[TrentChou]

A Sublime-style local text editor shared live with the Agent: MCP tools read, edit, create and save the same buffers the user sees, and review highlights (lines, character ranges or exact snippets, with notes) overlay code without touching files. Highlight lifetime is a user switch: gone once the code is edited or the file closed, or kept until cleared (also across restarts).

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[MyPrototypeWhat]

Update: we've adjusted our review bar. Reaching files outside the sidebar folders is no longer something we block on, so the symlink point below is now a suggestion. Nothing here blocks merging from my side.

Thanks for contributing this editor! Overall it's in great shape: locally on Node 22, npm run check passed; I also started the service and exercised it with headless Chrome and MCP tools. Agent edits show up live, highlight/annotation cards work, save_file refuses to overwrite on external conflicts, binary files are rejected for open, Host/Origin checks work, and repeated page refreshes don't accumulate SSE connections. I also confirmed this PR merges cleanly with the in-flight check-rules update (#24) and that checks still pass.

Suggestions (non-blocking)

1. Symlinks (suggestion, does not block merging). Agent tools can get past the "sidebar folders only" and "reject credential files" rules via symlinks, and they can write. resolvePath() and isSensitivePath() only check the literal path; later reads/writes follow the link. With only proj/ in the sidebar locally:

   • proj/src/notes.txt -> ~/.ssh/id_rsa: read_file returns the private key; write_file (save: true) overwrites ~/.ssh/id_rsa;
   • proj/linkdir -> ~: create_file proj/linkdir/.ssh/authorized_keys creates a file outside the sidebar;
   • create_file / save_file also skip the credential check — create_file proj/.env.local and save_file proj/.env both succeed.

   Today the README promises more than the code does. Either realpath the path (or the nearest existing parent) before the sidebar-membership and sensitivity checks, and apply the same checks on create/save; or say in README ## Data & access that the folder and credential-file limits apply to literal paths and don't follow symlinks.

2. editor-service.mjs:257 walks two levels up from dataDir to find the hook-written active-workspace. Only context.dataDir is a documented location, so consider a README note, or a log when the read fails, so this doesn't fail silently.

3. If convenient, put the isolation/runtime tests mentioned in the README into tests/ for regression.

[MyPrototypeWhat]

Suggestion (non-blocking): this only does a literal resolve(). A symlink inside a sidebar folder that points outside (e.g. to ~/.ssh/id_rsa) still passes inFolders and isSensitivePath, and later I/O follows the link. I reproduced with read_file / write_file locally. Consider realpath-ing existing paths (or the nearest existing parent) here before those two checks, or noting in README ## Data & access that these limits apply to literal paths and don't follow symlinks.