fix: confine MCP agents' files to allowed folders; recovery discard deletes only recovery entries (#205) (#578)

Agent tool calls (MCP, and bridged control requests carrying allow_paths) reach files only in the open design's folder (strictly inside home or the temporary folder, not in a hidden folder, and never its hidden files), the app's recovery folder, the server's private scratch folder and each --allow-path; --allow-any-path lifts the limit. Paths are resolved first, so .. and symlinks that lead out (including a save through a link, #845) are refused. On Windows, UNC, device, NT, verbatim non-drive, drive-relative, alternate-stream, reserved-device and 8.3 short-name paths are refused before any file system call, and the resolved path must be on a local drive. doc.recovery_discard and doc.recover {discard} delete only real recovery entries. Docs: mcp.md, control-protocol.md, README.

crates/io/src/design.rs

@@ -509,6 +509,7 @@ pub(super) fn read(bytes: &[u8]) -> Result<Document> {
 pub fn read_design_file(path: &str, notify: Option<impl FnOnce(DesignPreview)>) -> Result<Document> {
     #[cfg(not(target_arch = "wasm32"))]
     let mut source = {
+        crate::vfs::check(path).map_err(invalid)?;
         let metadata = std::fs::metadata(path).map_err(invalid)?;
         if !metadata.is_file() {
             return Err(invalid("not a regular file"));

crates/io/src/design/thumbnail.rs

@@ -60,6 +60,7 @@ pub fn read_design_thumbnail(bytes: &[u8]) -> Option<Vec<u8>> {
 pub fn read_design_thumbnail_file(path: &str) -> Option<Vec<u8>> {
     #[cfg(not(target_arch = "wasm32"))]
     let source = {
+        crate::vfs::check(path).ok()?;
         let metadata = std::fs::metadata(path).ok()?;
         if !metadata.is_file() || metadata.len() > MAX_DESIGN_BYTES as u64 {
             return None;

crates/io/src/safe_write.rs

@@ -117,7 +117,9 @@ fn write_steps(path: &Path, bytes: &[u8], backup: bool, stop: Option<Step>) -> s
 
 /// Write `bytes` to `path` atomically; with `backup`, the file being replaced is kept as
 /// `<path>.bak` first. A symbolic link at `path` is followed (the file it points to is replaced,
-/// the link stays), and the file keeps the permissions it had.
+/// the link stays), and the file keeps the permissions it had. The app's own folders (autosave,
+/// crash reports) write through this without a [`crate::vfs::PathScope`]; a command writing a
+/// path it was given calls [`crate::vfs::check`] first, which judges where the link leads.
 pub fn write_atomic(path: &Path, bytes: &[u8], backup: bool) -> std::io::Result<()> {
     // In the browser the host stores files (one write is already atomic there).
     if cfg!(target_arch = "wasm32") {

crates/io/src/vfs.rs

@@ -14,6 +14,7 @@ mod imp {
     /// blocks the caller instead. Refuse anything that is not a regular file, and never read
     /// more than the caller's cap plus the byte that proves it was exceeded.
     pub fn read(path: &str, max: usize) -> Result<Vec<u8>> {
+        check(path)?;
         // Cheap and non-blocking: refuse before opening, in case the open itself would block.
         let meta = std::fs::metadata(path)?;
         if !meta.is_file() {
@@ -35,15 +36,18 @@ mod imp {
         Ok(out)
     }
     pub fn write(path: &str, bytes: &[u8]) -> Result<()> {
+        check(path)?;
         std::fs::write(path, bytes)
     }
     pub fn len(path: &str) -> Result<u64> {
+        check(path)?;
         std::fs::metadata(path).map(|m| m.len())
     }
     pub fn exists(path: &str) -> bool {
-        std::path::Path::new(path).exists()
+        check(path).is_ok() && std::path::Path::new(path).exists()
     }
     pub fn remove(path: &str) -> Result<()> {
+        check(path)?;
         std::fs::remove_file(path)
     }
 }
@@ -104,6 +108,249 @@ mod imp {
 
 pub use imp::*;
 
+/// The folders an agent's commands may read, write and delete in (an MCP server's, see
+/// docs/mcp.md). While a scope is active on this thread ([`scoped`]), every file call here
+/// refuses paths outside it; without one (the user's own file dialogs, the CLI) nothing changes.
+///
+/// Two kinds of folder: those named on purpose (`--allow-path`, the app's own recovery folder),
+/// where everything is reachable, and the open design's folder, which counts only when
+/// [`design_folder_refusal`] has nothing against it and never reaches hidden files or folders
+/// (`.env`, `.git`) inside it.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct PathScope {
+    roots: Vec<std::path::PathBuf>,
+    design_roots: Vec<std::path::PathBuf>,
+}
+
+thread_local! {
+    static SCOPE: std::cell::RefCell<Option<PathScope>> = const { std::cell::RefCell::new(None) };
+}
+
+/// `dir` resolved, if it exists.
+fn canonical(dir: &std::path::Path) -> Option<std::path::PathBuf> {
+    std::fs::canonicalize(dir).ok()
+}
+
+/// The user's home folder, resolved.
+fn home_dir() -> Option<std::path::PathBuf> {
+    let var = if cfg!(windows) { "USERPROFILE" } else { "HOME" };
+    std::env::var_os(var).filter(|h| !h.is_empty()).and_then(|h| canonical(std::path::Path::new(&h)))
+}
+
+/// A folder or file name an agent never reaches by default: hidden on Unix (`.ssh`, `.env`),
+/// and on Windows also the per-user `AppData` folder.
+fn hidden(name: &std::ffi::OsStr) -> bool {
+    let n = name.to_string_lossy();
+    n.starts_with('.') || (cfg!(windows) && n.eq_ignore_ascii_case("AppData"))
+}
+
+/// Why `dir` (an open design's folder) can't be one of an agent's folders by default, or `None`
+/// when it can: it must lie strictly inside the home folder (or the temporary folder) and not
+/// in a hidden folder. So a design saved in home itself, in `/`, on a drive root or in a system
+/// folder never puts `~/.ssh`, `~/.bashrc` or anything else of the user's in reach.
+pub fn design_folder_refusal(dir: &std::path::Path) -> Option<String> {
+    design_folder_refusal_in(dir, home_dir().as_deref(), Some(&std::env::temp_dir()))
+}
+
+/// [`design_folder_refusal`] with the home and temporary folders given (tests).
+pub fn design_folder_refusal_in(dir: &std::path::Path, home: Option<&std::path::Path>, temp: Option<&std::path::Path>) -> Option<String> {
+    let Some(d) = canonical(dir) else { return Some("it doesn't exist".into()) };
+    if d.parent().is_none() {
+        return Some("it is a drive or file-system root".into());
+    }
+    let home = home.and_then(canonical);
+    if home.as_ref().is_some_and(|h| h.starts_with(&d)) {
+        return Some("it is your home folder or a folder above it".into());
+    }
+    let temp = temp.and_then(canonical).filter(|t| t.parent().is_some());
+    // The closer of the two (a temporary folder may lie inside home, in a hidden folder).
+    let Some(base) = [home, temp].into_iter().flatten().filter(|b| d.starts_with(b) && d != *b).max_by_key(|b| b.components().count()) else {
+        return Some("it is not inside your home folder".into());
+    };
+    let rel = d.strip_prefix(&base).ok()?;
+    if rel.components().any(|c| hidden(c.as_os_str())) {
+        return Some("it is inside a hidden folder".into());
+    }
+    None
+}
+
+impl PathScope {
+    /// Confine file access to `roots` (resolved now; folders that don't exist are left out, so an
+    /// empty scope refuses every path).
+    pub fn new(roots: impl IntoIterator<Item = std::path::PathBuf>) -> PathScope {
+        let mut out = PathScope::default();
+        for r in roots.into_iter().filter_map(|r| canonical(&r)) {
+            if !out.roots.contains(&r) {
+                out.roots.push(r);
+            }
+        }
+        out
+    }
+
+    /// Also the folder of the design at `path` (the open design), when
+    /// [`design_folder_refusal`] allows it; hidden entries inside it stay out of reach.
+    pub fn with_design(mut self, path: Option<&str>) -> PathScope {
+        let dir = path
+            .map(std::path::Path::new)
+            .and_then(std::path::Path::parent)
+            .map(|d| if d.as_os_str().is_empty() { std::path::Path::new(".") } else { d });
+        if let Some(d) = dir.filter(|d| design_folder_refusal(d).is_none()).and_then(canonical)
+            && !self.design_roots.contains(&d)
+        {
+            self.design_roots.push(d);
+        }
+        self
+    }
+
+    /// The folders named on purpose.
+    pub fn roots(&self) -> &[std::path::PathBuf] {
+        &self.roots
+    }
+
+    /// The open design's folder, when it counts.
+    pub fn design_roots(&self) -> &[std::path::PathBuf] {
+        &self.design_roots
+    }
+
+    /// Whether `path` lies inside one of the folders, after following symlinks and `..`.
+    pub fn check(&self, path: &str) -> Result<()> {
+        let refused = || {
+            let roots: Vec<String> = self.roots.iter().chain(&self.design_roots).map(|r| r.display().to_string()).collect();
+            Error::new(
+                ErrorKind::PermissionDenied,
+                format!(
+                    "{path}: outside the folders this agent may use ({}); allow another folder with `--allow-path DIR`",
+                    if roots.is_empty() { "none".into() } else { roots.join(", ") }
+                ),
+            )
+        };
+        let windows = |why: &str| Error::new(ErrorKind::PermissionDenied, format!("{path}: not allowed for this agent: {why}"));
+        // Judged from the text before any filesystem call: resolving a UNC path would already
+        // make Windows connect out, and a device name opens the device.
+        if cfg!(windows)
+            && let Some(why) = windows_refusal(path)
+        {
+            return Err(windows(why));
+        }
+        let resolved = resolve(std::path::Path::new(path)).map_err(|_| refused())?;
+        // Judged again once resolved: a link or junction inside an allowed folder may lead to a
+        // network share or a device even though the path given looked local.
+        if cfg!(windows) && !local_drive_path(&resolved) {
+            return Err(windows("only paths on a local drive"));
+        }
+        let inside_design =
+            || self.design_roots.iter().any(|r| resolved.strip_prefix(r).is_ok_and(|rel| !rel.components().any(|c| hidden(c.as_os_str()))));
+        if self.roots.iter().any(|r| resolved.starts_with(r)) || inside_design() { Ok(()) } else { Err(refused()) }
+    }
+}
+
+/// Whether a resolved path is on a local drive (`C:\…` or `\\?\C:\…`) with no `:` or device
+/// name in it. Always true off Windows, where these rules don't apply.
+fn local_drive_path(p: &std::path::Path) -> bool {
+    #[cfg(windows)]
+    {
+        let drive = matches!(
+            p.components().next(),
+            Some(std::path::Component::Prefix(x)) if matches!(x.kind(), std::path::Prefix::Disk(_) | std::path::Prefix::VerbatimDisk(_))
+        );
+        drive && windows_refusal(&p.to_string_lossy()).is_none()
+    }
+    #[cfg(not(windows))]
+    {
+        let _ = p;
+        true
+    }
+}
+
+/// Why Windows would not treat `path` as a plain file on a local drive, judged by Windows rules
+/// from the text alone (so it is tested on every platform): UNC, device (`\\.\`), NT (`\??\`) and
+/// verbatim paths other than a verbatim drive (`\\?\C:\`), drive-relative paths (`C:file`), a `:`
+/// inside a name (alternate data streams), reserved device names (`NUL`, `COM1.txt`, …) and
+/// short (8.3) names.
+pub fn windows_refusal(path: &str) -> Option<&'static str> {
+    let norm = path.replace('/', "\\");
+    let drive = |s: &str| matches!(s.as_bytes(), [d, b':', ..] if d.is_ascii_alphabetic());
+    let drive_abs = |s: &str| matches!(s.as_bytes(), [d, b':', b'\\', ..] if d.is_ascii_alphabetic());
+    let body = if let Some(v) = norm.strip_prefix("\\\\?\\") {
+        if !drive_abs(v) {
+            return Some("only paths on a local drive (no UNC, device or volume paths)");
+        }
+        v.get(2..).unwrap_or("")
+    } else if norm.starts_with("\\\\") || norm.starts_with("\\??\\") {
+        return Some("network (UNC), device and NT namespace paths");
+    } else if drive(&norm) {
+        if !drive_abs(&norm) {
+            return Some("drive-relative paths (`C:file`)");
+        }
+        norm.get(2..).unwrap_or("")
+    } else {
+        &norm
+    };
+    for name in body.split('\\').filter(|n| !n.is_empty()) {
+        if name.contains(':') {
+            return Some("`:` in a file name (alternate data streams)");
+        }
+        // A short (8.3) name such as `PROGRA~1` or `SSH~1` is another spelling of a folder whose
+        // real name could be anything; canonicalising expands existing ones, and a new file's
+        // name must not be one.
+        if name.as_bytes().windows(2).any(|w| w[0] == b'~' && w[1].is_ascii_digit()) {
+            return Some("short (8.3) names such as `PROGRA~1`");
+        }
+        let stem = name.split('.').next().unwrap_or("").trim_end_matches([' ', '.']).to_uppercase();
+        let numbered =
+            |p: &str| stem.strip_prefix(p).is_some_and(|n| matches!(n, "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" | "¹" | "²" | "³"));
+        if matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL" | "CONIN$" | "CONOUT$") || numbered("COM") || numbered("LPT") {
+            return Some("reserved device names (CON, NUL, COM1, …)");
+        }
+    }
+    None
+}
+
+/// `path` with symlinks and `..` resolved. A file that doesn't exist yet resolves through its
+/// folder, which must exist; a symlink whose target is missing is refused (writing through it
+/// would land wherever it points).
+fn resolve(path: &std::path::Path) -> Result<std::path::PathBuf> {
+    match std::fs::canonicalize(path) {
+        Ok(p) => Ok(p),
+        Err(e) if e.kind() == ErrorKind::NotFound && std::fs::symlink_metadata(path).is_err() => {
+            let (Some(parent), Some(name)) = (path.parent(), path.file_name()) else { return Err(e) };
+            let parent = if parent.as_os_str().is_empty() { std::path::Path::new(".") } else { parent };
+            Ok(std::fs::canonicalize(parent)?.join(name))
+        }
+        Err(e) => Err(e),
+    }
+}
+
+/// Run `f` with file access confined to `scope` on this thread (`None`: unconfined).
+pub fn scoped<T>(scope: Option<PathScope>, f: impl FnOnce() -> T) -> T {
+    struct Restore(Option<PathScope>);
+    impl Drop for Restore {
+        fn drop(&mut self) {
+            let prev = self.0.take();
+            SCOPE.with(|s| *s.borrow_mut() = prev);
+        }
+    }
+    let _restore = Restore(SCOPE.with(|s| s.replace(scope)));
+    f()
+}
+
+/// The scope active on this thread.
+pub fn current_scope() -> Option<PathScope> {
+    SCOPE.with(|s| s.borrow().clone())
+}
+
+/// Refuse `path` if a scope is active and it lies outside. Code that reaches the disk without
+/// going through this module calls it first. In the browser files are the host's, never the
+/// disk, so there is nothing to confine.
+// ponytail: checked then opened, so a local process racing a symlink swap in an allowed folder
+// could still redirect one call; opening by handle (openat/O_NOFOLLOW) would close that.
+pub fn check(path: &str) -> Result<()> {
+    if cfg!(target_arch = "wasm32") {
+        return Ok(());
+    }
+    SCOPE.with(|s| s.borrow().as_ref().map_or(Ok(()), |scope| scope.check(path)))
+}
+
 /// A file's text, at most `max` bytes.
 pub fn read_to_string(path: &str, max: usize) -> Result<String> {
     String::from_utf8(read(path, max)?).map_err(|e| Error::new(ErrorKind::InvalidData, e))
@@ -156,6 +403,251 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// An agent's scope (#205): inside its folders files work as before; outside, through `..`
+    /// or through a symlink that leads out, every call is refused with a clear error and the
+    /// disk is left alone. Without a scope nothing is confined.
+    #[cfg(all(unix, not(target_arch = "wasm32")))]
+    #[test]
+    fn a_scope_confines_every_call_to_its_folders() {
+        use super::{PathScope, scoped};
+        let base = std::env::temp_dir().join(format!("solidcraft-vfs-scope-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        let (root, out) = (base.join("root"), base.join("out"));
+        std::fs::create_dir_all(root.join("sub")).unwrap();
+        std::fs::create_dir_all(&out).unwrap();
+        std::fs::write(out.join("secret.txt"), "secret").unwrap();
+        std::os::unix::fs::symlink(&out, root.join("link")).unwrap();
+        std::os::unix::fs::symlink(out.join("missing.txt"), root.join("dangling")).unwrap();
+        let s = |p: std::path::PathBuf| p.to_string_lossy().to_string();
+        let scope = PathScope::new([root.clone()]);
+        scoped(Some(scope.clone()), || {
+            let inside = s(root.join("sub/a.txt"));
+            super::write(&inside, b"ok").unwrap();
+            assert_eq!(super::read(&inside, 16).unwrap(), b"ok");
+            assert_eq!(super::len(&inside).unwrap(), 2);
+            assert!(super::exists(&inside));
+            super::remove(&inside).unwrap();
+            for escape in [out.join("secret.txt"), root.join("../out/secret.txt"), root.join("link/secret.txt"), root.join("dangling")] {
+                let p = s(escape);
+                let e = super::read(&p, 16).unwrap_err();
+                assert_eq!(e.kind(), std::io::ErrorKind::PermissionDenied, "{p}: {e}");
+                assert!(e.to_string().contains("outside the folders this agent may use"), "{e}");
+                assert!(super::write(&p, b"x").is_err() && super::remove(&p).is_err() && super::len(&p).is_err() && !super::exists(&p), "{p}");
+            }
+            assert!(super::write(&s(out.join("new.txt")), b"x").is_err());
+            assert!(super::check(&s(root.join("sub/../sub/b.txt"))).is_ok(), "`..` that stays inside is fine");
+        });
+        assert_eq!(std::fs::read_to_string(out.join("secret.txt")).unwrap(), "secret");
+        assert!(!out.join("new.txt").exists() && !out.join("missing.txt").exists());
+        // The scope ends with the call; an empty one refuses everything.
+        assert!(super::current_scope().is_none());
+        assert_eq!(super::read(&s(out.join("secret.txt")), 16).unwrap(), b"secret");
+        assert!(PathScope::new([base.join("nonexistent")]).check(&s(root.join("sub/a.txt"))).is_err());
+        let _ = std::fs::remove_dir_all(&base);
+    }
+
+    /// Review of #205: a root is a folder, not a string prefix (`a` doesn't admit `ab`); a new
+    /// file needs an existing folder, and one whose folder is a symlink that leads out is refused.
+    #[cfg(all(unix, not(target_arch = "wasm32")))]
+    #[test]
+    fn roots_are_folders_and_new_files_resolve_through_their_folder() {
+        use super::PathScope;
+        let base = std::env::temp_dir().join(format!("solidcraft-vfs-prefix-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        let (a, ab, out) = (base.join("a"), base.join("ab"), base.join("out"));
+        for d in [&a, &ab, &out] {
+            std::fs::create_dir_all(d).unwrap();
+        }
+        std::os::unix::fs::symlink(&out, a.join("link")).unwrap();
+        let scope = PathScope::new([a.clone()]);
+        let s = |p: std::path::PathBuf| p.to_string_lossy().to_string();
+        assert!(scope.check(&s(a.join("new.txt"))).is_ok());
+        for refused in [ab.join("x.txt"), a.join("missing/x.txt"), a.join("link/new.txt")] {
+            let e = scope.check(&s(refused.clone())).unwrap_err();
+            assert!(e.to_string().contains("outside the folders this agent may use"), "{}: {e}", refused.display());
+        }
+        super::scoped(Some(scope), || assert!(super::write(&s(a.join("link/new.txt")), b"x").is_err()));
+        assert!(!out.join("new.txt").exists() && !a.join("missing").exists());
+        let _ = std::fs::remove_dir_all(&base);
+    }
+
+    /// Windows rules, judged from the text alone, on every platform (#205 review).
+    #[test]
+    fn windows_paths_that_are_not_plain_local_files_are_refused() {
+        use super::windows_refusal as w;
+        for ok in [
+            r"C:\work\part.step",
+            "C:/work/part.step",
+            r"\\?\C:\work\part.step",
+            r"work\part.step",
+            "part.step",
+            r"\work\a.b.step",
+            r"C:\com10\x.txt",
+            r"C:\console.txt",
+            r"\\?\c:\work\part.step",
+            r"C:\work\draft~v2.step",
+        ] {
+            assert_eq!(w(ok), None, "{ok}");
+        }
+        for bad in [
+            r"\\server\share\x.step",
+            "//server/share/x.step",
+            r"\\?\UNC\server\share\x.step",
+            r"\??\UNC\server\share\x.step",
+            r"\??\C:\x.step",
+            "/??/UNC/server/share/x.step",
+            r"\\.\COM1",
+            r"\\?\Volume{0}\x",
+            r"\\?\GLOBALROOT\Device\x",
+            "C:foo.step",
+            r"C:\work\a.step:stream",
+            r"C:\work\NUL",
+            r"C:\work\nul.txt",
+            r"C:\work\COM1.step",
+            r"C:\work\lpt9",
+            r"C:\work\Con .txt",
+            r"C:\work\COM¹",
+            r"C:\work\CONOUT$",
+            r"work\AUX\x.step",
+            // Every spelling of the NT, device and UNC prefixes.
+            r"\\?\unc\server\share\x.step",
+            "//?/UNC/server/share/x.step",
+            r"/\?\UNC\server\share\x.step",
+            r"\??/UNC/server/share/x.step",
+            r"\\.\C:\x.step",
+            "//./pipe/x",
+            r"\\?\C:",
+            r"\\server",
+            // Device names with any extension, in any case.
+            r"C:\work\aux.tar.gz",
+            r"C:\work\Prn.",
+            r"C:\work\lPt1.step",
+            r"C:\work\conin$.txt",
+            // Alternate data streams, and short (8.3) names.
+            r"C:\work\a.step::$DATA",
+            r"C:\Users\me\SSH~1\id_ed25519",
+            r"C:\PROGRA~1\x.step",
+        ] {
+            assert!(w(bad).is_some(), "{bad}");
+        }
+    }
+
+    /// The same, through a scope on Windows itself: refused before any filesystem call.
+    #[cfg(windows)]
+    #[test]
+    fn windows_unc_verbatim_drive_relative_and_device_paths_are_refused() {
+        let root = std::env::temp_dir().join(format!("solidcraft-vfs-win-{}", std::process::id()));
+        std::fs::create_dir_all(&root).unwrap();
+        let scope = super::PathScope::new([root.clone()]);
+        let inside = |f: &str| root.join(f).to_string_lossy().to_string();
+        assert!(scope.check(&inside("ok.step")).is_ok());
+        for bad in [
+            r"\\server\share\x.step".to_string(),
+            r"\\?\UNC\server\share\x.step".to_string(),
+            r"\??\UNC\server\share\x.step".to_string(),
+            r"\\.\COM1".to_string(),
+            "C:foo.step".to_string(),
+            inside("NUL"),
+            inside("COM1.txt"),
+            inside("con"),
+            inside("a.step:stream"),
+        ] {
+            let e = scope.check(&bad).unwrap_err();
+            assert_eq!(e.kind(), std::io::ErrorKind::PermissionDenied, "{bad}: {e}");
+        }
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// The open design's folder counts only when it is safe (#205): strictly inside home (or the
+    /// temporary folder), not home itself, a folder above it, a root or a hidden folder; and
+    /// hidden files inside it stay out of reach. Folders named on purpose reach everything.
+    #[cfg(all(unix, not(target_arch = "wasm32")))]
+    #[test]
+    fn the_designs_folder_counts_only_when_safe_and_never_reaches_hidden_files() {
+        use super::{PathScope, design_folder_refusal_in as refusal};
+        let base = std::env::temp_dir().join(format!("solidcraft-vfs-design-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        let home = base.join("home");
+        let (proj, dotdir) = (home.join("work/proj"), home.join(".config/x"));
+        for d in [&proj.join("sub"), &dotdir, &home.join(".ssh"), &proj.join(".git")] {
+            std::fs::create_dir_all(d).unwrap();
+        }
+        let sibling = base.join("homex");
+        std::fs::create_dir_all(&sibling).unwrap();
+        std::fs::write(home.join(".ssh/id_ed25519"), "key").unwrap();
+        std::fs::write(proj.join(".env"), "x").unwrap();
+        std::os::unix::fs::symlink(home.join(".ssh"), proj.join("keys")).unwrap();
+        let h = Some(home.as_path());
+        assert_eq!(refusal(&proj, h, None), None);
+        assert_eq!(refusal(&home.join("work/../work/proj"), h, None), None);
+        for (dir, why) in [
+            (home.clone(), "home"),
+            (base.clone(), "above home"),
+            ("/".into(), "root"),
+            (sibling.clone(), "a name that only starts like home"),
+            (dotdir.clone(), "hidden"),
+            (base.join("missing"), "doesn't exist"),
+        ] {
+            assert!(refusal(&dir, h, None).is_some(), "{why}: {}", dir.display());
+        }
+        assert!(refusal(&proj, None, None).is_some(), "no home known: nothing implicit");
+        assert_eq!(refusal(&base.join("homex"), None, Some(&base)), None, "inside the temporary folder");
+        assert!(refusal(&base, None, Some(&base)).is_some(), "the temporary folder itself");
+
+        // Through a scope: the design's folder reaches its own files, never hidden ones, and
+        // never a link that leads to them.
+        let s = |p: std::path::PathBuf| p.to_string_lossy().to_string();
+        let mut scope = PathScope::new([]);
+        // `with_design` judges with the real home; build the folder list directly instead.
+        scope.design_roots.push(std::fs::canonicalize(&proj).unwrap());
+        assert!(scope.check(&s(proj.join("part.step"))).is_ok());
+        assert!(scope.check(&s(proj.join("sub/../part.step"))).is_ok());
+        for bad in
+            [proj.join(".env"), proj.join(".git/config"), proj.join("keys/id_ed25519"), proj.join("../../.ssh/id_ed25519"), home.join(".bashrc")]
+        {
+            assert!(scope.check(&s(bad.clone())).is_err(), "{}", bad.display());
+        }
+        // Named on purpose, a folder reaches its hidden files too.
+        assert!(PathScope::new([proj.clone()]).check(&s(proj.join(".env"))).is_ok());
+        // A design saved at `/` or in a missing folder adds nothing.
+        assert!(PathScope::new([]).with_design(Some("/part.solidcraft")).design_roots().is_empty());
+        assert!(PathScope::new([]).with_design(Some(&s(base.join("missing/p.solidcraft")))).design_roots().is_empty());
+        let _ = std::fs::remove_dir_all(&base);
+    }
+
+    /// A save follows a symbolic link to the file it points to (#845), so the link's target is
+    /// what a scope judges: a link inside an allowed folder that leads out is refused, a chain of
+    /// links that stays inside is fine.
+    #[cfg(all(unix, not(target_arch = "wasm32")))]
+    #[test]
+    fn a_link_is_judged_by_where_it_leads() {
+        use super::PathScope;
+        let base = std::env::temp_dir().join(format!("solidcraft-vfs-link-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        let (root, out) = (base.join("root"), base.join("out"));
+        std::fs::create_dir_all(&root).unwrap();
+        std::fs::create_dir_all(&out).unwrap();
+        std::fs::write(out.join("part.solidcraft"), "outside").unwrap();
+        std::fs::write(root.join("real.solidcraft"), "inside").unwrap();
+        std::os::unix::fs::symlink(out.join("part.solidcraft"), root.join("part.solidcraft")).unwrap();
+        std::os::unix::fs::symlink("real.solidcraft", root.join("a.solidcraft")).unwrap();
+        std::os::unix::fs::symlink("a.solidcraft", root.join("b.solidcraft")).unwrap();
+        std::os::unix::fs::symlink("../out/new.solidcraft", root.join("dangling.solidcraft")).unwrap();
+        let scope = PathScope::new([root.clone()]);
+        let s = |p: std::path::PathBuf| p.to_string_lossy().to_string();
+        assert!(scope.check(&s(root.join("part.solidcraft"))).is_err());
+        assert!(scope.check(&s(root.join("dangling.solidcraft"))).is_err());
+        assert!(scope.check(&s(root.join("b.solidcraft"))).is_ok());
+        super::scoped(Some(scope), || {
+            let path = s(root.join("part.solidcraft"));
+            let refused = super::check(&path).and_then(|()| crate::safe_write::write_atomic(std::path::Path::new(&path), b"agent", false));
+            assert!(refused.is_err());
+        });
+        assert_eq!(std::fs::read_to_string(out.join("part.solidcraft")).unwrap(), "outside");
+        assert!(!out.join("new.solidcraft").exists());
+        let _ = std::fs::remove_dir_all(&base);
+    }
+
     /// A directory is not a file either.
     #[cfg(not(target_arch = "wasm32"))]
     #[test]