Adom Hydrogen

What

resolve_permission persists 1h/24h grants to <hd_data_dir>/permission-grant.json as {"until_ms": <deadline>}, and permission_grant_active() trusts that file. Anything that can write that file can grant itself a standing auto-approve window.

Why it matters

The gate's core property is grants are human-only — /permission/resolve accepts only action="deny" from a non-human caller, precisely "otherwise the agent being gated could approve itself." The persisted file is a second, unguarded path to the same outcome: an agent that already holds a short grant (or any local write access to %APPDATA%\hydrogen-desktop\) can escalate it to a persistent one and keep it alive indefinitely by rewriting the deadline.

Persistence itself is correct and worth keeping — a 24h grant that silently died on every app restart did not mean 24 hours, and every HD update restarts the app, so unattended work was impossible. The gap is only that the file is unauthenticated.

Suggested fixes (any one closes it)

1. Write it only from the click handler. Keep persistence, but have the Tauri resolve_permission command be the sole writer, and treat a file written by anything else as absent.
2. Sign/HMAC the payload with a per-install key held by HD, and reject unsigned/mismatched files.
3. Bind it to install identity (build sha + install id) so a copied/hand-written file doesn't apply.
4. Optionally log loudly whenever a persisted grant is loaded, so a grant nobody clicked is visible.

Disclosure

Found while implementing the persistence (2026-07-24). John explicitly asked me to write the grant file directly on his own machine so unattended overnight work could continue, which is a legitimate owner decision — but it demonstrates the path, so it should not stay open for everyone else.