View source for The rsync --delete incident of April 2026

== Summary ==

On the evening of '''2026-04-14''', a misformatted <code>rsync --delete</code> command provided by Claude destroyed large portions of the home directory on my MacBook Pro (m5). The command was intended to deploy a build artifact from m5 to m1, but due to a line break in the middle of the command, the shell split it into two commands. The first had only a source and no destination — and macOS rsync in local mode with <code>--delete</code> used the single path as both source and target, beginning to mirror a small <code>build/</code> folder over the entire home directory.

The deletion was interrupted with Ctrl-C mid-run, but not before Keychains, an entire automation repo, an in-progress project with uncommitted work, and substantial parts of <code>~/Library/</code> had been wiped.

== The command ==

Claude produced this rsync command, wrapped across two lines:

<pre>
rsync -avz --delete -e "ssh -o AddressFamily=inet" /Users/nik/Projects/GitHub/OrganizeMoneyAndTaxes/dashboard/build/
   edmiidz@m1.local:/Users/edmiidz/Projects/GitHub/OrganizeMoneyAndTaxes/dashboard/build/
</pre>

zsh split the command at the newline. rsync received only the source path (no destination) and, because macOS rsync in local mode with <code>--delete</code> treats a single argument as both source and target, began mirroring <code>dashboard/build/</code> '''over m5's home directory root (<code>/Users/nik/</code>)''', deleting everything in <code>~</code> that wasn't present in <code>dashboard/build/</code>.

The second line (<code>edmiidz@m1.local:...</code>) was then executed as a separate command and rejected by zsh as "no such file or directory."

== What was lost ==

* <code>~/Library/Keychains/login.keychain-db</code> — cascading Keychain failure, dialog flood until reboot.
* <code>~/Scripts/</code> — entire personal automation repo (AWS/GCP tooling, DB manager, Quick Navigation, deployment scripts).
* <code>~/Projects/GitHub/OrganizeMoneyAndTaxes/</code> — entire working copy, including uncommitted work from that session:
** Foreign Amount display fix on <code>TransactionDetail.js</code>
** FX parser changes in <code>scripts/import-bank-statements.js</code>
** A new <code>WorkSearch.js</code> page and <code>work-search.js</code> API route
** A new <code>backfill-foreign-currency.js</code> script
** Uncommitted changes to <code>App.js</code>, <code>Sidebar.js</code>, and <code>src/index.js</code>
* Portions of <code>~/Library/</code> affecting Mail, Google Drive Desktop sign-in, iMessage sign-in, etc.
* Parts of <code>~/google-cloud-sdk/</code> (reinstallable).

== What survived ==

* <code>~/Desktop/</code>, <code>~/Documents/</code>, <code>~/Downloads/</code> — fully intact.
* <code>~/Projects/GitHub/RusuAI-Mobile/</code> — intact.
* <code>~/.ssh/</code>, <code>~/.aws/</code>, <code>~/.gitconfig/</code>, <code>~/.claude/</code>, <code>~/.config/</code> — intact.
* m1 itself was untouched — the broken command never reached the network phase, so the other machine's filesystem and MySQL database (including in-session schema and data fixes) were unharmed.

== Root cause ==

* The command was presented to me broken across two lines in a way that looked like one command but wasn't. I pasted it as-is.
* <code>rsync --delete</code> with a missing or ambiguous destination is catastrophic. There was no dry run (<code>-n</code>) first.
* There was no safety review of the command structure before running it.

== Lessons ==

# '''Never issue multi-argument shell commands broken across unquoted newlines.''' Always one line, or use explicit <code>\</code> line continuations.
# '''<code>rsync --delete</code> requires an explicit dry-run (<code>-n</code>) first''' whenever the human can't visually verify that the destination is correct.
# '''Prefer <code>git</code> over <code>rsync</code>''' for deploying repo-shaped content across machines — commits provide a natural audit trail and can't accidentally <code>--delete</code> the wrong tree.
# '''Enable Time Machine.''' This would have been a 10-minute restore instead of days of recovery.

== Category ==

[[Category:2026 Articles]]
[[Category:Incidents]]
[[Category:AI Collaboration]]