DSH + deepseek-flash 删除了我的用户目录！！！

[AhYi8]

我在用创造模式开发一个 gotify 通知的插件时，突然 deepseek-harness 崩溃，说找不到当前会话，然后我重启之后，整个 DSH 就变回了初始状态。给我干懵了！！！然后我叫 DSH（初始化状态）查了一下是什么问题，就说整个用户目录被删除了，包括 Codex、Claude Code 等所有的用户数据都没了！！！

然后我叫 DSH 看看能不能恢复数据，整了半天一直在推卸责任🤣。

---

---

所以我信不过 DSH 了，就换了 codex + gpt-6.1-sol（打开 Codex 一看果然啥都没了，变成初始状态了）。

---

---

然后 Codex 就从什么卷影副本中给我找到的当前上午的快照，Codex 给我写了一个脚本，把快照复制出来了，足足 100 多个 G。也是成功找到的 DSH、Codex 等的会话数据了

---

---

叫 Codex 尽可能的帮我恢复完整的数据，最后也只恢复到当天早上 09:37 之前的数据（应该是我当天早上刚开机没多久），结果就是当天的会话数据全丢了！！！

---

---

最后叫 Codex 帮我查了一下原因，究竟是谁删了我的用户目录！！！我当天清楚的记得在做 gotify 通知插件的时候用的就是官方的 deepseek-flash（因为我心想官方的模型对自家插件开发应该有 buff 加成🤣）

---

[AhYi8]

现在我也是吸取的朋友的经验：做了一个“钩子”拦截所有删除命令（rm, delete, remove-item 等）改为移动到回收站的行为。

[paperbluster]

home这玩意ai的确很容易误操作删掉c盘

[Moody-Sin]

前面两天我也遇到过，我登录的Windows账户还被改成本地账户，我还以为怎么回事了呢，搞得我重新配置电脑和各个agent以及开发环境，看到你这个我想应该是dsh的原因了，刚好我也是在做dsh通知插件

[Shawnkurt]

自用的两个AGENTS.md有关文件安全的规则，分享一下：

File Deletion Safety - Linux

• Default to recoverable removal. Unless the user explicitly authorizes permanent deletion of the specific targets, move files and directories to the trash using gio trash -- <path>, except for the /tmp/ exception below.
• Exception for /tmp/: Files and directories located within /tmp/ may be permanently deleted using rm without separate authorization for permanent deletion or a prior trash attempt. Verify that the targets are within /tmp/; do not follow symlinks to delete targets outside /tmp/. This exception does not authorize deleting /tmp/ itself.
• Requests to "delete", "remove", or "clean up" do not by themselves authorize permanent deletion outside the /tmp/ exception.
• Without that authorization or the /tmp/ exception, do not permanently delete through rm, unlink, find -delete, language APIs, patch-based file deletion, Git commands, cleanup scripts, shred, or any other comparable mechanism.
• Before removal, verify the exact targets and scope. For glob patterns, directories containing files, or multiple targets, inspect the affected paths before proceeding. Ask for confirmation only if the scope is ambiguous or exceeds what the user has already authorized. When removing a symlink, remove the link itself rather than its target.
• If trashing is unavailable or fails outside the /tmp/ exception, stop the affected removal and report the failure. Do not fall back to permanent deletion or empty the trash.
• This rule covers deletion initiated by the agent and commands known to remove existing files. It does not require replacing ordinary build/test tools' internal management of disposable temporary files.

File Deletion Safety - Windows

• Default to recoverable removal. Unless the user explicitly authorizes permanent deletion of the specific targets, move files and directories to the Windows Recycle Bin using a recycle-aware API, except for the temporary-directory exception below. In PowerShell, load Microsoft.VisualBasic with Add-Type -AssemblyName Microsoft.VisualBasic, then use [Microsoft.VisualBasic.FileIO.FileSystem]::DeleteFile(<absolute-path>, 'OnlyErrorDialogs', 'SendToRecycleBin', 'ThrowException') for files or DeleteDirectory with the same arguments for directories. Do not use these methods for symbolic links or junctions unless their behavior has been verified to recycle only the link itself.
• Exception for temporary directories: Files and directories located within the current user's verified $env:TEMP or $env:TMP directory may be permanently deleted using Remove-Item -LiteralPath <path> without separate authorization for permanent deletion or a prior recycle attempt. Resolve and validate these environment-variable values before use; they must identify actual temporary directories, not empty values, drive roots, or arbitrary directories. Verify containment using normalized absolute paths and directory boundaries, not a simple string prefix; do not follow symbolic links, junctions, or other reparse points to delete targets outside those directories. This exception does not authorize deleting the temporary directories themselves.
• Requests to "delete", "remove", or "clean up" do not by themselves authorize permanent deletion outside the temporary-directory exception.
• Without that authorization or the temporary-directory exception, do not permanently delete through Remove-Item (including its rm, ri, and del aliases), CMD del, erase, rd, or rmdir, Unix-style rm or unlink, language APIs, patch-based file deletion, Git commands, cleanup scripts, secure-erasure tools, or any other comparable mechanism. PowerShell Remove-Item does not move items to the Recycle Bin.
• Before removal, verify the exact targets and scope. For glob patterns, directories containing files, or multiple targets, inspect the affected paths before proceeding. Use literal paths where supported to avoid unintended wildcard expansion. Ask for confirmation only if the scope is ambiguous or exceeds what the user has already authorized. When removing a symbolic link, junction, or other reparse point, remove the link itself rather than its target.
• If recycling is unavailable or fails outside the temporary-directory exception, stop the affected removal and report the failure. This includes paths on network shares or volumes that do not support recycling. Do not fall back to permanent deletion, accept a prompt to permanently delete, or empty the Recycle Bin.
• This rule covers deletion initiated by the agent and commands known to remove existing files. It does not require replacing ordinary build/test tools' internal management of disposable temporary files.

[SurFlurer]

纵观dsh仓库discussion的误删案例，有许多情况是模型把被删除的目录拼接成 $home，然后执行 Remove-Item，导致用户主目录被删除，我至少发现了五个这样的discussion。这非常不合理，不知道是模型训练时就形成了这样的倾向，还是系统提示词给出了错误的示范？

[ViCrack]

其他模型也有不少删除的案例，gpt、claude都有过，你是不是开了完全权限访问了。
经常是windows下的powershell容易搞出问题。

[tatuke]

You should regularly back up the status of your agent tool. I’ve encountered this issue myself—when using the agent tool harness, I experienced a system crash or pulled the latest incompatible code, which led to disastrous consequences. I’m currently trying to resolve this issue; https://github.com/tatuke/agent-switch
I hope it helps.
Additionally, deploying multiple Agent Tools on the same machine appears to cause even more complications, as other Agent rule files are treated as files that can be freely modified under the current ruleset. This is also dangerous.

[whengu]

这个模型确实拉, 他只是便宜,

另外这个harness也没有危险命令检测和拦截,

阿里的 qwenpaw 和 爱马仕hermes agent都有危险命令检测识别, 现在阶段还是太早了, 很多必要的功能都没有, 看这发版速度, 估计得等到明年才有正常的功能

[zqy1-1]

确实，这很蛋疼，我倒是没到被删的程度，就是d盘根目录下面多了好多零散的文件，一看就是什么转义符斜杠之类的写错了弄出来的