René's URL Explorer Experiment


Title: feat(cli): enforce /add-dir via sandbox writable roots (⚠ security — please review) by oratis · Pull Request #166 · oratis/deepcode · GitHub

Open Graph Title: feat(cli): enforce /add-dir via sandbox writable roots (⚠ security — please review) by oratis · Pull Request #166 · oratis/deepcode

X Title: feat(cli): enforce /add-dir via sandbox writable roots (⚠ security — please review) by oratis · Pull Request #166 · oratis/deepcode

Description: Security-sensitive — opening for review, not auto-merging. /add-dir only printed a message; settings.permissions.additionalDirectories was declared but consumed nowhere. Now: /add-dir validates the path is an existing directory and persists it to permissions.additionalDirectories (deduped) in the user settings; with no args it lists the current set. New core helper withAdditionalWritableDirs(sandbox, dirs) folds those dirs into the sandbox's filesystem.allowWrite. The REPL + headless build their sandboxConfig through it, so the sandboxed Bash tool can write to added dirs (beyond cwd). No-op when the sandbox is off; never mutates input. Why this is the right boundary The file tools (Read/Write/Edit/Glob/Grep) already accept any absolute path () — there's no cwd containment to "enforce". The only thing that restricts writes is the sandbox (for Bash). So /add-dir enforcement = expanding the sandbox's writable roots, which is exactly the user's intent. That's the security-relevant change — hence review. Tests withAdditionalWritableDirs (add / dedup / undefined-safe / seeds empty) + /add-dir (persist validated dir / reject missing / list). core 646 · cli 143, typecheck + format:check clean. 🤖 Generated with Claude Code

Open Graph Description: Security-sensitive — opening for review, not auto-merging. /add-dir only printed a message; settings.permissions.additionalDirectories was declared but consumed nowhere. Now: /add-dir <path>...

X Description: Security-sensitive — opening for review, not auto-merging. /add-dir only printed a message; settings.permissions.additionalDirectories was declared but consumed nowhere. Now: /add-dir &lt;path...

Opengraph URL: https://github.com/oratis/deepcode/pull/166

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:278679ca-b34e-f622-9e54-a00a56f63308
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idBB1A:3BF792:771564:A18597:6A4D452E
html-safe-nonceb4022d72ec5a5882c04e8f806b304585a607c9ebfe861fbdf539c0fb10de15fd
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJCQjFBOjNCRjc5Mjo3NzE1NjQ6QTE4NTk3OjZBNEQ0NTJFIiwidmlzaXRvcl9pZCI6IjkxNDAxMjkzODc2ODg4Mzg0NDYiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==
visitor-hmaceda0ba08f9814bf472c4f8ee751c63ad00ed536001326aed54f8294be8b570e4
hovercard-subject-tagpull_request:3818509552
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/oratis/deepcode/pull/166/files
twitter:imagehttps://avatars.githubusercontent.com/u/1140143?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/1140143?s=400&v=4
og:image:altSecurity-sensitive — opening for review, not auto-merging. /add-dir only printed a message; settings.permissions.additionalDirectories was declared but consumed nowhere. Now: /add-dir <path>...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None92571a8944142227b7e19cd10918b1ddd06e5066c1ad5bc7e4769cf6140a87e6
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/oratis/deepcode git https://github.com/oratis/deepcode.git
octolytics-dimension-user_id1140143
octolytics-dimension-user_loginoratis
octolytics-dimension-repository_id1251330559
octolytics-dimension-repository_nwooratis/deepcode
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id1251330559
octolytics-dimension-repository_network_root_nwooratis/deepcode
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release56fc8347865a14e2ec811533d68f929cf4e0ec19
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/oratis/deepcode/pull/166/files#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Foratis%2Fdeepcode%2Fpull%2F166%2Ffiles
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Foratis%2Fdeepcode%2Fpull%2F166%2Ffiles
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=oratis%2Fdeepcode
Reloadhttps://github.com/oratis/deepcode/pull/166/files
Reloadhttps://github.com/oratis/deepcode/pull/166/files
Reloadhttps://github.com/oratis/deepcode/pull/166/files
oratis https://github.com/oratis
deepcodehttps://github.com/oratis/deepcode
Notifications https://github.com/login?return_to=%2Foratis%2Fdeepcode
Fork 0 https://github.com/login?return_to=%2Foratis%2Fdeepcode
Star 1 https://github.com/login?return_to=%2Foratis%2Fdeepcode
Code https://github.com/oratis/deepcode
Issues 0 https://github.com/oratis/deepcode/issues
Pull requests 9 https://github.com/oratis/deepcode/pulls
Actions https://github.com/oratis/deepcode/actions
Projects https://github.com/oratis/deepcode/projects
Security and quality 0 https://github.com/oratis/deepcode/security
Insights https://github.com/oratis/deepcode/pulse
Code https://github.com/oratis/deepcode
Issues https://github.com/oratis/deepcode/issues
Pull requests https://github.com/oratis/deepcode/pulls
Actions https://github.com/oratis/deepcode/actions
Projects https://github.com/oratis/deepcode/projects
Security and quality https://github.com/oratis/deepcode/security
Insights https://github.com/oratis/deepcode/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Foratis%2Fdeepcode%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Foratis%2Fdeepcode%2Fissues%2Fnew%2Fchoose
oratishttps://github.com/oratis
mainhttps://github.com/oratis/deepcode/tree/main
feat/cli-add-dir-enforcehttps://github.com/oratis/deepcode/tree/feat/cli-add-dir-enforce
Conversation 0 https://github.com/oratis/deepcode/pull/166
Commits 1 https://github.com/oratis/deepcode/pull/166/commits
Checks 3 https://github.com/oratis/deepcode/pull/166/checks
Files changed https://github.com/oratis/deepcode/pull/166/files
Please reload this pagehttps://github.com/oratis/deepcode/pull/166/files
feat(cli): enforce /add-dir via sandbox writable roots (⚠ security — please review) https://github.com/oratis/deepcode/pull/166/files#top
Show all changes 1 commit https://github.com/oratis/deepcode/pull/166/files
843b036 feat(cli): enforce /add-dir via sandbox writable roots (security-sens… Jun 7, 2026 https://github.com/oratis/deepcode/pull/166/commits/843b036b38671532339577b7eb88c9ad22cbf284
Clear filters https://github.com/oratis/deepcode/pull/166/files
Please reload this pagehttps://github.com/oratis/deepcode/pull/166/files
Please reload this pagehttps://github.com/oratis/deepcode/pull/166/files
commands.ts https://github.com/oratis/deepcode/pull/166/files#diff-fdaca6f074ecd3059014d4b9211cad78279ba25dc252e68dd1aef95b0aea8182
headless.ts https://github.com/oratis/deepcode/pull/166/files#diff-1ae456fde98b58b55a110fc96c7144ffd615c09eb871cab87a5922fcdeb11b8d
parity-commands.test.ts https://github.com/oratis/deepcode/pull/166/files#diff-11ca280b321cab48a8810c5f48ff37bc1e0d2ee96e35bd03abac71f2b77ce41b
repl.ts https://github.com/oratis/deepcode/pull/166/files#diff-6e3a7c0b235cafd437014c1a5eb204887acf649fae0063be8eee5011f5ee3342
BEHAVIOR_PARITY.md https://github.com/oratis/deepcode/pull/166/files#diff-6c5f2446d227fa9764b119b85311e8dcfcd947b6465e1408f301a027cde3706d
index.ts https://github.com/oratis/deepcode/pull/166/files#diff-9a4ceebe7c6f86856371906c3f061d3b56b7457022b05179884a113e7ced67e8
additional-dirs.test.ts https://github.com/oratis/deepcode/pull/166/files#diff-0d0069acb981f45615d5da687c34cec94715654edbac520a9e4efbd2f9752b7c
index.ts https://github.com/oratis/deepcode/pull/166/files#diff-8952684ef0795a2423dbc2f262b9f057cd336efcdb923aa75cd1f84f8a9181b7
apps/cli/src/commands.tshttps://github.com/oratis/deepcode/pull/166/files#diff-fdaca6f074ecd3059014d4b9211cad78279ba25dc252e68dd1aef95b0aea8182
View file https://github.com/oratis/deepcode/blob/843b036b38671532339577b7eb88c9ad22cbf284/apps/cli/src/commands.ts
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/oratis/deepcode/pull/166/{{ revealButtonHref }}
https://github.com/oratis/deepcode/pull/166/files#diff-fdaca6f074ecd3059014d4b9211cad78279ba25dc252e68dd1aef95b0aea8182
https://github.com/oratis/deepcode/pull/166/files#diff-fdaca6f074ecd3059014d4b9211cad78279ba25dc252e68dd1aef95b0aea8182
https://github.com/oratis/deepcode/pull/166/files#diff-fdaca6f074ecd3059014d4b9211cad78279ba25dc252e68dd1aef95b0aea8182
https://github.com/oratis/deepcode/pull/166/files#diff-fdaca6f074ecd3059014d4b9211cad78279ba25dc252e68dd1aef95b0aea8182
apps/cli/src/headless.tshttps://github.com/oratis/deepcode/pull/166/files#diff-1ae456fde98b58b55a110fc96c7144ffd615c09eb871cab87a5922fcdeb11b8d
View file https://github.com/oratis/deepcode/blob/843b036b38671532339577b7eb88c9ad22cbf284/apps/cli/src/headless.ts
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/oratis/deepcode/pull/166/{{ revealButtonHref }}
https://github.com/oratis/deepcode/pull/166/files#diff-1ae456fde98b58b55a110fc96c7144ffd615c09eb871cab87a5922fcdeb11b8d
https://github.com/oratis/deepcode/pull/166/files#diff-1ae456fde98b58b55a110fc96c7144ffd615c09eb871cab87a5922fcdeb11b8d
https://github.com/oratis/deepcode/pull/166/files#diff-1ae456fde98b58b55a110fc96c7144ffd615c09eb871cab87a5922fcdeb11b8d
https://github.com/oratis/deepcode/pull/166/files#diff-1ae456fde98b58b55a110fc96c7144ffd615c09eb871cab87a5922fcdeb11b8d
apps/cli/src/parity-commands.test.tshttps://github.com/oratis/deepcode/pull/166/files#diff-11ca280b321cab48a8810c5f48ff37bc1e0d2ee96e35bd03abac71f2b77ce41b
View file https://github.com/oratis/deepcode/blob/843b036b38671532339577b7eb88c9ad22cbf284/apps/cli/src/parity-commands.test.ts
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/oratis/deepcode/pull/166/{{ revealButtonHref }}
https://github.com/oratis/deepcode/pull/166/files#diff-11ca280b321cab48a8810c5f48ff37bc1e0d2ee96e35bd03abac71f2b77ce41b
apps/cli/src/repl.tshttps://github.com/oratis/deepcode/pull/166/files#diff-6e3a7c0b235cafd437014c1a5eb204887acf649fae0063be8eee5011f5ee3342
View file https://github.com/oratis/deepcode/blob/843b036b38671532339577b7eb88c9ad22cbf284/apps/cli/src/repl.ts
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/oratis/deepcode/pull/166/{{ revealButtonHref }}
https://github.com/oratis/deepcode/pull/166/files#diff-6e3a7c0b235cafd437014c1a5eb204887acf649fae0063be8eee5011f5ee3342
https://github.com/oratis/deepcode/pull/166/files#diff-6e3a7c0b235cafd437014c1a5eb204887acf649fae0063be8eee5011f5ee3342
https://github.com/oratis/deepcode/pull/166/files#diff-6e3a7c0b235cafd437014c1a5eb204887acf649fae0063be8eee5011f5ee3342
https://github.com/oratis/deepcode/pull/166/files#diff-6e3a7c0b235cafd437014c1a5eb204887acf649fae0063be8eee5011f5ee3342
Please reload this pagehttps://github.com/oratis/deepcode/pull/166/files
Please reload this pagehttps://github.com/oratis/deepcode/pull/166/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.