Session-level file recycle bin / undo for destructive file operations

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

When Claude Code performs destructive file operations (rm, mv, overwrite) during a session, the files are permanently deleted with no recovery path. On case-insensitive filesystems like macOS APFS, merging two project folders can trigger silent overwrites — Claude resolves naming conflicts by removing files, and those deletions bypass the system Trash entirely.

I was merging two project directories into one unified app. Claude deleted data files (data files and configurations) during the merge to resolve conflicts. The files were gone instantly — no Trash, no undo, no snapshot. Hours of collected data lost permanently.

Current state: there is no safety net. The /undo command and Rewind feature do not cover file deletions. Once a file is rm'd, the only hope is third-party disk recovery tools, which rarely work on modern SSDs with TRIM.

Proposed Solution

1. Session-scoped recycle bin: Before any rm/mv/overwrite, copy the original file to ~/.claude/recycle/<session-id>/. Files persist until the session ends or a configurable TTL (e.g. 24 hours).

1. /undo support for file deletions: Extend the existing /undo and Rewind features to cover file system changes — not just code edits.

1. Use Trash instead of rm: On macOS, use trash (or NSFileManager moveToTrash) instead of rm. On Linux, use gio trash. This gives users native OS-level recovery.

1. Filesystem-aware merge safety: When merging directories on case-insensitive filesystems (APFS, NTFS), detect potential overwrites BEFORE executing and prompt the user.

1. Pre-deletion manifest: Log every file deletion in a session manifest (~/.claude/sessions/<id>/deletions.log) with original path, SHA-256 hash, size, and timestamp.

Alternative Solutions

• Time Machine: Only works if configured in advance and doesn't always capture files deleted within the same hour.
• APFS snapshots: Only available for OS volumes, not user data drives.
• Third-party recovery tools (PhotoRec, Disk Drill): Blocked by macOS SIP and nearly useless on SSDs with TRIM enabled.
• Manual backups before each session: Unrealistic workflow tax that defeats the purpose of an AI coding assistant.

None of these are viable after-the-fact solutions. The safety net needs to be built into Claude Code itself.

Priority

Critical - Blocking my work

Feature Category

CLI commands and flags

Use Case Example

Scenario — merging two project directories into one app:

1. I have Project A (with data files: data files) and Project B (the new unified app).
2. I ask Claude Code to merge Project A into Project B's directory.
3. On macOS APFS (case-insensitive), some filenames collide. Claude runs rm to resolve conflicts before copying.
4. Data files (167K+ files) are permanently deleted.
5. No undo, no Trash, no recovery. Third-party tools fail due to SSD TRIM and macOS SIP.

With a session recycle bin:

• Step 3 would move files to ~/.claude/recycle/<session>/ instead of deleting them.
• I could run /undo or manually recover from the recycle directory.
• Zero data loss, zero disruption.

Additional Context

Technical notes for implementation:

• On macOS, NSFileManager.trashItem(at:resultingItemURL:) or the trash CLI utility moves to Trash instead of permanently deleting. This is a one-line change per deletion call.
• On Linux, gio trash provides equivalent functionality.
• The session recycle bin at ~/.claude/recycle/<session-id>/ could use a flat structure with a manifest JSON mapping original paths to recycled filenames.
• Automatic cleanup: purge recycle bins older than 24h (configurable) on session start.
• Cost: minimal disk overhead — most deleted files are small configs/data. A 200MB cap per session would cover 99% of use cases.

This is especially critical for users who work across multiple projects or perform directory merges, where silent file conflicts on case-insensitive filesystems can cause catastrophic data loss.