From fc487b7e37c0ab2ae45f320620e929c3eaebce27 Mon Sep 17 00:00:00 2001
From: Jinwoo-H <jinwoo0825@gmail.com>
Date: Fri, 24 Apr 2026 18:46:21 -0400
Subject: [PATCH] fix(ssh): skip all hidden directories in readdir fallback

The shouldDescend guard had a dead-code branch that only skipped
blocklisted dotdirs. Arbitrary hidden directories like .aws, .ssh,
and .env were still descended into, leaking sensitive paths into
quick-open results.
---
 src/relay/fs-handler-readdir-fallback.ts | 22 +---------------------
 1 file changed, 1 insertion(+), 21 deletions(-)

diff --git a/src/relay/fs-handler-readdir-fallback.ts b/src/relay/fs-handler-readdir-fallback.ts
index a0422b7dbf5..ba39837ca8e 100644
--- a/src/relay/fs-handler-readdir-fallback.ts
+++ b/src/relay/fs-handler-readdir-fallback.ts
@@ -12,28 +12,8 @@ import { join, relative } from 'path'
 const MAX_FILES = 10_000
 const TIMEOUT_MS = 10_000
 
-const HIDDEN_DIR_BLOCKLIST = new Set([
-  '.git',
-  '.next',
-  '.nuxt',
-  '.cache',
-  '.stably',
-  '.vscode',
-  '.idea',
-  '.yarn',
-  '.pnpm-store',
-  '.terraform',
-  '.docker',
-  '.husky'
-])
-
 function shouldDescend(name: string): boolean {
-  if (name === 'node_modules' || HIDDEN_DIR_BLOCKLIST.has(name)) {
-    return false
-  }
-  // Skip hidden directories (dotfiles other than those in the blocklist
-  // are already covered, but be explicit for any remaining)
-  if (name.startsWith('.') && HIDDEN_DIR_BLOCKLIST.has(name)) {
+  if (name === 'node_modules' || name.startsWith('.')) {
     return false
   }
   return true