect(await invoke({ operation: 'read', toolCallId: 'nested' })).toMatchObject({
+        ok: true,
+        data: { text: 'new file in a subfolder' },
+      })
+      rmSync(join(source, 'empty', 'new.txt'))
       symlinkSync(join(outside, 'private.txt'), join(source, 'linked.txt'))
       calls.escape = { toolName: 'read_local_file', args: { path: join(source, 'linked.txt') } }
       const escapedRead = await requestPermission({ operation: 'read', toolCallId: 'escape' })
       await expect(escapedRead.prompt.getByRole('dialog')).toContainText(
-        JSON.stringify(realpathSync(join(outside, 'private.txt')))
+        JSON.stringify(realpathSync(outside))
       )
       await escapedRead.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
       expect(await escapedRead.result).toMatchObject({ ok: false })
@@ -202,21 +218,23 @@ test('native file tools require local consent and reuse only the approved chat a
         const stale = await requestPermission({ operation: 'read', toolCallId: 'stale' })
         if (changed) calls.stale.args.path = join(source, 'report.txt')
         else calls.stale = undefined
-        await stale.prompt.getByRole('button', { name: 'Allow for this chat', exact: true }).click()
+        await stale.prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
         expect(await stale.result).toMatchObject({ ok: false })
       }
     })
-    await test.step('a queued call is revalidated even when its folder is already approved', async () => {
+    await test.step('an unanswered prompt does not block approved folders', async () => {
       calls.blocker = { toolName: 'read_local_file', args: { path: join(outside, 'private.txt') } }
-      calls.queued = { toolName: 'read_local_file', args: { path: join(source, 'report.txt') } }
       const blocker = await requestPermission({ operation: 'read', toolCallId: 'blocker' })
-      const queued = invoke({ operation: 'read', toolCallId: 'queued' })
-      void queued.catch(() => {})
-      await expect.poll(() => authorizedCalls.has('queued')).toBe(true)
-      calls.queued = undefined
+      expect(await invoke({ operation: 'read', toolCallId: 'text' })).toMatchObject({ ok: true })
       await blocker.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
       expect(await blocker.result).toMatchObject({ ok: false })
-      expect(await queued).toMatchObject({ ok: false })
+    })
+    await test.step('cancelled calls cannot reuse an approved folder', async () => {
+      calls.expired = { toolName: 'read_local_file', args: { path: join(source, 'report.txt') } }
+      expireAfterAuthorization.add('expired')
+      expect(await invoke({ operation: 'read', toolCallId: 'expired' })).toMatchObject({
+        ok: false,
+      })
     })
     await test.step('replacing the proposed folder during consent does not expose its new target', async () => {
       const proposed = join(root, 'Proposed')
@@ -226,16 +244,10 @@ test('native file tools require local consent and reuse only the approved chat a
       renameSync(proposed, join(root, 'Original'))
       mkdirSync(proposed)
       writeFileSync(join(proposed, 'unapproved.txt'), 'replacement folder contents')
-      await retargeted.prompt
-        .getByRole('button', { name: 'Allow for this chat', exact: true })
-        .click()
+      await retargeted.prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
       expect(await retargeted.result).toMatchObject({ ok: false })
     })
-    const importPrompt = app.waitForEvent('window')
-    const importing = invoke({ operation: 'manifest', toolCallId: 'import' })
-    const importConsent = await importPrompt
-    await importConsent.getByRole('button', { name: 'Allow for this chat', exact: true }).click()
-    const result = await importing
+    const result = await invoke({ operation: 'manifest', toolCallId: 'import' })
     if (!result.ok || result.data.kind !== 'manifest') throw new Error(JSON.stringify(result))
     expect(result.data.targetWorkspaceId).toBe('target-workspace')
     expect(result.data.entries.map((entry) => entry.relativePath)).toEqual([
@@ -279,22 +291,59 @@ test('native file tools require local consent and reuse only the approved chat a
       ok: false,
       code: 'ALREADY_STARTED',
     })
-    await test.step('import approval is bound to its destination workspace', async () => {
+    await test.step('an approved folder permits imports without repeated destination prompts', async () => {
       calls.otherImport = {
         toolName: 'import_local_files',
         args: { path: source, targetWorkspaceId: 'other-workspace' },
       }
-      const otherImport = await requestPermission({
-        operation: 'manifest',
-        toolCallId: 'otherImport',
+      expect(await invoke({ operation: 'manifest', toolCallId: 'otherImport' })).toMatchObject({
+        ok: true,
       })
-      await otherImport.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
-      expect(await otherImport.result).toMatchObject({ ok: false })
+    })
+    await test.step('folder permissions survive restarting the desktop app', async () => {
+      await app?.close()
+      app = await launch()
+      window = await app.firstWindow()
+      await expect(window.getByRole('heading')).toHaveText('Local files')
+      expect(await invoke({ operation: 'read', toolCallId: 'text' })).toMatchObject({ ok: true })
+    })
+    await test.step('forgetting a folder revokes native reads and survives restart', async () => {
+      await window.getByRole('button', { name: 'Forget folders', exact: true }).click()
+      await expect(window.getByRole('button', { name: 'Forgotten', exact: true })).toBeVisible()
+      await app?.close()
+      app = await launch()
+      window = await app.firstWindow()
+      await expect(window.getByRole('heading')).toHaveText('Local files')
+      const revoked = await requestPermission({ operation: 'read', toolCallId: 'text' })
+      await revoked.prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
+      expect(await revoked.result).toMatchObject({ ok: true })
+    })
+
+    await test.step('a remembered grant does not follow a replaced folder after restart', async () => {
+      await app?.close()
+      renameSync(source, join(root, 'Original-reports'))
+      mkdirSync(source)
+      writeFileSync(join(source, 'report.txt'), 'replacement contents')
+      app = await launch()
+      window = await app.firstWindow()
+      await expect(window.getByRole('heading')).toHaveText('Local files')
+      const replaced = await requestPermission({ operation: 'read', toolCallId: 'text' })
+      await replaced.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      expect(await replaced.result).toMatchObject({ ok: false })
+      rmSync(source, { recursive: true })
+      renameSync(join(root, 'Original-reports'), source)
+      const restored = await requestPermission({ operation: 'read', toolCallId: 'text' })
+      await restored.prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
+      expect(await restored.result).toMatchObject({ ok: true })
     })
 
-    await test.step('sign-out revokes chat grants before the next account session', async () => {
-      await window.evaluate(async () => {
-        await fetch('/api/auth/sign-out', { method: 'POST' })
+    await test.step('sign-out revokes remembered grants before the next account session', async () => {
+      await app?.evaluate(({ Menu }) => {
+        const item = Menu.getApplicationMenu()
+          ?.items.flatMap((entry) => entry.submenu?.items ?? [])
+          .find((entry) => entry.label === 'Sign Out')
+        if (!item) throw new Error('Sign Out menu item missing')
+        item.click()
       })
       await expect(window).toHaveURL(`http://127.0.0.1:${address.port}/login`)
       signedIn = true

apps/desktop/src/main/index.ts

@@ -849,6 +849,9 @@ function main(): void {
       allowHttpLocalhost,
       openSettings,
       openServerSettings: () => serverWindow.open(),
+      openFolderAccess: (parent) => {
+        if (accountDataAvailable()) localFilesystem.showAccessMenu(parent)
+      },
       newWindow: () => void createAndLoadAppWindow(),
       newChat: () => void openMainWindowAt(newChatRoute(config.get('lastRoute'))),
       handleFocusedResourceShortcut: (win, shortcut) =>