It finds the file paths, diffs every block against your folder, and refuses to overwrite a
real file with // ... rest unchanged. Nothing is uploaded — the whole round
trip happens in this tab.
Drop a folder here
or choose one — a .zip works everywhere
You asked an assistant to change six files and it answered with six code blocks. Now you are
going to create them by hand — copy, New File, type the path from memory, paste, repeat — with
no diff, no undo, and no way to notice that block four is only half the file because the model
wrote // ... rest of the implementation unchanged in the middle of it.
The tools that solve the outbound half of this are command-line programs, npm packages and editor extensions. unfence exists for the machine where you cannot install any of those.
filepath: comment — so whatever comes
back is easy to place.
changes.patch and updated.zip, and
git apply does the rest.
A reply is text from a language model, and unfence treats it as data rather than instructions. Paths that leave your folder, name a file that runs code, or differ from another block only in capitalisation are refused and listed, never quietly repaired. Where a refusal is a judgement call rather than a rule, you can override it by typing the confirmation — but not by clicking past it.
.., is absolute, uses a drive letter or a URL scheme,
carries a control or invisible character, contains a backslash, or names a Windows device.
Paths are never repaired or guessed — a suspicious one is refused and listed.
// ... rest unchanged even phrased in a way we have never seen, in a language
we have never seen. Genuine large deletions happen, so you can override — by typing the
confirmation, after reading the hunks.
.git/, .github/workflows/, package.json,
Makefile, .vscode/ and .envrc are refused by default.
Your browser does not protect these: a web page with folder access can write
.git/hooks/pre-commit on every operating system, because the one Chromium rule
that looks like it should stop that is Windows-only and never applies to this kind of
access. This refusal is ours, not your browser’s.
.gitignore to un-hide .env cannot make your secrets appear in the
next bundle — the secret list is separate from .gitignore and has no way to be
switched off by it.
.env files, private keys and build output by default, precisely because this
step is the leak.
.env refusal caught.
Values from environment files are baked into built JavaScript as ordinary strings. unfence
always excludes dist/, build/, out/ and
.next/ for that reason, and warns if it spots a refused value inside an
included file — but that check is best effort. Build tools split and re-encode strings, so
it cannot be a guarantee.
~/.ssh; it does not block one pointing at the rest of your home folder.
.gitignore is invisible to it, so ignore rules cannot be applied there and you
should check the file list yourself before copying.
feedback.benrichardson.dev. Nothing is
sent unless you open the feedback form and press Send; your files and data never are.
unfence is the missing return leg between a chat window and a project folder. It packs your folder into one paste-ready bundle, and — the part nothing else on the open web does — takes the reply back, works out which file each code block is, diffs it against what is actually on your disk, and writes the parts you accept.
It exists for the machine where you cannot install a command-line tool or an editor extension, which is exactly the machine where copying six files by hand is most likely.
It is built and maintained by Ben Richardson. The rest of the catalogue of tools and sites lives at lab.benrichardson.dev.
Source: github.com/ben-gy/unfence.
markdown-it, MIT — CommonMark tokenising, so fences inside lists and blockquotes are read correctly.diff, BSD-3-Clause — unified diffs that git apply accepts byte for byte.client-zip, MIT — streaming zip writing, with an exact predicted length that makes the backup verifiable.fflate, MIT — reading a dropped .zip.The sample project is fictional and was written for this tool, as was the sample reply. Both are deliberately imperfect: the reply contains a truncated block, an elided file and a path that will be refused.