[saddlepaddle]

Summary

• Saving a file from the UI failed when the file was outside the workspace root, even though the editor can open it since fix(workspace-fs): allow viewing symlinks outside workspace root #7897.
• writeFile in packages/workspace-fs/src/fs.ts no longer checks root containment. It keeps the atomic write, writes through symlinks, keeps the file mode, and keeps the ifMatch conflict check.
• Create directory, create unique entry, delete, move and copy stay confined to the root.

Why this is safe

The host-service caller can already read any host file and run any command in a terminal, so write confinement was not a real boundary. Related history: #7828 (reverted in #7834), #7897.

Tests

• Flipped 2 unit tests (fs.test.ts) and 2 host-service bug-hunt integration tests from "rejects" to "writes".
• workspace-fs: 45 pass; host-service bug-hunt suites: 35 pass; typecheck clean in both packages.
• Not verified by saving in the running desktop app.

---

Summary by cubic

Allows saving files that live outside the workspace root, or through an in-root symlink pointing outside, which the UI editor previously rejected with "Path is outside workspace root". writeFile in packages/workspace-fs now follows the read policy: the same caller can already read any host file and run terminal commands, so write confinement was not a real boundary.

• Removes the root-containment check from writeFile; create, delete, move, and copy stay confined to the root.
• Keeps atomic writes, symlink resolution, file mode preservation, and the ifMatch conflict check.
• Updates unit and integration tests to expect writes instead of rejections.

^{Written for commit 29fa64d. Summary will update on new commits.}

Summary by CodeRabbit

• Behavior Changes
  • File writes can now target paths outside the workspace, including paths reached through directory symlinks. Existing write options and revision checks remain available.
  • Structural changes, such as creating or removing filesystem entries, remain confined to the workspace.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1d3d27c2-9dad-4b0e-8fc9-1bca4905ec12

📥 Commits

Reviewing files that changed from the base of the PR and between 64b26a9 and 29fa64d.

📒 Files selected for processing (5)

• packages/host-service/test/integration/bug-hunt-2.integration.test.ts
• packages/host-service/test/integration/bug-hunt.integration.test.ts
• packages/workspace-fs/src/fs.test.ts
• packages/workspace-fs/src/fs.ts
• packages/workspace-fs/src/host/service.ts

💤 Files with no reviewable changes (1)

• packages/workspace-fs/src/host/service.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

File writes no longer enforce workspace-root containment. The host service no longer passes the root path to the write helper. Unit and integration tests now verify writes to paths outside the workspace, including through symlinks.

Changes

Host-wide file writes

Layer / File(s)	Summary
Write API and host-service delegation packages/workspace-fs/src/fs.ts, packages/workspace-fs/src/host/service.ts	writeFile no longer accepts rootPath or checks target containment and realpath. writeAtomically no longer checks the temporary file’s parent against the root. The host service omits rootPath when calling writeFile.
Workspace filesystem write tests packages/workspace-fs/src/fs.test.ts	Tests verify writes outside the workspace and through symlinks. Tests also retain coverage for write options, revision preconditions, concurrent writes, and binary content without passing rootPath.
Host-service integration tests packages/host-service/test/integration/bug-hunt*.integration.test.ts	Integration tests verify writes to sibling paths and outside-pointing symlink targets. The suite description states that reads and file edits are host-wide, while structural mutations remain workspace-confined.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Bug fix

Suggested reviewers: kitenite

Merge Risk: ⚪ Minimal · up to 29fa6

Saving outside the workspace, including through symlinks, now matches the intended host-wide editing policy. No actionable merge-blocking issue remains; desktop-app saving has not been verified.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 29fa6

Existing callers already have terminal command access, which limits the additional authority granted by host-wide saves. However, saving a private host file can temporarily expose its contents to another local user when directory permissions and default file permissions allow access. Deployment-specific protections were not established.

Retained concerns

• Medium · security · inferred: Host-wide saves extend an existing temporary-file confidentiality weakness to private host files. Content is written before the original restrictive mode is applied. With a permissive inherited umask and an accessible parent directory, another local user can read that content before chmod; interruption can leave the temporary copy behind. Workspace containment previously rejected these outside targets.

Security review details

Security Blast Radius

• inferred — Direct write exposure now encompasses host paths reachable under the process's effective filesystem permissions, not just one workspace. The temporary-copy concern additionally exposes saved content to local readers where directory accessibility and creation permissions permit it. This does not establish cross-host access or an operating-system privilege escalation.

Security Findings and Attack Paths

• inferred — A legitimate save of an outside private file creates a sibling temporary copy using default creation permissions before restoring the target mode. An independently acting local reader can discover and read that copy if the directory is accessible and the inherited umask permits access. UUID naming does not prevent directory enumeration. Final chmod and cleanup reduce the window, but process termination before either completes can leave exposed content. This is a broadened exposure of an existing sequence, not a verified exploit in a production environment.

Trust Boundaries and Controls

• inferred — The inspected callers already expose command execution under the same authentication or desktop procedure boundary, providing strong counterevidence to a new caller-authority escalation. Host-wide reads alone would not establish write authority; the terminal command paths are the decisive counterevidence. This conclusion is bounded to the inspected application paths and does not establish external gateway policies.

Hardening Proposals

• proposed — Create temporary files exclusively with restrictive permissions before writing any content, and apply the intended final mode before rename. This would protect private content during normal writes, partial failures, and interruption rather than relying on a later chmod or inherited umask.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: allowing files outside the workspace root to be saved. It uses the required conventional commit format.
Description check	✅ Passed	The description explains what changed, why it changed, safety considerations, preserved behavior, test results, and one unverified scenario. It provides equivalent Summary, Why, and Tests sections, al…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🧹 Preview Cleanup Complete

The following preview resources have been cleaned up:

• ✅ Neon database branch

Thank you for your contribution! 🎉