fix(files): refresh expired outside-workspace grants (#3078)

* fix(files): refresh expired outside file grants

* fix(files): scope outside grants to local runtime

packages/ui/src/lib/desktop.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 import type { ProjectEntry, RuntimeAPIs, TerminalShell } from '@/lib/api/types';
 import { getInjectedBootOutcome } from '@/lib/desktopBoot';
 import type { DraftStarterRef } from '@/lib/draftStarters';
@@ -640,6 +641,12 @@ const isDesktopFileGrantResult = (
   value !== null && typeof value === 'object' && !Array.isArray(value)
 );
 
+const desktopExistingFileGrantSchema = z.object({
+  path: z.string().min(1),
+  outsideFileGrant: z.string().min(1),
+  expiresAt: z.number().finite(),
+});
+
 export const requestFileAccess = async (
   options?: { filters?: Array<{ name: string; extensions: string[] }>; defaultPath?: string }
 ): Promise<{ success: boolean; path?: string; outsideFileGrant?: string; error?: string }> => {
@@ -682,7 +689,10 @@ export const requestFileAccess = async (
 
 export const requestExistingFileAccess = async (
   path: string
-): Promise<{ success: boolean; path?: string; outsideFileGrant?: string; error?: string }> => {
+): Promise<
+  | { success: true; path: string; outsideFileGrant: string; expiresAt: number }
+  | { success: false; error: string }
+> => {
   const targetPath = typeof path === 'string' ? path.trim() : '';
   if (!targetPath) {
     return { success: false, error: 'Path is required' };
@@ -693,15 +703,14 @@ export const requestExistingFileAccess = async (
 
   try {
     const selected = await getDesktopBridge()?.grantFileAccess?.(targetPath);
-    if (!isDesktopFileGrantResult(selected)) {
+    const parsed = desktopExistingFileGrantSchema.safeParse(selected);
+    if (!parsed.success) {
       return { success: false, error: 'File access was not granted' };
     }
-    const grantedPath = typeof selected.path === 'string' ? selected.path : '';
-    const outsideFileGrant = typeof selected.outsideFileGrant === 'string' ? selected.outsideFileGrant : '';
-    if (!grantedPath || !outsideFileGrant) {
-      return { success: false, error: 'File access was not granted' };
-    }
-    return { success: true, path: grantedPath, outsideFileGrant };
+    return {
+      success: true,
+      ...parsed.data,
+    };
   } catch (error) {
     console.warn('Failed to request existing file access', error);
     return { success: false, error: error instanceof Error ? error.message : String(error) };

packages/ui/src/lib/outsideFileGrants.test.ts

@@ -0,0 +1,76 @@
+import { expect, test } from 'bun:test';
+
+import { initializeRuntimeEndpoint, switchRuntimeEndpoint } from './runtime-switch';
+import { getOutsideFileGrant, resolveOutsideFileReadOptions } from './outsideFileGrants';
+
+test('renews an expired outside-file grant before returning read options', async () => {
+  let now = 1_000;
+  let grantRequests = 0;
+  let grantFileAccess = async (path: string) => {
+    grantRequests += 1;
+    return { path, outsideFileGrant: `grant-${grantRequests}`, expiresAt: now + 60_000 };
+  };
+  const originalNow = Date.now;
+  const originalWindow = globalThis.window;
+  Date.now = () => now;
+  Object.defineProperty(globalThis, 'window', {
+    configurable: true,
+    value: {
+      __OPENCHAMBER_ELECTRON__: { runtime: 'electron' },
+      __OPENCHAMBER_DESKTOP__: {
+        invoke: async () => null,
+        grantFileAccess: (path: string) => grantFileAccess(path),
+      },
+      dispatchEvent: () => true,
+      location: { origin: 'http://127.0.0.1:57123' },
+    },
+  });
+  initializeRuntimeEndpoint({ apiBaseUrl: 'http://127.0.0.1:57123/api', runtimeKey: 'local' });
+
+  try {
+    expect(await resolveOutsideFileReadOptions('C:/workspace/file.txt', 'C:/workspace', true))
+      .toEqual({ allowOutsideWorkspace: false });
+    expect(await resolveOutsideFileReadOptions('C:/outside/file.txt', 'C:/workspace', false))
+      .toEqual({ allowOutsideWorkspace: false });
+    expect(grantRequests).toBe(0);
+
+    const first = await resolveOutsideFileReadOptions('C:/outside/file.txt', 'C:/workspace', true);
+    now += 55_001;
+    const [renewed, concurrent] = await Promise.all([
+      resolveOutsideFileReadOptions('C:/outside/file.txt', 'C:/workspace', true),
+      resolveOutsideFileReadOptions('C:/outside/file.txt', 'C:/workspace', true),
+    ]);
+
+    expect(first).toEqual({ allowOutsideWorkspace: true, outsideFileGrant: 'grant-1' });
+    expect(renewed).toEqual({ allowOutsideWorkspace: true, outsideFileGrant: 'grant-2' });
+    expect(concurrent).toEqual(renewed);
+    expect(grantRequests).toBe(2);
+
+    switchRuntimeEndpoint({ apiBaseUrl: 'https://remote.example/api', runtimeKey: 'remote' });
+    expect(await resolveOutsideFileReadOptions('C:/outside/file.txt', 'C:/workspace', true))
+      .toEqual({ allowOutsideWorkspace: true, outsideFileGrant: undefined });
+    expect(grantRequests).toBe(2);
+
+    switchRuntimeEndpoint({ apiBaseUrl: 'http://127.0.0.1:57123/api', runtimeKey: 'local' });
+    let finishGrantRequest: (grant: { path: string; outsideFileGrant: string; expiresAt: number }) => void = () => undefined;
+    grantFileAccess = (path) => new Promise((resolve) => {
+      finishGrantRequest = resolve;
+      grantRequests += 1;
+      void path;
+    });
+    const pending = resolveOutsideFileReadOptions('C:/outside/pending.txt', 'C:/workspace', true);
+    switchRuntimeEndpoint({ apiBaseUrl: 'https://remote.example/api', runtimeKey: 'remote' });
+    finishGrantRequest({
+      path: 'C:/outside/pending.txt',
+      outsideFileGrant: 'stale-grant',
+      expiresAt: now + 10 * 60 * 1000,
+    });
+    expect(await pending).toEqual({ allowOutsideWorkspace: true, outsideFileGrant: undefined });
+    switchRuntimeEndpoint({ apiBaseUrl: 'http://127.0.0.1:57123/api', runtimeKey: 'local' });
+    expect(getOutsideFileGrant('C:/outside/pending.txt')).toBe(undefined);
+  } finally {
+    switchRuntimeEndpoint({ apiBaseUrl: 'http://127.0.0.1:57123/api', runtimeKey: 'local' });
+    Date.now = originalNow;
+    Object.defineProperty(globalThis, 'window', { configurable: true, value: originalWindow });
+  }
+});

packages/ui/src/lib/outsideFileGrants.ts

@@ -1,13 +1,17 @@
 import { requestExistingFileAccess } from '@/lib/desktop';
 import { isFilePathWithinDirectory, normalizeFilePath } from '@/lib/path-utils';
+import { getRuntimeKey } from '@/lib/runtime-switch';
 
 type OutsideFileGrantEntry = {
   outsideFileGrant: string;
   expiresAt: number;
 };
 
-const DEFAULT_GRANT_TTL_MS = 10 * 60 * 1000;
-const grantsByPath = new Map<string, OutsideFileGrantEntry>();
+const GRANT_RENEWAL_BUFFER_MS = 5_000;
+const grantsByCacheKey = new Map<string, OutsideFileGrantEntry>();
+const pendingGrantsByCacheKey = new Map<string, Promise<string | undefined>>();
+
+const grantCacheKey = (path: string, runtimeKey = getRuntimeKey()): string => `${runtimeKey}\0${path}`;
 
 export const getOutsideFileGrant = (path: string): string | undefined => {
   const normalizedPath = normalizeFilePath(path);
@@ -15,13 +19,14 @@ export const getOutsideFileGrant = (path: string): string | undefined => {
     return undefined;
   }
 
-  const entry = grantsByPath.get(normalizedPath);
+  const cacheKey = grantCacheKey(normalizedPath);
+  const entry = grantsByCacheKey.get(cacheKey);
   if (!entry) {
     return undefined;
   }
 
   if (entry.expiresAt <= Date.now()) {
-    grantsByPath.delete(normalizedPath);
+    grantsByCacheKey.delete(cacheKey);
     return undefined;
   }
 
@@ -31,18 +36,17 @@ export const getOutsideFileGrant = (path: string): string | undefined => {
 const rememberOutsideFileGrant = (
   path: string,
   outsideFileGrant: string,
-  expiresAt?: number,
+  expiresAt: number,
+  runtimeKey: string,
 ): void => {
   const normalizedPath = normalizeFilePath(path);
   if (!normalizedPath || !outsideFileGrant) {
     return;
   }
 
-  grantsByPath.set(normalizedPath, {
+  grantsByCacheKey.set(grantCacheKey(normalizedPath, runtimeKey), {
     outsideFileGrant,
-    expiresAt: typeof expiresAt === 'number' && Number.isFinite(expiresAt)
-      ? expiresAt
-      : Date.now() + DEFAULT_GRANT_TTL_MS,
+    expiresAt: expiresAt - GRANT_RENEWAL_BUFFER_MS,
   });
 };
 
@@ -55,19 +59,58 @@ export const ensureOutsideFileGrantForDesktop = async (
     return undefined;
   }
 
+  const runtimeKey = getRuntimeKey();
+  if (runtimeKey !== 'local') {
+    return undefined;
+  }
+  const cacheKey = grantCacheKey(normalizedPath, runtimeKey);
   const existing = getOutsideFileGrant(normalizedPath);
   if (existing) {
     return existing;
   }
 
-  const result = await requestExistingFileAccess(normalizedPath);
-  if (!result.success || !result.path || !result.outsideFileGrant) {
-    return undefined;
+  const pending = pendingGrantsByCacheKey.get(cacheKey);
+  if (pending) {
+    return pending;
   }
 
-  rememberOutsideFileGrant(result.path, result.outsideFileGrant);
-  if (normalizeFilePath(result.path) !== normalizedPath) {
-    rememberOutsideFileGrant(normalizedPath, result.outsideFileGrant);
+  const request = requestExistingFileAccess(normalizedPath).then((result) => {
+    if (!result.success || getRuntimeKey() !== runtimeKey) {
+      return undefined;
+    }
+
+    const { path: grantedPath, outsideFileGrant, expiresAt } = result;
+    if (expiresAt <= Date.now() + GRANT_RENEWAL_BUFFER_MS) {
+      return undefined;
+    }
+    rememberOutsideFileGrant(grantedPath, outsideFileGrant, expiresAt, runtimeKey);
+    if (normalizeFilePath(grantedPath) !== normalizedPath) {
+      rememberOutsideFileGrant(normalizedPath, outsideFileGrant, expiresAt, runtimeKey);
+    }
+    return outsideFileGrant;
+  });
+  pendingGrantsByCacheKey.set(cacheKey, request);
+  try {
+    return await request;
+  } finally {
+    pendingGrantsByCacheKey.delete(cacheKey);
   }
-  return result.outsideFileGrant;
+};
+
+export const resolveOutsideFileReadOptions = async (
+  path: string,
+  workspaceRoot: string,
+  enabled: boolean,
+): Promise<{ allowOutsideWorkspace: boolean; outsideFileGrant?: string }> => {
+  const allowOutsideWorkspace = enabled
+    && Boolean(workspaceRoot)
+    && !isFilePathWithinDirectory(path, workspaceRoot);
+  if (!allowOutsideWorkspace) {
+    return { allowOutsideWorkspace: false };
+  }
+
+  return {
+    allowOutsideWorkspace: true,
+    outsideFileGrant: await ensureOutsideFileGrantForDesktop(path, workspaceRoot),
+  };
 };