[FEATURE] Remember the "Allow Claude to open this file?" consent per session folder

Preflight

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request

Problem Statement

In the desktop app, every time I click a file:/// link that Claude wrote into its own response, I get a modal: "File access request / Allow Claude to open this file?" with Cancel and Allow.

These links are almost always a document Claude just generated inside my session folder, typically a rendered PDF. When I am iterating on a document I might open the same regenerated file fifteen or twenty times in one sitting, and each open is a separate modal. The answer is always Allow, because I asked for the file, Claude wrote it, and it is sitting inside the folder I opened as the session.

The dialog has no "don't ask again" affordance, so there is no way to express "yes, for this folder, for this session."

Proposed Solution

Add an opt-in "Don't ask again for this session folder" checkbox to the dialog that already exists.

Electron's dialog.showMessageBox supports this natively through checkboxLabel / checkboxChecked, and returns checkboxChecked on the result. The consent helper currently builds its options without those fields:

// app.asar, the chunk exporting confirmOpenSessionFileWithDefaultApp
{
  type: 'question',
  buttons: ['Cancel', 'Allow'],
  defaultId: 0, cancelId: 0,
  title: 'File access request',
  message: 'Allow Claude to open this file?',
  detail: `${path}\n\nThis will open the file with your default application.`
}

Suggested scope for the remembered grant, deliberately narrow:

• Scoped to the session's cwd or worktree path. Never global.
• Cleared when the session ends, or persisted per project if that is preferable.
• Default off, so behaviour is unchanged for anyone who does not opt in.

Why this scope looks safe

I read the surrounding code before filing, and the prompt is already the last of several gates. Before it runs, the path must resolve, must not be a network path, must be inside the session folder, must have a symlink target extension matching the link, must contain no unsafe characters, must not match a blocked filename, and must not be an executable by type or by content. After consent it re-stats the file and re-checks executability before calling shell.openPath, which reads as deliberate TOCTOU hardening.

So a remembered grant would only ever apply to non-executable files already inside the folder the user explicitly opened as a session, and the post-consent revalidation would still run on every single open. That is a much smaller surface than a blanket "stop asking about files" toggle, which is not what I am asking for.

Alternative Solutions

• A settings.json flag such as skipSessionFileOpenPrompt. Weaker: it is global rather than per folder, and the consent helper reads no settings today, so this introduces a new concept for the same benefit.
• Have the agent open files via a tool call. This works today and does not prompt, but it removes the link from the workflow, and links are how I navigate back to a document later.
• Register a custom OS protocol handler locally. I ruled this out. It would create a browser-reachable path into launching local files, which is considerably worse than one click.

Environment

• Claude desktop app 1.30096.5
• Claude Code 2.1.229
• Windows 11 Pro 26200