dsh-safe-delete
在工具防护层拦截任何 DSH 代理会话（GUI、自动化运行、无头桥接）发出的 `rm` 命令，并将目标移至 macOS Trash，而不是删除。可在 Web GUI 的 Settings → General 中切换。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:NattoCB/dsh-safe-delete#149190d58104e8b09497967babaa69de2252d309Safe Delete 以 dsh-safe-delete 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
rm an agent runs becomes a recoverable move to the macOS Trash.ctx.tools.guard() —— no tool, prompt, or core changes
A DeepSeek Harness host-side plugin that makes agent-issued
rmcommands recoverable: targets are moved to the macOS Trash instead of deleted, across GUI sessions, automation runs, headless bridges, and subagents. One switch in Settings → General turns it off — disabled, commands run with native DSH behavior.
rm in command position is denied and rewritten to /usr/bin/trash -v; the model receives a report of exactly what was moved, so nothing silently disappears.sudo rm, /bin/rm, env/nice-prefixed rm, VAR=x rm, and xargs rm inside compound commands (&&, ||, ;, |).rm ($(...), backticks, subshells, heredocs, eval, nested sh -c) are denied with guidance instead of rewritten; a failed trash is reported, never retried as real deletion.POST /safe-delete/config; the state persists across restarts in $DSH_HOME/storages/safe-delete.json.The plugin installs one guard on the DSH tools registry. Every bash tool call is scanned before execution:
flowchart LR
A["bash tool call"] --> B{"rm in command<br/>position?"}
B -- "no" --> C["native execution"]
B -- "yes" --> D{"switch on?"}
D -- "off" --> C
D -- "on" --> E{"safely<br/>rewritable?"}
E -- "no: subshell, eval,<br/>heredoc, backticks" --> F["deny with guidance,<br/>nothing runs"]
E -- "yes" --> G["run trash -v, deny the<br/>original, report targets"]
Intercepted calls are denied and re-executed as trash by the guard itself, so quoting and globs survive:
[dsh-safe-delete] intercepted `rm` — the targets were MOVED TO TRASH (recoverable),
not deleted. Original command denied. Targets: build/ dist
trash: build/ → .Trash/build/
Plain non-rm commands pass through untouched; commands that merely mention rm (echo rm, grep "rm " log) are ignored. rm flags (-f, -r, …) are stripped rather than honored: trash moves whole directories natively.
| Covered | Not covered | |
|---|---|---|
| Commands | rm, sudo rm, absolute-path rm, xargs rm — simple and compound | find -delete, unlink, git clean, language runtimes' own file APIs |
| Guarantee | intercepted at the guard layer, before execution | the guard is an accident-prevention net for the most common destructive verb, not a sandbox |
sudo rm is intercepted before sudo ever runs, but trashing files that require root can still fail — trash errors are reported verbatim.
dsh plugin --profile web add github:NattoCB/dsh-safe-delete
Restart the DSH web process — host-side bundles and their patches load at process start. On boot the plugin logs rm guard active once.
| Surface | How |
|---|---|
| Web GUI | Settings → General → Safe Delete — the switch takes effect on the next bash call, no reload |
| HTTP | GET /safe-delete/config → { "enabled": bool }; POST /safe-delete/config with { "enabled": bool } |
| File | $DSH_HOME/storages/safe-delete.json — { "enabled": bool } |
Default: enabled. A missing or corrupt state file also resolves to enabled — installing the plugin expresses the intent to have the guard, and a corrupt file never silently downgrades protection.
npm test # node --test: lexer, rewrite matrix, guard contract, switch store/API
The lexer/rewriter is exported as exports._internals so tests exercise the real code paths (analyzeCommand, tokenize, splitSegments, makeGuard, ConfigStore, handleConfigRequest).
MIT — part of the awesome-dsh-plugin ecosystem.