Context
Dogfood filesystem traversal and risky-code recipes found central traversal and destructive directory operation sites.
Evidence
- Filesystem traversal calls are centralized in
FileSystemTraversalPolicy.cs.
- Risk recipes also surfaced directory deletion operations in command and probe paths.
Additional dogfood evidence
Path.GetFullPath appears around 142 times across 59 production files. Hot clusters include FileIndexer, DbPathResolver, export/import, IndexCommandRunner, LspServer, GitHelper, ProgramRunner, QueryCommandRunner, and MCP tool handlers.Path.GetRelativePath appears around 39 times across 17 production files, concentrated in FileIndexer, IndexCommandRunner, SolutionProjectResolver, and MCP tool handlers.- URI construction appears broadly (
Uri( around 112 hits across 35 files, Uri.TryCreate around 7 hits across 6 files), including MCP, LSP, DB command, FileUriPolicy, and path-boundary code.
- Broad
StartsWith( searches still produce around 371 hits across 121 files. Some are path-prefix checks, some are protocol or CLI-token checks, and some are ordinary string matching; the audit needs to separate those categories.
filesystem-traversal --format count reported traversal evidence in src/CodeIndex/FileSystemTraversalPolicy.cs, including Directory.EnumerateFiles, EnumerateDirectories, EnumerateFileSystemEntries, and EnumerationOptions.- The risky-code recipe counted
Directory.Delete in DbCommandRunner, ExportImportCommandRunner, ProgramRunner, and CaseSensitivityProbeDirectory paths.
- Follow-up candidates include ignore-file TOCTOU behavior, symlink/dangling entry handling, cleanup failure diagnostics, and generated/source detector boundaries.
Risk
Traversal, canonicalization, URI conversion, and deletion boundaries need explicit cancellation, budget, symlink/inaccessible-path behavior, case-sensitivity behavior, cleanup behavior, and error taxonomy.
Suggested direction
Extend the traversal policy with budget/cancellation/error semantics and ensure destructive directory operations go through reviewed helpers. Add path/URI boundary helpers or audit recipes that classify full-path normalization, relative-path creation, URI parsing, prefix checks, symlink/dangling behavior, and cleanup operations by semantic category.
2026-06-28 follow-up: data-directory and traversal helper evidence
Additional dogfooding found filesystem boundary helpers beyond direct traversal calls:
DataDirectorySecurity and GetTempPath are high-reference surfaces.ExclusiveFileLock.Open, LongPath, and test cleanup helpers appear in hotspot output.- Test fixture helpers repeatedly create, write, and delete temporary project trees.
The destructive-operation policy should include data-dir permission enforcement, lock-file placement, temp root selection, long-path normalization, fixture cleanup containment, and consistent symlink/reparse handling.
2026-06-28 follow-up: scanner traversal and platform-probe inventory
The scanner hotspot pass added more traversal-related evidence:
CollectProjectMarkerFiles and LoadGitSubmodulePaths are sizable scanner traversal helpers.CanReadDirectory, EnumerateIndexableFilesInDirectory, TryRecordNonRecursiveSubdirectory, and BuildAncestorIgnoreDirectories sit on the directory-enumeration boundary.CaseSensitivityProbeDirectory, ProbePathScope, LinuxStat, MacStat, and TryGetWindowsFileIdentity show that traversal policy also owns platform identity/probe behavior.
This strengthens the case for a traversal contract that covers marker discovery, submodules, ignore ancestors, unreadable directories, platform stat/probe failures, and non-recursive skipped-directory diagnostics together.
Context
Dogfood filesystem traversal and risky-code recipes found central traversal and destructive directory operation sites.
Evidence
FileSystemTraversalPolicy.cs.Additional dogfood evidence
Path.GetFullPathappears around 142 times across 59 production files. Hot clusters includeFileIndexer,DbPathResolver, export/import,IndexCommandRunner,LspServer,GitHelper,ProgramRunner,QueryCommandRunner, and MCP tool handlers.Path.GetRelativePathappears around 39 times across 17 production files, concentrated inFileIndexer,IndexCommandRunner,SolutionProjectResolver, and MCP tool handlers.Uri(around 112 hits across 35 files,Uri.TryCreatearound 7 hits across 6 files), including MCP, LSP, DB command,FileUriPolicy, and path-boundary code.StartsWith(searches still produce around 371 hits across 121 files. Some are path-prefix checks, some are protocol or CLI-token checks, and some are ordinary string matching; the audit needs to separate those categories.filesystem-traversal --format countreported traversal evidence insrc/CodeIndex/FileSystemTraversalPolicy.cs, includingDirectory.EnumerateFiles,EnumerateDirectories,EnumerateFileSystemEntries, andEnumerationOptions.Directory.DeleteinDbCommandRunner,ExportImportCommandRunner,ProgramRunner, andCaseSensitivityProbeDirectorypaths.Risk
Traversal, canonicalization, URI conversion, and deletion boundaries need explicit cancellation, budget, symlink/inaccessible-path behavior, case-sensitivity behavior, cleanup behavior, and error taxonomy.
Suggested direction
Extend the traversal policy with budget/cancellation/error semantics and ensure destructive directory operations go through reviewed helpers. Add path/URI boundary helpers or audit recipes that classify full-path normalization, relative-path creation, URI parsing, prefix checks, symlink/dangling behavior, and cleanup operations by semantic category.
2026-06-28 follow-up: data-directory and traversal helper evidence
Additional dogfooding found filesystem boundary helpers beyond direct traversal calls:
DataDirectorySecurityandGetTempPathare high-reference surfaces.ExclusiveFileLock.Open,LongPath, and test cleanup helpers appear in hotspot output.The destructive-operation policy should include data-dir permission enforcement, lock-file placement, temp root selection, long-path normalization, fixture cleanup containment, and consistent symlink/reparse handling.
2026-06-28 follow-up: scanner traversal and platform-probe inventory
The scanner hotspot pass added more traversal-related evidence:
CollectProjectMarkerFilesandLoadGitSubmodulePathsare sizable scanner traversal helpers.CanReadDirectory,EnumerateIndexableFilesInDirectory,TryRecordNonRecursiveSubdirectory, andBuildAncestorIgnoreDirectoriessit on the directory-enumeration boundary.CaseSensitivityProbeDirectory,ProbePathScope,LinuxStat,MacStat, andTryGetWindowsFileIdentityshow that traversal policy also owns platform identity/probe behavior.This strengthens the case for a traversal contract that covers marker discovery, submodules, ignore ancestors, unreadable directories, platform stat/probe failures, and non-recursive skipped-directory diagnostics together.