From a7b671444186fb8cfcc3c1c18de3d71ebd691c33 Mon Sep 17 00:00:00 2001
From: CatoPaus <cato@umbrellacorp.no>
Date: Thu, 25 Dec 2025 14:54:09 +0100
Subject: [PATCH 1/2] feat: add open working directory button to header

---
 src/app/api/open-directory/route.ts | 49 +++++++++++++++++++++++++++++
 src/components/Header.tsx           | 35 +++++++++++++++++++++
 2 files changed, 84 insertions(+)
 create mode 100644 src/app/api/open-directory/route.ts

diff --git a/src/app/api/open-directory/route.ts b/src/app/api/open-directory/route.ts
new file mode 100644
index 0000000..9786756
--- /dev/null
+++ b/src/app/api/open-directory/route.ts
@@ -0,0 +1,49 @@
+
+import { NextRequest, NextResponse } from "next/server";
+import { exec } from "child_process";
+import { promisify } from "util";
+import os from "os";
+
+const execAsync = promisify(exec);
+
+export async function POST(req: NextRequest) {
+    try {
+        const body = await req.json();
+        const { path } = body;
+
+        if (!path) {
+            return NextResponse.json(
+                { success: false, error: "Path is required" },
+                { status: 400 }
+            );
+        }
+
+        let command = "";
+        const platform = os.platform();
+
+        switch (platform) {
+            case "darwin":
+                command = `open "${path}"`;
+                break;
+            case "win32":
+                command = `explorer "${path}"`;
+                break;
+            case "linux":
+                command = `xdg-open "${path}"`;
+                break;
+            default:
+                // Fallback for other Unix-like systems, might not work everywhere
+                command = `xdg-open "${path}"`;
+        }
+
+        await execAsync(command);
+
+        return NextResponse.json({ success: true });
+    } catch (error) {
+        console.error("Failed to open directory:", error);
+        return NextResponse.json(
+            { success: false, error: "Failed to open directory" },
+            { status: 500 }
+        );
+    }
+}
diff --git a/src/components/Header.tsx b/src/components/Header.tsx
index 9c0e722..8182308 100644
--- a/src/components/Header.tsx
+++ b/src/components/Header.tsx
@@ -77,6 +77,22 @@ export function Header() {
     }, 50);
   };
 
+  const handleOpenDirectory = async () => {
+    if (!saveDirectoryPath) return;
+
+    try {
+      await fetch("/api/open-directory", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ path: saveDirectoryPath }),
+      });
+    } catch (error) {
+      console.error("Failed to open directory:", error);
+    }
+  };
+
   return (
     <>
       <ProjectSetupModal
@@ -126,6 +142,25 @@ export function Header() {
                     <span className="absolute -top-0.5 -right-0.5 w-2 h-2 rounded-full bg-red-500" />
                   )}
                 </button>
+                <button
+                  onClick={handleOpenDirectory}
+                  className="p-1 text-neutral-400 hover:text-neutral-200 transition-colors"
+                  title="Open Project Folder"
+                >
+                  <svg
+                    className="w-4 h-4"
+                    fill="none"
+                    viewBox="0 0 24 24"
+                    stroke="currentColor"
+                    strokeWidth={2}
+                  >
+                    <path
+                      strokeLinecap="round"
+                      strokeLinejoin="round"
+                      d="M2.25 12.75V12A2.25 2.25 0 0 1 4.5 9.75h15A2.25 2.25 0 0 1 21.75 12v.75m-8.69-6.44-2.12-2.12a1.5 1.5 0 0 0-1.061-.44H4.5A2.25 2.25 0 0 0 2.25 6v12a2.25 2.25 0 0 0 2.25 2.25h15A2.25 2.25 0 0 0 21.75 18V9a2.25 2.25 0 0 0-2.25-2.25h-5.379a1.5 1.5 0 0 1-1.06-.44Z"
+                    />
+                  </svg>
+                </button>
                 <button
                   onClick={handleOpenSettings}
                   className="p-1 text-neutral-400 hover:text-neutral-200 transition-colors"

From 5560aecf943ccaeac2fa22f5e8c74926113f5938 Mon Sep 17 00:00:00 2001
From: CatoPaus <cato@umbrellacorp.no>
Date: Thu, 25 Dec 2025 15:16:14 +0100
Subject: [PATCH 2/2] fix: address PR feedback (security & UX)

---
 src/app/api/open-directory/route.ts | 21 ++++++++-----
 src/components/Header.tsx           | 49 ++++++++++++++++++-----------
 2 files changed, 43 insertions(+), 27 deletions(-)

diff --git a/src/app/api/open-directory/route.ts b/src/app/api/open-directory/route.ts
index 9786756..1b6ad73 100644
--- a/src/app/api/open-directory/route.ts
+++ b/src/app/api/open-directory/route.ts
@@ -1,10 +1,10 @@
 
 import { NextRequest, NextResponse } from "next/server";
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import os from "os";
 
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 export async function POST(req: NextRequest) {
     try {
@@ -19,24 +19,29 @@ export async function POST(req: NextRequest) {
         }
 
         let command = "";
+        let args: string[] = [];
         const platform = os.platform();
 
         switch (platform) {
             case "darwin":
-                command = `open "${path}"`;
+                command = "open";
+                args = [path];
                 break;
             case "win32":
-                command = `explorer "${path}"`;
+                command = "explorer";
+                args = [path];
                 break;
             case "linux":
-                command = `xdg-open "${path}"`;
+                command = "xdg-open";
+                args = [path];
                 break;
             default:
-                // Fallback for other Unix-like systems, might not work everywhere
-                command = `xdg-open "${path}"`;
+                // Fallback for other Unix-like systems
+                command = "xdg-open";
+                args = [path];
         }
 
-        await execAsync(command);
+        await execFileAsync(command, args);
 
         return NextResponse.json({ success: true });
     } catch (error) {
diff --git a/src/components/Header.tsx b/src/components/Header.tsx
index 8182308..86d1e45 100644
--- a/src/components/Header.tsx
+++ b/src/components/Header.tsx
@@ -81,15 +81,24 @@ export function Header() {
     if (!saveDirectoryPath) return;
 
     try {
-      await fetch("/api/open-directory", {
+      const response = await fetch("/api/open-directory", {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
         },
         body: JSON.stringify({ path: saveDirectoryPath }),
       });
+
+      const result = await response.json();
+
+      if (!response.ok || !result.success) {
+        console.error("Failed to open directory:", result.error);
+        alert(`Failed to open project folder: ${result.error || "Unknown error"}`);
+        return;
+      }
     } catch (error) {
       console.error("Failed to open directory:", error);
+      alert("Failed to open project folder. Please try again.");
     }
   };
 
@@ -142,25 +151,27 @@ export function Header() {
                     <span className="absolute -top-0.5 -right-0.5 w-2 h-2 rounded-full bg-red-500" />
                   )}
                 </button>
-                <button
-                  onClick={handleOpenDirectory}
-                  className="p-1 text-neutral-400 hover:text-neutral-200 transition-colors"
-                  title="Open Project Folder"
-                >
-                  <svg
-                    className="w-4 h-4"
-                    fill="none"
-                    viewBox="0 0 24 24"
-                    stroke="currentColor"
-                    strokeWidth={2}
+                {saveDirectoryPath && (
+                  <button
+                    onClick={handleOpenDirectory}
+                    className="p-1 text-neutral-400 hover:text-neutral-200 transition-colors"
+                    title="Open Project Folder"
                   >
-                    <path
-                      strokeLinecap="round"
-                      strokeLinejoin="round"
-                      d="M2.25 12.75V12A2.25 2.25 0 0 1 4.5 9.75h15A2.25 2.25 0 0 1 21.75 12v.75m-8.69-6.44-2.12-2.12a1.5 1.5 0 0 0-1.061-.44H4.5A2.25 2.25 0 0 0 2.25 6v12a2.25 2.25 0 0 0 2.25 2.25h15A2.25 2.25 0 0 0 21.75 18V9a2.25 2.25 0 0 0-2.25-2.25h-5.379a1.5 1.5 0 0 1-1.06-.44Z"
-                    />
-                  </svg>
-                </button>
+                    <svg
+                      className="w-4 h-4"
+                      fill="none"
+                      viewBox="0 0 24 24"
+                      stroke="currentColor"
+                      strokeWidth={2}
+                    >
+                      <path
+                        strokeLinecap="round"
+                        strokeLinejoin="round"
+                        d="M2.25 12.75V12A2.25 2.25 0 0 1 4.5 9.75h15A2.25 2.25 0 0 1 21.75 12v.75m-8.69-6.44-2.12-2.12a1.5 1.5 0 0 0-1.061-.44H4.5A2.25 2.25 0 0 0 2.25 6v12a2.25 2.25 0 0 0 2.25 2.25h15A2.25 2.25 0 0 0 21.75 18V9a2.25 2.25 0 0 0-2.25-2.25h-5.379a1.5 1.5 0 0 1-1.06-.44Z"
+                      />
+                    </svg>
+                  </button>
+                )}
                 <button
                   onClick={handleOpenSettings}
                   className="p-1 text-neutral-400 hover:text-neutral-200 transition-colors"