It's Time to Make AI Put Files in the Trash Before Deleting Them

Recently I’ve been doing work with WorkBuddy, and I noticed a rather interesting detail.

The temp files it creates — after you’re done with them and delete them — don’t disappear. They go to the Trash. And its temp files are kept right there in the current working directory, unlike opencode, which I normally use and which is forever dumping a pile of stuff under /tmp.

The whole flow is clean. This harness is quite particular about deletion.

It’s a detail that made me give it a thumbs up.

My daily driver is opencode, which I use alongside Paseo. When an agent is doing work, deleting files is routine — cleaning up intermediate artifacts, re-running something, deleting scripts that are no longer needed. But an agent deleting files and a human deleting files are two different things:

A human glances at the path first, hesitates for a moment. An agent doesn’t. Its paths are assembled; its variables are guessed from context. Get the path wrong once, and the instant rm -rf goes through, the thing is gone — no second chance.

So the real question isn’t “should we let agents delete files”, it’s “can we make deletion undoable“.

WorkBuddy uses the Trash. So can opencode do the same?

A quick look, and the answer was simpler than I expected: since macOS 15, the system ships with a trash command.

The system’s built-in trash command

/usr/bin/trash

This binary is signed by Apple (com.apple.trash), protected by SIP, and lives on the read-only system volume — you can’t delete it, and you don’t need to maintain it. The man page is at man trash.

There’s just one prerequisite: it only exists on macOS 15 Sequoia and later.

There’s a catch here: the trash man page says First appeared in macOS 14.0 in its HISTORY section, and that’s Apple’s own mistake. The community has tested it, and the command doesn’t exist on Sonoma 14.6.1 or 14.8; the Tahoe man page has changed its tune and now says it was added in Sequoia. So if your Mac doesn’t have trash, run sw_vers first to check your version — chances are your system is older than 15.

Usage

The syntax is minimal:

trash <file|directory>...

From what I’ve tested so far, its behavior matches deleting in Finder: it can delete files, directories, aliases, and symlinks.

Wiring it up for your agent

Just add a line to your project’s AGENTS.md or CLAUDE.md:

## File deletion safety

- Always use the `trash` command to move files to the Trash; never permanently delete them with `rm`.
- Only use `rm` when permanent deletion is explicitly requested.

That’s exactly what my own global config says.

The good news is that this rule is harness-agnostic — trash is just an ordinary Unix command, so any agent that can run a shell can use it. The only difference is which file you write the rule into.

Still, be clear-eyed about one thing: a rules file is a soft constraint. Writing “no rm” relies on the model being disciplined. Once the context gets long, or the model decides for itself that “this is just a temp file”, it can still fire off a plain rm. For a hard guarantee, you need another gate at the harness’s permission layer, setting rm-style commands to require confirmation. Soft rules shape habits; hard blocks catch what slips through.

Two caveats

The Trash isn’t “no deletion”, it’s “deferred deletion”. When an agent runs a batch job it might delete hundreds or thousands of files, and the Trash can balloon to tens of GB without you noticing. Empty it regularly, or take a look after a job finishes.

Recovery goes through Finder. Open the Trash → select the file → right-click “Put Back”. Note that if the original directory no longer exists, this option won’t work and you’ll have to drag it back manually.

What about older systems

If your Mac is stuck on Sonoma or earlier, you have two options:

• brew install trash (Ali Rantakari’s version). Note that it’s keg-only, and it conflicts with the macos-trash, osx-trash, and trash-cli packages — they all claim the trash name.
• Or use osascript to have Finder do it for you, with nothing to install:

osascript -e 'tell application "Finder" to delete POSIX file "/path/to/file"'

In short: wherever you can use trash, don’t use rm. Especially when the one typing the command is an AI.