Agent deletes local files after misinterpreting a command sequence (Gemini CLI)
Asked to rename a directory and move its contents, the agent's mkdir silently failed; a wildcard move against the non-existent target overwrote every file onto the same name until all but the last were destroyed.
What happened
Gemini CLI, acting as a coding agent on the user’s real filesystem (Windows) with shell
access, was asked to rename a folder and move its contents into a new subfolder. Its mkdir
for the destination failed, but the agent continued as if it had succeeded, then issued
a wildcard move at the non-existent target. On Windows, move * to a missing destination
renames each file to the same name in sequence, overwriting the previous one each step —
destroying every file but the last. The agent called the result “unacceptable and
irreversible.”
Why it passed the checks
No read-after-write verification. The agent never read filesystem state (dir) after a
destructive step to confirm the world matched its assumptions; it assumed the mkdir
succeeded and built on that false premise (CWE-754, improper check for unusual conditions).
What Salvager does about this class
This is the center of Salvager’s promise: local, uncommitted files — exactly what the
watcher captures and git does not. If the watcher was running, each overwritten file has its
prior revision in the store, and salvager restore-at <ms> returns the whole set to the
instant before the move cascade, in one step. The agent called the damage “irreversible”
because it measured the world with the wrong safety net (git). With a per-file net, it was
not.