Once #343 is resolved, we could run into code that has unintended results. For example:

> echo(ls()); // start out in a directory containing these 3 files
[ 'a.txt', 'b.txt', '*.txt' ]
> ls().forEach(function (file) {
  if (file === 'a.txt') return; // don't delete a.txt
  rm(file); // delete the other two fies
});
> echo(ls()); // when we deleted *.txt, it was treated as a glob, so we deleted everything
[]

If we allow shellEscape() to be a function, then we could replace the questionable line with rm(shellEscape(file)), which is guaranteed to not glob.

An alternative would be to insist on the syntax: set('-f'); rm(file); set('+f') (very verbose, but if #344 is resolved, should be safe).

Another alternative would be rm(file, {glob: false}). This is a nice syntax, but complicates parsing. The advantage of this would be that we could extend it to support more than just glob, like silent: true (to emulate echo foo >/dev/null), instead of the very verbose config.silent = true; ls(); config.silent = false, for getting a single command to be silent.