dsh-trash

dsh-trash

English | 中文

A DeepSeek Harness plugin that turns every delete operation into a recoverable trash move — even under the highest permission (danger-full-access). Accidentally deleted something? Restore it in one call.

• Intercepts delete commands in the pwsh / bash / run_code tools (Remove-Item, rm, del, rd, rmdir, unlink, [System.IO.*]::Delete, fs.unlink/rm/rmdir, os.remove, shutil.rmtree, …) at the tool pipeline's tools/pre-execute gate, denies them, and guides the model to the trash tools.
• Ships 4 tools: trash (delete = move to trash), trash-list (inspect), trash-restore (recover), trash-purge (confirmed permanent cleanup — the only path that truly deletes).
• Zero runtime dependencies (Node built-ins only), installable from anywhere (registry / file: / link: / GitHub).

How it works

<trashRoot>/
  <entryId>/
    data/...        the "deleted" files & directories (original names preserved)
    meta.json       original path, deleted-at, size, reason

Installation

# From a local checkout (dev / link mode — edits to the source take effect immediately)
dsh plugin --profile web add link:D:/path/to/dsh-trash

# Or straight from GitHub (requires git + a GitHub token on this machine)
dsh plugin --profile web add github:LeonSone/dsh-trash

dsh plugin add adds the package to the profile's dependencies; because the package declares dsh.bundle, it is automatically appended to dsh.profile.bundles. Restart dsh web (or the headless runner) for the plugin to load.

Headless profile: dsh plugin --profile headless add <spec> — same flow.

Usage

Once installed, the model's behavior changes automatically:

Tool reference

Configuration (optional)

Append to your profile's cordis.patch.yml:

- id: dsh-trash
  config:
    location: D:/data/dsh-trash   # trash root; same drive as the workspace = instant renames
    interceptPwsh: true           # intercept deletes in pwsh (default true)
    interceptBash: true           # intercept deletes in bash (default true)
    interceptRunCode: true        # intercept fs.* deletes in run_code (default true)

Security notes

• Fail-safe by design: the detector prefers false positives over letting a real delete through (e.g. a tutorial string mentioning Remove-Item is blocked too; the denial message explains why). Short aliases (rm/del/rd/ri) only match in command position, so cat /tmp/rm, Test-Path C:\rd, or grep 'rm -rf' docs are not flagged.
• One true delete path: only trash-purge(confirm: true), and it only touches the trash root.
• Restore safety: entry_id is strictly validated (no path traversal); target_path may not point inside the trash root.
• Overwrite safety: restoring over an existing file first backs that file up into the trash — every step is reversible.

Development

node test/unit.test.mjs   # 48 cases: detector hit/miss matrix + full trash-store workflow

Uninstall

dsh plugin --profile web remove dsh-trash

The trash directory itself is left untouched; move it away first if you want to keep the data.

License

MIT