An assistant that is never shown your files
Disk Map is a treemap explorer, built because Disk Inventory X was discontinued. The part worth writing about is the advisor bolted to it. It recommends what to delete while being structurally incapable of reading what is inside anything. First pass recovered 80 GB.
Metadata only, by construction
An assistant that helps you delete things has to be trusted twice. That its advice is sound, and that asking for the advice was itself safe. The second is the one people actually worry about, and it cannot be answered with a privacy policy.
So the advisor is only ever given names, sizes, extensions, dates and counts. Not a byte of file content reaches it, because the scanner does not hold any. There are exactly two backends, the Anthropic API when a key is present or a local Ollama model otherwise, free and offline. With neither available the app behaves as it did before the feature existed.
The honest version of "we never read your files" is an assistant that could not read them if it tried.
A deliberately small surface
- list_folder, folder_stats, search_names read the scan's in-memory metadata. Nothing touches the disk again.
- propose_rescan cannot scan anything. It surfaces a button for the person to press.
- photo_date_taken reads the EXIF header of one image at a time to recover a capture date. A camera-metadata header, never the image.
None of them modify or delete. The assistant can argue for a deletion. It cannot perform one. That division is the whole safety model, and it is enforced by what exists instead of by instructions in a prompt.
Context is what makes a folder readable
A verdict is safe, risky or unknown, with a confidence, two or three plain sentences, and an estimate of the bytes recoverable without losing anything personal. "Unknown" is a first-class answer. The alternative is a model guessing about someone's only copy of something.
The prompt leans conservative on purpose. Personal media, documents and anything ambiguous fall to risky. The model is also shown a folder's siblings, because that is where the meaning is. A dist next to a package.json is build output. A Backup next to Old iPhone Backup 2 is probably somebody's only copy.
A context window that truncates from the front
Ollama's default context is small enough that a large folder manifest overruns it. It does not error. It truncates from the front, which is where the system prompt lives. The model then answers without its instructions, fluently and in the wrong format, and nothing in the output says so.
The manifest is bounded instead: depth, children and total nodes all capped, and the context raised to 16k, comfortably inside what the local model handles. The failure I was designing against was not a bad answer. It was a confident one with the rules quietly missing.
What I take from it
Same lesson as the color tool. A system that advises has to earn trust structurally, not reassure verbally. Give it the least access that still answers the question, let it say "unknown", and assume the quiet failures are the ones that will reach a user.