dsh-trash

English | 中文

A DeepSeek Harness plugin that turns every delete operation into a recoverable trash move — even under the highest permission (danger-full-access). Accidentally deleted something? Restore it in one call.

• Intercepts delete commands in the pwsh / bash / run_code tools (Remove-Item, rm, del, rd, rmdir, unlink, [System.IO.*]::Delete, fs.unlink/rm/rmdir, os.remove, shutil.rmtree, …) at the tool pipeline's tools/pre-execute gate, denies them, and guides the model to the trash tools.
• Ships 4 tools: trash (delete = move to trash), trash-list (inspect), trash-restore (recover), trash-purge (confirmed permanent cleanup — the only path that truly deletes).
• Zero runtime dependencies (Node built-ins only), installable from anywhere (registry / file: / link: / GitHub).

How it works

Layer	What happens
Interceptor	A tools/pre-execute listener (prepended, so it runs first) scans pwsh.command, bash.command, and run_code.code for delete patterns. On a hit it returns { kind: "deny" } — denials are monotonic, so no later stage (approval, guard, dispatch) can let the call through. The model sees an actionable message telling it to use trash instead.
Trash store	Each "delete" becomes one entry under the trash root (default $DSH_HOME/trash): data/ keeps the original names, meta.json records original paths, timestamps, sizes, and an optional reason. Cross-volume moves degrade to copy-then-clean.
Tools	trash / trash-list / trash-restore / trash-purge — see below.

<trashRoot>/
  <entryId>/
    data/...        the "deleted" files & directories (original names preserved)
    meta.json       original path, deleted-at, size, reason

Installation

# From a local checkout (dev / link mode — edits to the source take effect immediately)
dsh plugin --profile web add link:D:/path/to/dsh-trash

# Or straight from GitHub (requires git + a GitHub token on this machine)
dsh plugin --profile web add github:LeonSone/dsh-trash

dsh plugin add adds the package to the profile's dependencies; because the package declares dsh.bundle, it is automatically appended to dsh.profile.bundles. Restart dsh web (or the headless runner) for the plugin to load.

Headless profile: dsh plugin --profile headless add <spec> — same flow.

Usage

Once installed, the model's behavior changes automatically:

Scenario	Behavior
Model runs Remove-Item / rm / del / …	Blocked with a message explaining the trash workflow
Model calls trash(paths=[...])	Files/dirs move into the trash (recoverable)
Accidental delete	trash-restore(entry_id=...) restores to the original path; or trash-restore(path="<substring of original path>") finds the newest matching entry
Permanent cleanup	trash-purge(confirm: true) — optionally scoped to specific entry_ids

Tool reference

Tool	Purpose
trash(paths, reason?)	Move files/directories into the trash. Returns entry_id, trash_root, moved.
trash-list(path?)	List trash entries (deleted-at, size, reason, original paths). Optional substring filter on the original path.
trash-restore(entry_id? | path?, target_path?, overwrite?)	Restore an entry to its original location (or target_path for single-item entries). If the target exists, it refuses unless overwrite: true — in which case the existing content is first moved to the trash itself, then the restore proceeds. Nothing is ever lost.
trash-purge(entry_ids?, confirm: true)	Permanently delete trash entries. The only real deletion in the whole plugin.

Configuration (optional)

Append to your profile's cordis.patch.yml:

- id: dsh-trash
  config:
    location: D:/data/dsh-trash   # trash root; same drive as the workspace = instant renames
    interceptPwsh: true           # intercept deletes in pwsh (default true)
    interceptBash: true           # intercept deletes in bash (default true)
    interceptRunCode: true        # intercept fs.* deletes in run_code (default true)

Security notes

• Fail-safe by design: the detector prefers false positives over letting a real delete through (e.g. a tutorial string mentioning Remove-Item is blocked too; the denial message explains why). Short aliases (rm/del/rd/ri) only match in command position, so cat /tmp/rm, Test-Path C:\rd, or grep 'rm -rf' docs are not flagged.
• One true delete path: only trash-purge(confirm: true), and it only touches the trash root.
• Restore safety: entry_id is strictly validated (no path traversal); target_path may not point inside the trash root.
• Overwrite safety: restoring over an existing file first backs that file up into the trash — every step is reversible.

Development

node test/unit.test.mjs   # 48 cases: detector hit/miss matrix + full trash-store workflow

Uninstall

dsh plugin --profile web remove dsh-trash

The trash directory itself is left untouched; move it away first if you want to keep the data.

License

MIT