fix(desktop): revalidate folder consent and preserve exact identities

Author: waleedlatif1

apps/desktop/e2e/background-executor.spec.ts

@@ -1,4 +1,12 @@
-import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { type ElectronApplication, expect, test } from '@playwright/test'
@@ -203,6 +211,127 @@ test.describe('background executor', () => {
     })
   })
 
+  test('background consent cannot grant access when Sim cannot verify the call', async () => {
+    const userData = mkdtempSync(join(tmpdir(), 'sim-executor-offline-consent-'))
+    const launched = await launch(sim, userData)
+    app = launched.app
+    const deviceId = await registeredDevice(sim)
+    const readable = join(userData, 'private.txt')
+    writeFileSync(readable, 'offline consent fixture')
+
+    await check('offline approval returns an error without remembering a grant', async () => {
+      const shown = launched.app.waitForEvent('window')
+      const call = sim.issue(deviceId, CHAT_B, 'read_local_file', { path: readable })
+      const prompt = await shown
+      await expect(prompt.getByRole('button', { name: 'Allow folder', exact: true })).toBeVisible()
+      sim.disconnect()
+      await prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
+      await expect
+        .poll(() =>
+          launched.app.evaluate(({ safeStorage }, toolCallId) => {
+            const fs = process.getBuiltinModule('node:fs')
+            const path = `${process.env.SIM_DESKTOP_USER_DATA}/desktop-executor-journal.json`
+            const envelope = JSON.parse(fs.readFileSync(path, 'utf8'))
+            const journal = JSON.parse(
+              safeStorage.decryptString(Buffer.from(envelope.ciphertext, 'base64'))
+            ) as { entries: { toolCallId: string; state: string }[] }
+            return journal.entries.find((entry) => entry.toolCallId === toolCallId)?.state
+          }, call)
+        )
+        .toBe('result')
+      sim.reconnect()
+      const completion = await settled(sim, call)
+      expect(completion.status).toBe('error')
+      expect(JSON.stringify(completion)).not.toContain('offline consent fixture')
+      const nextPrompt = launched.app.waitForEvent('window')
+      const next = sim.issue(deviceId, CHAT_B, 'read_local_file', { path: readable })
+      await (await nextPrompt).getByRole('button', { name: "Don't allow", exact: true }).click()
+      expect((await settled(sim, next)).status).toBe('error')
+    })
+  })
+
+  test('background consent does not reopen the main app after its windows are closed', async () => {
+    test.skip(process.platform !== 'darwin', 'The macOS app remains running without a window.')
+    const userData = mkdtempSync(join(tmpdir(), 'sim-executor-windowless-consent-'))
+    const launched = await launch(sim, userData)
+    app = launched.app
+    const deviceId = await registeredDevice(sim)
+    const readable = join(userData, 'private.txt')
+    writeFileSync(readable, 'windowless consent fixture')
+    await launched.window.close()
+
+    await check('only the standalone consent window opens for a background read', async () => {
+      const shown = launched.app.waitForEvent('window')
+      const call = sim.issue(deviceId, CHAT_B, 'read_local_file', { path: readable })
+      const prompt = await shown
+      await expect(prompt.getByRole('button', { name: 'Allow folder', exact: true })).toBeVisible()
+      expect(
+        await launched.app.evaluate(({ BrowserWindow }) =>
+          BrowserWindow.getAllWindows().map((window) => window.getParentWindow() === null)
+        )
+      ).toEqual([true])
+      await prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      expect((await settled(sim, call)).status).toBe('error')
+    })
+  })
+
+  test('sign-out clears folder grants even when desktop settings cannot be saved', async () => {
+    const userData = mkdtempSync(join(tmpdir(), 'sim-executor-grant-cleanup-'))
+    const launched = await launch(sim, userData)
+    app = launched.app
+    const deviceId = await registeredDevice(sim)
+    const readable = join(userData, 'private.txt')
+    writeFileSync(readable, 'cleanup consent fixture')
+    const shown = launched.app.waitForEvent('window')
+    const call = sim.issue(deviceId, CHAT_B, 'read_local_file', { path: readable })
+    await (await shown).getByRole('button', { name: 'Allow folder', exact: true }).click()
+    expect((await settled(sim, call)).status).toBe('success')
+    const grants = join(userData, 'local-filesystem-grants.json')
+    expect(existsSync(grants)).toBe(true)
+    await launched.window.evaluate(() => {
+      const button = document.createElement('button')
+      button.textContent = 'Enable full file access'
+      button.onclick = async () => {
+        const api = (globalThis as typeof globalThis & { simDesktop: SimDesktopApi }).simDesktop
+        await api.settings.setFullFileAccess?.(true)
+        button.textContent = 'Full file access enabled'
+      }
+      document.body.append(button)
+    })
+    await launched.window
+      .getByRole('button', { name: 'Enable full file access', exact: true })
+      .click()
+    await expect(
+      launched.window.getByRole('button', { name: 'Full file access enabled', exact: true })
+    ).toBeVisible()
+    const settings = join(userData, 'settings.json')
+    if (existsSync(settings)) renameSync(settings, `${settings}.backup`)
+    mkdirSync(settings)
+
+    try {
+      await check(
+        'failed settings persistence does not skip independent grant cleanup',
+        async () => {
+          const failedSignOut = launched.app.waitForEvent('window')
+          await launched.app.evaluate(({ Menu }) => {
+            const item = Menu.getApplicationMenu()
+              ?.items.flatMap((entry) => entry.submenu?.items ?? [])
+              .find((entry) => entry.label === 'Sign Out')
+            if (!item) throw new Error('Missing Sign Out menu item')
+            item.click()
+          })
+          const failure = await failedSignOut
+          await failure.getByRole('button', { name: 'OK', exact: true }).click()
+          expect(existsSync(join(userData, 'account-data-teardown-required.json'))).toBe(true)
+          await expect.poll(() => existsSync(grants)).toBe(false)
+        }
+      )
+    } finally {
+      rmSync(settings, { recursive: true, force: true })
+      if (existsSync(`${settings}.backup`)) renameSync(`${settings}.backup`, settings)
+    }
+  })
+
   test('B: a result produced while the network is cut is delivered once after reconnecting', async () => {
     const userData = mkdtempSync(join(tmpdir(), 'sim-executor-b-'))
     app = (await launch(sim, userData)).app

apps/desktop/e2e/browser-focus.spec.ts

@@ -308,6 +308,33 @@ test('browser focus and shortcuts stay with the surface the user is using', asyn
       await clickMenu('New Tab')
       await expect.poll(tabCount).toBe(before + 1)
     })
+    await check(
+      'a revealed page resumes throttling in its own chat after switching chats',
+      async () => {
+        await panelAction({ action: 'switch-tab', tabId: '1' })
+        await shell.evaluate(async (scope) => {
+          const api = (globalThis as Bridge).simDesktop.browserAgent
+          api.setPanelBounds(
+            { x: 0, y: 120, width: innerWidth, height: innerHeight - 120 },
+            null,
+            scope
+          )
+          await api.activateScope('browser-focus-other-chat')
+        }, SCOPE)
+        await expect
+          .poll(() =>
+            shellApp.evaluate(
+              ({ webContents }, url) =>
+                webContents
+                  .getAllWebContents()
+                  .find((contents) => contents.getURL() === url)
+                  ?.getBackgroundThrottling(),
+              `${site}/five`
+            )
+          )
+          .toBe(true)
+      }
+    )
     passed = true
   } finally {
     mkdirSync(dirname(reportPath), { recursive: true })

apps/desktop/e2e/local-files.spec.ts

@@ -219,7 +219,9 @@ createRoot(document.getElementById('settings')).render(
         process.env.DESKTOP_LOCAL_FILES_REPORT_PATH ??
         test.info().outputPath('local-file-consent.png'),
     })
-    await denial.getByRole('button', { name: "Don't allow", exact: true }).click()
+    await denial
+      .getByRole('button', { name: "Don't allow", exact: true })
+      .click({ noWaitAfter: true })
     await expect.poll(() => deniedResults.length).toBe(2)
     expect(deniedResults).toEqual([
       { ok: false, error: expect.any(String) },
@@ -232,10 +234,15 @@ createRoot(document.getElementById('settings')).render(
     const folderConsent = await folderPrompt
     const queuedRead = invoke({ operation: 'read', toolCallId: 'text' })
     void queuedRead.catch(() => {})
+    await expect(
+      folderConsent.getByRole('button', { name: 'Allow folder', exact: true })
+    ).toBeVisible()
     expect(
       await folderConsent.evaluate(() => typeof (globalThis as { simDesktop?: unknown }).simDesktop)
     ).toBe('undefined')
-    await folderConsent.getByRole('button', { name: 'Allow folder', exact: true }).click()
+    await folderConsent
+      .getByRole('button', { name: 'Allow folder', exact: true })
+      .click({ noWaitAfter: true })
     expect(await folderRead).toMatchObject({ ok: true, data: { representation: 'directory' } })
     expect(await queuedRead).toMatchObject({ ok: true, data: { text: 'native file contents' } })
     const canonicalRequest = {
@@ -292,7 +299,9 @@ createRoot(document.getElementById('settings')).render(
       await invoke({ operation: 'cancel', toolCallId: 'sharedLeader' })
       expect(await leader.result).toMatchObject({ ok: false })
       await expect(leader.prompt.getByRole('dialog')).toBeVisible()
-      await leader.prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
+      await leader.prompt
+        .getByRole('button', { name: 'Allow folder', exact: true })
+        .click({ noWaitAfter: true })
       expect(await survivor).toMatchObject({ ok: true, data: { text: 'shared contents' } })
     })
     await test.step('Full file access is opt-in, survives restart, and stops granting access when disabled', async () => {
@@ -375,7 +384,9 @@ createRoot(document.getElementById('settings')).render(
         window.getByRole('switch', { name: 'Full file access', exact: true })
       ).not.toBeChecked()
       const permission = await requestPermission({ operation: 'read', toolCallId: 'fullAccess' })
-      await permission.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      await permission.prompt
+        .getByRole('button', { name: "Don't allow", exact: true })
+        .click({ noWaitAfter: true })
       expect(await permission.result).toMatchObject({ ok: false })
     })
     await test.step('a folder grant works in another chat but does not permit symlink escapes', async () => {
@@ -400,7 +411,9 @@ createRoot(document.getElementById('settings')).render(
       await expect(escapedRead.prompt.getByRole('dialog')).toContainText(
         JSON.stringify(realpathSync(outside))
       )
-      await escapedRead.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      await escapedRead.prompt
+        .getByRole('button', { name: "Don't allow", exact: true })
+        .click({ noWaitAfter: true })
       expect(await escapedRead.result).toMatchObject({ ok: false })
       rmSync(join(source, 'linked.txt'))
     })
@@ -410,7 +423,9 @@ createRoot(document.getElementById('settings')).render(
         const stale = await requestPermission({ operation: 'read', toolCallId: 'stale' })
         if (changed) calls.stale.args.path = join(source, 'report.txt')
         else calls.stale = undefined
-        await stale.prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
+        await stale.prompt
+          .getByRole('button', { name: 'Allow folder', exact: true })
+          .click({ noWaitAfter: true })
         expect(await stale.result).toMatchObject({ ok: false })
       }
     })
@@ -432,12 +447,12 @@ createRoot(document.getElementById('settings')).render(
               openApproved(
                 root: string,
                 relative: string,
-                dev: number,
-                ino: number,
+                dev: bigint,
+                ino: bigint,
                 directory: boolean
               ): Promise<number>
             }
-            const root = await stat(paths.source)
+            const root = await stat(paths.source, { bigint: true })
             const denied = async (path: string, ino = root.ino) => {
               try {
                 const fd = await native.openApproved(paths.source, path, root.dev, ino, false)
@@ -460,12 +475,19 @@ createRoot(document.getElementById('settings')).render(
               text,
               ancestor: await denied('native-link/private.txt'),
               traversal: await denied('../Reports-other/private.txt'),
-              replaced: await denied('native-parent/inside.txt', root.ino + 1),
+              replaced: await denied('native-parent/inside.txt', root.ino + 1n),
+              overflow: await denied('native-parent/inside.txt', root.ino + (1n << 64n)),
             }
           },
           { source: realpathSync(source) }
         )
-        expect(result).toEqual({ text: 'inside', ancestor: true, traversal: true, replaced: true })
+        expect(result).toEqual({
+          text: 'inside',
+          ancestor: true,
+          traversal: true,
+          replaced: true,
+          overflow: true,
+        })
       } finally {
         rmSync(linked)
         rmSync(parent, { recursive: true })
@@ -654,7 +676,9 @@ createRoot(document.getElementById('settings')).render(
       await closed
       expect(await cancelled.result).toMatchObject({ ok: false })
       const again = await requestPermission({ operation: 'read', toolCallId: 'cancelled' })
-      await again.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      await again.prompt
+        .getByRole('button', { name: "Don't allow", exact: true })
+        .click({ noWaitAfter: true })
       expect(await again.result).toMatchObject({ ok: false })
     })
     await test.step('consent escapes direction controls in folder names', async () => {
@@ -663,14 +687,18 @@ createRoot(document.getElementById('settings')).render(
       calls.bidi = { toolName: 'read_local_file', args: { path: folder } }
       const bidi = await requestPermission({ operation: 'read', toolCallId: 'bidi' })
       await expect(bidi.prompt.getByRole('dialog')).toContainText('Bidi\\u061c\\u200e\\u200f')
-      await bidi.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      await bidi.prompt
+        .getByRole('button', { name: "Don't allow", exact: true })
+        .click({ noWaitAfter: true })
       expect(await bidi.result).toMatchObject({ ok: false })
     })
     await test.step('an unanswered prompt does not block approved folders', async () => {
       calls.blocker = { toolName: 'read_local_file', args: { path: join(outside, 'private.txt') } }
       const blocker = await requestPermission({ operation: 'read', toolCallId: 'blocker' })
       expect(await invoke({ operation: 'read', toolCallId: 'text' })).toMatchObject({ ok: true })
-      await blocker.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      await blocker.prompt
+        .getByRole('button', { name: "Don't allow", exact: true })
+        .click({ noWaitAfter: true })
       expect(await blocker.result).toMatchObject({ ok: false })
     })
     await test.step('cancelled calls cannot reuse an approved folder', async () => {
@@ -688,7 +716,9 @@ createRoot(document.getElementById('settings')).render(
       renameSync(proposed, join(root, 'Original'))
       mkdirSync(proposed)
       writeFileSync(join(proposed, 'unapproved.txt'), 'replacement folder contents')
-      await retargeted.prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
+      await retargeted.prompt
+        .getByRole('button', { name: 'Allow folder', exact: true })
+        .click({ noWaitAfter: true })
       expect(await retargeted.result).toMatchObject({ ok: false })
     })
     const result = await invoke({ operation: 'manifest', toolCallId: 'import' })
@@ -763,7 +793,9 @@ createRoot(document.getElementById('settings')).render(
         'Local files'
       )
       const revoked = await requestPermission({ operation: 'read', toolCallId: 'text' })
-      await revoked.prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
+      await revoked.prompt
+        .getByRole('button', { name: 'Allow folder', exact: true })
+        .click({ noWaitAfter: true })
       expect(await revoked.result).toMatchObject({ ok: true })
     })
 
@@ -778,12 +810,16 @@ createRoot(document.getElementById('settings')).render(
         'Local files'
       )
       const replaced = await requestPermission({ operation: 'read', toolCallId: 'text' })
-      await replaced.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      await replaced.prompt
+        .getByRole('button', { name: "Don't allow", exact: true })
+        .click({ noWaitAfter: true })
       expect(await replaced.result).toMatchObject({ ok: false })
       rmSync(source, { recursive: true })
       renameSync(join(root, 'Original-reports'), source)
       const restored = await requestPermission({ operation: 'read', toolCallId: 'text' })
-      await restored.prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
+      await restored.prompt
+        .getByRole('button', { name: 'Allow folder', exact: true })
+        .click({ noWaitAfter: true })
       expect(await restored.result).toMatchObject({ ok: true })
     })
 
@@ -820,7 +856,9 @@ createRoot(document.getElementById('settings')).render(
         )
         .toMatchObject({ fullFileAccess: false })
       const revoked = await requestPermission({ operation: 'read', toolCallId: 'text' })
-      await revoked.prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      await revoked.prompt
+        .getByRole('button', { name: "Don't allow", exact: true })
+        .click({ noWaitAfter: true })
       expect(await revoked.result).toMatchObject({ ok: false })
     })
     await test.step('a failed settings write reports the error and leaves Full file access disabled', async () => {