fix(desktop): share pending folder consent decisions

Author: waleedlatif1

apps/desktop/README.md

@@ -188,7 +188,7 @@ Copilot can inspect user-selected local directories through the ordinary VFS too
 - **Bound to a live Copilot call:** before a native read/search or browser action, Electron asks the authenticated Sim origin for the pending tool-call record. Local requests must exactly match its persisted operation, path, and options; browser actions run with the persisted arguments rather than renderer-supplied ones. Completed, failed, and aborted runs are rejected.
 - **Abort-aware and bounded:** stop/cancel propagates to active native scans and reads. File size, aggregate grep bytes, line, result, traversal-depth, and scan-count limits remain enforced in Electron, and unsafe regular expressions are rejected before execution.
 
-The native `read_local_file` and `import_local_files` tools also accept absolute or `~/` paths. They reuse the same remembered folder grants as the VFS tools. For an unapproved path, Electron displays a bundled, isolated dialog showing the canonical folder and connected server. **Allow folder** grants read and import access to that folder and its subfolders across chats and normal app restarts. A file request proposes its containing folder explicitly; no wider folder is approved silently. Closing or declining the dialog returns no contents. Users can add or forget folders through **File → Folder Access**. As with VFS grants, sign-out and server changes clear access, and unavailable secure storage limits persistence to the app session. New consent prompts are serialized, but reads of approved folders proceed independently. Existing encrypted path-based approvals retain their scope and acquire folder-identity metadata on their first restore.
+The native `read_local_file` and `import_local_files` tools also accept absolute or `~/` paths. They reuse the same remembered folder grants as the VFS tools. For an unapproved path, Electron displays a bundled, isolated dialog showing the canonical folder and connected server. **Allow folder** grants read and import access to that folder and its subfolders across chats and normal app restarts. A file request proposes its containing folder explicitly; no wider folder is approved silently. Closing or declining the dialog returns no contents. Users can add or forget folders through **File → Folder Access**. As with VFS grants, sign-out and server changes clear access, and unavailable secure storage limits persistence to the app session. Concurrent requests for the same folder share one allow or deny decision. New consent prompts are serialized, but reads of approved folders proceed independently. Existing encrypted path-based approvals retain their scope and acquire folder-identity metadata on their first restore.
 
 Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates every pending call before using a grant, including remembered grants, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. Directory enumeration uses `fdopendir` on the verified descriptor, so replacing a parent path cannot redirect the listing. Listings scan at most 1,001 entries and return up to 1,000 sorted names with an explicit truncation flag; the cap bounds both memory and filesystem work, rather than promising the globally first 1,000 names in an arbitrarily large directory. Imports reject truncated listings. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
 

apps/desktop/e2e/local-files.spec.ts

@@ -140,8 +140,12 @@ test('native file tools remember folder consent across chats and restarts until
       await api.settings.setPreference('terminalEnabled', false)
     })
     const deniedPrompt = app.waitForEvent('window', { timeout: 10_000 })
-    const deniedRead = invoke({ operation: 'read', toolCallId: 'text' })
-    void deniedRead.catch(() => {})
+    const deniedReads = ['text', 'otherChat'].map((toolCallId) =>
+      invoke({ operation: 'read', toolCallId })
+    )
+    const deniedResults: unknown[] = []
+    for (const read of deniedReads)
+      void read.then((result) => deniedResults.push(result)).catch(() => {})
     const denial = await deniedPrompt
     await expect(denial.getByRole('button', { name: "Don't allow", exact: true })).toBeFocused()
     await denial.screenshot({
@@ -150,7 +154,11 @@ test('native file tools remember folder consent across chats and restarts until
         test.info().outputPath('local-file-consent.png'),
     })
     await denial.getByRole('button', { name: "Don't allow", exact: true }).click()
-    expect(await deniedRead).toMatchObject({ ok: false })
+    await expect.poll(() => deniedResults.length).toBe(2)
+    expect(deniedResults).toEqual([
+      { ok: false, error: expect.any(String) },
+      { ok: false, error: expect.any(String) },
+    ])
 
     const folderPrompt = app.waitForEvent('window')
     const folderRead = invoke({ operation: 'read', toolCallId: 'directory' })

apps/desktop/src/main/local-file-permissions.ts

@@ -40,10 +40,10 @@ async function revalidate(context: LocalFilePermissionContext): Promise<void> {
   assertCurrent(context)
 }
 
-/** Serializes new consent prompts while remembered folder access remains concurrent. */
+/** Shares each pending folder decision while remembered access remains concurrent. */
 export class LocalFilePermissions {
   private queue: Promise<void> = Promise.resolve()
-  private pending = 0
+  private readonly pending = new Map<string, Promise<void>>()
 
   constructor(private readonly filesystem: LocalFilesystemService) {}
 
@@ -62,32 +62,32 @@ export class LocalFilePermissions {
     const path = await realpath(nativePath(authorization.args.path))
     const existing = await this.filesystem.nativeAccess(path)
     if (existing) return this.authorizedAccess(existing, context)
-    if (this.pending >= MAX_PENDING_REQUESTS)
-      throw new Error('Too many local file requests are waiting for permission. Try again later.')
-    this.pending++
-    const pending = this.queue.then(() => this.requestFolder(path, context))
-    this.queue = pending.then(
-      () => undefined,
-      () => undefined
-    )
-    try {
-      return await pending
-    } finally {
-      this.pending--
-    }
-  }
-
-  private async requestFolder(
-    path: string,
-    context: LocalFilePermissionContext
-  ): Promise<LocalFileAccess> {
-    await revalidate(context)
-    const existing = await this.filesystem.nativeAccess(path)
-    if (existing) return this.authorizedAccess(existing, context)
     const info = await stat(path)
     if (!info.isFile() && !info.isDirectory())
       throw new Error('The path is not a regular file or directory.')
     const folder = info.isDirectory() ? path : dirname(path)
+    const key = JSON.stringify([context.generation, context.origin, folder])
+    let pending = this.pending.get(key)
+    if (!pending) {
+      if (this.pending.size >= MAX_PENDING_REQUESTS)
+        throw new Error('Too many local file requests are waiting for permission. Try again later.')
+      const decision = this.queue.then(() => this.requestFolder(folder, context))
+      this.queue = decision.then(
+        () => undefined,
+        () => undefined
+      )
+      pending = decision.finally(() => this.pending.delete(key))
+      this.pending.set(key, pending)
+    }
+    await pending
+    const access = await this.filesystem.nativeAccess(path)
+    if (!access) throw new Error('The approved folder is no longer available.')
+    return this.authorizedAccess(access, context)
+  }
+
+  private async requestFolder(folder: string, context: LocalFilePermissionContext): Promise<void> {
+    await revalidate(context)
+    if (await this.filesystem.nativeAccess(folder)) return
     const root = await lstat(folder)
     if (!root.isDirectory()) throw new Error('The folder is no longer available.')
     const displayedPath = JSON.stringify(folder).replace(
@@ -108,9 +108,6 @@ export class LocalFilePermissions {
     if (result.response !== 0) throw new Error('The user did not allow this local file access.')
     await revalidate(context)
     await this.filesystem.grantDirectory({ path: folder }, context.generation, root)
-    const access = await this.filesystem.nativeAccess(path)
-    if (!access) throw new Error('The approved folder is no longer available.')
-    return this.authorizedAccess(access, context)
   }
 
   private async authorizedAccess(