Repository navigation
Plans refuse to trash your own folders - #20
Merged
Merged
Conversation
Plan validation checks each trash against the inventory's only-yours folders (Documents, Desktop, Pictures, Movies, Music, Mail, Messages under home, and any Photos library). A path that is one, sits inside one, or holds one gets an error naming the folder, so the plan can't be approved. Before, only the human approval stopped a model proposing ~/Documents. PLACES moves to a shared constant so the Cleanup window and plan checks use one list. validate() keeps its signature; validate_with() takes the home folder for tests. Pavol chose "Refuse such plans in validation" on 2026-11-03. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017mKbacqC4bPDSYsaK9dVdu
…Documents) may still go Matches the inventory, which lists it on the rebuildable side. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017mKbacqC4bPDSYsaK9dVdu
- Links: check the path as asked and as resolved, and each folder at its real location, so ~/Movies moved to a disk and left as a link stays protected. - A folder that holds a Photos library is refused (bounded search, three levels, no links followed). - The build-output exemption covers project build rules only; caches, logs, .gradle and .m2 inside your folders stay refused. - Docs say what the code does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017mKbacqC4bPDSYsaK9dVdu
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017mKbacqC4bPDSYsaK9dVdu
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017mKbacqC4bPDSYsaK9dVdu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pavol's choice on 2026-11-03 (decision card mac-dir-stat.o0, relayed by the orchestrating session): "Refuse such plans in validation." This was proposal 1 in the 30 Oct hand-back.
What changed
cleanup::only_yours_reason(path, home)refuses any trash path that is, is inside, or holds one of the inventory's own folders: Documents, Desktop, Pictures, Movies, Music, Mail and Messages under home, plus any*.photoslibrary. The match is case-insensitive, as on APFS. The error names the folder, e.g. "~/Documents/Taxes is inside ~/Documents, your own Documents folder. MacDirStat never offers your own files for deletion; …".plan::validateruns this check right after the system-path check. It also checks the raw path when the path can't be resolved, so the refusal names the folder either way. A plan with any refused op isvalid: false, and approving it returns 409. The existing rule already makes one bad op refuse the whole plan.cleanup::PLACESis now one shared list for the Cleanup window and the plan check.propose_plandescription, README, CHANGELOG and the SIGNATURE.md decision log are updated.Reversible calls (default taken)
~/Libraryholds Mail; it was already protected). Default: refuse.Tests (written first)
plan::tests::validate_refuses_your_own_folders_and_their_contents: with a temp home,~/Documentsand~/Documents/taxesare refused with a message naming~/Documents. A plan mixing node_modules with a file in Documents is invalid and can't be approved.inventory_tests::a_plan_may_not_trash_your_own_folders_or_anything_in_them: covers subfolders, case, Mail, Photos libraries, holders, and look-alikes that stay allowed (~/DocumentsOld, another user's Documents, node_modules, Caches).server_tests::mcp_plan_touching_your_own_folders_is_refused: the journey over MCP.propose_planwith~/Documentsand~/Documents/Taxes 2025returns invalid with the folder named, approve gets 409, and nothing runs.No release tag (v0.7.0 is Pavol's step).
Generated by Claude Code