Restrict CSS mirror writes to workspace

[Vidal Ortega (vidorteg)]

Restrict CSS mirror writes to workspace

[Copilot]

🟢 Approval recommended

The changes correctly restrict CSS mirroring writes to trusted roots and include targeted tests covering both allowed and blocked paths.

Pull request overview

This PR hardens the CSS mirroring feature so that stylesheet writes initiated by the inspected page cannot write to arbitrary filesystem locations, and are instead restricted to trusted local roots (workspace folders, or the target file’s directory for single-file debugging).

Changes:

• Add a “trusted root” guard to CSS mirroring that blocks writes outside the workspace (and blocks path traversal escapes).
• Define trusted roots as the opened workspace folder(s), with a fallback to the target file’s directory when debugging a single local file.
• Update and extend unit tests/mocks to validate both allowed (in-workspace) and blocked (out-of-workspace / traversal) mirroring scenarios.

File summaries

File	Description
src/devtoolsPanel.ts	Adds trusted-root computation and enforcement for CSS mirror writes.
test/devtoolsPanel.test.ts	Updates existing CSS mirroring test and adds negative tests for out-of-workspace + traversal paths.
test/helpers/helpers.ts	Adjusts VS Code workspace folder mock shape to include uri.fsPath needed by the new trusted-root logic.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.