Deletion Protection

An agent can get a shell command wrong. A prefix assignment like HOME=/tmp/x rm -rf "$HOME" only changes that one command’s environment — a later $HOME in the same script still means your real home folder. vord protects you from exactly that, without slowing agents down for the work they actually do all day.

What’s protected

vord watches your Documents, Desktop, Downloads, Pictures, Music, Movies, iCloud Drive and other cloud folders, Keychain, Mail, Messages, .ssh, .gnupg, and other projects next to yours (for example, ~/Cursor when it is outside a personal folder). For personal folders, about ten deletions within two seconds trigger a pause; deleting a personal folder root such as ~/Documents triggers at once. In other projects outside personal folders, single files do not count; only a whole repository disappearing triggers at once. If your projects folder is inside a personal folder, the stricter personal-folder rule applies. Build and cache folders such as .build, DerivedData, node_modules, .next, .nuxt, .svelte-kit, .turbo, .parcel-cache, .astro, __pycache__, .pytest_cache, .mypy_cache, .ruff_cache, .tox, .venv, .gradle, and .dart_tool never count, wherever they are; ambiguous names such as build, dist, out, and target stay protected. Git’s own lock and temporary files inside .git don’t count, and a worktree’s bare .git file doesn’t count. macOS atomic-write temporary copies with names ending in .sb-<8 lowercase hex>-<6 alphanumeric characters> are ignored; deleting the original file still counts. When vord can identify the deleting session, it pauses only that session and asks you: Resume agents or Stop agents. Besides the processes it sees, vord also recognizes the session from a delete command the agent ran shortly before (such as rm, mv, find … -delete, or git clean); the warning then names the session and shows that command, with tokens and other secrets hidden. A session that only has the protected folder itself open, such as a file watcher on your projects folder, does not count as the cause of deletions in a neighbouring project. vord keeps these commands only in memory for a few minutes and never writes them to its logs. When the cause is unknown, vord pauses nothing and shows a critical warning with Pause agents and OK; there is no deadline or automatic resume. Builds, the build gate and queue, simulators, and Docker are never paused, even when you choose Pause agents. Photos library database internals, caches of macOS services inside the Photos library, and Spotlight indexes managed by macOS do not count as protected deletions. Writing and creating files stays allowed everywhere, and moving something to the Trash in Finder never counts as a deletion.

Agents don’t run in a sandbox for this. Tools that bring their own sandbox, such as Xcode, Swift packages and macros, or codex, keep working normally.

What stays free

Your own project, its worktrees (folders named <project>-worktrees or <project>-wt-*, including the session worktrees vord creates under <repo>-worktrees/), temp folders, caches, ~/.config, ~/Library, and so on remain fully open — an agent deletes and rewrites things there constantly. Safety snapshots (below) are what backs up that freedom.

When an agent really needs to delete something

It asks vord, through a tool called request_deletion. Three outcomes, depending on the case:

A child session asks its parent agent, which decides.
A session with no parent can ask directly for an everyday case — vord moves the item to the Trash and shows you a note about it.
A critical case — a repository root, a .git folder, a folder that sits directly inside your home folder, or anything over 2,000 files or 1 GB — always asks you, with an Allow deletion? dialog and a Move to Trash / Deny choice.

Some things are refused outright and never happen: your home folder itself, /, system folders, and the protected folders listed above. Whatever vord does delete goes through the Trash, so it’s recoverable.

A symbolic link is treated as its own item. Any request or confirmation shows the link path with Symlink → <target>; moving it to the Trash leaves the target untouched, and the target’s contents do not count toward the large-deletion limit. If an agent’s request is still pending, that agent can withdraw it with resolve_deletion_request and approve: false. The request disappears without deleting anything.

Safety snapshots

While at least one agent session is running, vord takes a local APFS snapshot (built into macOS, no Time Machine needed) at most once every 30 minutes.

A snapshot keeps every file that was deleted or changed after it was taken. That space doesn’t show up in Finder, so vord cleans up its own snapshots instead of waiting for macOS:

Snapshots older than 6 hours are deleted, and vord keeps at most 12.
If free disk space drops below 10 % of the disk (at least 20 GB), vord deletes all of its snapshots right away and takes no new ones until there’s room again.

vord only deletes snapshots it took itself. Time Machine snapshots are left alone.

To restore from one, open Terminal (this needs an admin password):

tmutil listlocalsnapshots /
mkdir -p /tmp/snap
sudo mount_apfs -o nobrowse,rdonly -s <snapshot name> /System/Volumes/Data /tmp/snap

Copy back what you need from /tmp/snap/Users/<you>/…, then unmount:

sudo umount /tmp/snap

Deciding from your iPhone

With a current Mac and a paired iPhone or iPad, you can answer a deletion request and a watchdog pause from the phone. The Mac stays the source of truth: the same dialog that would appear on the Mac also appears on the phone, and whichever side decides first closes the other.

The phone inbox shows an Open decisions section at the top with every open request. The oldest open request also appears as a prominent sheet.

Deletion request. Allow / Deny. Allow asks Allow deletion? — The files will be moved to the Trash.
Agents paused (the watchdog). Resume / Stop agents. Stop agents asks Stop paused agents? — All paused agents will be stopped.
A push tap opens the oldest open decision of that kind.

Against an older Mac that does not announce this capability, the inbox keeps the previous text and has no buttons — you decide on the Mac. A guest device never sees the open lists; a decision from a guest is refused. If the Mac or another device already answered, the phone says This request was already decided.

Protected folders, extra free folders, and safety snapshots stay on the Mac: Settings → Rules & Workflow → Deletion protection. The phone does not configure them.

The phone’s Mac settings section does show the Delete guard switch as a preview of the Mac’s state, but it is always read-only: the toggle is disabled and says Deletion protection can only be changed on the Mac. See Changing Mac settings from the phone.

Settings

Settings → Rules & Workflow → Deletion protection has three controls:

Protect folders from agent deletions — turns the deletion watchdog on or off. Takes effect within a few seconds.
Additional folders agents may clean up — your own list of extra free folders.
Safety snapshots while agents run — the periodic-snapshot toggle.

Limits

The watchdog reacts; it doesn’t prevent the first deletions. By the time the deleting session is paused, a few files may already be gone. The latest safety snapshot can restore them. If vord cannot determine which session caused the deletions, it pauses nothing and shows the critical warning with Pause agents and OK. There is no deadline and no automatic resume; choosing Pause agents starts the regular pause flow, still leaving builds, the build gate and queue, simulators, and Docker running. A very short deletion wave that is already over before the watchdog checks it (a fraction of a second) is only logged; the safety snapshot has the files. Long deletions such as an accidental rm -rf ~ are still stopped. It doesn’t stop an agent from overwriting a file in place; it only covers deletion.

Permission Modes — the separate system that decides whether an agent needs to ask before acting at all.