fix(desktop): require folder permission for native file tools by waleedlatif1 · Pull Request #8345 · simstudioai/sim

waleedlatif1 · 2026-09-26T21:48:58Z

Summary

Ask once for folder access before native file reads and imports, then reuse the existing encrypted grants across chats and app restarts.
Reuse previously approved VFS folders and add File → Folder Access controls. Concurrent requests for the same folder share one allow or deny decision; approved reads continue independently.
Revalidate pending calls, cancellation, canonical containment, and folder identity. Enumerate verified directory descriptors and reject replacements. Sign-out and server changes clear remembered access.

Type of Change

Bug fix

Testing

Rebased onto current staging and reviewed the consent, persistence, revocation, and native directory boundaries again.
Full root test suite and all workspace type checks; 876 desktop tests passing.
Real Electron E2E covers shared allow/deny decisions, recursive access across chats, imports, restart persistence, revocation, sign-out, cancellation, and symlink or replaced-folder denial. Screenshot artifact supports DESKTOP_LOCAL_FILES_REPORT_PATH.
The duplicate-denial and cancellation-takeover regressions each failed before their fixes. Earlier regression checks also failed with pending-call, persistence, revocation, path, and folder-identity guards removed independently.
Lint, block-registry audit, all 58 repository audits, and docs-manifest check.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-09-26T21:49:02Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 5, 2026 11:26pm UTC

cubic-dev-ai

All reported issues were addressed across 8 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

greptile-apps · 2026-09-26T21:53:23Z

Confidence Score: 5/5

[High risk] Adds native file system access with permission checks.

The PR appears safe to merge; no actionable new issue or outstanding previous finding was identified.

Summary

The PR requires folder consent for native file reads and imports, reuses encrypted grants, and adds native folder-management controls.

Adds pending-call revalidation, cancellation handling, and descriptor-based directory enumeration.
The latest change lets a valid caller take over consent after the caller owning a shared prompt expires.

Diagram

sequenceDiagram
  participant Caller as Native file caller
  participant Shell as Electron shell
  participant Server as Sim server
  participant User
  Caller->>Shell: Read or import request
  Shell->>Server: Verify pending tool call
  Shell->>Shell: Check remembered folder grant
  alt No valid grant
    Shell->>User: Request folder consent
    User-->>Shell: Allow or deny
  end
  Shell->>Server: Revalidate pending call
  Shell->>Shell: Resolve and verify approved path
  Shell-->>Caller: Bounded result or refusal

_{Reviews (7) · Last reviewed commit: "fix(desktop): preserve consent for remai..."}

waleedlatif1 · 2026-09-26T22:08:01Z

@greptile

waleedlatif1 · 2026-09-26T22:08:03Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T22:08:08Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 13 files

_{Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic}

waleedlatif1 · 2026-09-26T22:31:52Z

@greptile

waleedlatif1 · 2026-09-26T22:31:54Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T22:31:59Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 15 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

waleedlatif1 · 2026-09-26T22:52:04Z

@greptile

waleedlatif1 · 2026-09-26T22:52:05Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T22:52:10Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 20 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-09-26T22:59:20Z

@greptile

waleedlatif1 · 2026-09-26T22:59:21Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-26T22:59:27Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 20 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Re-trigger cubic}

waleedlatif1 · 2026-10-05T23:14:12Z

@greptile

waleedlatif1 · 2026-10-05T23:14:13Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-05T23:14:19Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 20 files

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-10-05T23:27:04Z

@greptile

waleedlatif1 · 2026-10-05T23:27:05Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-05T23:27:12Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 20 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Re-trigger cubic}

vercel Bot temporarily deployed to Preview September 26, 2026 21:49 Inactive

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/desktop/src/main/local-file-permissions.ts Outdated

greptile-apps Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/desktop/src/main/local-file-permissions.ts Outdated

Comment thread apps/desktop/src/main/local-file-permissions.ts Outdated

Comment thread apps/desktop/e2e/local-files.spec.ts Outdated

waleedlatif1 force-pushed the codex/desktop-local-file-consent branch from d43d45a to 6ca8a97 Compare September 26, 2026 22:07

vercel Bot temporarily deployed to Preview September 26, 2026 22:07 Inactive

waleedlatif1 changed the title ~~fix(desktop): ask before accessing local files~~ fix(desktop): require folder permission for native file tools Sep 26, 2026

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

waleedlatif1 force-pushed the codex/desktop-local-file-consent branch from 6ca8a97 to b5ae75a Compare September 26, 2026 22:31

vercel Bot temporarily deployed to Preview September 26, 2026 22:31 Inactive

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

greptile-apps Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/desktop/src/main/local-files.ts Outdated

Comment thread apps/desktop/src/main/ipc.ts

waleedlatif1 requested a review from a team as a code owner September 26, 2026 22:51

vercel Bot deployed to Preview September 26, 2026 22:53 View deployment

greptile-apps Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/desktop/native/directory.cc

Comment thread apps/desktop/src/main/local-files.ts

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

Comment thread apps/desktop/src/main/local-files.ts

vercel Bot temporarily deployed to Preview September 26, 2026 22:59 Inactive

cubic-dev-ai Bot reviewed Sep 26, 2026

View reviewed changes

waleedlatif1 added 6 commits October 5, 2026 16:02

fix(desktop): ask before accessing local files

302dbb6

fix(desktop): remember folder permissions across chats

89f3687

fix(desktop): cancel pending file consent and recheck access

635e680

fix(desktop): enumerate approved directory descriptors

8a8f593

fix(desktop): reject replaced directory listings

4280b1a

fix(desktop): share pending folder consent decisions

f524997

waleedlatif1 force-pushed the codex/desktop-local-file-consent branch from ce6f05b to f524997 Compare October 5, 2026 23:13

vercel Bot temporarily deployed to Preview October 5, 2026 23:13 Inactive

greptile-apps Bot reviewed Oct 5, 2026

View reviewed changes

Comment thread apps/desktop/src/main/local-file-permissions.ts Outdated

cubic-dev-ai Bot reviewed Oct 5, 2026

View reviewed changes

Comment thread apps/desktop/src/main/menu.ts Outdated

Comment thread apps/desktop/src/main/ipc.ts

Comment thread apps/desktop/package.json

fix(desktop): preserve consent for remaining callers

b56f8e7

vercel Bot temporarily deployed to Preview October 5, 2026 23:26 Inactive

cubic-dev-ai Bot reviewed Oct 5, 2026

View reviewed changes

Conversation

waleedlatif1 commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

waleedlatif1 commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 26, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 5, 2026

Uh oh!

waleedlatif1 commented Oct 5, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 5, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Sep 26, 2026 •

edited

Loading

vercel Bot commented Sep 26, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Sep 26, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading