Skip to content

fix(safe-delete): file-existence check + expanded rm deny patterns#74

Merged
dean0x merged 1 commit intomainfrom
fix/safe-delete-hardening
Mar 4, 2026
Merged

fix(safe-delete): file-existence check + expanded rm deny patterns#74
dean0x merged 1 commit intomainfrom
fix/safe-delete-hardening

Conversation

@dean0x
Copy link
Owner

@dean0x dean0x commented Mar 4, 2026

Summary

  • File-existence check: Filter non-existent files before calling trash in bash/zsh, fish, and PowerShell Unix blocks — prevents noisy errors like trash: index.lock doesn't exist when rm -f is used on missing files (e.g., rm -f .git/index.lock). Handles broken symlinks via [ -L "$f" ]. PowerShell Windows already had this via Resolve-Path.
  • Expanded deny list: Add rm -r, rm -fr, and rm -f flag variations to managed-settings deny patterns — closes bypass gap where only rm -rf was blocked (21 rm patterns, up from 8).
  • Updated tests: 3 existing tests updated to verify existence checks + 1 new PowerShell Windows regression guard. All 169 tests pass.

Test plan

  • npm run build passes
  • npm test — 169/169 pass
  • Manual: rm nonexistent-file in terminal after reinstall — should silently no-op
  • Manual: rm existing-file — should move to trash as before

The trash command errors noisily when a file doesn't exist, unlike rm -f
which is silent. Add existence filtering (including broken symlinks) to
bash/zsh, fish, and PowerShell Unix blocks before calling trash.

Expand the managed-settings deny list to cover rm -r, rm -fr, and rm -f
flag variations that could bypass the existing rm -rf-only patterns.
@dean0x dean0x merged commit 34b4e92 into main Mar 4, 2026
4 checks passed
@dean0x dean0x deleted the fix/safe-delete-hardening branch March 4, 2026 11:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant