[Broccolito]

Behavior and user impact

An agent working in Project A can ask for access to a specific folder in Project B, receive a scoped human decision, and continue the original read or edit in place. The working directory stays Project A. Users can choose Allow once or Allow for this session, inspect and revoke grants, and receive actionable recovery guidance. A pathname, connector result or model-supplied identifier supplies no authority by itself.

Supported file operations retain directory authority through validation and I/O. Session history and undo snapshots receive ownership and permission checks; Smart Approve decisions apply only to the invocation reviewed. Most enforcement is in the backend. Visible changes are folder prompts, grant management, accurate lifetime wording and recovery messages. Existing tool names and file arguments remain available.

Published head 14b68c9b519255730923c7545c689b97187892c4: full local just check-everything, including mandatory Clippy, passed; exact-head CI finished 18 SUCCESS / 1 SKIPPED. Actual macOS runtime evidence remains attributed to frozen f227d13d26f2bbbab8f70637173943617976eced. The sole f227→14b change is a reviewed test assertion waiting for asynchronous state publication; the remaining tracked tree and six protected runtime binaries are unchanged. Runtime artifacts have not been relabelled as 14b builds.

Implementation

• Share bounded read/list/create/editor/patch/undo access across workspace and approved roots. Capture directory identities, preflight every patch child before effects, and request permission before recursive analysis enumerates external linked code. Apply restrictive policy to requested and resolved targets; approval cannot override explicit denials.
• Bind managed Unix shared-desktop grants to an authenticated native-client lifetime held by Electron's main process over the verified Unix socket. Disconnect revokes that client's session and pending once authority and releases pending requests. Other clients and the shared daemon continue. Reconnection needs fresh approval; renderer identifiers or API credentials cannot claim another client's grants. Ownership belongs to the Electron process, rather than one chat window.
• Preserve client ownership and unattended-caller restrictions through spawned work, admission and actual awaited execution. An incompatible shared daemon requires explicit update/restart instead of silently creating unowned grants. Nonshared Windows desktop retains its owned-daemon lifecycle.
• State deployment lifetimes accurately. Browser/external-backend grants belong to the backend: closing their interface does not revoke access. Users can revoke, delete the chat, or restart the owning backend. The primary workspace needs no routine new prompt.
• Protect SQLite directories, DB/WAL/SHM and persisted undo snapshots before use/publication. Refuse unsafe ownership, aliases or ACLs with recovery guidance; preserve failed restores and recoverable legacy enrollment. Give Smart Approve the complete invocation, reject malformed/unsolicited decisions, and prevent automatic review from persisting tool-wide grants.
• Protect desktop/interactive CLI decisions. Browser approval requires a separate terminal-configured key; API credentials/browser login tokens cannot approve folders. Keep JSON/stream-JSON stdout parseable by moving runtime workflow summaries to stderr while retaining --explain stdout. Unattended refusals carry permission_denied, retryable=false and neutral “Access was not approved” wording.

Shared file access, dispatch, storage startup, history and approval plumbing change substantially; the agent loop and public tool interfaces remain intact.

Windows compatibility

Typed NtCreateFile captures and leases the retained directory object without unchecked pathname reopening. An idle exact captured folder can move without authorizing its replacement. Windows can refuse moving an ancestor while a captured descendant is open; active operations also hold short move-preventing leases. Finish/stop work and await completion, revoke affected external grants, then retry after holders release handles. Workspace/skill roots or other clients may require changing workspace or stopping their owning backend. Closing a browser/external-backend interface is not a handle-release guarantee.

Validation

Evidence and source	Result and denominator
Published 14b local/hosted checks	Complete just check-everything passed. Exact-head CI and associated frontend/storage/apps checks: 18 SUCCESS, 1 SKIPPED. PR-job checkout is merge 49fb26d06a686a742fddd8f54defd18928aaf238, parents main 48c154d4 + 14b
Full hosted Vitest on 14b	1,097 files passed; 15,256 tests passed, 14 skipped
Rebuilt Linux storage on the 14b merge	39/39 case records: 13 controls × 3 repetitions, 234 true Boolean assertions; two ordinary UIDs, zero unexercised, three verified cleanup receipts. Archive digest and actual checkout independently verified
Windows CI on 14b	Workspace lib/bin batches passed; bounded_fs 18 passed; sandbox 17 passed/1 ignored. Separate core integration-binaries step skipped. Primitive probes verified 8 native same-object rows and 21 nested-handle controls, with zero app/tool calls or ACL changes
Actual native macOS on f227	20 case receipts/22 sessions, 81 unique matched tool pairs: Core 39, OMOP 21, CDW 21. Two additional Stop workflows have zero durable pairs and remain separate
Actual CLI on f227	11 matched calls: 6 unattended structured refusals, plus 5 interactive calls comprising 3 approved reads/2 human denials. No unanswered/orphan responses; sampled canaries unchanged. Original selected selftest had zero calls and remains INCONCLUSIVE
Actual browser on f227, separate cohorts	Unconfigured: 2 submissions, 1 denial pair and separate Stop. Configured: 6 submissions, 5 pairs (4 reads/1 denial) and separate Stop. Wrong-key attempts add no tool operation; reload retained the same backend's grant; Revoke re-prompted

The f227 14-command focused checkpoint also passed. Its WebSocket selection of 5 includes 4 shared guards; unattended-caller selection of 7 includes 4 shared guards; the one real-binary output regression contains 6 input/format subcases. Regression totals, repeated storage controls, case receipts, sessions and matched pairs are distinct denominators, not attack-success rates. Codex operated normal UI controls; the app used a deterministic synthetic provider for the tool sequence. Connector controls exercised real registrars, stores, waits, pagination, expected failures/cancellation and original-path consent without production databases or real PHI. Both connector PRs are merged; their mains retain 3/3 green checks.

Historical failures remain preserved through the audit evidence, integration notes and separate raw receipts: 971 CI ended 16/2/1; f227 CI ended 17/1/1 with the Crew assertion subsequently corrected in 14b. Earlier restart #455, CLI #456, incomplete trials, f9/448 full-check failures and UI pretriage failures are retained. Frozen ACA 19 scenarios/162 pairs and prior storage cohorts are not pooled with these final cohorts.

Limits and remaining completion steps

The assessment uses synthetic data and ordinary outside/separate non-root actors. It does not establish comprehensive security, HIPAA compliance, unrestricted shell/computer isolation or live-model adversarial robustness. Same-account hostile code, root/admin/SYSTEM and historical handles are outside the demonstrated boundary; network filesystems are unverified. SQLite is not a custom race-proof VFS; patch preflight is not transactional rollback. Cancellation/revocation does not undo completed effects: both cancelled connector jobs retained private 69-byte partial CSV files.

Actual headed acceptance is macOS. All-windows/tray behavior, seamless backend retarget within the same Electron process, a separate two-native-app workflow and optional browser-backend restart were not exercised. Software tests cover additional ownership/isolation paths; browser reload is not native-client expiry. Final runtime cleanup is recorded separately. Root review, deliberate issue acceptance/closure, merge, post-merge main CI and manuscript/supplement publication remain distinct completion steps.

Genuine Opus 5.5/Sonnet 5.5 requests failed gateway signature validation before generation. A catalog-listed 4.6 matching-factory control had the same failure, consistent with shared authentication/signing failure; root cause remains unknown. No successful live 5.5 response, tool round trip or availability conclusion is claimed.

Refs #424, #436, #437, #445, #446, #447, #452, #453, #455, #456; no automatic closing references.

AI assistance

• This PR was created or reviewed with AI assistance.