[quickbeard]

Why

On macOS the desktop app asked for permission to Downloads, Photos, Desktop, and the Music library. The TCC database showed all four requested by ai.codev.desktop — Downloads granted and Photos denied one second apart, the signature of a single recursive walk of ~.

Root cause: materializing the file-search service walks everything under its location (fff at creation; ripgrep as an eagerly forked scan), and two paths rooted that location in the home directory:

1. the project picker's bare-word search calls find.files({directory}) against its base, which is ~;
2. any server request that names no directory falls back to process.cwd() (workspace-routing.ts), which the sidecar inherited as ~ from the main process's startup chdir(homedir()).

Reproduced end to end against a decoy home (sentinel files with pinned atimes): one directory-less find/file request made the server open files inside Downloads/ and inside Photos Library.photoslibrary/ — exactly the accesses macOS answers with those prompts.

What

Three changes, defense in depth:

• core (filesystem/search.ts): new unindexableDirectory() — true for the home directory (Global.Path.home, honoring CODEV_TEST_HOME) and filesystem roots. The layer chooser routes such locations to a new shallowLayer: find answers from a single readDirectoryEntries of the location itself (direct children only — no protected folder is entered), with the same fuzzysort/empty-query/limit semantics as the indexed layers; glob/grep keep their on-demand ripgrep behavior, extracted into a shared ripgrepGlobGrep effect (ripgrepLayer spreads it — no behavior change there).
• app (directory-picker-domain.ts): the picker's bare-word branch matches direct children via the existing file.list-based match() when its base is home or a filesystem root, instead of the recursive find.files — same protection against older/remote servers.
• desktop (main/index.ts): startup chdir goes to an empty app-owned folder (userData/cwd, created after setPath("userData")) instead of homedir(), so directory-less fallbacks have nothing to crawl. Still not /, which the original chdir was avoiding for ripgrep's sake.

Browsing into a protected folder yourself (drilling into Downloads in the picker) still prompts, once — that access is user-chosen and shallow.

Test plan

• Reproduction flipped: with the guard, the same decoy-home find/file request returns ["Music/","Pictures/","Desktop/","Downloads/"], finds nothing nested, and every sentinel atime is untouched.
• Desktop, seen working: bun run dev boots, UI renders, and main + all helper/sidecar processes run with cwd …/ai.codev.desktop.dev/cwd (verified via lsof).
• New tests: unindexableDirectory (home via CODEV_TEST_HOME, dot-segments, fs root), shallowLayer find (children only, no recursion, type filter) and on-demand glob; picker bare-word-over-home and over-root staying shallow.
• Suites: core 1087 pass, app 697 pass, desktop 151 pass, opencode test/server 293 pass. bun typecheck in core, app, desktop.

DIVERGENCES.md gains one row covering all three upstream-file edits; CHANGELOG.md gains an Unreleased Privacy entry.

🤖 Generated with Claude Code