Case study - Tooling & on-device AI

An assistant that is never shown your files

Disk Map is a treemap explorer, built because Disk Inventory X was discontinued. It tells you what is safe to delete while being structurally incapable of reading what is inside any of it. First pass recovered 80 GB.

macOS app On-device AI Ollama

Disk Map open on a laptop, angled against a pale ground: the Diskbot conversation down the left, every file on the drive drawn in the middle as a rectangle sized by the space it takes, and the safe-to-delete rail on the right.

The app

3 screens

Disk Map. The Diskbot panel answering a question about locating a file, beside the treemap of the whole drive.

Disk Map. The light theme with the scan-location dialog open, choosing which volume or folder to read.

Disk Map. The treemap zoomed into one branch, individual files resolving as separate blocks.

01 - The constraint that came first

Metadata only, by construction

An assistant that helps you delete things has to be trusted twice. That its advice is sound, and that asking for the advice was itself safe. The second is the one people actually worry about, and it cannot be answered with a privacy policy.

So the advisor is only ever given names, sizes, extensions, dates and counts. Not a byte of file content reaches it, because the scanner does not hold any. There are exactly two backends, the Anthropic API when a key is present or a local Ollama model otherwise, free and offline. With neither available the app behaves as it did before the feature existed.

The honest version of "we never read your files" is an assistant that could not read them if it tried.

02 - The tools it is given

A deliberately small surface

list_folder, folder_stats, search_names read the scan's in-memory metadata. Nothing touches the disk again.
propose_rescan cannot scan anything. It surfaces a button for the person to press.
photo_date_taken reads the EXIF header of one image at a time to recover a capture date. A camera-metadata header, never the image.

None of them modify or delete. The assistant can argue for a deletion. It cannot perform one. That division is the whole safety model, and it is enforced by what exists instead of by instructions in a prompt.

The Diskbot conversation: a short exchange where the assistant offers to look at a specific folder or file more closely. — **It talks, but only about metadata.** The assistant is conversational on purpose, because the question people actually have is vague. What it can answer with is not.

The question in the Diskbot panel: whats the top 10 largest GIFs scanned. Beneath it the disclosed lookup, a name search for star dot gif with 287 matches, and the model's text answer listing paths and sizes. — **Search by description, not by filename.** The ask and the answer. Asking for the largest GIFs runs a name search across the in-memory scan and returns paths and sizes. The thumbnails are drawn by the app from the file on disk; the model never sees them.

The result list continued: each of the largest GIFs as a row with a preview thumbnail, the file path and its size in megabytes. — **Search by description, not by filename.** The ask and the answer. Asking for the largest GIFs runs a name search across the in-memory scan and returns paths and sizes. The thumbnails are drawn by the app from the file on disk; the model never sees them.

03 - Judgment

Context is what makes a folder readable

A verdict is safe, risky or unknown, with a confidence, two or three plain sentences, and an estimate of the bytes recoverable without losing anything personal. "Unknown" is a first-class answer. The alternative is a model guessing about someone's only copy of something.

The prompt leans conservative on purpose. Personal media, documents and anything ambiguous fall to risky. The model is also shown a folder's siblings, because that is where the meaning is. A dist next to a package.json is build output. A Backup next to Old iPhone Backup 2 is probably somebody's only copy.

04 - The bug worth keeping

A context window that truncates from the front

Ollama's default context is small enough that a large folder manifest overruns it. It does not error. It truncates from the front, which is where the system prompt lives. The model then answers without its instructions, fluently and in the wrong format, and nothing in the output says so.

The manifest is bounded instead: depth, children and total nodes all capped, and the context raised to 16k, comfortably inside what the local model handles. The failure I was designing against was not a bad answer. It was a confident one with the rules quietly missing.

What I take from it

Same lesson as the color tool. A system that advises has to earn trust structurally, not reassure verbally. Give it the least access that still answers the question, let it say "unknown", and assume the quiet failures are the ones that will reach a user.