fix(desktop): reject replaced directory listings

Author: waleedlatif1

apps/desktop/README.md

@@ -190,7 +190,7 @@ Copilot can inspect user-selected local directories through the ordinary VFS too
 
 The native `read_local_file` and `import_local_files` tools also accept absolute or `~/` paths. They reuse the same remembered folder grants as the VFS tools. For an unapproved path, Electron displays a bundled, isolated dialog showing the canonical folder and connected server. **Allow folder** grants read and import access to that folder and its subfolders across chats and normal app restarts. A file request proposes its containing folder explicitly; no wider folder is approved silently. Closing or declining the dialog returns no contents. Users can add or forget folders through **File → Folder Access**. As with VFS grants, sign-out and server changes clear access, and unavailable secure storage limits persistence to the app session. New consent prompts are serialized, but reads of approved folders proceed independently. Existing encrypted path-based approvals retain their scope and acquire folder-identity metadata on their first restore.
 
-Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates every pending call before using a grant, including remembered grants, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. Directory enumeration uses `fdopendir` on the verified descriptor, so replacing a parent path cannot redirect the listing. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
+Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates every pending call before using a grant, including remembered grants, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. Directory enumeration uses `fdopendir` on the verified descriptor, so replacing a parent path cannot redirect the listing. Listings scan at most 1,001 entries and return up to 1,000 sorted names with an explicit truncation flag; the cap bounds both memory and filesystem work, rather than promising the globally first 1,000 names in an arbitrarily large directory. Imports reject truncated listings. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
 
 ## Auto-update, channels, rollout, rollback
 

apps/desktop/e2e/local-files.spec.ts

@@ -317,6 +317,40 @@ test('native file tools remember folder consent across chats and restarts until
         rmSync(otherParent, { recursive: true, force: true })
       }
     })
+    await test.step('a replaced directory cannot return a listing for its old contents', async () => {
+      const directory = join(realpathSync(source), 'replace-during-read')
+      const backup = join(realpathSync(source), 'previous-directory')
+      mkdirSync(directory)
+      writeFileSync(join(directory, 'old.txt'), 'old contents')
+      calls.directoryReplaced = { toolName: 'read_local_file', args: { path: directory } }
+      await app?.evaluate(
+        (_electron, paths) => {
+          const fs = process.getBuiltinModule(
+            'node:fs/promises'
+          ) as typeof import('node:fs/promises')
+          const original = fs.lstat
+          fs.lstat = (async (...args: Parameters<typeof fs.lstat>) => {
+            const result = await original(...args)
+            if (args[0] === paths.directory) {
+              fs.lstat = original
+              await fs.rename(paths.directory, paths.backup)
+              await fs.mkdir(paths.directory)
+              await fs.writeFile(`${paths.directory}/new.txt`, 'new contents')
+            }
+            return result
+          }) as typeof fs.lstat
+        },
+        { directory, backup }
+      )
+      try {
+        expect(await invoke({ operation: 'read', toolCallId: 'directoryReplaced' })).toMatchObject({
+          ok: false,
+        })
+      } finally {
+        rmSync(directory, { recursive: true, force: true })
+        rmSync(backup, { recursive: true, force: true })
+      }
+    })
     await test.step('cancelling after a file opens prevents its contents from returning', async () => {
       await app?.evaluate(
         (_electron, path) => {

apps/desktop/src/main/local-files.ts

@@ -74,7 +74,10 @@ async function readApprovedDirectory(path: string, access: LocalFileAccess) {
   const handle = await openApprovedPath(path, access, true)
   try {
     const listing = await readNativeDirectory(handle.fd, MAX_ENTRIES)
-    if ((await access.resolve(path)) !== path)
+    const canonical = await access.resolve(path)
+    const current = await lstat(canonical)
+    const opened = await handle.stat()
+    if (canonical !== path || current.dev !== opened.dev || current.ino !== opened.ino)
       throw new Error('The local directory changed while it was being read. Try again.')
     listing.entries.sort((left, right) => compareStrings(left.name, right.name))
     return listing