disk-hygiene: no engine-level large-target confirmation gate; relies entirely on the invoking agent remembering --max-depth

[kyle-sexton]

Summary

Today, SKILL.md's own text tells the agent (Claude) to voluntarily bound a "large root (a home
directory, anything whose recursive walk could exceed the engine's entry cap)" with --max-depth 1
before fanning out. That's a prompt-level convention with no engine-side backstop: if the invoking
agent skips it, forgets, or a differently-tuned future agent doesn't weight that instruction the same
way, an unbounded recursive walk against $HOME or a large drive root can happen with no confirmation
step — the scan itself is unauthenticated today; only the later destructive apply lane is gated.

Framing (verbatim from a live audit session)

"the skill should probably recognize what is $HOME directory, or root drives and interrogate/confirm
with the user - particularly if the file tree is/would be large"

That's the right bar: ask before an expensive/unbounded walk, not just before a destructive one.

Suggested direction

Detect known-large targets deterministically at the engine layer: target resolves to
$HOME/%USERPROFILE%, or (post drive-root-reasoning fix, see companion issue) a drive root that
passes the reasoned-root check. On match, either require an explicit
--max-depth/--confirmed-large-scan flag, or have scan do a cheap top-level os.scandir probe
first and emit a large-target-confirmation-required status instead of walking fully — mirroring the
same "ask before it's expensive" posture the apply lane already has, just moved earlier since the
expense here is time/resource, not data loss.

Related

Companion to the drive-root-reasoning issue filed in the same audit session — a root target and a
"large target" are overlapping but distinct concerns; neither fix should silently paper over the other.