Q123: files shared in a private conversation stay with its members

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/app/ipc-contracts/platform.ts

@@ -49,7 +49,7 @@ export const platformContracts = {
   setScheduledPostState: z.strictObject({
     orgId: id, scheduledPostId: id, state: z.enum(["draft", "scheduled", "published", "cancelled"]), employeeId: id,
   }) satisfies z.ZodType<C.SetScheduledPostStateInput>,
-  importFile: z.strictObject({ orgId: id }) satisfies z.ZodType<C.ImportFileInput>,
+  importFile: z.strictObject({ orgId: id, spaceId: id.optional() }) satisfies z.ZodType<C.ImportFileInput>,
   openFile: z.strictObject({ orgId: id, fileId: id }) satisfies z.ZodType<C.OpenFileInput>,
   setFilePinned: z.strictObject({ orgId: id, fileId: id, pinned: z.boolean() }) satisfies z.ZodType<C.SetFilePinnedInput>,
   createMigrationReport: z.strictObject({ orgId: id, sourceDatabasePath: z.string() }) satisfies z.ZodType<C.CreateMigrationReportInput>,

src/main/services/agent-attachment-tools.ts

@@ -1,4 +1,4 @@
-import { readVerifiedFile } from "./files/file-object-store";
+import { agentCanReadFile, readVerifiedFile } from "./files/file-object-store";
 import type { DatabaseSync } from "node:sqlite";
 import { FILE_SCAN_STATE } from "../../shared/domain";
 import { requireString } from "./agent-tool-args";
@@ -30,11 +30,16 @@ export function attachmentNote(db: DatabaseSync, messageId: string): string {
   return ` [attachments: ${files.map((file) => `${file.name} (file_id=${file.id})`).join(", ")}]`;
 }
 
+export function noAccess(name: string): string {
+  return `You have no access to ${name}; it was shared in a conversation you are not part of.`;
+}
+
 export function readAttachmentTool(deps: AgentToolDeps, ctx: AgentToolContext, args: JsonRecord): string {
   const fileId = requireString(args.file_id, "file_id");
   const file = deps.db.prepare("select name, storage_path, sha256, scan_state from file_objects where id = ? and org_id = ?")
     .get(fileId, ctx.orgId) as { name: string; storage_path: string; sha256: string; scan_state: string } | undefined;
   if (!file) throw new Error(`No file with file_id "${fileId}".`);
+  if (!agentCanReadFile(deps.db, ctx.orgId, fileId, ctx.agent.id)) throw new Error(noAccess(file.name));
   if (file.scan_state !== FILE_SCAN_STATE.APPROVED) throw new Error(`${file.name} was blocked by the file scan and cannot be read.`);
   const bytes = readVerifiedFile({ name: file.name, storagePath: file.storage_path, sha256: file.sha256 });
   const content = utf8Text(bytes);

src/main/services/agent-task-handoff.ts

@@ -1,4 +1,5 @@
-import { readVerifiedFile } from "./files/file-object-store";
+import { agentCanReadFile, readVerifiedFile } from "./files/file-object-store";
+import { noAccess } from "./agent-attachment-tools";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import type { DatabaseSync } from "node:sqlite";
@@ -24,6 +25,8 @@ export const HANDOFF_TOOL_PROPERTIES = {
 export function buildTaskHandoff(
   db: DatabaseSync,
   orgId: string,
+  agentId: string,
+  assignee: { id: string; name: string } | null,
   source: { taskId: string | null; threadId: string | null },
   args: JsonRecord,
 ): TaskHandoff {
@@ -31,6 +34,11 @@ export function buildTaskHandoff(
     const file = db.prepare("select id, name, storage_path, sha256 from file_objects where id = ? and org_id = ?")
       .get(fileId, orgId) as { id: string; name: string; storage_path: string; sha256: string } | undefined;
     if (!file) throw new Error(`No file with file_id "${fileId}" exists in this company.`);
+    // A task's assignee gets its inputs, so only files the delegating agent may read can be handed on.
+    if (!agentCanReadFile(db, orgId, file.id, agentId)) throw new Error(noAccess(file.name));
+    if (assignee && !agentCanReadFile(db, orgId, file.id, assignee.id)) {
+      throw new Error(`${assignee.name} has no access to ${file.name}; it was shared in a conversation they are not part of. Share it with them or assign someone who has it.`);
+    }
     // The handoff pins the recorded content; bytes that no longer match it are refused, not pinned as if they were.
     readVerifiedFile({ name: file.name, storagePath: file.storage_path, sha256: file.sha256 });
     return { fileId: file.id, name: file.name, sha256: file.sha256 };

src/main/services/agent-tools.ts

@@ -347,7 +347,7 @@ function createTask(deps: AgentToolDeps, ctx: AgentToolContext, args: JsonRecord
   const description = requireString(args.description, "description");
   const assigneeName = optionalString(args.assignee_agent_name);
   const assignee = assigneeName ? requireRunnableAgentByName(deps.db, ctx.orgId, assigneeName) : null;
-  const handoff = buildTaskHandoff(deps.db, ctx.orgId, { taskId: ctx.taskId, threadId: ctx.sourceThreadId }, args);
+  const handoff = buildTaskHandoff(deps.db, ctx.orgId, ctx.agent.id, assignee, { taskId: ctx.taskId, threadId: ctx.sourceThreadId }, args);
   const parentTaskId = delegationParent(deps.db, ctx);
   const writingMode = optionalEnum(args.writing_mode, "writing_mode", Object.values(WRITING_MODE), WRITING_MODE.CONVERSATIONAL) as WritingMode;
   const create = () => {

src/main/services/file-service.ts

@@ -26,10 +26,12 @@ export class FileService {
       securityScopedBookmarks: true,
     });
     if (result.canceled || result.filePaths.length === 0) return null;
-    return this.importPath(input.orgId, result.filePaths[0]);
+    return this.importPath(input.orgId, result.filePaths[0], input.spaceId ?? null);
   }
 
-  importPath(orgId: string, sourcePath: string): string {
+  /** A file imported into a direct conversation or restricted channel is readable by that space's members only. */
+  importPath(orgId: string, sourcePath: string, spaceId: string | null): string {
+    const access = spaceId ? spaceAccess(this.db, orgId, spaceId) : "workspace";
     const id = createId("fil");
     const now = new Date().toISOString();
     const stats = statSync(sourcePath);
@@ -53,6 +55,7 @@ export class FileService {
         sha256: hash,
         storagePath: target,
         sourcePath: target,
+        access,
         ownerType: "system",
         ownerId: null,
         scan,
@@ -104,3 +107,11 @@ export class FileService {
   }
 
 }
+
+function spaceAccess(db: DatabaseSync, orgId: string, spaceId: string): "workspace" | Array<{ type: "employee" | "agent"; id: string }> {
+  const space = db.prepare("select visibility, space_type from chat_spaces where id = ? and org_id = ?").get(spaceId, orgId) as { visibility: string; space_type: string } | undefined;
+  if (!space) throw new Error("The conversation to import into was not found.");
+  if (space.visibility === "workspace" && space.space_type !== "direct") return "workspace";
+  return db.prepare("select principal_type as type, principal_id as id from chat_memberships where space_id = ? and principal_type in ('employee', 'agent')")
+    .all(spaceId) as Array<{ type: "employee" | "agent"; id: string }>;
+}

src/main/services/files/file-object-store.ts

@@ -77,6 +77,8 @@ export interface FileObjectInput {
   storagePath: string;
   /** The path the file came from; one id per content of it, the newest current and older ones superseded. */
   sourcePath: string;
+  /** Who may read it once it exists: the whole workspace, or only these principals (a private conversation's members). */
+  access: "workspace" | Array<{ type: "employee" | "agent"; id: string }>;
   ownerType: string;
   ownerId: string | null;
   scan: FileScanResult;
@@ -145,7 +147,8 @@ function writeFileObject(db: DatabaseSync, input: FileObjectInput): string {
     input.now,
     input.now,
   );
-  grantWorkspaceAccess(db, input.orgId, id, input.now);
+  if (input.access === "workspace") grantWorkspaceAccess(db, input.orgId, id, input.now);
+  else for (const principal of input.access) grantPrincipalAccess(db, input.orgId, id, principal, input.now);
   return id;
 }
 
@@ -177,6 +180,7 @@ export function recordWorkspaceFile(db: DatabaseSync, input: {
     sha256,
     storagePath: copy,
     sourcePath: absolute,
+    access: "workspace",
     ownerType: input.ownerType,
     ownerId: input.ownerId,
     scan,
@@ -227,6 +231,29 @@ function isInside(root: string, path: string): boolean {
   return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
 }
 
+/** Whether an agent may read a file: it owns it, or holds a grant of its own or the workspace's. */
+export function agentCanReadFile(db: DatabaseSync, orgId: string, fileId: string, agentId: string): boolean {
+  return Boolean(db.prepare(`
+    select 1 from file_objects f where f.id = ? and f.org_id = ? and (
+      (f.owner_type = 'agent' and f.owner_id = ?)
+      or exists (
+        select 1 from file_access_grants g where g.file_id = f.id and g.access_level in ('read', 'manage')
+          and ((g.granted_to_type = 'agent' and g.granted_to_id = ?) or (g.granted_to_type = 'org_group' and g.granted_to_id = ?))
+      )
+    )
+  `).get(fileId, orgId, agentId, agentId, `${orgId}:workspace`));
+}
+
+function grantPrincipalAccess(db: DatabaseSync, orgId: string, fileId: string, principal: { type: string; id: string }, now: string): void {
+  db.prepare(`
+    insert into file_access_grants(
+      id, org_id, file_id, granted_to_type, granted_to_id, granted_by_type, granted_by_id,
+      source_message_id, source_thread_id, access_level, created_at
+    )
+    values (?, ?, ?, ?, ?, 'system', null, null, null, 'read', ?)
+  `).run(createId("fgr"), orgId, fileId, principal.type, principal.id, now);
+}
+
 function grantWorkspaceAccess(db: DatabaseSync, orgId: string, fileId: string, now: string): void {
   db.prepare(`
     insert into file_access_grants(