@andares/pi-toolkits 0.11.0 → 0.11.1

package/README.md

@@ -116,7 +116,7 @@ Enter with `/ask` (press it again to exit). Meant for the case where you only wa
 
 Repeating the argument form with the modes already in force is a **no-op**: no second "ON" notice and no loss of the session grants collected so far. Changing any mode records the change and clears those grants, because they were made under the old policy.
 
-**Defaults**: in-project read/write allowed, outside read allowed, outside write asks.
+**Defaults**: in-project read/write allowed, outside read allowed, outside write asks — except writes under the OS temp root, which are scratch space and pass directly. An explicit `out write = deny` still denies them.
 
 | Scope | reads | writes / exec |
 | --- | --- | --- |
@@ -125,19 +125,22 @@ Repeating the argument form with the modes already in force is a **no-op**: no s
 
 `exec` is folded into `write`: any command that changes state counts as a write.
 
+**Temporary write zone**: a write outside the project but under the OS temp root (`os.tmpdir()`, `/var/tmp`, `/dev/shm`) is allowed without a dialog when `out write` is `ask` (the audit layer is `temp`). `/tmp` is shared scratch space, so this is a convenience rule, not an isolation boundary; deleting a temp root itself (`rm -rf /tmp`) still hits the destructive table.
+
 **What is inspected**
 
 - **bash** is decomposed into simple commands — `&&`, `||`, `;`, pipes, `$(…)`, backticks, `bash -c`, `eval`, the common indirection wrappers (`sudo`, `env`, `xargs`, `find -exec`, …), heredocs — and judged per command. `cd` folds into the commands after it; the strictest result wins, so `cd /tmp && rm x` cannot ride on the first segment.
 - **path-bearing tools** (`read` / `write` / `edit` / `grep` / `find` / `ls`) are judged by their own path; every other tool is judged by the working directory.
 - **unresolvable input** — a non-literal `cd` or `git -C`, an unknown shell variable in a path, an unterminated heredoc or substitution — is asked about regardless of mode (fail closed), never guessed.
 - **`git -C <dir>`** is resolved like a local `cd`: relative path arguments (and the repository) are judged against `<dir>`, not the working directory.
+- **device sinks and data arguments** — `/dev/null`, `/dev/stdout` and `/dev/stderr` are never boundary targets, whether written as a redirect (`cmd > /dev/null`) or an operand (`curl -o /dev/null`); the arguments of `echo` / `printf` are data, not paths.
 
 **Answers**: `a` allow once · `s` allow this directory for the session · `d` deny · `f` deny this directory for the session. Session grants are kept in memory as `(read|write, directory)`, matched by containment, and cleared when the mode is turned off or the session ends. A session grant outranks the destructive table — once you have allowed an operation for the session, repeating it does not ask again. A command the parser cannot resolve is granted by its exact text instead, so repeating the same opaque command does not ask again.
 
 **Fixed safety tables** (independent of the four modes):
 
 - **credentials are denied in every mode** — `~/.ssh`, `~/.gnupg`, `~/.aws`, `~/.pi/agent/auth*.json`, `.env` files (templates excepted). Without this, `out read = allow` would hand out `~/.ssh/id_rsa`.
-- **destructive commands always ask** — `rm` of `/`, the home directory, or the working directory; `git reset --hard`; `git clean -f`; `git push --force`; package `publish`; `dd` to a raw device; `mkfs*`; shutdown/reboot; `chmod -R 777`; anything through `sudo`. Scope alone cannot express "destructive".
+- **destructive commands always ask** — `rm` of `/`, the home directory, the working directory, or a temp root (`/tmp`, `/var/tmp`, `/dev/shm`); `git reset --hard`; `git clean -f`; `git push --force`; package `publish`; `dd` to a raw device; `mkfs*`; shutdown/reboot; `chmod -R 777`; anything through `sudo`. Scope alone cannot express "destructive".
 
 **Approval log** (write-only telemetry, on by default)
 

package/README.zh-CN.md

@@ -116,7 +116,7 @@ pi -e ./src/index.ts
 
 参数形式重复执行、且四项模式与当前一致时是**空操作**:不会再出一条「ON」提示,也不会清掉已经攒下的会话授权。只有模式真的变了才会提示并清空授权——那些授权是按旧策略给的。
 
-**默认值**:项目内读/写全放行,项目外读放行,项目外写询问。
+**默认值**:项目内读/写全放行,项目外读放行,项目外写询问——但 `os.tmpdir()`、`/var/tmp`、`/dev/shm` 下的临时写入直接放行。显式把 `out write` 设为 `deny` 时仍然拒绝。
 
 | 作用域 | 读 | 写 / 执行 |
 | --- | --- | --- |
@@ -125,19 +125,22 @@ pi -e ./src/index.ts
 
 `exec` 折进 `write`:任何产生变更的执行都算写。
 
+**临时写入区**:项目外、但落在操作系统临时根(`os.tmpdir()`、`/var/tmp`、`/dev/shm`)的写入,在 `out write = ask` 时直接放行(审计层记 `temp`)。`/tmp` 是共享草稿空间,这条是便利规则,不是隔离边界;**删除临时根本身**(`rm -rf /tmp`)仍然走破坏性表。
+
 **检查方式**
 
 - **bash** 先拆成简单命令 —— `&&`、`||`、`;`、管道、`$(…)`、反引号、`bash -c`、`eval`、常见间接包装(`sudo`、`env`、`xargs`、`find -exec`…)、heredoc —— 再逐条判定;`cd` 向前折叠,取最严格的结果,所以 `cd /tmp && rm x` 不会靠第一段蒙混过关
 - **带路径的工具**(`read` / `write` / `edit` / `grep` / `find` / `ls`)按自己的路径判定;其它工具按工作目录判定
 - **无法解析的输入** —— 非字面量 `cd` 或 `git -C`、路径里的未知 shell 变量、未闭合的 heredoc/命令替换 —— 一律询问,不看模式(fail closed),绝不猜测
 - **`git -C <dir>`** 按局部 `cd` 处理:相对路径参数(和仓库本身)按 `<dir>` 判定,而不是工作目录
+- **设备 sink 与数据参数** —— `/dev/null`、`/dev/stdout`、`/dev/stderr` 无论是重定向(`cmd > /dev/null`)还是普通操作数(`curl -o /dev/null`),都不算边界目标;`echo` / `printf` 的参数是数据,不按路径处理
 
 **回答**:`a` 本次允许 · `s` 本会话允许该目录 · `d` 拒绝 · `f` 本会话拒绝该目录。会话授权在内存中按 `(读|写, 目录)` 保存、按包含关系匹配,关闭模式或会话结束时清空;**会话授权优先于破坏性表**——你按了 `s` 之后,重复同一操作不会再弹;解析不了完整路径的命令则按**完整命令文本**授权,重复同一条命令不会再问。
 
 **固定安全表**(与四格模式无关):
 
 - **凭据路径任何模式都拒绝** —— `~/.ssh`、`~/.gnupg`、`~/.aws`、`~/.pi/agent/auth*.json`、`.env` 文件(模板除外)。没有这一条,默认的「项目外读放行」就等于把 `~/.ssh/id_rsa` 交出去
-- **破坏性命令永远询问** —— 对 `/`、家目录或工作目录的 `rm`;`git reset --hard`;`git clean -f`;`git push --force`;包 `publish`;`dd` 写裸设备;`mkfs*`;关机/重启;`chmod -R 777`;任何经 `sudo` 的命令。作用域本身表达不了「破坏性」
+- **破坏性命令永远询问** —— 对 `/`、家目录、工作目录或临时根(`/tmp`、`/var/tmp`、`/dev/shm`)的 `rm`;`git reset --hard`;`git clean -f`;`git push --force`;包 `publish`;`dd` 写裸设备;`mkfs*`;关机/重启;`chmod -R 777`;任何经 `sudo` 的命令。作用域本身表达不了「破坏性」
 
 **审批日志**(只写遥测,默认开启)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andares/pi-toolkits",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Integrated toolkit extension for pi — ask mode (read-only Q&A), session-scoped permission checks, model favorites, prompt stash, third-party code review, session autostart, a dedicated compaction model, and an agent memory framework (/ask-init)",
   "type": "module",
   "license": "MIT",

package/src/features/ask/index.ts

@@ -1,7 +1,8 @@
 /**
  * ask feature — read-only consult mode.
  *
- * Design notes (see PLAN.md and AGENTS.md):
+ * Design notes (see AGENTS.md §Feature: ask, plus the D1–D6 records in
+ * .agents/memory/ARCHITECTURE.md):
  *  - Project writes stay impossible: write/edit/powershell are removed from the
  *    active tool set via pi.setActiveTools(), and pi's runtime rejects calls to
  *    non-active tools ("Tool not found"). A gate blocks them again as defence in

package/src/features/ask/prompt.ts

@@ -16,7 +16,8 @@
  *    be ~300 tokens per request restating what the sandbox already enforces.
  *
  * Do NOT use the removed `systemPromptAppend` field or wholesale systemPrompt
- * replacement (see PLAN.md).
+ * replacement (see `AGENTS.md` §Feature: ask and the D5 record in
+ * `.agents/memory/ARCHITECTURE.md`).
  */
 
 export interface AskBannerOptions {

package/src/features/permission/audit.test.ts

@@ -45,7 +45,7 @@ function audit(command: string, ctx: PolicyContext, prompt?: readonly string[])
 describe("permission audit payload", () => {
 	it("records the decomposition, target scope and deciding layer", () => {
 		const cwd = project();
-		const payload = audit("rm -rf /tmp/outside/x", makeContext(cwd));
+		const payload = audit("rm -rf /var/pi-perm-outside/x", makeContext(cwd));
 
 		expect(payload.modes).toEqual({
 			inRead: "allow",
@@ -58,7 +58,7 @@ describe("permission audit payload", () => {
 			expect.objectContaining({
 				head: "rm",
 				command: "rm",
-				args: ["-rf", "/tmp/outside/x"],
+				args: ["-rf", "/var/pi-perm-outside/x"],
 				base: canonicalize(cwd),
 				effect: "write",
 				opaque: false,
@@ -66,8 +66,8 @@ describe("permission audit payload", () => {
 				layer: "mode",
 				targets: [
 					{
-						path: "/tmp/outside/x",
-						canonical: "/tmp/outside/x",
+						path: "/var/pi-perm-outside/x",
+						canonical: canonicalize("/var/pi-perm-outside/x"),
 						effect: "write",
 						source: "operand",
 						scope: "out",
@@ -79,11 +79,11 @@ describe("permission audit payload", () => {
 			action: "ask",
 			layer: "mode",
 			unit: 0,
-			target: "/tmp/outside/x",
+			target: canonicalize("/var/pi-perm-outside/x"),
 			effect: "write",
 			scope: "out",
 			grantScope: "root",
-			grantRoot: "/tmp/outside",
+			grantRoot: canonicalize("/var/pi-perm-outside"),
 		});
 	});
 
@@ -137,20 +137,20 @@ describe("permission audit payload", () => {
 
 	it("carries the exact prompt lines when asked", () => {
 		const cwd = project();
-		const payload = audit("rm -rf /tmp/outside/x", makeContext(cwd), [
+		const payload = audit("rm -rf /var/pi-perm-outside/x", makeContext(cwd), [
 			"Permission required",
-			"Command: rm -rf /tmp/outside/x",
+			"Command: rm -rf /var/pi-perm-outside/x",
 		]);
 		expect(payload.prompt).toEqual([
 			"Permission required",
-			"Command: rm -rf /tmp/outside/x",
+			"Command: rm -rf /var/pi-perm-outside/x",
 		]);
 	});
 
 	it("clips long arguments but keeps the target", () => {
 		const cwd = project();
 		const longArg = `--flag=${"x".repeat(2000)}`;
-		const payload = audit(`rm -rf /tmp/outside/x ${longArg}`, makeContext(cwd));
+		const payload = audit(`rm -rf /var/pi-perm-outside/x ${longArg}`, makeContext(cwd));
 		const unit = (payload.units as Array<Record<string, unknown>>)[0];
 		const args = unit.args as string[];
 		expect(args[2]).toContain("[+");

package/src/features/permission/constants.test.ts

@@ -2,10 +2,16 @@
  * Fixed safety tables: credential paths are denied in every mode, destructive
  * commands always ask.
  */
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
-import { dangerReason, secretReason } from "./constants.js";
+import { canonicalize } from "./paths.js";
+import {
+	dangerReason,
+	isTemporaryPath,
+	secretReason,
+	temporaryRoots,
+} from "./constants.js";
 
 const HOME = homedir();
 
@@ -37,11 +43,30 @@ describe("secrets table", () => {
 	});
 });
 
+describe("temporary write zone", () => {
+	it("covers the OS temp root and the common volatile directories", () => {
+		expect(temporaryRoots()).toContain(canonicalize(tmpdir()));
+		expect(temporaryRoots()).toContain(canonicalize("/var/tmp"));
+		expect(temporaryRoots()).toContain(canonicalize("/dev/shm"));
+		expect(isTemporaryPath(join(tmpdir(), "pi", "x"))).toBe(true);
+		expect(isTemporaryPath(join("/var/tmp", "x"))).toBe(true);
+		expect(isTemporaryPath(join("/dev/shm", "x"))).toBe(true);
+	});
+
+	it("does not over-match a sibling prefix or an ordinary path", () => {
+		expect(isTemporaryPath(`${tmpdir()}-evil/x`)).toBe(false);
+		expect(isTemporaryPath("/var/tmp-evil/x")).toBe(false);
+		expect(isTemporaryPath("/proj/x")).toBe(false);
+	});
+});
+
 describe("danger table", () => {
 	it("catches the destructive core", () => {
 		expect(dangerReason("rm", ["-rf", "/"], ["/"], "/proj")).toContain("recursive delete");
 		expect(dangerReason("rm", ["-rf", HOME], [HOME], "/proj")).toContain("recursive delete");
 		expect(dangerReason("rm", ["-rf", "/proj"], ["/proj"], "/proj")).toContain("recursive delete");
+		expect(dangerReason("rm", ["-rf", tmpdir()], [tmpdir()], "/proj")).toContain("recursive delete");
+		expect(dangerReason("rm", ["-rf", "/var/tmp"], ["/var/tmp"], "/proj")).toContain("recursive delete");
 		expect(dangerReason("git", ["push", "--force"], [], "/proj")).toBe("forced git push");
 		expect(dangerReason("git", ["push", "-f"], [], "/proj")).toBe("forced git push");
 		expect(dangerReason("git", ["reset", "--hard"], [], "/proj")).toBe("git reset --hard");
@@ -53,6 +78,7 @@ describe("danger table", () => {
 
 	it("does not flag ordinary commands", () => {
 		expect(dangerReason("rm", ["-rf", "/proj/build"], ["/proj/build"], "/proj")).toBeUndefined();
+		expect(dangerReason("rm", ["-rf", join(tmpdir(), "x")], [join(tmpdir(), "x")], "/proj")).toBeUndefined();
 		expect(dangerReason("git", ["push"], [], "/proj")).toBeUndefined();
 		expect(dangerReason("git", ["log"], [], "/proj")).toBeUndefined();
 		expect(dangerReason("npm", ["view", "react"], [], "/proj")).toBeUndefined();

package/src/features/permission/constants.ts

@@ -13,8 +13,9 @@
  *    when their scope says allow (`rm -rf .` inside the project is still a
  *    guarded operation). Scope alone cannot express "destructive".
  */
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { basename, join, sep } from "node:path";
+import { canonicalize } from "./paths.js";
 
 /** Three-way mode, used for outside-project operations. */
 export type TriMode = "ask" | "allow" | "deny";
@@ -85,6 +86,29 @@ function isSecretEnvFile(pathValue: string): boolean {
 	return name === ".env" || name.startsWith(".env.");
 }
 
+/**
+ * Ephemeral directories whose writes are built-in safe: a scratch artifact
+ * under the OS temp root is not a boundary crossing worth a dialog. Kept to
+ * genuinely volatile locations; `~/.cache` is deliberately not included (it
+ * is a home-directory state area, not a scratch area).
+ *
+ * Resolved once at module load so the comparisons use the same spelling as the
+ * policy's canonical paths (`/tmp` is a symlink to `/private/tmp` on macOS).
+ */
+const TEMPORARY_ROOTS: readonly string[] = [tmpdir(), "/var/tmp", "/dev/shm"].map(
+	(root) => canonicalize(root),
+);
+
+export function temporaryRoots(): string[] {
+	return [...TEMPORARY_ROOTS];
+}
+
+/** `true` when `pathValue` is inside one of {@link temporaryRoots}. */
+export function isTemporaryPath(pathValue: string): boolean {
+	const canonical = canonicalize(pathValue);
+	return TEMPORARY_ROOTS.some((root) => pathWithin(root, canonical));
+}
+
 /** Absolute secret prefixes, `~` expanded. */
 export function secretRoots(): string[] {
 	return SECRET_ROOTS.map((root) =>
@@ -118,11 +142,12 @@ export function dangerReason(
 	const inDangerousRoot = (pathValue: string): boolean =>
 		pathValue === "/" ||
 		pathValue === home ||
-		(base !== null && pathValue === base);
+		(base !== null && pathValue === base) ||
+		TEMPORARY_ROOTS.includes(canonicalize(pathValue));
 
 	if (command === "sudo" || command === "doas") return "privileged command";
 	if (command === "rm" && targets.some(inDangerousRoot)) {
-		return "recursive delete of /, the home directory, or the working directory";
+		return "recursive delete of /, the home directory, the working directory, or a temp root";
 	}
 	if (command === "git") {
 		const [verb, ...rest] = args;

package/src/features/permission/index.test.ts

@@ -22,6 +22,7 @@ import {
 	resetJailedTools,
 } from "../../lib/tools.js";
 import { markStartupCommand } from "../../lib/startup.js";
+import { canonicalize } from "./paths.js";
 import { registerPermission } from "./index.js";
 
 function bashEvent(command: string): ToolCallEvent {
@@ -169,7 +170,7 @@ function asAsk(verdict: unknown): AskVerdict {
 describe("/ask-perm", () => {
 	it("is off by default", async () => {
 		const h = makeHarness();
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("enables from arguments, reports status, and asks for an outside write", async () => {
@@ -177,15 +178,53 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		expect(h.statuses.at(-1)?.[0]).toBe("perm-mode");
 		expect(h.statuses.at(-1)?.[1]).toContain("perm");
-		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside")));
-		expect(verdict.request.details.join("\n")).toContain("/tmp/outside");
-		expect(verdict.request.root).toBe("/tmp");
+		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside")));
+		expect(verdict.request.details.join("\n")).toContain("/var/pi-perm-outside");
+		expect(verdict.request.root).toBe(canonicalize("/var"));
+	});
+
+	it("does not ask for a write under the OS temp root", async () => {
+		const h = makeHarness();
+		await h.command("allow allow allow ask");
+		expect(
+			await h.evaluate(bashEvent("echo hi > /tmp/pi-perm-temp.txt")),
+		).toBeUndefined();
+		// The same rule must cover the path-bearing write tool, not just bash.
+		expect(
+			await h.evaluate(pathEvent("write", "/tmp/pi-perm-temp.txt")),
+		).toBeUndefined();
+	});
+
+	it("does not ask for a /dev/null sink operand", async () => {
+		const h = makeHarness();
+		await h.command("allow allow allow ask");
+		expect(
+			await h.evaluate(
+				bashEvent("curl -s -o /dev/null -w '%{http_code}\\n' http://localhost:5173/"),
+			),
+		).toBeUndefined();
+	});
+
+	it("does not ask for echo arguments that merely look like paths", async () => {
+		const h = makeHarness();
+		await h.command("allow allow allow ask");
+		expect(
+			await h.evaluate(
+				bashEvent('echo "  $f  改动 $tot 行 / 忽略空白后 $w 行"'),
+			),
+		).toBeUndefined();
+	});
+
+	it("still asks before deleting a temp root itself", async () => {
+		const h = makeHarness();
+		await h.command("allow allow allow ask");
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp"))).kind).toBe("ask");
 	});
 
 	it("blocks immediately when outside writes are denied", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow deny");
-		const verdict = (await h.evaluate(bashEvent("rm -rf /tmp/outside"))) as {
+		const verdict = (await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))) as {
 			kind: "block";
 			reason: string;
 		};
@@ -197,17 +236,17 @@ describe("/ask-perm", () => {
 	it("records a session grant and applies it to later calls", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		const first = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x")));
+		const first = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x")));
 		first.request.apply("allow-session");
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).toBeUndefined();
 	});
 
 	it("records a session deny and blocks later calls", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		const first = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x")));
+		const first = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x")));
 		first.request.apply("deny-session");
-		const later = (await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))) as {
+		const later = (await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))) as {
 			kind: "block";
 			reason: string;
 		};
@@ -220,7 +259,7 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		await h.command("");
 		expect(h.statuses.at(-1)?.[1]).toBeUndefined();
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("writes a startup notice as an entry instead of a status line", async () => {
@@ -233,7 +272,7 @@ describe("/ask-perm", () => {
 			"Permission ON",
 		);
 		expect(h.statuses.at(-1)?.[1]).toContain("perm");
-		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).kind).toBe(
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).kind).toBe(
 			"ask",
 		);
 	});
@@ -250,14 +289,14 @@ describe("/ask-perm", () => {
 		const h = makeHarness();
 		await h.command("");
 		expect(h.notes.at(-1)?.message).toContain("cancelled");
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("rejects invalid arguments without enabling", async () => {
 		const h = makeHarness();
 		await h.command("deny");
 		expect(h.notes.at(-1)?.kind).toBe("error");
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("keeps the state when the same session emits session_start again", async () => {
@@ -266,7 +305,7 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		// A startup rebind reports the same session again; state must survive.
 		await h.sessionStart();
-		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).kind).toBe(
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).kind).toBe(
 			"ask",
 		);
 	});
@@ -276,28 +315,28 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		h.setSessionId("session-2");
 		await h.sessionStart();
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("resets on session_start", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
 		await h.sessionStart();
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 		expect(h.statuses.at(-1)?.[1]).toBeUndefined();
 	});
 
 	it("treats add-dir directories as inside the project", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp/added/x"))).kind).toBe("ask");
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-added/x"))).kind).toBe("ask");
 
 		h.branch.push({
 			type: "custom",
 			customType: "add-dir:state",
-			data: { dirs: [{ absolutePath: "/tmp/added" }] },
+			data: { dirs: [{ absolutePath: "/var/pi-perm-added" }] },
 		});
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/added/x"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-added/x"))).toBeUndefined();
 	});
 
 	it("treats a redirect write to a credential path as a fixed deny, not a write ask", async () => {
@@ -313,15 +352,19 @@ describe("/ask-perm", () => {
 	it("judges git -C by the -C directory, not the working directory", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		expect(await h.evaluate(bashEvent("git -C ../outside log"))).toBeUndefined();
-		expect(asAsk(await h.evaluate(bashEvent("git -C ../outside push"))).kind).toBe("ask");
+		expect(
+			await h.evaluate(bashEvent("git -C /var/pi-perm-outside log")),
+		).toBeUndefined();
+		expect(
+			asAsk(await h.evaluate(bashEvent("git -C /var/pi-perm-outside push"))).kind,
+		).toBe("ask");
 	});
 
 	it("answers path-bearing tools by their own path", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
 		expect(await h.evaluate(pathEvent("write", "notes.txt"))).toBeUndefined();
-		expect(asAsk(await h.evaluate(pathEvent("write", "/tmp/outside.txt"))).kind).toBe("ask");
+		expect(asAsk(await h.evaluate(pathEvent("write", "/var/pi-perm-outside.txt"))).kind).toBe("ask");
 		const denied = (await h.evaluate(pathEvent("read", "~/.ssh/id_rsa"))) as {
 			kind: "block";
 		};
@@ -339,26 +382,26 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		expect(h.notes).toHaveLength(1);
 
-		asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x"))).request.apply(
+		asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x"))).request.apply(
 			"allow-session",
 		);
 		await h.command("allow allow allow ask");
 		expect(h.notes).toHaveLength(1);
 		// The grant collected before the repeat is still in force.
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).toBeUndefined();
 	});
 
 	it("notifies and clears session grants when the modes actually change", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x"))).request.apply(
+		asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x"))).request.apply(
 			"allow-session",
 		);
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).toBeUndefined();
 
 		await h.command("ask allow allow ask");
 		expect(h.notes).toHaveLength(2);
-		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).kind).toBe("ask");
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).kind).toBe("ask");
 	});
 });
 
@@ -366,7 +409,7 @@ describe("dialog contract", () => {
 	it("fails closed without a UI", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside")));
+		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside")));
 		const noUi = { ...h.ctx, hasUI: false } as ExtensionContext;
 		await expect(verdict.request.present(noUi)).resolves.toBeUndefined();
 	});
@@ -374,7 +417,7 @@ describe("dialog contract", () => {
 	it("falls back to the host selector in non-TUI modes", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside")));
+		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside")));
 		const rpc = {
 			cwd: h.cwd,
 			hasUI: true,
@@ -456,13 +499,13 @@ describe("audit log", () => {
 		const { audit } = makeAudit();
 		const h = makeHarness(audit);
 		await h.command("allow allow allow ask");
-		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x")));
+		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x")));
 		expect(verdict.request.audit).toMatchObject({
 			modes: { outWrite: "ask" },
 			verdict: {
 				action: "ask",
 				layer: "mode",
-				target: "/tmp/outside/x",
+				target: "/var/pi-perm-outside/x",
 				scope: "out",
 			},
 		});
@@ -543,9 +586,9 @@ describe("audit log — session-grant allows", () => {
 		const { audit, records } = makeAudit();
 		const h = makeHarness(audit);
 		await h.command("allow allow allow ask");
-		const first = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x")));
+		const first = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x")));
 		first.request.apply("allow-session");
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).toBeUndefined();
 
 		const allow = records.find((record) => record.event === "allow");
 		expect(allow).toMatchObject({

package/src/features/permission/policy.test.ts

@@ -7,7 +7,7 @@ import { mkdtempSync, realpathSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { describe, expect, it } from "vitest";
-import { DEFAULT_MODES, type PermissionModes } from "./constants.js";
+import { DEFAULT_MODES, temporaryRoots, type PermissionModes } from "./constants.js";
 import { canonicalize } from "./paths.js";
 import {
 	decideProgram,
@@ -46,14 +46,14 @@ describe("four-mode policy", () => {
 	it("asks for an outside write and allows an outside read by default", () => {
 		const cwd = project();
 		const ctx = makeContext(cwd);
-		expect(decide("rm -rf /tmp/outside", ctx).action).toBe("ask");
+		expect(decide("rm -rf /var/pi-perm-outside", ctx).action).toBe("ask");
 		expect(decide("cat /etc/hostname", ctx).action).toBe("allow");
 	});
 
 	it("honours a deny mode for outside writes", () => {
 		const cwd = project();
 		const ctx = makeContext(cwd, { ...DEFAULT_MODES, outWrite: "deny" });
-		const decision = decide("rm -rf /tmp/outside", ctx);
+		const decision = decide("rm -rf /var/pi-perm-outside", ctx);
 		expect(decision.action).toBe("deny");
 		expect(decision.reason).toContain("outside-project write");
 	});
@@ -65,6 +65,43 @@ describe("four-mode policy", () => {
 	});
 });
 
+describe("temporary write zone", () => {
+	it("allows a temp write when the mode would otherwise ask", () => {
+		const cwd = project();
+		const ctx = makeContext(cwd);
+		for (const root of temporaryRoots()) {
+			const decision = decide(`echo hi > ${join(root, "pi-perm-temp.txt")}`, ctx);
+			expect(decision.action).toBe("allow");
+			expect(decision.layer).toBe("temp");
+		}
+	});
+
+	it("still honours an explicit outside-write deny", () => {
+		const cwd = project();
+		const ctx = makeContext(cwd, { ...DEFAULT_MODES, outWrite: "deny" });
+		const decision = decide(`echo hi > ${join(tmpdir(), "pi-perm-temp.txt")}`, ctx);
+		expect(decision.action).toBe("deny");
+		expect(decision.layer).toBe("mode");
+	});
+
+	it("still asks before deleting a temp root itself", () => {
+		const cwd = project();
+		const decision = decide(`rm -rf ${tmpdir()}`, makeContext(cwd));
+		expect(decision.action).toBe("ask");
+		expect(decision.layer).toBe("danger");
+	});
+
+	it("keeps the secrets table ahead of the temp zone", () => {
+		const cwd = project();
+		const decision = decide(
+			`echo x > ${join(tmpdir(), ".env")}`,
+			makeContext(cwd),
+		);
+		expect(decision.action).toBe("deny");
+		expect(decision.layer).toBe("secret");
+	});
+});
+
 describe("fixed safety table", () => {
 	it("denies credential paths in every mode, even when reads are allowed", () => {
 		const cwd = project();
@@ -117,26 +154,26 @@ describe("session grants", () => {
 	it("allows a write under a granted directory", () => {
 		const cwd = project();
 		const rules = new SessionRules();
-		rules.allow({ effect: "write", root: "/tmp/granted" });
+		rules.allow({ effect: "write", root: "/var/pi-perm-granted" });
 		expect(
-			decide("rm -rf /tmp/granted/x", makeContext(cwd, DEFAULT_MODES, rules)).action,
+			decide("rm -rf /var/pi-perm-granted/x", makeContext(cwd, DEFAULT_MODES, rules)).action,
 		).toBe("allow");
 	});
 
 	it("does not let a read grant cover a write", () => {
 		const cwd = project();
 		const rules = new SessionRules();
-		rules.allow({ effect: "read", root: "/tmp/granted" });
+		rules.allow({ effect: "read", root: "/var/pi-perm-granted" });
 		expect(
-			decide("rm -rf /tmp/granted/x", makeContext(cwd, DEFAULT_MODES, rules)).action,
+			decide("rm -rf /var/pi-perm-granted/x", makeContext(cwd, DEFAULT_MODES, rules)).action,
 		).toBe("ask");
 	});
 
 	it("denies before allowing, even when the mode allows", () => {
 		const cwd = project();
 		const rules = new SessionRules();
-		rules.deny({ effect: "read", root: "/tmp/granted" });
-		const decision = decide("cat /tmp/granted/x", makeContext(cwd, DEFAULT_MODES, rules));
+		rules.deny({ effect: "read", root: "/var/pi-perm-granted" });
+		const decision = decide("cat /var/pi-perm-granted/x", makeContext(cwd, DEFAULT_MODES, rules));
 		expect(decision.action).toBe("deny");
 		expect(decision.reason).toContain("denied for this session");
 	});
@@ -155,13 +192,13 @@ describe("severity folding", () => {
 	it("takes the strictest unit of a compound command", () => {
 		const cwd = project();
 		const ctx = makeContext(cwd, { ...DEFAULT_MODES, outWrite: "deny" });
-		const decision = decide(`cd ${cwd} && rm -rf /tmp/outside`, ctx);
+		const decision = decide(`cd ${cwd} && rm -rf /var/pi-perm-outside`, ctx);
 		expect(decision.action).toBe("deny");
 	});
 
 	it("does not let an allowed first segment mask a later ask", () => {
 		const cwd = project();
-		const decision = decide("echo hi && rm -rf /tmp/outside", makeContext(cwd));
+		const decision = decide("echo hi && rm -rf /var/pi-perm-outside", makeContext(cwd));
 		expect(decision.action).toBe("ask");
 	});
 });

package/src/features/permission/policy.ts

@@ -13,7 +13,12 @@
  * `cd safe && rm -rf /` cannot ride on the first segment's verdict.
  */
 import type { PermissionModes } from "./constants.js";
-import { dangerReason, secretReason, type Effect } from "./constants.js";
+import {
+	dangerReason,
+	isTemporaryPath,
+	secretReason,
+	type Effect,
+} from "./constants.js";
 import { canonicalize, grantRoot, insideAnyRoot } from "./paths.js";
 import type { SessionRules } from "./session-rules.js";
 import type { CommandUnit } from "./units.js";
@@ -51,6 +56,7 @@ export type PolicyLayer =
 	| "session-command"
 	| "danger"
 	| "privileged"
+	| "temp"
 	| "opaque"
 	| "unresolved"
 	| "empty";
@@ -132,6 +138,15 @@ function decidePath(
 			reason: `${scope === "out" ? "outside-project" : "in-project"} ${effect} is set to deny`,
 		};
 	}
+	// A write under the OS temp root is the one outside write that is safe by
+	// default: it is scratch space, not persistent state. It only replaces the
+	// *ask* answer — an explicit `deny` still wins, and the temp root itself is
+	// protected by the danger table (`rm -rf /tmp` still asks). Only **outside**
+	// writes are affected: a project that happens to live under /tmp keeps its
+	// own in-project mode.
+	if (scope === "out" && effect === "write" && isTemporaryPath(pathValue)) {
+		return { action: "allow", layer: "temp", unit, target };
+	}
 	return {
 		action: "ask",
 		layer: "mode",

package/src/features/permission/units.test.ts

@@ -88,14 +88,21 @@ describe("wrappers and nested execution", () => {
 });
 
 describe("redirects and heredocs", () => {
-	it("classifies redirect targets and ignores /dev/null", () => {
-		expect(summary("ls 2>/dev/null")[0]?.targets).toEqual([]);
-		expect(summary("echo hi > /tmp/x")[0]?.targets).toEqual(["write:/tmp/x"]);
-		expect(summary("cat < input > output")[0]?.targets).toEqual([
-			"read:/proj/input",
-			"write:/proj/output",
-		]);
-	});
+it("classifies redirect targets and ignores /dev/null", () => {
+expect(summary("ls 2>/dev/null")[0]?.targets).toEqual([]);
+expect(summary("echo hi > /tmp/x")[0]?.targets).toEqual(["write:/tmp/x"]);
+expect(summary("cat < input > output")[0]?.targets).toEqual([
+"read:/proj/input",
+"write:/proj/output",
+]);
+});
+
+it("ignores a device sink as a plain operand, not just a redirect", () => {
+expect(summary("curl -s -o /dev/null https://example.com")[0]?.targets).toEqual([]);
+expect(summary("sort -o /dev/null input")[0]?.targets).toEqual([]);
+// A command that mutates the node itself still surfaces the target.
+expect(summary("rm /dev/null")[0]?.targets).toEqual(["write:/dev/null"]);
+});
 
 	it("treats a redirect to a credential path as a write to it", () => {
 		expect(summary("echo a > ~/.ssh/authorized_keys")[0]?.targets).toEqual([
@@ -170,6 +177,15 @@ describe("paths", () => {
 		]);
 	});
 
+	it("does not treat echo/printf arguments as paths", () => {
+		const echo = first('echo "  $f  改动 $tot 行 / 忽略空白后 $w 行"');
+		expect(echo.opaque).toBe(false);
+		expect(echo.targets).toEqual([]);
+		const printf = first('printf "%s\\n" "$value"');
+		expect(printf.opaque).toBe(false);
+		expect(printf.targets).toEqual([]);
+	});
+
 	it("expands ~ while parsing", () => {
 		expect(summary("tee ~/x")[0]?.targets).toEqual([`write:${HOME}/x`]);
 	});
@@ -177,7 +193,7 @@ describe("paths", () => {
 
 describe("fail closed", () => {
 	it("marks an unresolved variable in a path position opaque", () => {
-		expect(summary("echo $UNKNOWN/x")).toEqual([
+		expect(summary("cat $UNKNOWN/x")).toEqual([
 			expect.objectContaining({ opaque: true, targets: [] }),
 		]);
 	});

package/src/features/permission/units.ts

@@ -57,6 +57,23 @@ export interface CommandUnit {
 
 const SENTINEL = "\u0000";
 
+/**
+ * Device sinks: writing to them is a no-op, not a boundary decision. They are
+ * excluded whenever they appear as a plain operand (`curl -o /dev/null`),
+ * not just as a redirect target (`cmd > /dev/null`). Commands that mutate the
+ * node itself (`rm /dev/null`, `mv /dev/null x`) still collect the target —
+ * the write-path branch below keeps them visible to the policy.
+ */
+const DEVICE_SINKS = new Set(["/dev/null", "/dev/stdout", "/dev/stderr"]);
+
+/**
+ * Commands whose ordinary arguments are never filesystem paths. `echo` /
+ * `printf` can only write through a redirect, which is collected separately,
+ * so skipping their operands cannot hide a write and avoids treating a
+ * message containing `/` plus an unresolved variable as an opaque path.
+ */
+const NO_PATH_OPERANDS = new Set(["echo", "printf"]);
+
 /* -------------------------------------------------------------------------- */
 /* Read/write classification                                                  */
 /* -------------------------------------------------------------------------- */
@@ -768,9 +785,7 @@ function analyzeSegment(
 	for (const redirect of redirects) {
 		if (redirect.target === undefined) continue;
 		if (redirect.op === "<<<") continue; // herestring: data, not a path
-		if (redirect.target === "/dev/null" || redirect.target === "/dev/stdout" || redirect.target === "/dev/stderr") {
-			continue;
-		}
+		if (DEVICE_SINKS.has(redirect.target)) continue;
 		const descriptor =
 			(redirect.op === ">&" || redirect.op === "<&" || redirect.op === "&>") &&
 			/^\d+$/.test(redirect.target);
@@ -839,9 +854,12 @@ function analyzeSegment(
 			}
 			targets.push({ path: pathValue, effect: "write", source: "operand" });
 		}
-	} else if (command === "dd") {		for (const arg of args) {
+	} else if (command === "dd") {
+		for (const arg of args) {
 			if (arg.startsWith("of=")) {
-				const pathValue = resolveTargetPath(base, arg.slice(3));
+				const value = arg.slice(3);
+				if (DEVICE_SINKS.has(value)) continue;
+				const pathValue = resolveTargetPath(base, value);
 				if (pathValue === undefined) {
 					return {
 						units: [opaqueUnit(raw, headWord, command, base, "unresolved dd target")],
@@ -858,28 +876,35 @@ function analyzeSegment(
 		}
 	}
 
-	// Path-like arguments are targets for every command.
-	for (const arg of args) {
-		if (!looksLikePath(arg)) continue;
-		// `sed -i` operands were already classified above; its script is not a path.
-		if (command === "sed" && effect === "write") continue;
-		const pathValue = resolveTargetPath(commandBase, arg);
-		if (pathValue === undefined) {
-			return {
-				units: [opaqueUnit(raw, headWord, command, base, "unresolved path argument")],
-				nextBase: base,
-			};
+	// Path-like arguments are targets for every command, except for commands
+	// whose arguments are data (`echo`, `printf`) and device sinks.
+	if (!NO_PATH_OPERANDS.has(command)) {
+		for (const arg of args) {
+			if (DEVICE_SINKS.has(arg)) continue;
+			if (!looksLikePath(arg)) continue;
+			// `sed -i` operands were already classified above; its script is not a path.
+			if (command === "sed" && effect === "write") continue;
+			const pathValue = resolveTargetPath(commandBase, arg);
+			if (pathValue === undefined) {
+				return {
+					units: [opaqueUnit(raw, headWord, command, base, "unresolved path argument")],
+					nextBase: base,
+				};
+			}
+			targets.push({ path: pathValue, effect, source: "operand" });
 		}
-		targets.push({ path: pathValue, effect, source: "operand" });
 	}
 
-	// `-o FILE` / `--output FILE` writes whatever the command is.
-	for (let i = 0; i < args.length; i++) {
-		if (args[i] !== "-o" && args[i] !== "--output") continue;
-		const value = args[i + 1];
-		if (value === undefined) continue;
-		const pathValue = resolveTargetPath(commandBase, value);
-		if (pathValue) targets.push({ path: pathValue, effect: "write", source: "operand" });
+	// `-o FILE` / `--output FILE` writes whatever the command is. `echo` and
+	// `printf` do not have an output option, so their `-o` is data too.
+	if (!NO_PATH_OPERANDS.has(command)) {
+		for (let i = 0; i < args.length; i++) {
+			if (args[i] !== "-o" && args[i] !== "--output") continue;
+			const value = args[i + 1];
+			if (value === undefined || DEVICE_SINKS.has(value)) continue;
+			const pathValue = resolveTargetPath(commandBase, value);
+			if (pathValue) targets.push({ path: pathValue, effect: "write", source: "operand" });
+		}
 	}
 
 	units.push({