security: reject unknown OAuth connection authority fields

.github/workflows/test.yml

@@ -3,29 +3,31 @@ name: Test
 on:
   push:
     branches: [main]
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-      # Content-checked by contract tests (vitest + cargo test) — must still run CI.
-      - "!docs/doctoring/release-artifact-provenance.md"
-      - "!docs/doctoring/tauri-content-security-policy.md"
-      - "!docs/doctoring/model-artifact-integrity.md"
-      - "!docs/doctoring/model-load-handle-binding.md"
-      - "!docs/development/icloud-local-eviction-batch.md"
-      - "!docs/architecture/goals/cloud-offload-goal.json"
-      - "!CHANGELOG.md"
+    paths:
+      - "**"
+      - "!docs/**"
+      - "!*.md"
+      # GitHub supports re-inclusion only with ordered positive patterns under `paths`.
+      - "docs/doctoring/release-artifact-provenance.md"
+      - "docs/doctoring/tauri-content-security-policy.md"
+      - "docs/doctoring/model-artifact-integrity.md"
+      - "docs/doctoring/model-load-handle-binding.md"
+      - "docs/development/icloud-local-eviction-batch.md"
+      - "docs/architecture/goals/cloud-offload-goal.json"
+      - "CHANGELOG.md"
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-      # Content-checked by contract tests (vitest + cargo test) — must still run CI.
-      - "!docs/doctoring/release-artifact-provenance.md"
-      - "!docs/doctoring/tauri-content-security-policy.md"
-      - "!docs/doctoring/model-artifact-integrity.md"
-      - "!docs/doctoring/model-load-handle-binding.md"
-      - "!docs/development/icloud-local-eviction-batch.md"
-      - "!docs/architecture/goals/cloud-offload-goal.json"
-      - "!CHANGELOG.md"
+    paths:
+      - "**"
+      - "!docs/**"
+      - "!*.md"
+      # GitHub supports re-inclusion only with ordered positive patterns under `paths`.
+      - "docs/doctoring/release-artifact-provenance.md"
+      - "docs/doctoring/tauri-content-security-policy.md"
+      - "docs/doctoring/model-artifact-integrity.md"
+      - "docs/doctoring/model-load-handle-binding.md"
+      - "docs/development/icloud-local-eviction-batch.md"
+      - "docs/architecture/goals/cloud-offload-goal.json"
+      - "CHANGELOG.md"
 
 permissions:
   contents: read
@@ -49,7 +51,12 @@ jobs:
           persist-credentials: false
       - name: Install Tauri system deps
         run: |
-          sudo apt-get update
+          for source_file in /etc/apt/sources.list.d/*; do
+            if [[ -f "$source_file" ]] && grep -q 'dl.google.com/linux/chrome' "$source_file"; then
+              sudo rm -f "$source_file"
+            fi
+          done
+          sudo apt-get -o Acquire::Retries=3 update
           sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev lsof
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
@@ -80,9 +87,34 @@ jobs:
       - run: npm test
       - run: npm run build
 
+  macos-cache-cleanup:
+    runs-on: macos-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          workspaces: src-tauri
+          cache-targets: false
+      - name: macOS cache cleanup regressions when owner source is present
+        env:
+          TMPDIR: ${{ runner.temp }}
+        run: |
+          for test_name in cache_cleanup_corepack_scope cache_cleanup_cli_permanent_gradle generated_cache_staged_activity; do
+            if [[ -f "src-tauri/tests/${test_name}.rs" ]]; then
+              cargo test --manifest-path src-tauri/Cargo.toml --test "$test_name"
+            else
+              printf 'SKIP %s: owner test source absent; no runtime regression executed\n' "$test_name"
+            fi
+          done
+
   windows-home-resolution:
     runs-on: windows-latest
-    timeout-minutes: 10
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -95,6 +127,26 @@ jobs:
           New-Item -ItemType Directory -Force target | Out-Null
           rustc --edition=2021 --test src-tauri/tests/home_resolution_contract.rs -o target/home-resolution-contract.exe
           & .\target\home-resolution-contract.exe
+      - name: Windows agent-state regression when owner source is present
+        shell: pwsh
+        run: |
+          if (Test-Path 'src-tauri/src/agent_state_guard.rs') {
+            rustc --edition=2021 --test src-tauri/src/agent_state_guard.rs -o target/agent-state-guard.exe
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+            & .\target\agent-state-guard.exe --nocapture
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          } else {
+            Write-Output 'SKIP agent_state_guard: owner source absent; no runtime regression executed'
+          }
+      - name: Windows provider OAuth process contract when owner source is present
+        shell: pwsh
+        run: |
+          if (Test-Path 'src-tauri/tests/provider_oauth_cli_process.rs') {
+            cargo test --manifest-path src-tauri/Cargo.toml --locked --features cloud-cli --test provider_oauth_cli_process
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          } else {
+            Write-Output 'SKIP provider_oauth_cli_process: owner source absent; no runtime regression executed'
+          }
 
   llm-engine-build:
     runs-on: ubuntu-latest
@@ -106,12 +158,17 @@ jobs:
           persist-credentials: false
       - name: Install build deps (llama.cpp native + tauri)
         run: |
-          sudo apt-get update
+          for source_file in /etc/apt/sources.list.d/*; do
+            if [[ -f "$source_file" ]] && grep -q 'dl.google.com/linux/chrome' "$source_file"; then
+              sudo rm -f "$source_file"
+            fi
+          done
+          sudo apt-get -o Acquire::Retries=3 update
           sudo apt-get install -y cmake clang libclang-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: src-tauri
           cache-targets: false
       - name: Build with llm-engine (compiles real llama.cpp CPU + engine.rs FFI)
-        run: cargo test --manifest-path src-tauri/Cargo.toml --features llm-engine --lib --no-run
+        run: cargo test --manifest-path src-tauri/Cargo.toml --features llm-engine --lib --no-run

CHANGELOG.md

@@ -184,6 +184,10 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ### Fixed
 
+- Resolve the provider OAuth descriptor's platform data-home authority before entering the domain:
+  honor absolute Linux `$XDG_DATA_HOME` and redirected Windows `%APPDATA%`, ignore invalid relative
+  environment paths, keep explicit `--connections` and `--home` authoritative, and preserve native
+  non-UTF-8 filesystem operands while leaving macOS Application Support behavior unchanged.
 - Use macOS `NSFileManager` for reversible Trash moves so cleanup does not wait on Finder
   AppleEvents or inherit a stalled Finder copy queue.
 - Permit fully current-user-owned real children of the shared Unix temporary root while retaining

docs/superpowers/specs/2026-07-16-cloud-provider-oauth-pkce-design.md

@@ -68,8 +68,22 @@ DiskSage displays this before consent. It does not silently fall back to a broad
 
 `disksage-provider-oauth` exposes the same Rust PKCE and credential lifecycle outside the Tauri
 webview so an operator can prepare a headless `disksage-cloud-plan` run without pasting a bearer or
-refresh token. The default descriptor path is the DiskSage application-data path; an explicit
-`--connections` value must be absolute and can be shared with `disksage-cloud-plan`.
+refresh token. An explicit `--connections` value must be absolute and is the highest descriptor-path
+authority. An explicit `--home` is next and derives the platform default from that supplied home;
+this keeps hermetic operator/test roots independent of ambient environment data-home variables.
+Without either explicit option, the shipped host entrypoint resolves the default descriptor path as
+follows:
+
+- Linux/non-macOS Unix: an absolute, non-empty `$XDG_DATA_HOME`, otherwise
+  `$HOME/.local/share/com.contextualwisdomlab.disksage/cloud-oauth-connections.json`. Relative XDG
+  values are invalid authority and are ignored.
+- Windows: an absolute, non-empty `%APPDATA%` so redirected roaming AppData remains authoritative;
+  otherwise `%USERPROFILE%\AppData\Roaming\com.contextualwisdomlab.disksage\cloud-oauth-connections.json`.
+- macOS: `$HOME/Library/Application Support/com.contextualwisdomlab.disksage/cloud-oauth-connections.json`.
+
+The entrypoint resolves these process/platform values and passes one explicit path into the OAuth
+domain. The domain does not read process-global environment state. `--list` remains read-only: a
+missing descriptor returns an empty list and does not create the app-data directory or document.
 
 ```bash
 cargo run --locked --features cloud-cli --bin disksage-provider-oauth -- --list
@@ -128,6 +142,8 @@ this design.
 
 ## Primary references
 
+- [XDG Base Directory Specification 0.8](https://specifications.freedesktop.org/basedir/latest/)
+- [Windows Folder Redirection with Group Policy](https://learn.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-using-group-policy)
 - [Microsoft identity platform authorization-code flow](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow)
 - [Microsoft redirect URI restrictions and native loopback behavior](https://learn.microsoft.com/en-us/entra/identity-platform/reply-url)
 - [Microsoft Graph permission reference](https://learn.microsoft.com/en-us/graph/permissions-reference)

src-tauri/Cargo.toml

@@ -147,7 +147,7 @@ path = "src/bin/disksage-container-orphan-plan.rs"
 
 [[bin]]
 name = "disksage-provider-oauth"
-path = "src/bin/disksage-provider-oauth.rs"
+path = "src/bin/disksage-provider-oauth-entry.rs"
 required-features = ["cloud-cli"]
 
 [[bin]]

src-tauri/src/bin/disksage-provider-oauth.rs → src-tauri/provider_oauth_cli_impl.rs.inc

@@ -1,8 +1,8 @@
-//! Headless OAuth lifecycle for OneDrive and Google Drive evidence and explicit API uploads.
-//!
-//! Refresh tokens remain in the operating-system credential store. This command emits only
-//! non-secret connection descriptors and provider capacity evidence; this command itself never
-//! performs a cloud file write or source eviction.
+// Headless OAuth lifecycle for OneDrive and Google Drive evidence and explicit API uploads.
+//
+// Refresh tokens remain in the operating-system credential store. This command emits only
+// non-secret connection descriptors and provider capacity evidence; this command itself never
+// performs a cloud file write or source eviction.
 
 #[cfg(not(coverage))]
 use std::path::{Path, PathBuf};
@@ -94,7 +94,9 @@ fn usage() -> String {
         "[--connections ABSOLUTE_PATH] ",
         "(--list | --connect --cloud-root ABSOLUTE_PATH --client-id ID ",
         "[--manual-browser] [--write-access] | --verify-capacity --cloud-root ABSOLUTE_PATH | ",
-        "--disconnect --cloud-root ABSOLUTE_PATH)"
+        "--disconnect --cloud-root ABSOLUTE_PATH)\n",
+        "다음 단계: 먼저 --list로 연결을 확인하세요. --connect는 동의 후 자격 증명을 로컬 보안 저장소에 보관하며, ",
+        "--write-access는 명시적으로 선택할 때만 요청됩니다. 출력에는 토큰이 포함되지 않습니다."
     )
     .into()
 }
@@ -388,30 +390,6 @@ fn execute(args: Args) -> Result<Output, String> {
     }
 }
 
-#[cfg(not(coverage))]
-fn run() -> Result<(), String> {
-    let args = std::env::args().skip(1).collect::<Vec<_>>();
-    let parsed = parse_args(&args, std::env::var_os("HOME").map(PathBuf::from))?;
-    let output = execute(parsed)?;
-    println!(
-        "{}",
-        serde_json::to_string_pretty(&output)
-            .map_err(|_| "provider-oauth-output-serialization-failed".to_string())?
-    );
-    Ok(())
-}
-
-#[cfg(not(coverage))]
-fn main() {
-    if let Err(error) = run() {
-        eprintln!("{error}");
-        std::process::exit(1);
-    }
-}
-
-#[cfg(coverage)]
-fn main() {}
-
 #[cfg(all(test, not(coverage)))]
 mod tests {
     use super::*;

src-tauri/src/bin/disksage-icloud-provider-recovery.rs

@@ -71,18 +71,39 @@ fn now_ms() -> Result<u64, String> {
     u64::try_from(value).map_err(|_| "system-time-overflow".into())
 }
 
-fn read_plan(path: &Path) -> Result<IcloudFileProviderRecoveryPlan, String> {
+#[cfg(target_os = "macos")]
+fn current_user_uid() -> Result<u32, String> {
+    Ok(unsafe { libc::getuid() })
+}
+
+#[cfg(not(target_os = "macos"))]
+fn current_user_uid() -> Result<u32, String> {
+    Err("icloud-recovery-platform-unsupported".into())
+}
+
+fn read_plan_with_hook<F>(
+    path: &Path,
+    before_read: F,
+) -> Result<IcloudFileProviderRecoveryPlan, String>
+where
+    F: FnOnce(),
+{
     let metadata = std::fs::symlink_metadata(path)
         .map_err(|_| "icloud-recovery-plan-unavailable".to_string())?;
     if !metadata.is_file() || metadata.file_type().is_symlink() || metadata.len() > 64 * 1024 {
         return Err("icloud-recovery-plan-unsafe".into());
     }
+    before_read();
     serde_json::from_slice(
         &std::fs::read(path).map_err(|_| "icloud-recovery-plan-read-failed".to_string())?,
     )
     .map_err(|_| "icloud-recovery-plan-json-invalid".into())
 }
 
+fn read_plan(path: &Path) -> Result<IcloudFileProviderRecoveryPlan, String> {
+    read_plan_with_hook(path, || {})
+}
+
 fn run() -> Result<(), String> {
     let home = std::env::var_os("HOME")
         .map(PathBuf::from)
@@ -104,7 +125,7 @@ fn run() -> Result<(), String> {
         serde_json::to_value(plan_icloud_file_provider_recovery(
             &health,
             daemon,
-            unsafe { libc::getuid() },
+            current_user_uid()?,
             now,
         ))
     }
@@ -160,4 +181,56 @@ mod tests {
         )
         .is_ok());
     }
+
+    #[cfg(unix)]
+    #[test]
+    fn execution_plan_read_rejects_path_replacement_after_admission() {
+        use disksage_lib::icloud_provider_recovery::IcloudFileProviderDaemonIdentity;
+
+        fn plan(observed_at_ms: u64) -> IcloudFileProviderRecoveryPlan {
+            IcloudFileProviderRecoveryPlan {
+                schema_version: 1,
+                observed_at_ms,
+                health_evidence_fingerprint_sha256: "a".repeat(64),
+                stale_error_count: 1,
+                oldest_stale_error_age_ms: 15 * 60 * 1_000,
+                daemon: IcloudFileProviderDaemonIdentity {
+                    uid: 501,
+                    pid: 1234,
+                    service_label: "com.apple.FileProvider".into(),
+                    executable_path: "/System/Library/Frameworks/FileProvider.framework/Support/fileproviderd".into(),
+                    executable_object_id: "b".repeat(64),
+                    apple_signature_valid: true,
+                },
+                blockers: Vec::new(),
+                eligible: true,
+                plan_fingerprint_sha256: "c".repeat(64),
+                exact_approval_phrase: "test approval".into(),
+                mutation_performed: false,
+            }
+        }
+
+        let temp = tempfile::tempdir().expect("tempdir");
+        let plan_path = temp.path().join("plan.json");
+        let replacement_path = temp.path().join("replacement.json");
+        let admitted_path = temp.path().join("admitted.json");
+        std::fs::write(
+            &plan_path,
+            serde_json::to_vec(&plan(1)).expect("serialize admitted plan"),
+        )
+        .expect("write admitted plan");
+        std::fs::write(
+            &replacement_path,
+            serde_json::to_vec(&plan(2)).expect("serialize replacement plan"),
+        )
+        .expect("write replacement plan");
+
+        let error = read_plan_with_hook(&plan_path, || {
+            std::fs::rename(&plan_path, &admitted_path).expect("move admitted object");
+            std::fs::rename(&replacement_path, &plan_path).expect("install replacement object");
+        })
+        .expect_err("path replacement must not switch execution-plan authority");
+
+        assert_eq!(error, "icloud-recovery-plan-object-changed");
+    }
 }