The safety model
Eight checks.
In order. Every time.
What stops AllInsight from deleting something it should not, written to be checked against the code rather than believed.
The order of priorities
When they conflict, the earlier one wins.
Several features are narrower than they could be, for exactly this reason.
Safetythenprivacythencorrectnessthenperformancethenfeatures
Rule one
The interface cannot name a file.
The window you click in never sends a file path to anything that deletes. It sends a cleanup category, or an id the backend itself issued. A whole class of mistake becomes impossible, rather than merely unlikely.
An id from an older scan is refused outright, and Large Files and Duplicates only ever move files to the Recycle Bin, never delete them permanently.
pub struct CleanupRequest {
pub scan_id: u64,
pub categories: Vec<CleanupCategory>, // an enum variant
pub candidate_ids: Vec<String>, // ids the backend issued
pub confirmed: bool,
}
// No path anywhere. There is no variant
// of this type that could carry one.
Rule two
A token that cannot be forged.
The interface never sends a file path to a destructive command. Removal needs a token only the deletion guard can issue, and the last five checks run at the moment of deletion, not when the preview was built.
- Collapse
..and.so a path cannot sneak past the list - Refuse the protected list: the system, your folders, your credentials
- Refuse anything outside the category's own folders
- Confirm it still exists, without following links
- Refuse it if it is itself a link or junction
- Refuse it if any folder above it is one
- Resolve the real path, and run checks two and three again
- Confirm it is still what the scan recorded
Never part of a cleanup
Documents · Desktop · Pictures · Videos · Music · Downloads · Source code · Databases · Browser profiles · Saved passwords · The operating system
Auto-Clean
Automatic, inside firm boundaries.
Only categories built in as eligible
And only those you opted into. The intersection, never the union.
Only when space is genuinely low
Below your own free-space threshold, and only when no scan you started is running.
Only when it is worth it
At least 256 MB to reclaim, because interrupting you for less is not worth it.
Through the same guard
Every removal, automatic or not, passes all eight checks at the moment it happens.