fix(desktop): complete file consent and add full file access

Author: waleedlatif1

apps/desktop/README.md

@@ -190,6 +190,8 @@ Copilot can inspect user-selected local directories through the ordinary VFS too
 
 The native `read_local_file` and `import_local_files` tools also accept absolute or `~/` paths. They reuse the same remembered folder grants as the VFS tools. For an unapproved path, Electron displays a bundled, isolated dialog showing the canonical folder and connected server. **Allow folder** grants read and import access to that folder and its subfolders across chats and normal app restarts. A file request proposes its containing folder explicitly; no wider folder is approved silently. Closing or declining the dialog returns no contents. Users can add or forget folders through **File → Folder Access**. As with VFS grants, sign-out and server changes clear access, and unavailable secure storage limits persistence to the app session. Concurrent requests for the same folder share one allow or deny decision. New consent prompts are serialized, but reads of approved folders proceed independently. Existing encrypted path-based approvals retain their scope and acquire folder-identity metadata on their first restore.
 
+**Desktop settings → Local files → Full file access** bypasses folder prompts for authorized native reads and imports. It is off by default, persists across ordinary restarts, and resets on sign-out or server changes. Turning it off restores folder consent checks. Call authorization, cancellation, file identity, and resource limits still apply, and VFS access continues to use explicit mounts. A failed settings write reports an error and leaves full access disabled in the running app.
+
 Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates every pending call before using a grant, including remembered grants, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. Directory enumeration uses `fdopendir` on the verified descriptor, so replacing a parent path cannot redirect the listing. Listings scan at most 1,001 entries and return up to 1,000 sorted names with an explicit truncation flag; the cap bounds both memory and filesystem work, rather than promising the globally first 1,000 names in an arbitrarily large directory. Imports reject truncated listings. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
 
 ## Auto-update, channels, rollout, rollback

apps/desktop/e2e/background-executor.spec.ts

@@ -104,7 +104,9 @@ test.describe('background executor', () => {
         args: { command: `sleep 1; echo B-${n} >> '${marker}'`, waitSeconds: 30 },
       })
     )
+    const readConsent = launched.app.waitForEvent('window')
     const localRead = sim.issue(deviceId, CHAT_B, 'read_local_file', { path: readable })
+    await (await readConsent).getByRole('button', { name: 'Allow folder', exact: true }).click()
 
     await window.goto(`${sim.origin}/workspace/ws-other/home`)
     await window.reload()
@@ -157,6 +159,50 @@ test.describe('background executor', () => {
     })
   })
 
+  test('background file reads require consent and Stop cancels pending permission', async () => {
+    const userData = mkdtempSync(join(tmpdir(), 'sim-executor-consent-'))
+    const launched = await launch(sim, userData)
+    app = launched.app
+    const deviceId = await registeredDevice(sim)
+    const readable = join(userData, 'private.txt')
+    writeFileSync(readable, 'background consent fixture')
+
+    await check('background read stays pending until folder consent', async () => {
+      const shown = launched.app.waitForEvent('window', { timeout: 10_000 })
+      const call = sim.issue(deviceId, CHAT_B, 'read_local_file', { path: readable })
+      const prompt = await shown
+      await expect(prompt.getByRole('button', { name: 'Allow folder', exact: true })).toBeVisible()
+      expect(sim.requireCall(call).completions).toHaveLength(0)
+      await prompt.getByRole('button', { name: "Don't allow", exact: true }).click()
+      const completion = await settled(sim, call)
+      expect(completion.status).toBe('error')
+      expect(JSON.stringify(completion)).not.toContain('background consent fixture')
+    })
+
+    await check('Stop dismisses background consent without granting access', async () => {
+      const shown = launched.app.waitForEvent('window', { timeout: 10_000 })
+      const call = sim.issue(deviceId, CHAT_B, 'read_local_file', { path: readable })
+      const prompt = await shown
+      await expect(prompt.getByRole('button', { name: 'Allow folder', exact: true })).toBeVisible()
+      sim.stopCall(call)
+      await expect.poll(() => prompt.isClosed()).toBe(true)
+      await settled(sim, call)
+      expect(sim.requireCall(call).completions[0]?.outcome).toBe('superseded')
+    })
+
+    await check('approved background reads reuse the shared folder grant', async () => {
+      const shown = launched.app.waitForEvent('window', { timeout: 10_000 })
+      const call = sim.issue(deviceId, CHAT_B, 'read_local_file', { path: readable })
+      const prompt = await shown
+      await prompt.getByRole('button', { name: 'Allow folder', exact: true }).click()
+      expect((await settled(sim, call)).status).toBe('success')
+      const next = sim.issue(deviceId, CHAT_A, 'read_local_file', { path: readable })
+      expect(JSON.stringify((await settled(sim, next)).data)).toContain(
+        'background consent fixture'
+      )
+    })
+  })
+
   test('B: a result produced while the network is cut is delivered once after reconnecting', async () => {
     const userData = mkdtempSync(join(tmpdir(), 'sim-executor-b-'))
     app = (await launch(sim, userData)).app
@@ -237,12 +283,15 @@ test.describe('background executor', () => {
     writeFileSync(join(source, 'q3', 'export.bin'), large)
     await launched.window.goto(`${sim.origin}/workspace/${WORKSPACE}/chat/${CHAT_C}`)
 
+    const importConsent = launched.app.waitForEvent('window')
     const call = sim.issue(deviceId, CHAT_B, 'import_local_files', {
       path: source,
       targetWorkspaceId: WORKSPACE,
       folderId: 'folder-e2e',
     })
 
+    await (await importConsent).getByRole('button', { name: 'Allow folder', exact: true }).click()
+
     await check('D: the import completes with every entry it stored', async () => {
       const completion = await settled(sim, call, 60_000)
       expect(completion.status).toBe('success')

apps/desktop/e2e/desktop-tools-live-sim.spec.ts

@@ -245,6 +245,12 @@ test.describe('desktop tools against a live Sim', () => {
     })
     const page = await app.firstWindow({ timeout })
     pageErrors = []
+    app.on('window', (permission) => {
+      void permission
+        .getByRole('button', { name: 'Allow folder', exact: true })
+        .click({ timeout: 10_000 })
+        .catch((error) => pageErrors.push(`Folder approval failed: ${String(error)}`))
+    })
     page.on('pageerror', (error) => pageErrors.push(error.message))
     page.on('console', (message) => {
       if (message.type() === 'error') pageErrors.push(message.text())