[sivadaboi]

The folder-trust work from dev, re-cut on dev-public (951cee6). It undoes the part of the 2.4.1 security fix (CVE-2026-103398) that made games wait on Home, and still doesn't let a peer choose folders.

The problem. Since 2.4.1, a game arriving from another device is tracked by itself only at a folder this device's own scan has already seen. Anything else waits on Home. On a new PC, or for a game not played on this one yet, that is almost every game, so a second PC had to have each game placed by hand.

The change:

• Folders this device can vouch for, before they exist. A game is tracked by itself where the save catalogue says that game keeps its saves on this device (presets.CatalogueSaveLocation), or in Steam's own userdata/<user>/<appid> folder (SteamSaveLocation), even if the game hasn't been played here yet. The check is per game: it matches by App ID, or by name when there is no App ID. A broad root never counts (a drive, home, Documents, AppData, or the game's install folder). A catalogue wildcard never vouches for a folder inside a game's install: that is your 0eec6a3, cherry-picked with its authorship.
• "Trust it to choose folders" on Devices (opensave peers trust <device> on|off). For your own devices, a game goes in the folder that device names, as before 2.4.1.
  • It is off by default, asks before turning on, and is removed when the device is unpaired.
  • Trust follows the device the signature proved, never one inferred from an address.
• Offers clear themselves. When a game is offered, the daemon looks for its folder straight away instead of at the next hourly scan (at most once a minute). An offer that has since been tracked drops off Home.
• The catalogue check never runs out the peer's 30 s. A peer is waiting while it runs, so it waits at most 2 s for an index rebuild, then answers from the index it has. This is loadManifestIndexWithin, built on Don't hold the window for a game database rebuild #102's loadManifestIndexNoWait.
• An offer is logged once, when it is new. Before, it was logged at every sync attempt from the other device, every 15–30 s.

Migration 0044 (peer_folder_trust). 0042 and 0043 are taken by open PRs (#118/#127/#128, and ChakraFusion's series against main). It uses IF NOT EXISTS because some dev builds created the same table as 0038.

Changelog: left to your batch. Suggested wording:

• Games from your other devices set themselves up again. 2.4.1 stopped another device from choosing folders on this one, and in doing so made many games wait on Home for you to pick a folder. Now a game arriving from another device is tracked by itself wherever this device can tell the folder is that game's save: where the save catalogue or Steam says the game keeps its saves here, even before you have played it, in an emulator's save folder, or in a folder a scan has seen. The other device still chooses nothing.
• Trust your own devices to choose folders. For a folder this device can't recognise, the game still waits on Home. On Devices, "Trust it to choose folders" lets one of your own devices decide instead, as before 2.4.1 (opensave peers trust <device> on). It is off until you turn it on, asks first, and is removed when the device is unpaired.
• A game waiting for a folder no longer stays on Home once it syncs, and an offered game's folder is looked for straight away instead of at the next hourly scan.

Tests:

• presets/verify_test.go: the game's own folder before it exists; nothing else; Steam's folder; inside the install folder; the 2 s bound.
• p2p/cve_2026_103398_test.go: a trusted device's folder is tracked; trust is per device; trust needs the proven device; an offer clears once its folder is known; an offer is logged once. The last one fails without the fix.
• store/peer_folder_trust_test.go, store offered games.
• e2e/folder_choice_test.go: a catalogue game arrives before its folder exists; a trusted device's own folder syncs; an offer clears when its folder becomes known.

Seen by hand. Scratch daemons built from dev-public with and without this PR, plus a released 2.4.1. A fresh "Steam Deck" was paired with a "Gaming PC" that had Terraria (at the catalogue's folder) and Celeste (a plain folder).

• dev-public: both wait on Home. The other device's sync attempts log the offer six times in a minute.
• This PR: Terraria sets itself up at the Deck's own catalogue folder, and its save arrives. Celeste waits on Home and is logged once. After "Trust it to choose folders" (confirm dialog shown), Celeste goes where the PC named it. The 2.4.1 device still offers everything, as it does today.

Checks:

• With Games from your other devices set themselves up again; trust your own devices to choose folders #132, Device settings take the catalogue once it is indexed, without a restart #133 and Watcher: list a folder without blocking its removal (restores failing since #100) #134 merged onto dev-public (951cee6), the full Windows unit and e2e suites pass, with one exception: TestBuildManifest_SurvivesFilesVanishingDuringTheWalk (delta), which fails in over half of runs on this PC on dev-public and dev alike and isn't touched here. After Games from your other devices set themselves up again; trust your own devices to choose folders #132's last commit (a fix to how the catalogue check reads the index after a rebuild), presets, p2p, daemon and api and the folder, offer and rollback e2e tests were run again, and pass.
• -race on Linux (WSL Ubuntu) passes for presets, daemon, p2p/..., api, store, cliapp, fsx, watcher and snapshot, and for the folder, offer and rollback e2e tests. TestSignIn_AnOldAttemptsTimerLeavesTheNewListener once reported a data race in its cleanup; it does the same on plain dev-public.
• Merged one at a time with every open PR against dev-public (sync: a peer that pulled says what it now holds, so the base is recorded at once #51, Let a wails dev window reach its daemon #87, Deck: a game's start waits for its save, and its play is told to the daemon #109, sync: a game being played is held back from syncing until the session ends #117, device settings: find a game's settings by what they hold, and give back what is a save #118, i18n: extract the conflict modals and the Settings page #124, Track game: the games running now come first #126, A game tracked without an App ID is offered its game database link #127, sessions: see protected games and games installed anywhere; a safety net for the rest #128, fix(daemon): fail-closed game ownership checks and transactional path admission #131): no conflicts, and each merge builds and vets.
• sync: batch small files, skip unchanged manifests, probe presence on its own #26 and sync: closest devices first, by measured link speed #27 already conflict with dev-public; this PR adds no file to those conflicts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
open-save	Ready	Preview	Oct 27, 2026 9:50pm UTC