Opening a coding agent in a folder the attacker chose

A crafted link can make a desktop app launch a coding-agent CLI inside a directory the attacker controls. The victim only has to click the app's normal "open in terminal?" prompt. Once the agent starts in that folder and the victim trusts it, the folder's config files can run commands on the victim's machine.

The whole bug is one missing check. The app makes sure the folder exists, but never asks whether the folder is yours.

The feature#

The app has an "Open in Terminal" button. You're looking at some item, an issue or a task or a piece of context, and you want to hack on it locally, so the app opens a coding-agent CLI (think Claude Code, Aider, or similar) in a folder of your choosing. Normally you pick that folder yourself. The app pops the native OS folder picker, you choose a project directory, and the CLI starts there.