NattoCB/dsh-safe-delete

A DeepSeek Harness host-side plugin that makes agent-issued rm commands recoverable: targets are moved to the macOS Trash instead of deleted, across GUI sessions, automation runs, headless bridges, and subagents. One switch in Settings → General turns it off — disabled, commands run with native DSH behavior.

Capabilities

• Recoverable deletion — an rm in command position is denied and rewritten to /usr/bin/trash -v; the model receives a report of exactly what was moved, so nothing silently disappears.
• Every session, one guard — registers once on the DSH tools registry; GUI chats, scheduled automations, headless bridges, and subagents are all covered with zero per-session wiring.
• Shell-aware interception — quote-preserving lexer catches sudo rm, /bin/rm, env/nice-prefixed rm, VAR=x rm, and xargs rm inside compound commands (&&, ||, ;, |).
• Fail-safe by design — constructs that could hide an rm ($(...), backticks, subshells, heredocs, eval, nested sh -c) are denied with guidance instead of rewritten; a failed trash is reported, never retried as real deletion.
• Runtime switch — toggle in the web GUI (Settings → General → Safe Delete) or via POST /safe-delete/config; the state persists across restarts in $DSH_HOME/storages/safe-delete.json.

How it works

The plugin installs one guard on the DSH tools registry. Every bash tool call is scanned before execution:

flowchart LR
    A["bash tool call"] --> B{"rm in command<br/>position?"}
    B -- "no" --> C["native execution"]
    B -- "yes" --> D{"switch on?"}
    D -- "off" --> C
    D -- "on" --> E{"safely<br/>rewritable?"}
    E -- "no: subshell, eval,<br/>heredoc, backticks" --> F["deny with guidance,<br/>nothing runs"]
    E -- "yes" --> G["run trash -v, deny the<br/>original, report targets"]

Intercepted calls are denied and re-executed as trash by the guard itself, so quoting and globs survive:

[dsh-safe-delete] intercepted `rm` — the targets were MOVED TO TRASH (recoverable),
not deleted. Original command denied. Targets: build/ dist
trash: build/ → .Trash/build/

Plain non-rm commands pass through untouched; commands that merely mention rm (echo rm, grep "rm " log) are ignored. rm flags (-f, -r, …) are stripped rather than honored: trash moves whole directories natively.

Scope and limits

	Covered	Not covered
Commands	rm, sudo rm, absolute-path rm, xargs rm — simple and compound	find -delete, unlink, git clean, language runtimes' own file APIs
Guarantee	intercepted at the guard layer, before execution	the guard is an accident-prevention net for the most common destructive verb, not a sandbox

sudo rm is intercepted before sudo ever runs, but trashing files that require root can still fail — trash errors are reported verbatim.

Install

dsh plugin --profile web add github:NattoCB/dsh-safe-delete

Restart the DSH web process — host-side bundles and their patches load at process start. On boot the plugin logs rm guard active once.

Configuration

Surface	How
Web GUI	Settings → General → Safe Delete — the switch takes effect on the next bash call, no reload
HTTP	GET /safe-delete/config → { "enabled": bool }; POST /safe-delete/config with { "enabled": bool }
File	$DSH_HOME/storages/safe-delete.json — { "enabled": bool }

Default: enabled. A missing or corrupt state file also resolves to enabled — installing the plugin expresses the intent to have the guard, and a corrupt file never silently downgrades protection.

Development

npm test        # node --test: lexer, rewrite matrix, guard contract, switch store/API

The lexer/rewriter is exported as exports._internals so tests exercise the real code paths (analyzeCommand, tokenize, splitSegments, makeGuard, ConfigStore, handleConfigRequest).

License

MIT — part of the awesome-dsh-plugin ecosystem.