Overflowing cleanup command deletes local files (scope creep)

What happened

A general-purpose agent with shell access to the user’s real filesystem — often in a no-confirmation mode — was asked for a scoped cleanup. In one case it ran rm -rf over an entire photos directory (~15,000 family photos, 15 years) while “organizing” a desktop; in another, running in “Turbo” mode, it targeted the root of the D: drive instead of the project subfolder while “clearing the cache,” bypassing the recycle bin. One was recovered from an iCloud backup; the other was permanent.

Why it passed the checks

The command was valid and the user’s intent was benign; the failure was one of scope — which path it touched — executed with no barrier and no confirmation (consumer rails skipped / Turbo mode). The instruction “only the project cache” lived in the prompt, not in a wall — now over an end user’s filesystem, not a developer’s repo.

What Salvager does about this class

This is doubly in-scope. The hook (Tier A) denies an rm -rf or a root-level delete before it runs, even in Turbo / skip-permissions modes (the hook fires regardless); and if anything is overwritten, the watcher recovers what it was tracking. Honest boundary: Salvager recovers the tree it watches, not an arbitrary whole D: drive — for a general consumer desktop the value is mostly in the hook that stops the command, not in backing up the entire disk. In the photos case, a local net would have removed the dependence on the iCloud sync window.