From 44fe52195ebe9ac858f9683f4ba68e265685e3a9 Mon Sep 17 00:00:00 2001
From: dave <futurechimp@users.noreply.github.com>
Date: Tue, 14 Apr 2026 09:21:39 +0000
Subject: [PATCH] fix: allow MCP tools to access merge_workspace so mergemaster
 can fix conflicts

The permission lockdown restricted run_command/run_tests to
.huskies/worktrees/ only. The mergemaster could diagnose merge
conflict compile errors but couldn't edit files in .huskies/merge_workspace/
to fix them. Add merge_workspace as an allowed path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 server/src/http/mcp/shell_tools.rs | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/server/src/http/mcp/shell_tools.rs b/server/src/http/mcp/shell_tools.rs
index 99bafb86..cbaa80ca 100644
--- a/server/src/http/mcp/shell_tools.rs
+++ b/server/src/http/mcp/shell_tools.rs
@@ -83,9 +83,17 @@ fn validate_working_dir(working_dir: &str, ctx: &AppContext) -> Result<PathBuf,
         return Err("No worktrees directory found in project".to_string());
     };
 
-    if !canonical_wd.starts_with(&canonical_wt) {
+    // Also allow the merge workspace so mergemaster can fix conflicts.
+    let merge_workspace = project_root.join(".huskies").join("merge_workspace");
+    let canonical_mw = merge_workspace
+        .canonicalize()
+        .unwrap_or_default();
+
+    if !canonical_wd.starts_with(&canonical_wt)
+        && !(!canonical_mw.as_os_str().is_empty() && canonical_wd.starts_with(&canonical_mw))
+    {
         return Err(format!(
-            "working_dir must be inside .huskies/worktrees/. Got: {working_dir}"
+            "working_dir must be inside .huskies/worktrees/ or .huskies/merge_workspace/. Got: {working_dir}"
         ));
     }