@andares/pi-toolkits 0.11.0 → 0.11.2

package/src/features/permission/constants.test.ts

@@ -2,10 +2,16 @@
  * Fixed safety tables: credential paths are denied in every mode, destructive
  * commands always ask.
  */
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
-import { dangerReason, secretReason } from "./constants.js";
+import { canonicalize } from "./paths.js";
+import {
+	dangerReason,
+	isTemporaryPath,
+	secretReason,
+	temporaryRoots,
+} from "./constants.js";
 
 const HOME = homedir();
 
@@ -37,11 +43,30 @@ describe("secrets table", () => {
 	});
 });
 
+describe("temporary write zone", () => {
+	it("covers the OS temp root and the common volatile directories", () => {
+		expect(temporaryRoots()).toContain(canonicalize(tmpdir()));
+		expect(temporaryRoots()).toContain(canonicalize("/var/tmp"));
+		expect(temporaryRoots()).toContain(canonicalize("/dev/shm"));
+		expect(isTemporaryPath(join(tmpdir(), "pi", "x"))).toBe(true);
+		expect(isTemporaryPath(join("/var/tmp", "x"))).toBe(true);
+		expect(isTemporaryPath(join("/dev/shm", "x"))).toBe(true);
+	});
+
+	it("does not over-match a sibling prefix or an ordinary path", () => {
+		expect(isTemporaryPath(`${tmpdir()}-evil/x`)).toBe(false);
+		expect(isTemporaryPath("/var/tmp-evil/x")).toBe(false);
+		expect(isTemporaryPath("/proj/x")).toBe(false);
+	});
+});
+
 describe("danger table", () => {
 	it("catches the destructive core", () => {
 		expect(dangerReason("rm", ["-rf", "/"], ["/"], "/proj")).toContain("recursive delete");
 		expect(dangerReason("rm", ["-rf", HOME], [HOME], "/proj")).toContain("recursive delete");
 		expect(dangerReason("rm", ["-rf", "/proj"], ["/proj"], "/proj")).toContain("recursive delete");
+		expect(dangerReason("rm", ["-rf", tmpdir()], [tmpdir()], "/proj")).toContain("recursive delete");
+		expect(dangerReason("rm", ["-rf", "/var/tmp"], ["/var/tmp"], "/proj")).toContain("recursive delete");
 		expect(dangerReason("git", ["push", "--force"], [], "/proj")).toBe("forced git push");
 		expect(dangerReason("git", ["push", "-f"], [], "/proj")).toBe("forced git push");
 		expect(dangerReason("git", ["reset", "--hard"], [], "/proj")).toBe("git reset --hard");
@@ -53,6 +78,7 @@ describe("danger table", () => {
 
 	it("does not flag ordinary commands", () => {
 		expect(dangerReason("rm", ["-rf", "/proj/build"], ["/proj/build"], "/proj")).toBeUndefined();
+		expect(dangerReason("rm", ["-rf", join(tmpdir(), "x")], [join(tmpdir(), "x")], "/proj")).toBeUndefined();
 		expect(dangerReason("git", ["push"], [], "/proj")).toBeUndefined();
 		expect(dangerReason("git", ["log"], [], "/proj")).toBeUndefined();
 		expect(dangerReason("npm", ["view", "react"], [], "/proj")).toBeUndefined();

package/src/features/permission/constants.ts

@@ -13,8 +13,9 @@
  *    when their scope says allow (`rm -rf .` inside the project is still a
  *    guarded operation). Scope alone cannot express "destructive".
  */
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { basename, join, sep } from "node:path";
+import { canonicalize } from "./paths.js";
 
 /** Three-way mode, used for outside-project operations. */
 export type TriMode = "ask" | "allow" | "deny";
@@ -85,6 +86,29 @@ function isSecretEnvFile(pathValue: string): boolean {
 	return name === ".env" || name.startsWith(".env.");
 }
 
+/**
+ * Ephemeral directories whose writes are built-in safe: a scratch artifact
+ * under the OS temp root is not a boundary crossing worth a dialog. Kept to
+ * genuinely volatile locations; `~/.cache` is deliberately not included (it
+ * is a home-directory state area, not a scratch area).
+ *
+ * Resolved once at module load so the comparisons use the same spelling as the
+ * policy's canonical paths (`/tmp` is a symlink to `/private/tmp` on macOS).
+ */
+const TEMPORARY_ROOTS: readonly string[] = [tmpdir(), "/var/tmp", "/dev/shm"].map(
+	(root) => canonicalize(root),
+);
+
+export function temporaryRoots(): string[] {
+	return [...TEMPORARY_ROOTS];
+}
+
+/** `true` when `pathValue` is inside one of {@link temporaryRoots}. */
+export function isTemporaryPath(pathValue: string): boolean {
+	const canonical = canonicalize(pathValue);
+	return TEMPORARY_ROOTS.some((root) => pathWithin(root, canonical));
+}
+
 /** Absolute secret prefixes, `~` expanded. */
 export function secretRoots(): string[] {
 	return SECRET_ROOTS.map((root) =>
@@ -118,11 +142,12 @@ export function dangerReason(
 	const inDangerousRoot = (pathValue: string): boolean =>
 		pathValue === "/" ||
 		pathValue === home ||
-		(base !== null && pathValue === base);
+		(base !== null && pathValue === base) ||
+		TEMPORARY_ROOTS.includes(canonicalize(pathValue));
 
 	if (command === "sudo" || command === "doas") return "privileged command";
 	if (command === "rm" && targets.some(inDangerousRoot)) {
-		return "recursive delete of /, the home directory, or the working directory";
+		return "recursive delete of /, the home directory, the working directory, or a temp root";
 	}
 	if (command === "git") {
 		const [verb, ...rest] = args;

package/src/features/permission/index.test.ts

@@ -22,6 +22,7 @@ import {
 	resetJailedTools,
 } from "../../lib/tools.js";
 import { markStartupCommand } from "../../lib/startup.js";
+import { canonicalize } from "./paths.js";
 import { registerPermission } from "./index.js";
 
 function bashEvent(command: string): ToolCallEvent {
@@ -169,7 +170,7 @@ function asAsk(verdict: unknown): AskVerdict {
 describe("/ask-perm", () => {
 	it("is off by default", async () => {
 		const h = makeHarness();
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("enables from arguments, reports status, and asks for an outside write", async () => {
@@ -177,15 +178,53 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		expect(h.statuses.at(-1)?.[0]).toBe("perm-mode");
 		expect(h.statuses.at(-1)?.[1]).toContain("perm");
-		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside")));
-		expect(verdict.request.details.join("\n")).toContain("/tmp/outside");
-		expect(verdict.request.root).toBe("/tmp");
+		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside")));
+		expect(verdict.request.details.join("\n")).toContain("/var/pi-perm-outside");
+		expect(verdict.request.root).toBe(canonicalize("/var"));
+	});
+
+	it("does not ask for a write under the OS temp root", async () => {
+		const h = makeHarness();
+		await h.command("allow allow allow ask");
+		expect(
+			await h.evaluate(bashEvent("echo hi > /tmp/pi-perm-temp.txt")),
+		).toBeUndefined();
+		// The same rule must cover the path-bearing write tool, not just bash.
+		expect(
+			await h.evaluate(pathEvent("write", "/tmp/pi-perm-temp.txt")),
+		).toBeUndefined();
+	});
+
+	it("does not ask for a /dev/null sink operand", async () => {
+		const h = makeHarness();
+		await h.command("allow allow allow ask");
+		expect(
+			await h.evaluate(
+				bashEvent("curl -s -o /dev/null -w '%{http_code}\\n' http://localhost:5173/"),
+			),
+		).toBeUndefined();
+	});
+
+	it("does not ask for echo arguments that merely look like paths", async () => {
+		const h = makeHarness();
+		await h.command("allow allow allow ask");
+		expect(
+			await h.evaluate(
+				bashEvent('echo "  $f  改动 $tot 行 / 忽略空白后 $w 行"'),
+			),
+		).toBeUndefined();
+	});
+
+	it("still asks before deleting a temp root itself", async () => {
+		const h = makeHarness();
+		await h.command("allow allow allow ask");
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp"))).kind).toBe("ask");
 	});
 
 	it("blocks immediately when outside writes are denied", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow deny");
-		const verdict = (await h.evaluate(bashEvent("rm -rf /tmp/outside"))) as {
+		const verdict = (await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))) as {
 			kind: "block";
 			reason: string;
 		};
@@ -197,17 +236,17 @@ describe("/ask-perm", () => {
 	it("records a session grant and applies it to later calls", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		const first = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x")));
+		const first = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x")));
 		first.request.apply("allow-session");
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).toBeUndefined();
 	});
 
 	it("records a session deny and blocks later calls", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		const first = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x")));
+		const first = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x")));
 		first.request.apply("deny-session");
-		const later = (await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))) as {
+		const later = (await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))) as {
 			kind: "block";
 			reason: string;
 		};
@@ -220,7 +259,7 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		await h.command("");
 		expect(h.statuses.at(-1)?.[1]).toBeUndefined();
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("writes a startup notice as an entry instead of a status line", async () => {
@@ -233,7 +272,7 @@ describe("/ask-perm", () => {
 			"Permission ON",
 		);
 		expect(h.statuses.at(-1)?.[1]).toContain("perm");
-		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).kind).toBe(
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).kind).toBe(
 			"ask",
 		);
 	});
@@ -250,14 +289,14 @@ describe("/ask-perm", () => {
 		const h = makeHarness();
 		await h.command("");
 		expect(h.notes.at(-1)?.message).toContain("cancelled");
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("rejects invalid arguments without enabling", async () => {
 		const h = makeHarness();
 		await h.command("deny");
 		expect(h.notes.at(-1)?.kind).toBe("error");
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("keeps the state when the same session emits session_start again", async () => {
@@ -266,7 +305,7 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		// A startup rebind reports the same session again; state must survive.
 		await h.sessionStart();
-		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).kind).toBe(
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).kind).toBe(
 			"ask",
 		);
 	});
@@ -276,28 +315,28 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		h.setSessionId("session-2");
 		await h.sessionStart();
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 	});
 
 	it("resets on session_start", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
 		await h.sessionStart();
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside"))).toBeUndefined();
 		expect(h.statuses.at(-1)?.[1]).toBeUndefined();
 	});
 
 	it("treats add-dir directories as inside the project", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp/added/x"))).kind).toBe("ask");
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-added/x"))).kind).toBe("ask");
 
 		h.branch.push({
 			type: "custom",
 			customType: "add-dir:state",
-			data: { dirs: [{ absolutePath: "/tmp/added" }] },
+			data: { dirs: [{ absolutePath: "/var/pi-perm-added" }] },
 		});
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/added/x"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-added/x"))).toBeUndefined();
 	});
 
 	it("treats a redirect write to a credential path as a fixed deny, not a write ask", async () => {
@@ -313,15 +352,19 @@ describe("/ask-perm", () => {
 	it("judges git -C by the -C directory, not the working directory", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		expect(await h.evaluate(bashEvent("git -C ../outside log"))).toBeUndefined();
-		expect(asAsk(await h.evaluate(bashEvent("git -C ../outside push"))).kind).toBe("ask");
+		expect(
+			await h.evaluate(bashEvent("git -C /var/pi-perm-outside log")),
+		).toBeUndefined();
+		expect(
+			asAsk(await h.evaluate(bashEvent("git -C /var/pi-perm-outside push"))).kind,
+		).toBe("ask");
 	});
 
 	it("answers path-bearing tools by their own path", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
 		expect(await h.evaluate(pathEvent("write", "notes.txt"))).toBeUndefined();
-		expect(asAsk(await h.evaluate(pathEvent("write", "/tmp/outside.txt"))).kind).toBe("ask");
+		expect(asAsk(await h.evaluate(pathEvent("write", "/var/pi-perm-outside.txt"))).kind).toBe("ask");
 		const denied = (await h.evaluate(pathEvent("read", "~/.ssh/id_rsa"))) as {
 			kind: "block";
 		};
@@ -339,26 +382,26 @@ describe("/ask-perm", () => {
 		await h.command("allow allow allow ask");
 		expect(h.notes).toHaveLength(1);
 
-		asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x"))).request.apply(
+		asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x"))).request.apply(
 			"allow-session",
 		);
 		await h.command("allow allow allow ask");
 		expect(h.notes).toHaveLength(1);
 		// The grant collected before the repeat is still in force.
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).toBeUndefined();
 	});
 
 	it("notifies and clears session grants when the modes actually change", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x"))).request.apply(
+		asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x"))).request.apply(
 			"allow-session",
 		);
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).toBeUndefined();
 
 		await h.command("ask allow allow ask");
 		expect(h.notes).toHaveLength(2);
-		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).kind).toBe("ask");
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).kind).toBe("ask");
 	});
 });
 
@@ -366,7 +409,7 @@ describe("dialog contract", () => {
 	it("fails closed without a UI", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside")));
+		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside")));
 		const noUi = { ...h.ctx, hasUI: false } as ExtensionContext;
 		await expect(verdict.request.present(noUi)).resolves.toBeUndefined();
 	});
@@ -374,7 +417,7 @@ describe("dialog contract", () => {
 	it("falls back to the host selector in non-TUI modes", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
-		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside")));
+		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside")));
 		const rpc = {
 			cwd: h.cwd,
 			hasUI: true,
@@ -456,13 +499,13 @@ describe("audit log", () => {
 		const { audit } = makeAudit();
 		const h = makeHarness(audit);
 		await h.command("allow allow allow ask");
-		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x")));
+		const verdict = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x")));
 		expect(verdict.request.audit).toMatchObject({
 			modes: { outWrite: "ask" },
 			verdict: {
 				action: "ask",
 				layer: "mode",
-				target: "/tmp/outside/x",
+				target: "/var/pi-perm-outside/x",
 				scope: "out",
 			},
 		});
@@ -543,9 +586,9 @@ describe("audit log — session-grant allows", () => {
 		const { audit, records } = makeAudit();
 		const h = makeHarness(audit);
 		await h.command("allow allow allow ask");
-		const first = asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside/x")));
+		const first = asAsk(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/x")));
 		first.request.apply("allow-session");
-		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside/y"))).toBeUndefined();
+		expect(await h.evaluate(bashEvent("rm -rf /var/pi-perm-outside/y"))).toBeUndefined();
 
 		const allow = records.find((record) => record.event === "allow");
 		expect(allow).toMatchObject({

package/src/features/permission/policy.test.ts

@@ -7,7 +7,7 @@ import { mkdtempSync, realpathSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { describe, expect, it } from "vitest";
-import { DEFAULT_MODES, type PermissionModes } from "./constants.js";
+import { DEFAULT_MODES, temporaryRoots, type PermissionModes } from "./constants.js";
 import { canonicalize } from "./paths.js";
 import {
 	decideProgram,
@@ -46,14 +46,14 @@ describe("four-mode policy", () => {
 	it("asks for an outside write and allows an outside read by default", () => {
 		const cwd = project();
 		const ctx = makeContext(cwd);
-		expect(decide("rm -rf /tmp/outside", ctx).action).toBe("ask");
+		expect(decide("rm -rf /var/pi-perm-outside", ctx).action).toBe("ask");
 		expect(decide("cat /etc/hostname", ctx).action).toBe("allow");
 	});
 
 	it("honours a deny mode for outside writes", () => {
 		const cwd = project();
 		const ctx = makeContext(cwd, { ...DEFAULT_MODES, outWrite: "deny" });
-		const decision = decide("rm -rf /tmp/outside", ctx);
+		const decision = decide("rm -rf /var/pi-perm-outside", ctx);
 		expect(decision.action).toBe("deny");
 		expect(decision.reason).toContain("outside-project write");
 	});
@@ -65,6 +65,43 @@ describe("four-mode policy", () => {
 	});
 });
 
+describe("temporary write zone", () => {
+	it("allows a temp write when the mode would otherwise ask", () => {
+		const cwd = project();
+		const ctx = makeContext(cwd);
+		for (const root of temporaryRoots()) {
+			const decision = decide(`echo hi > ${join(root, "pi-perm-temp.txt")}`, ctx);
+			expect(decision.action).toBe("allow");
+			expect(decision.layer).toBe("temp");
+		}
+	});
+
+	it("still honours an explicit outside-write deny", () => {
+		const cwd = project();
+		const ctx = makeContext(cwd, { ...DEFAULT_MODES, outWrite: "deny" });
+		const decision = decide(`echo hi > ${join(tmpdir(), "pi-perm-temp.txt")}`, ctx);
+		expect(decision.action).toBe("deny");
+		expect(decision.layer).toBe("mode");
+	});
+
+	it("still asks before deleting a temp root itself", () => {
+		const cwd = project();
+		const decision = decide(`rm -rf ${tmpdir()}`, makeContext(cwd));
+		expect(decision.action).toBe("ask");
+		expect(decision.layer).toBe("danger");
+	});
+
+	it("keeps the secrets table ahead of the temp zone", () => {
+		const cwd = project();
+		const decision = decide(
+			`echo x > ${join(tmpdir(), ".env")}`,
+			makeContext(cwd),
+		);
+		expect(decision.action).toBe("deny");
+		expect(decision.layer).toBe("secret");
+	});
+});
+
 describe("fixed safety table", () => {
 	it("denies credential paths in every mode, even when reads are allowed", () => {
 		const cwd = project();
@@ -117,26 +154,26 @@ describe("session grants", () => {
 	it("allows a write under a granted directory", () => {
 		const cwd = project();
 		const rules = new SessionRules();
-		rules.allow({ effect: "write", root: "/tmp/granted" });
+		rules.allow({ effect: "write", root: "/var/pi-perm-granted" });
 		expect(
-			decide("rm -rf /tmp/granted/x", makeContext(cwd, DEFAULT_MODES, rules)).action,
+			decide("rm -rf /var/pi-perm-granted/x", makeContext(cwd, DEFAULT_MODES, rules)).action,
 		).toBe("allow");
 	});
 
 	it("does not let a read grant cover a write", () => {
 		const cwd = project();
 		const rules = new SessionRules();
-		rules.allow({ effect: "read", root: "/tmp/granted" });
+		rules.allow({ effect: "read", root: "/var/pi-perm-granted" });
 		expect(
-			decide("rm -rf /tmp/granted/x", makeContext(cwd, DEFAULT_MODES, rules)).action,
+			decide("rm -rf /var/pi-perm-granted/x", makeContext(cwd, DEFAULT_MODES, rules)).action,
 		).toBe("ask");
 	});
 
 	it("denies before allowing, even when the mode allows", () => {
 		const cwd = project();
 		const rules = new SessionRules();
-		rules.deny({ effect: "read", root: "/tmp/granted" });
-		const decision = decide("cat /tmp/granted/x", makeContext(cwd, DEFAULT_MODES, rules));
+		rules.deny({ effect: "read", root: "/var/pi-perm-granted" });
+		const decision = decide("cat /var/pi-perm-granted/x", makeContext(cwd, DEFAULT_MODES, rules));
 		expect(decision.action).toBe("deny");
 		expect(decision.reason).toContain("denied for this session");
 	});
@@ -155,13 +192,13 @@ describe("severity folding", () => {
 	it("takes the strictest unit of a compound command", () => {
 		const cwd = project();
 		const ctx = makeContext(cwd, { ...DEFAULT_MODES, outWrite: "deny" });
-		const decision = decide(`cd ${cwd} && rm -rf /tmp/outside`, ctx);
+		const decision = decide(`cd ${cwd} && rm -rf /var/pi-perm-outside`, ctx);
 		expect(decision.action).toBe("deny");
 	});
 
 	it("does not let an allowed first segment mask a later ask", () => {
 		const cwd = project();
-		const decision = decide("echo hi && rm -rf /tmp/outside", makeContext(cwd));
+		const decision = decide("echo hi && rm -rf /var/pi-perm-outside", makeContext(cwd));
 		expect(decision.action).toBe("ask");
 	});
 });

package/src/features/permission/policy.ts

@@ -13,7 +13,12 @@
  * `cd safe && rm -rf /` cannot ride on the first segment's verdict.
  */
 import type { PermissionModes } from "./constants.js";
-import { dangerReason, secretReason, type Effect } from "./constants.js";
+import {
+	dangerReason,
+	isTemporaryPath,
+	secretReason,
+	type Effect,
+} from "./constants.js";
 import { canonicalize, grantRoot, insideAnyRoot } from "./paths.js";
 import type { SessionRules } from "./session-rules.js";
 import type { CommandUnit } from "./units.js";
@@ -51,6 +56,7 @@ export type PolicyLayer =
 	| "session-command"
 	| "danger"
 	| "privileged"
+	| "temp"
 	| "opaque"
 	| "unresolved"
 	| "empty";
@@ -132,6 +138,15 @@ function decidePath(
 			reason: `${scope === "out" ? "outside-project" : "in-project"} ${effect} is set to deny`,
 		};
 	}
+	// A write under the OS temp root is the one outside write that is safe by
+	// default: it is scratch space, not persistent state. It only replaces the
+	// *ask* answer — an explicit `deny` still wins, and the temp root itself is
+	// protected by the danger table (`rm -rf /tmp` still asks). Only **outside**
+	// writes are affected: a project that happens to live under /tmp keeps its
+	// own in-project mode.
+	if (scope === "out" && effect === "write" && isTemporaryPath(pathValue)) {
+		return { action: "allow", layer: "temp", unit, target };
+	}
 	return {
 		action: "ask",
 		layer: "mode",

package/src/features/permission/units.test.ts

@@ -88,14 +88,21 @@ describe("wrappers and nested execution", () => {
 });
 
 describe("redirects and heredocs", () => {
-	it("classifies redirect targets and ignores /dev/null", () => {
-		expect(summary("ls 2>/dev/null")[0]?.targets).toEqual([]);
-		expect(summary("echo hi > /tmp/x")[0]?.targets).toEqual(["write:/tmp/x"]);
-		expect(summary("cat < input > output")[0]?.targets).toEqual([
-			"read:/proj/input",
-			"write:/proj/output",
-		]);
-	});
+it("classifies redirect targets and ignores /dev/null", () => {
+expect(summary("ls 2>/dev/null")[0]?.targets).toEqual([]);
+expect(summary("echo hi > /tmp/x")[0]?.targets).toEqual(["write:/tmp/x"]);
+expect(summary("cat < input > output")[0]?.targets).toEqual([
+"read:/proj/input",
+"write:/proj/output",
+]);
+});
+
+it("ignores a device sink as a plain operand, not just a redirect", () => {
+expect(summary("curl -s -o /dev/null https://example.com")[0]?.targets).toEqual([]);
+expect(summary("sort -o /dev/null input")[0]?.targets).toEqual([]);
+// A command that mutates the node itself still surfaces the target.
+expect(summary("rm /dev/null")[0]?.targets).toEqual(["write:/dev/null"]);
+});
 
 	it("treats a redirect to a credential path as a write to it", () => {
 		expect(summary("echo a > ~/.ssh/authorized_keys")[0]?.targets).toEqual([
@@ -170,6 +177,15 @@ describe("paths", () => {
 		]);
 	});
 
+	it("does not treat echo/printf arguments as paths", () => {
+		const echo = first('echo "  $f  改动 $tot 行 / 忽略空白后 $w 行"');
+		expect(echo.opaque).toBe(false);
+		expect(echo.targets).toEqual([]);
+		const printf = first('printf "%s\\n" "$value"');
+		expect(printf.opaque).toBe(false);
+		expect(printf.targets).toEqual([]);
+	});
+
 	it("expands ~ while parsing", () => {
 		expect(summary("tee ~/x")[0]?.targets).toEqual([`write:${HOME}/x`]);
 	});
@@ -177,7 +193,7 @@ describe("paths", () => {
 
 describe("fail closed", () => {
 	it("marks an unresolved variable in a path position opaque", () => {
-		expect(summary("echo $UNKNOWN/x")).toEqual([
+		expect(summary("cat $UNKNOWN/x")).toEqual([
 			expect.objectContaining({ opaque: true, targets: [] }),
 		]);
 	});