security: protect persisted history and scope approved file access

.github/workflows/rust.yml

@@ -187,6 +187,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+      - name: Probe Windows directory reopen and nested-handle move semantics
+        if: runner.os == 'Windows'
+        timeout-minutes: 1
+        shell: pwsh
+        run: |
+          python scripts/security/windows-directory-lease-probe.py
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          python scripts/security/windows-nested-handle-probe.py
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: "1.92"
@@ -410,11 +418,11 @@ jobs:
       # The cross-platform-sensitive suites BR-70 exists to prove, run on every
       # OS they apply to. The workspace step above already runs the sandbox,
       # developer shell/background and security unit tests through their library
-      # targets. The sandbox's integration target is the one `tests/` binary
-      # that runs on every OS (the rest follow in the next step, ubuntu only);
-      # name it directly rather than executing those unit tests a second time.
+      # targets. The sandbox integration runs on every OS; Windows also runs
+      # bounded_fs to exercise its retained-handle and ACL fixtures natively.
+      # Ubuntu runs bounded_fs in the offline integration step below.
       - name: cargo test (sandbox integration)
-        run: cargo test -p biorouter-sandbox --test sandbox --locked --no-fail-fast
+        run: cargo test -p biorouter-sandbox --test sandbox ${{ matrix.os == 'windows-latest' && '--test bounded_fs' || '' }} --locked --no-fail-fast
 
       # ── Every other `tests/*.rs` binary, bar a table of exceptions ─────────
       #

.github/workflows/security-storage.yml

@@ -0,0 +1,134 @@
+name: Rebuilt session storage acceptance
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '.github/workflows/security-storage.yml'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - 'crates/biorouter/src/session/**'
+      - 'crates/biorouter/src/config/paths.rs'
+      - 'crates/biorouter-sandbox/**'
+      - 'crates/biorouter-mcp/src/developer/**'
+      - 'crates/biorouter-mcp/src/lib.rs'
+      - 'crates/biorouter-server/**'
+      - 'scripts/security-assessment/session_storage_rebuilt.py'
+      - 'scripts/security-assessment/test_session_storage_rebuilt.py'
+      - 'scripts/security-assessment/session-storage-runtime.Dockerfile'
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/security-storage.yml'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - 'crates/biorouter/src/session/**'
+      - 'crates/biorouter/src/config/paths.rs'
+      - 'crates/biorouter-sandbox/**'
+      - 'crates/biorouter-mcp/src/developer/**'
+      - 'crates/biorouter-mcp/src/lib.rs'
+      - 'crates/biorouter-server/**'
+      - 'scripts/security-assessment/session_storage_rebuilt.py'
+      - 'scripts/security-assessment/test_session_storage_rebuilt.py'
+      - 'scripts/security-assessment/session-storage-runtime.Dockerfile'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-storage-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  rebuilt-linux-sqlite:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    env:
+      CARGO_BUILD_JOBS: 2
+      CARGO_PROFILE_DEV_DEBUG: 0
+      CARGO_TERM_COLOR: always
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Record exact source before building
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          export SECURITY_STORAGE_EVIDENCE="$RUNNER_TEMP/security-storage-evidence"
+          echo "SECURITY_STORAGE_EVIDENCE=$SECURITY_STORAGE_EVIDENCE" >> "$GITHUB_ENV"
+          mkdir -p "$SECURITY_STORAGE_EVIDENCE"
+          python3 - <<'PY'
+          import json, os, subprocess
+          from pathlib import Path
+          actual = subprocess.check_output(['git', 'rev-parse', 'HEAD'], text=True).strip()
+          assert actual == os.environ['SOURCE_SHA']
+          proof = {'source_sha': actual, 'pull_request_head_sha': os.environ['PR_HEAD_SHA'] or None,
+                   'runner_os': 'ubuntu-24.04', 'build_profile': 'dev', 'status': 'source_recorded'}
+          (Path(os.environ['SECURITY_STORAGE_EVIDENCE']) / 'source.json').write_text(json.dumps(proof, indent=2) + '\n')
+          PY
+      - name: Check fixture protocol helpers without Docker or a database
+        run: python3 -m unittest discover -s scripts/security-assessment -p test_session_storage_rebuilt.py -v
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: '1.92'
+      - name: Keep the cache keyed to the pinned toolchain
+        run: |
+          set -euo pipefail
+          pinned=$(rustup show active-toolchain | cut -d' ' -f1)
+          test -n "$pinned"
+          for toolchain in $(rustup toolchain list | cut -d' ' -f1); do
+            if [ "$toolchain" != "$pinned" ]; then rustup toolchain uninstall "$toolchain"; fi
+          done
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: serve
+          save-if: false
+      - uses: arduino/setup-protoc@v3
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Install normal Linux build dependencies
+        run: |
+          set -euo pipefail
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list \
+            /etc/apt/sources.list.d/azure-cli.list /etc/apt/sources.list.d/microsoft-prod.sources \
+            /etc/apt/sources.list.d/azure-cli.sources
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends libdbus-1-dev libxcb1-dev libxdo-dev pkg-config
+      - name: Rebuild the actual daemon from the checked-out source
+        run: |
+          set -euo pipefail
+          cargo build --locked -p biorouter-server --bin biorouterd 2>&1 | tee "$SECURITY_STORAGE_EVIDENCE/build.log"
+          git diff --exit-code HEAD
+          rustc -vV > "$SECURITY_STORAGE_EVIDENCE/rustc.txt"
+          sha256sum target/debug/biorouterd > "$SECURITY_STORAGE_EVIDENCE/daemon.sha256"
+      - name: Build a matching Ubuntu runtime
+        run: |
+          set -euo pipefail
+          docker build --pull --tag biorouter-security-storage-runtime:ci \
+            --file scripts/security-assessment/session-storage-runtime.Dockerfile \
+            scripts/security-assessment 2>&1 | tee "$SECURITY_STORAGE_EVIDENCE/runtime-build.log"
+          docker image inspect biorouter-security-storage-runtime:ci > "$SECURITY_STORAGE_EVIDENCE/runtime-image.json"
+      - name: Exercise real SQLite and Developer undo with two separate non-root accounts
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          python3 scripts/security-assessment/session_storage_rebuilt.py \
+            --daemon target/debug/biorouterd \
+            --image biorouter-security-storage-runtime:ci \
+            --source-commit "$SOURCE_SHA" \
+            --repetitions 3 \
+            --output "$SECURITY_STORAGE_EVIDENCE/rebuilt-runtime" \
+            2>&1 | tee "$SECURITY_STORAGE_EVIDENCE/acceptance.log"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: rebuilt-session-storage-${{ github.sha }}
+          path: ${{ runner.temp }}/security-storage-evidence/
+          if-no-files-found: error
+          retention-days: 30

biorouter-self-test.yaml

@@ -22,6 +22,7 @@ activities:
   - Exercise isolated OKF, BioOKF, and built-in Soul migration round trips
   - Generate and execute test workflows
   - Test error boundaries and security controls
+  - Verify protected external-folder approval, in-place result reads, cancellation, and revocation using synthetic files
   - Verify asynchronous operation failures remain visible without turning successful status lookups into tool errors
   - Validate the Settings reset contract and its active-work safety gate
   - Verify provider error handling, conversation-scoped reasoning, and saved-credential deletion safeguards
@@ -39,7 +40,7 @@ parameters:
     input_type: string
     requirement: optional
     default: "all"
-    description: "Which test phases to run: all, basic, extensions, computer_use, crew, apps, previews, subagents, knowledge, workflows, reset, providers, local_inference, agent_loop, operation_outcome, office, advanced"
+    description: "Which test phases to run: all, basic, extensions, computer_use, crew, apps, previews, subagents, knowledge, workflows, reset, providers, local_inference, agent_loop, operation_outcome, office, advanced, folder_access"
 
   - key: test_depth
     input_type: string
@@ -251,6 +252,50 @@ instructions: |
 
   {% endif %}
 
+  {% if test_depth != "fixture_only" and (test_phases == "all" or "folder_access" in test_phases) %}
+  ## PHASE 4A-F: External-folder authorization
+
+  Use only disposable synthetic files and a fresh isolated profile; never authorize a real home,
+  credential, or patient-data directory. Do not use shell or computer tools to bypass a denial.
+  1. Run `cargo test -p biorouter --test folder_access_authorization` for exact-file once scope,
+     session grants, read-to-write escalation, denial, cancellation, wrong-session decisions,
+     unproven decisions, connector-result reads in place, revocation, and unattended recovery.
+  2. In an interactive desktop chat, request Developer view on a synthetic completed connector
+     result outside its workspace. Confirm the displayed folder, read-only access, file list,
+     and session lifetime. Choose Allow once and verify the original result is read in place.
+  3. Request an external synthetic write; choose Deny and verify no file changed and no repeated
+     request is shown during the same turn. Retry on a fresh user turn and cancel the request.
+  4. Grant a specific synthetic folder for this session, create and undo a file there, then open
+     Folder access beneath the composer and revoke it. The next external write must ask again.
+     Repeat grant inspection and revocation in the local CLI using `/folder-access` and
+     `/folder-access revoke <id>`. For directory analysis, verify the once-only read of descendants
+     is disclosed and grants no writes or remembered session access.
+  5. Record browser proof limitations explicitly if the tested browser surface cannot approve.
+     A disabled control, screenshot, or synthetic provider fixture is not a live model-driven pass.
+  6. With closed standard input and no `--quiet` workaround, request an unapproved external read
+     using `--output-format json`. Parse the entire stdout as one JSON object; verify the actual
+     tool result contains `authorization_required`, the requested scope, and interactive recovery
+     guidance without file content. Repeat with `stream-json` and parse every output line as JSON.
+     Repeat with a parameterized workflow; its human parameter summary must remain on stderr.
+     Run `cargo test -p biorouter-cli --test non_interactive run_output_formats_keep_machine_stdout_parseable`
+     for the real-binary format controls; ordinary text output must retain the session banner.
+
+  7. Manual headed-desktop lifecycle gate (#455): in an isolated managed profile, approve a
+     synthetic external folder for this chat, quit the actual app normally, reopen the same chat,
+     and request that file again. Require a new folder card before any read. Also exercise abrupt
+     native disconnection, reconnect, and two active clients using the same chat: ending one client
+     must revoke its retained once/session access and pending request without stopping the shared
+     daemon or revoking the other client's grants. Do not treat this CLI workflow, a unit test,
+     or a screenshot as proof that OS app quit/restart passed; record unrun actions as NOT EXERCISED.
+  8. Confirm lifetime notices match deployment: managed desktop says app quit/restart; browser
+     and manual external backends say backend restart and explicitly retain grants across interface
+     restart. Include the environment-selected external backend. Nonshared/native Windows retains
+     its owned-daemon normal-quit cleanup; do not claim it uses the Unix shared-client protocol.
+
+  Log exact commands, model/provider, human decisions, and observed results to:
+  {{ workspace_dir }}/phase4_folder_access.md
+  {% endif %}
+
   {% if test_depth != "fixture_only" and (test_phases == "all" or "advanced" in test_phases) %}
   ### Phase 4: Advanced Self-Testing
   Push boundaries and test limits:

crates/biorouter-cli/src/cli.rs

@@ -1493,6 +1493,13 @@ struct ServeOptions {
     )]
     computer_use_approval: bool,
 
+    /// Configure a separate key for external-folder decisions in the browser
+    #[arg(
+        long,
+        help = "Interactively set a folder-access approval key; requires a terminal"
+    )]
+    folder_access_approval: bool,
+
     /// Open a browser once it is ready
     #[arg(long, help = "Open a browser once the server is ready")]
     open: bool,
@@ -1509,6 +1516,7 @@ impl ServeOptions {
             self.public_url,
             self.open,
             self.computer_use_approval,
+            self.folder_access_approval,
         )
         .await
     }
@@ -3742,8 +3750,21 @@ mod cli_tests {
         assert!(options.web_dir.is_none());
         assert!(!options.no_token);
         assert!(!options.computer_use_approval);
+        assert!(!options.folder_access_approval);
         assert!(!options.open);
 
+        let parsed = Cli::try_parse_from([
+            "biorouter",
+            "serve",
+            "--folder-access-approval",
+            "--computer-use-approval",
+        ])
+        .unwrap();
+        let Some(Command::Serve(options)) = parsed.command else {
+            panic!("serve command expected")
+        };
+        assert!(options.folder_access_approval && options.computer_use_approval);
+
         let parsed = Cli::try_parse_from([
             "biorouter",
             "headless",