@@ -192,7 +192,9 @@ The native `read_local_file` and `import_local_files` tools also accept absolute
 
 **Desktop settings → Local files → Full file access** bypasses folder prompts for authorized native reads and imports. It is off by default, persists across ordinary restarts, and resets on sign-out or server changes. Turning it off restores folder consent checks. Call authorization, cancellation, file identity, and resource limits still apply, and VFS access continues to use explicit mounts. A failed settings write reports an error and leaves full access disabled in the running app.
 
-Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates every pending call before using a grant, including remembered grants, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. Directory enumeration uses `fdopendir` on the verified descriptor, so replacing a parent path cannot redirect the listing. Listings scan at most 1,001 entries and return up to 1,000 sorted names with an explicit truncation flag; the cap bounds both memory and filesystem work, rather than promising the globally first 1,000 names in an arbitrarily large directory. Imports reject truncated listings. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
+Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates every pending call before using a grant, including remembered grants, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. On macOS and Linux, a native module opens each path component relative to the verified grant descriptor, and directory enumeration uses `fdopendir` on the verified descriptor, so replacing a parent path cannot redirect the open or the listing. Listings scan at most 1,001 entries and return up to 1,000 sorted names with an explicit truncation flag; the cap bounds both memory and filesystem work, rather than promising the globally first 1,000 names in an arbitrarily large directory. Imports reject truncated listings. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
+
+On Windows, Node cannot open a path relative to a directory handle, so the same tools use checked Node fs opens instead (`src/main/win32-native-files.ts`). Paths are validated lexically first: only drive paths and `~\` paths are accepted, and reserved device names, alternate data streams, and trailing dots or spaces are refused. Then Electron checks that the granted folder still has its recorded identity, resolves the path and refuses it unless it is already canonical beneath the granted folder (so any symlink or junction in it, even one pointing back inside, is refused), and opens it only when the opened handle has the identity the path had just before the open; after the open it checks the path and the granted folder again. A directory listing must leave the path naming the opened handle. Listings report symlinks and junctions as links and never follow them, under the same caps as macOS. These checks narrow, but cannot eliminate, a race by a process already running as the user that swaps a path component between a check and the open. The model itself cannot create links or junctions: the tools are read-only. OneDrive Files-On-Demand placeholders are downloaded when they are read or imported. UNC and other network paths, including a drive letter mapped to a share, are refused in this release.
 
 ## Windows
 
@@ -205,7 +207,7 @@ The Windows build is a one-click, per-user NSIS installer (`Sim-<version>-x64.ex
 - Updates: the NSIS updater requests `latest.yml` from the same `/api/desktop/update` feed. `ready` is reached when electron-updater's own `update-downloaded` fires (after the publisher check); there is no native staging step. A confirmed restart runs the installer silently and relaunches. Builds without a packaged `app-update.yml` fall back to the manual-download pipeline. Deltas use `.exe.blockmap`.
 - Publication: Windows publishes independently of macOS. `desktop-signing-windows` probes the Azure configuration and skips with a warning until it exists; unsigned Windows builds are never published. No job waits on the Windows calls, so a Windows failure never blocks the macOS release, and the feed treats a release without `latest.yml` as having no Windows build (Windows shells keep the newest release that has one). `latest.yml` is uploaded last.
 - SmartScreen: a new signing identity starts without download reputation, so early installers can show "Windows protected your PC" until reputation builds. Keep the same certificate profile across releases.
-- Not available on Windows yet: Terminal, native local-file tools, native Computer Use, and importing from other browsers. node-pty still ships but is not exercised.
+- Not available on Windows yet: Terminal, native Computer Use, and importing from other browsers. The native local-file tools ship with the checks described in [Local filesystem access](#local-filesystem-access). node-pty still ships but is not exercised.
 
 | Secret / variable | Kind | Contents |
 |---|---|---|
 
@@ -141,37 +141,53 @@ describe('background terminal calls', () => {
 })
 
 describe('calls for a surface the platform does not ship', () => {
-  it.each([
-    ['terminal', { operation: 'run', args: { command: 'echo hi' } }],
-    ['read_local_file', { path: '~/notes.txt' }],
-    ['import_local_files', { path: '~/notes', targetWorkspaceId: 'ws-1' }],
-  ])('never starts %s on Windows', async (toolName, args) => {
-    const executeTool = vi.fn()
-    const request = vi.fn()
-    const completion = await runner({
-      platform: 'win32',
-      terminal: { executeTool, cancelTool: vi.fn(async () => true) },
-      localFiles: { request },
-    }).run(
+  it.each([['terminal', { operation: 'run', args: { command: 'echo hi' } }]])(
+    'never starts %s on Windows',
+    async (toolName, args) => {
+      const executeTool = vi.fn()
+      const request = vi.fn()
+      const completion = await runner({
+        platform: 'win32',
+        terminal: { executeTool, cancelTool: vi.fn(async () => true) },
+        localFiles: { request },
+      }).run(
+        {
+          toolCallId: 'call-1',
+          toolName,
+          args,
+          chatId: 'chat-b',
+          workspaceId: 'ws-1',
+          executionToken: 'token-call-1',
+        },
+        new AbortController().signal
+      )
+
+      expect(completion.data).toMatchObject({ notStarted: true })
+      expect(completion.message).toContain('on this operating system')
+      expect(executeTool).not.toHaveBeenCalled()
+      expect(request).not.toHaveBeenCalled()
+    }
+  )
+})
+
+describe('local file calls', () => {
+  it.each(['read_local_file', 'import_local_files'])('starts %s on Windows', async (toolName) => {
+    const request = vi.fn(async () => ({ ok: false as const, error: 'unreadable' }))
+    await runner({ platform: 'win32', localFiles: { request } }).run(
       {
-        toolCallId: 'call-1',
+        toolCallId: 'local-1',
         toolName,
-        args,
+        args: { path: '~/notes', targetWorkspaceId: 'ws-1' },
         chatId: 'chat-b',
         workspaceId: 'ws-1',
-        executionToken: 'token-call-1',
+        executionToken: 'token-local-1',
       },
       new AbortController().signal
     )
 
-    expect(completion.data).toMatchObject({ notStarted: true })
-    expect(completion.message).toContain('on this operating system')
-    expect(executeTool).not.toHaveBeenCalled()
-    expect(request).not.toHaveBeenCalled()
+    expect(request).toHaveBeenCalledOnce()
   })
-})
 
-describe('local file calls', () => {
   it('names a passing storage state, not a setting, when local files are out of reach', async () => {
     const completion = await runner({ accountDataAvailable: () => false }).run(
       {
@@ -191,7 +207,7 @@ describe('local file calls', () => {
   })
 })
 
-describe.skipIf(process.platform === 'win32')('background imports', () => {
+describe('background imports', () => {
   const roots: string[] = []
 
   afterEach(async () => {
 
@@ -228,17 +228,17 @@ describe('results recovery will hand to the model', () => {
 
 describe('desktop executor registration', () => {
   it.each([
-    ['darwin', true],
-    ['win32', false],
+    ['darwin', true, true],
+    ['win32', false, true],
   ] as const)(
-    'advertises the terminal and native file tools on %s: %s',
-    async (platform, shipped) => {
+    'advertises on %s the terminal: %s, and the native file tools: %s',
+    async (platform, terminal, localFiles) => {
       const { sim, desktopExecutor } = await service(1, undefined, platform)
       desktopExecutor.start()
       await vi.waitFor(() => expect(sim.registrations).toHaveLength(1))
 
       expect(sim.registrationBodies[0]).toMatchObject({
-        capabilities: { browser: true, terminal: shipped, localFiles: shipped },
+        capabilities: { browser: true, terminal, localFiles },
       })
       sim.registrations[0]?.(false)
       await desktopExecutor.signOut()
 
@@ -376,7 +376,6 @@ describe('registerIpcHandlers', () => {
     'computer-use:execute-tool',
     'browser-import:all',
     'browser-credentials:import',
-    'desktop:local-files',
     'browser-credentials:copy',
   ])('registers no handler on Windows for %s, which that shell does not ship', (channel) => {
     expect(collectHandlers().invoke.has(channel) || collectHandlers().on.has(channel)).toBe(true)
@@ -389,12 +388,13 @@ describe('registerIpcHandlers', () => {
     expect(invoke.has(channel) || on.has(channel)).toBe(false)
   })
 
-  it('keeps the user-local folder grants and password reveal on Windows', () => {
+  it('keeps the folder grants, native file tools, and password reveal on Windows', () => {
     vi.mocked(ipcMain.handle).mockClear()
     registerIpcHandlers({ ...deps, platform: 'win32' })
 
     const { invoke } = collectHandlers()
     expect(invoke.has('desktop:local-filesystem')).toBe(true)
+    expect(invoke.has('desktop:local-files')).toBe(true)
     expect(invoke.has('browser-credentials:reveal')).toBe(true)
   })