Skip to content

feat(files): add delete action to file explorer#2691

Open
arnestrickmann wants to merge 1 commit into
mainfrom
arne/eng-1672-add-delete-action-for-files-and-folders-in-file-explorer
Open

feat(files): add delete action to file explorer#2691
arnestrickmann wants to merge 1 commit into
mainfrom
arne/eng-1672-add-delete-action-for-files-and-folders-in-file-explorer

Conversation

@arnestrickmann

Copy link
Copy Markdown
Contributor

Summary

  • Add a destructive Delete action to file explorer context menus for files and folders.
  • Confirm deletion before removing workspace items.
  • Forward recursive delete options through the filesystem RPC and cover local recursive folder deletion with a test.

Impact

Users can remove files or whole folders directly from the file explorer. Folder deletion removes the selected folder and its contents, updates the tree, and closes deleted file tabs across split panes.

Validation

  • corepack pnpm exec oxfmt --check src/main/core/fs/controller.ts src/main/core/fs/impl/local-fs.test.ts src/renderer/features/tasks/editor/editor-file-tree.tsx
  • corepack pnpm exec oxlint src/main/core/fs/controller.ts src/main/core/fs/impl/local-fs.test.ts src/renderer/features/tasks/editor/editor-file-tree.tsx
  • corepack pnpm exec vitest run --project node src/main/core/fs/impl/local-fs.test.ts
  • corepack pnpm run typecheck

@arnestrickmann arnestrickmann marked this pull request as ready for review June 26, 2026 14:33
@greptile-apps

greptile-apps Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR adds deleting files and folders from the file explorer. The main changes are:

  • A Delete item in file and folder context menus.
  • A confirmation modal before destructive deletes.
  • Recursive delete options forwarded through the filesystem RPC.
  • File tree and open-tab cleanup after successful deletion.
  • A local filesystem test for recursive folder removal.

Confidence Score: 4/5

The SSH recursive delete path needs a containment fix before merging.

  • Normal file-tree deletion flow appears consistent for local UI paths.
  • The new recursive option can reach SSH rm -rf with a crafted path containing ...
  • The path should be normalized or rejected before recursive deletion reaches the provider.

apps/emdash-desktop/src/main/core/fs/controller.ts and the SSH filesystem path resolver

Security Review

Recursive delete now reaches SSH workspaces through the RPC path. Crafted paths containing .. can escape the SSH provider's prefix check and delete remote files outside the workspace.

Important Files Changed

Filename Overview
apps/emdash-desktop/src/main/core/fs/controller.ts Forwards recursive delete options to the workspace filesystem, which exposes a remote SSH path-containment bug for crafted RPC paths.
apps/emdash-desktop/src/main/core/fs/impl/local-fs.test.ts Adds coverage for recursive local directory deletion.
apps/emdash-desktop/src/renderer/features/tasks/editor/editor-file-tree.tsx Adds the Delete context menu action, confirmation flow, RPC call, tab cleanup, and file tree update.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
  participant User
  participant UI as File explorer
  participant RPC as removeFile RPC
  participant FS as Workspace filesystem
  participant Store as Tabs and file tree

  User->>UI: Confirm Delete
  UI->>RPC: removeFile(path, recursive)
  RPC->>FS: remove(path, options)
  FS-->>RPC: delete result
  RPC-->>UI: result
  UI->>Store: close deleted file tabs
  UI->>Store: remove deleted node
Loading
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
  participant User
  participant UI as File explorer
  participant RPC as removeFile RPC
  participant FS as Workspace filesystem
  participant Store as Tabs and file tree

  User->>UI: Confirm Delete
  UI->>RPC: removeFile(path, recursive)
  RPC->>FS: remove(path, options)
  FS-->>RPC: delete result
  RPC-->>UI: result
  UI->>Store: close deleted file tabs
  UI->>Store: remove deleted node
Loading
Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
apps/emdash-desktop/src/main/core/fs/controller.ts:125
**Recursive SSH Path Traversal**

Forwarding `recursive` makes this RPC a recursive delete for SSH workspaces too. A crafted renderer RPC path like `subdir/../../../outside` can pass the SSH provider's string-prefix workspace check before the remote shell resolves `..`, so this changed call can turn the new folder-delete option into `rm -rf` outside the workspace.

Reviews (1): Last reviewed commit: "feat(files): add delete action to file e..." | Re-trigger Greptile


try {
const result = await env.fs.remove(filePath);
const result = await env.fs.remove(filePath, options);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Recursive SSH Path Traversal

Forwarding recursive makes this RPC a recursive delete for SSH workspaces too. A crafted renderer RPC path like subdir/../../../outside can pass the SSH provider's string-prefix workspace check before the remote shell resolves .., so this changed call can turn the new folder-delete option into rm -rf outside the workspace.

Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/emdash-desktop/src/main/core/fs/controller.ts
Line: 125

Comment:
**Recursive SSH Path Traversal**

Forwarding `recursive` makes this RPC a recursive delete for SSH workspaces too. A crafted renderer RPC path like `subdir/../../../outside` can pass the SSH provider's string-prefix workspace check before the remote shell resolves `..`, so this changed call can turn the new folder-delete option into `rm -rf` outside the workspace.

How can I resolve this? If you propose a fix, please make it concise.

@arnestrickmann arnestrickmann force-pushed the arne/eng-1672-add-delete-action-for-files-and-folders-in-file-explorer branch from e6467d3 to 64fb860 Compare June 26, 2026 16:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant