gentle-pi 4.2.0 → 4.4.0

package/tests/ask-user-choice.test.ts

@@ -33,6 +33,7 @@ interface ChoiceTool {
 	promptGuidelines?: string[];
 	parameters: ChoiceParameters;
 	execute: (...args: unknown[]) => Promise<ChoiceResult>;
+	renderResult?: (result: unknown, options: unknown, theme: ChoiceTheme) => { render(width: number): string[] };
 }
 
 interface ChoiceLifecycleEvent {
@@ -711,3 +712,32 @@ test("ask_user_choice is offered on an interactive rpc host and withdrawn once t
 	for (const hook of registration.hooks) await hook({}, { mode: "rpc" });
 	assert.deepEqual(registration.activeTools(), ["read"]);
 });
+
+test("ask_user_choice renderResult renders selected, custom response with text, and cancelled states (#1692)", () => {
+	const registration = registerChoiceTool();
+	const theme: ChoiceTheme = { fg: (_color, text) => text, bg: (_color, text) => text, bold: (text) => text };
+
+	// 1. Selected option
+	const selected = registration.tool.renderResult!(
+		{ details: { selection: { index: 1, label: "Deploy to production" } } },
+		{},
+		theme,
+	).render(80).join("\n");
+	assert.match(selected, /✓ 1\. Deploy to production/);
+
+	// 2. Custom response with submitted text (#1692)
+	const custom = registration.tool.renderResult!(
+		{ details: { customResponse: "use the staging bucket" } },
+		{},
+		theme,
+	).render(80).join("\n");
+	assert.match(custom, /✓ Custom response — use the staging bucket/);
+
+	// 3. Cancelled
+	const cancelled = registration.tool.renderResult!(
+		{ details: { cancelled: true } },
+		{},
+		theme,
+	).render(80).join("\n");
+	assert.match(cancelled, /Cancelled/);
+});

package/tests/auto-mode.test.ts

@@ -42,6 +42,23 @@ test("Auto cannot bypass data-loss, configured confirmation, protected paths or
  assert.equal(h.requests.length,0);
 });
 
+test("production hook classifies companion updates without granting permission to change authority",async t=>{
+ const h=harness(t);await h.enable();await h.input("Update the installed companion tools from main; preserve permissions.");
+ for(const toolName of ["write","edit"]) {
+  assert.equal(await h.call(toolName,{path:join(h.home,"dev-binary.json"),content:"fixture companion update"}),undefined);
+ }
+ assert.equal(h.requests.length,2,"updates reach the ordinary Auto classifier");
+ h.setDecision("deny");
+ assert.equal((await h.call("write",{path:join(h.home,"channel.json"),content:"unapproved"})).block,true);
+ assert.equal(h.requests.length,3);
+ h.setDecision("allow");
+ for(const name of ["permission-mode.json","runtime-guardrails.json","models.json","persona.json"]) {
+  assert.equal((await h.call("write",{path:join(h.home,name),content:"{}"})).block,true);
+ }
+ assert.equal(h.requests.length,3,"a classifier allow cannot override protected authority");
+ assert.equal(h.confirmations(),0);
+});
+
 test("normal mode preserves previous guard behavior and named children do not inherit Auto",async t=>{
  const h=harness(t);assert.equal((await h.call("bash",{command:"git push origin feature"})).block,true);assert.equal(h.requests.length,0);
  await h.enable();await h.emit("before_agent_start",{agent:{name:"worker"},systemPromptOptions:{}});

package/tests/auto-permission-memory-diagnostics.test.ts

@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { AutoPermissionMemory } from "../lib/auto-permission-memory.ts";
+test("binder diagnostics retain rejection cause without destination or content",()=>{
+ const memory=new AutoPermissionMemory(()=>[]);
+ const ctx:any={cwd:"PRIVATE_CWD",sessionManager:{getSessionId:()=>"PRIVATE_SESSION",getBranch:()=>[{id:"PRIVATE_ANCHOR"}]}};
+ memory.admitted({toolName:"mem_current_project",toolCallId:"PRIVATE_CALL",input:{cwd:ctx.cwd}},ctx,1);
+ memory.context({toolName:"mem_save",input:{cwd:ctx.cwd,project:"PRIVATE_PROJECT",content:"PRIVATE_CONTENT"}},ctx,1);
+ assert.deepEqual(memory.diagnostic(),{stage:"admission",reason:"untrusted-source",sourceRejection:"tool-missing"});
+ assert.doesNotMatch(JSON.stringify(memory.diagnostic()),/PRIVATE/);
+ memory.clear();
+ memory.context({toolName:"mem_session_summary",input:{}},ctx,1);
+ assert.deepEqual(memory.diagnostic(),{stage:"clear",reason:"binding-cleared"});
+});
+
+test("source rejection reports only the first failed provenance predicate",()=>{
+ const sourceInfo={path:"/installed/engram.ts",source:"npm:gentle-engram@latest",scope:"user",origin:"package"};
+ const tool={name:"mem_current_project",sourceInfo};
+ const cases:[string,any[]][]=[
+  ["tool-missing",[]],["tool-ambiguous",[tool,tool]],
+  ["metadata-missing",[{name:tool.name}]],
+  ["origin",[{...tool,sourceInfo:{...sourceInfo,origin:"top-level",source:"local"}}]],
+  ["source-format",[{...tool,sourceInfo:{...sourceInfo,source:"PRIVATE_SOURCE"}}]],
+  ["path",[{...tool,sourceInfo:{...sourceInfo,path:"<PRIVATE_PATH>"}}]],
+ ];
+ const ctx:any={cwd:"/project",sessionManager:{getSessionId:()=>"session",getBranch:()=>[{id:"human"}]}};
+ const call={toolName:tool.name,toolCallId:"resolve",input:{cwd:ctx.cwd}};
+ for(const [sourceRejection,tools] of cases){
+  const memory=new AutoPermissionMemory(()=>tools);
+  memory.admitted(call,ctx,1);
+  assert.deepEqual(memory.diagnostic(),{stage:"admission",reason:"untrusted-source",sourceRejection});
+  memory.context({toolName:"mem_save",input:{}},ctx,1);
+  assert.equal(memory.diagnostic()?.sourceRejection,sourceRejection);
+  assert.doesNotMatch(JSON.stringify(memory.diagnostic()),/PRIVATE/);
+ }
+ const memory=new AutoPermissionMemory(()=>[tool] as any);
+ memory.admitted(call,ctx,1);
+ assert.deepEqual(memory.diagnostic(),{stage:"admission",reason:"admitted"});
+});
+
+test("registry exceptions replace successful attachment diagnostics",()=>{
+ let fail=false;
+ const sourceInfo={path:"/installed/engram.ts",source:"npm:gentle-engram",scope:"user",origin:"package"};
+ const memory=new AutoPermissionMemory(()=>{if(fail)throw Error("PRIVATE_ERROR");return ["mem_current_project","mem_save"].map(name=>({name,sourceInfo})) as any;});
+ const ctx:any={cwd:"/project",sessionManager:{getSessionId:()=>"session",getBranch:()=>[{id:"human"}]}};
+ const call={toolName:"mem_current_project",toolCallId:"resolve",input:{cwd:ctx.cwd}};
+ memory.admitted(call,ctx,1);
+ memory.result({...call,isError:false,details:{data:{cwd:ctx.cwd,project:"project",project_source:"git_remote"}}} as any,ctx,1);
+ const save={toolName:"mem_save",input:{cwd:ctx.cwd,project:"project"}};
+ assert.ok(memory.context(save,ctx,1));
+ assert.deepEqual(memory.diagnostic(),{stage:"write",reason:"attached"});
+ fail=true;
+ assert.equal(memory.context(save,ctx,1),undefined);
+ assert.deepEqual(memory.diagnostic(),{stage:"write",reason:"unexpected-error"});
+ assert.doesNotMatch(JSON.stringify(memory.diagnostic()),/PRIVATE/);
+});

package/tests/auto-permission-runtime.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { mkdtempSync, mkdirSync, symlinkSync, rmSync, writeFileSync } from "node:fs";
+import { mkdtempSync, mkdirSync, symlinkSync, linkSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { AutoPermissionRuntime } from "../lib/auto-permission-runtime.ts";
@@ -258,6 +258,90 @@ test("Native consent, human questions and delegation remain with their original
  f.setMode("auto");assert.equal((await f.execute("custom_tool",{},false)).executions,1);assert.equal(f.requests.length,0);
 });
 
+test("Companion update files are not permission authority and still receive ordinary checks", async t=>{
+ const f=fixture(t);f.input("Update the installed companion tools from main.");
+ for(const mode of ["normal","auto","yolo"]) {
+  f.setMode(mode);
+  for(const path of ["dev-binary.json","channel.json","main/gentle-ai","tools/go/bin/go"]) {
+   const input={path:join(f.cwd,"config",path),content:"updated companion data"};
+   for(const toolName of ["write","edit"]) {
+    assert.equal(f.runtime.guard({toolName,input},f.ctx),undefined,`${mode}: ${path} is not policy`);
+    assert.equal((await f.execute(toolName,input)).executions,1);
+   }
+  }
+ }
+ assert.equal(f.requests.length,8,"only Auto requests are classified; other modes keep their own behavior");
+ f.setMode("auto");f.setResponse({status:"available",decision:"deny",reason:"Update not authorized"});
+ assert.equal((await f.execute("write",{path:join(f.cwd,"config","dev-binary.json"),content:"unapproved"})).executions,0);
+ assert.equal(f.requests.length,9,"an update path is not an automatic allow");
+});
+
+test("Permission authority, aliases and parent directories remain protected in every mode", async t=>{
+ const f=fixture(t);f.input("Update companion tools without changing permissions.");
+ const home=join(f.cwd,"config");mkdirSync(home);
+ const projectHome=join(f.cwd,".pi","gentle-ai");mkdirSync(projectHome,{recursive:true});
+ for(const name of ["permission-mode.json","runtime-guardrails.json"])writeFileSync(join(home,name),"{}");
+ writeFileSync(join(projectHome,"runtime-guardrails.json"),"{}");
+ symlinkSync(home,join(f.cwd,"config-alias"));
+ symlinkSync(join(home,"permission-mode.json"),join(f.cwd,"policy-alias"));
+ symlinkSync(join(home,"runtime-guardrails.json"),join(home,"dev-binary.json"));
+ for(const mode of ["normal","auto","yolo"]) {
+  f.setMode(mode);
+  for(const path of [join(home,"permission-mode.json"),join(home,"runtime-guardrails.json"),
+   join(f.cwd,"config-alias","permission-mode.json"),join(f.cwd,"policy-alias"),join(home,"dev-binary.json"),
+   join(projectHome,"runtime-guardrails.json"),projectHome,home,f.cwd,
+   ...["profiles.json","models.json","background-subagents.json","persona.json","builtin-codemode-optout.json",
+    "history-capture.json","scratch/session.json","tools/other-tool"].map(path=>join(home,path))]) {
+   for(const toolName of ["write","edit"]) {
+    const input={path,content:"{}"};
+    assert.equal(f.runtime.guard({toolName,input},f.ctx)?.block,true,`${mode}: ${path} stays protected`);
+    assert.equal((await f.execute(toolName,input)).executions,0);
+   }
+  }
+  for(const toolName of ["bash","bash_background","monitor"]) {
+   for(const command of [`rm -rf '${home}'`,`rm -rf '${home}/'`,`rm -rf '${home}'/*`,
+    `printf '{}' > '${join(home,"permission-mode.json")}'`,`printf '{}' > '${join(home,"runtime-guardrails.json")}'`,
+    `printf '{}' > '${join(projectHome,"runtime-guardrails.json")}'`]) {
+    assert.equal(f.runtime.guard({toolName,input:{command}},f.ctx)?.block,true);
+    assert.equal((await f.execute(toolName,{command})).executions,0);
+   }
+  }
+ }
+ assert.equal(f.requests.length,0,"a classifier allow never overrides the policy guard");
+});
+
+test("Updater exceptions cannot overwrite authority through hardlinks", async t=>{
+ const f=fixture(t);f.input("Update companion tools without changing permission or routing policy.");
+ const home=join(f.cwd,"config");mkdirSync(join(home,"main"),{recursive:true});
+ for(const [policy,alias] of [["permission-mode.json","dev-binary.json"],["models.json","main/routing-alias"]]) {
+  writeFileSync(join(home,policy),"{}");linkSync(join(home,policy),join(home,alias));
+  for(const toolName of ["write","edit"]) {
+   const input={path:join(home,alias),content:"{}"};
+   assert.equal(f.runtime.guard({toolName,input},f.ctx)?.block,true,alias);
+   assert.equal((await f.execute(toolName,input)).executions,0);
+  }
+ }
+ assert.equal(f.requests.length,0);
+});
+
+test("Dangling updater aliases cannot create absent permission authority", async t=>{
+ const f=fixture(t);f.input("Update companion tools without creating or changing permission policy.");
+ const home=join(f.cwd,"config");mkdirSync(join(home,"tools"),{recursive:true});
+ for(const [alias,policy] of [["dev-binary.json","permission-mode.json"],["channel.json","runtime-guardrails.json"],
+  ["main","permission-mode.json"],["tools/go","runtime-guardrails.json"]]) {
+  symlinkSync(join(home,policy),join(home,alias));
+  for(const mode of ["normal","auto","yolo"]) {
+   f.setMode(mode);
+   for(const toolName of ["write","edit"]) {
+    const input={path:join(home,alias),content:"{}"};
+    assert.equal(f.runtime.guard({toolName,input},f.ctx)?.block,true,`${mode}: ${alias} stays protected`);
+    assert.equal((await f.execute(toolName,input)).executions,0);
+   }
+  }
+ }
+ assert.equal(f.requests.length,0,"unresolved aliases never reach an allowing classifier");
+});
+
 test("Policy files cannot be modified by model file tools; symlink escapes are reviewed", async t=>{
  const f=fixture(t);f.input("Edit source code");mkdirSync(join(f.cwd,"config"));
  assert.equal((await f.execute("write",{path:join(f.cwd,"config","permission-mode.json"),content:"yolo"})).executions,0);

package/tests/autonomous-guard.test.ts

@@ -40,6 +40,84 @@ test("YOLO waives reversible push and rebase segments after full evaluation (#21
 	]) assert.equal(isReversibleYoloCommand(command, evaluateGuardedCommand(command, config)), false, command);
 });
 
+// YOLO also waives recursive removal of the session's own temp scratch: one
+// literal path component under a temp root whose admission-time lstat is
+// missing, a symlink, an own file or an own mktemp directory. Every other
+// effect in the command keeps its ordinary guard.
+test("YOLO waives recursive removal of own temp scratch only", () => {
+	const config = { autonomousMode: false, guardedCommands: {} };
+	const entry = (type: "dir" | "file" | "link", uid = 1000) => ({
+		uid, isDirectory: () => type === "dir", isFile: () => type === "file", isSymbolicLink: () => type === "link",
+	});
+	const entries = new Map([
+		["/tmp/tmp.8phya1BpFr", entry("dir")], ["/tmp/tmp.LKd1kBX8Rw", entry("dir")], ["/tmp/tmp.C94OVzf01o", entry("dir")],
+		["/tmp/ctx-backstop-pnpm-test.log", entry("file")], ["/tmp/tmp.abcdef1234", entry("dir")], ["/tmp/latest", entry("link", 0)],
+		["/var/tmp/tmp.zzzzzz", entry("dir")], ["/tmp/cache", entry("dir")], ["/tmp/tmp.other1234", entry("dir", 0)],
+		["/tmp/shared.log", entry("file", 0)],
+	]);
+	const fs = {
+		uid: 1000, tmpdir: "/tmp", home: "/home/user",
+		lstat(path: string) {
+			if (path === "/tmp/tmp.denied99") throw Object.assign(new Error("EACCES"), { code: "EACCES" });
+			const found = entries.get(path);
+			if (found === undefined) throw Object.assign(new Error(`ENOENT: ${path}`), { code: "ENOENT" });
+			return found;
+		},
+	};
+	const waived = (command: string) => isReversibleYoloCommand(command, evaluateGuardedCommand(command, config), fs);
+	for (const command of [
+		"rm -rf /tmp/tmp.8phya1BpFr /tmp/tmp.LKd1kBX8Rw /tmp/tmp.C94OVzf01o /tmp/ctx-backstop-pnpm-test.log; cd /home/gentleman/work/gentle-pi-worktrees/harness-r1 && git log --oneline -1",
+		"rm -rf /tmp/tmp.abcdef1234", "rm -rf /tmp/ctx-backstop-pnpm-test.log", "rm -rf /tmp/latest", "rm -rf /tmp/tmp.gone1234",
+		"rm -r -f -- /var/tmp/tmp.zzzzzz", "rm -rf /tmp/tmp.abcdef1234 && git push -u origin feature/x",
+		"rm -rf /tmp/tmp.abcdef1234 && rm -rf /tmp/tmp.gone1234\nrm -rf /tmp/latest || git log --oneline -1",
+	]) assert.equal(waived(command), true, command);
+	for (const command of [
+		"rm -rf /tmp", "rm -rf /tmp/", "rm -rf /tmp/*", "rm -rf /tmp/tmp.x/", "rm -rf /tmp/tmp.x/../..", "rm -rf /tmp/./tmp.x",
+		"rm -rf /tmp/a/b", `rm -rf "$TMPDIR/x"`, "rm -rf $TMPDIR/x", "rm -rf /tmp/tmp.{a,b}", "rm -rf /tmp/tmp.abc?", "rm -rf tmp.abcdef1234",
+		"sudo rm -rf /tmp/tmp.abcdef1234", "xargs rm -rf /tmp/tmp.abcdef1234", "rm -rf --no-preserve-root /tmp/tmp.abcdef1234",
+		"rm -rf /tmp/tmp.abcdef1234 ~/foo", "rm -rf /tmp/tmp.abcdef1234 && rm -rf data", "rm -rf /tmp/tmp.abcdef1234 data",
+		"rm -rf /tmp/tmp.abcdef1234 && find /tmp/x -delete", "rm -rf /tmp/tmp.abcdef1234 && psql -c 'DROP TABLE users'",
+		"rm -rf /tmp/tmp.abcdef1234 && git push --delete origin main", "rm -rf /tmp/tmp.abcdef1234 && npm publish",
+		"rm -rf /tmp/tmp.abcdef1234 && git stash drop", "rm -rf /tmp/cache", "rm -rf /tmp/tmp.other1234", "rm -rf /tmp/shared.log",
+		"rm -rf /tmp/tmp.denied99", "rm -rf /home/user/tmp.abcdef1234", "sh -c 'rm -rf /tmp/tmp.abcdef1234'",
+		"find /tmp -maxdepth 1 -name 'tmp.*' -exec rm -rf {} +", "rm -rf /tmp/tmp.gone1234>important.txt", "rm -rf /tmp/tmp.gone1234 2>/dev/null",
+		// Ordering: an earlier segment can move data into a target the lstat saw as scratch.
+		"mv /home/u/data /tmp/tmp.missingZZ619976 && rm -rf /tmp/tmp.missingZZ619976", "mv /home/u/data /tmp/tmp.abcdef1234 && rm -rf /tmp/tmp.abcdef1234",
+		"cp -r x /tmp/tmp.abcdef1234; rm -rf /tmp/tmp.abcdef1234", "echo hi; rm -rf /tmp/tmp.abcdef1234", "ln -s /home/u/data /tmp/tmp.gone1234 && rm -rf /tmp/tmp.gone1234",
+		"(mv /home/u/data /tmp/tmp.abcdef1234) && rm -rf /tmp/tmp.abcdef1234", "(rm -rf /tmp/tmp.abcdef1234)",
+		"rm -rf /tmp/tmp.abcdef1234 & mv /home/u/data /tmp/tmp.abcdef1234", "rm -rf /tmp/tmp.abcdef1234 | cat",
+		"rm -rf /tmp/tmp.gone1234; mv /home/u/data /tmp/tmp.abcdef1234; rm -rf /tmp/tmp.abcdef1234",
+	]) assert.equal(waived(command), false, command);
+	// A tmpdir under home would make top-level repository files look like scratch.
+	const underHome = { ...fs, home: "/home/gentleman", tmpdir: "/home/gentleman/work/repo", lstat: () => entry("file") };
+	assert.equal(isReversibleYoloCommand("rm -rf /home/gentleman/work/repo/README.md", evaluateGuardedCommand("rm -rf /home/gentleman/work/repo/README.md", config), underHome), false);
+	// A missing uid (no POSIX ownership) never proves own scratch.
+	assert.equal(isReversibleYoloCommand("rm -rf /tmp/tmp.abcdef1234", evaluateGuardedCommand("rm -rf /tmp/tmp.abcdef1234", config), { ...fs, uid: undefined }), false);
+});
+
+// An eligible push or rebase stays waived with fd or /dev/null redirections
+// and a pipe into a read-only filter; any other redirection or consumer asks.
+test("YOLO waives push and rebase segments with harmless redirections and read-only filters", () => {
+	const config = { autonomousMode: false, guardedCommands: {} };
+	const entry = { uid: 1000, isDirectory: () => true, isFile: () => false, isSymbolicLink: () => false };
+	const fs = { uid: 1000, tmpdir: "/tmp", home: "/home/user", lstat: () => entry };
+	const waived = (command: string) => isReversibleYoloCommand(command, evaluateGuardedCommand(command, config), fs);
+	for (const command of [
+		"git push origin main 2>&1", "git push -u origin feat/x 2>&1 | tail -5", "git push origin main >/dev/null", "git push origin main 2>/dev/null",
+		"git push origin main &>/dev/null", "git push origin main > /dev/null 2>&1", "git push origin main 2>&1 | grep -v hint | head -20",
+		"git push origin main | cat", "git push origin main 2>&1 | wc -l && gh pr create --fill", "git push 2>&1 | grep 'remote: '",
+		"git rebase origin/main 2>&1 | tail -3", "git fetch && git rebase origin/main >/dev/null && git push 2>&1 | tail -5",
+		"rm -rf /tmp/tmp.abcdef1234; git push origin main 2>&1 | tail -5",
+	]) assert.equal(waived(command), true, command);
+	for (const command of [
+		"git push origin main > out.txt", "git push origin main 2>err.log", "git push origin main >> /dev/null.txt", "git push origin main &>log",
+		"git push origin main | sh", "git push origin main | tee out", "git push origin main 2>&1 | tail -5 | sh", "git push origin main | tail -5 > out",
+		"git push origin main | catx", "git push origin main 2>&1 &", "git push origin main | tail -5 &", "git push origin main | grep \"$(id)\"",
+		"git push --force origin main 2>&1", "git push --delete origin main 2>&1 | tail -5", "git push origin :main 2>&1", "git push --mirror origin 2>&1",
+		"git rebase -i main 2>&1 | tail", "git push origin main 2>&1 | xargs echo",
+	]) assert.equal(waived(command), false, command);
+});
+
 // gentle-shell#2174: a guarded word inside an argument of a known data command
 // (search, print, view, non-executing edit) is text, not an operation. Every
 // opaque form keeps today's lexical match.
@@ -53,6 +131,11 @@ test("guarded words inside data-command arguments are not guarded operations (#2
 		"cat > probe.mts <<'EOF'\nconst x = \"git push --force origin main\";\nEOF",
 		"grep -rn 'git reset --hard' docs",
 		"env LC_ALL=C grep 'pi remove' notes.md",
+		"grep -l \"git push\" a.jsonl",
+		// A data-only command substitution or a plain assignment keeps the exemption.
+		"f=$(ls); grep -l \"git push\" $f",
+		"cd x; f=$(ls -t */*.jsonl | head -40); grep -l \"git push\" $f 2>/dev/null | head -5",
+		"grep -l 'git push' $(ls *.jsonl)", "f=1; grep 'git push' x", "grep \"git push $(pwd)\" x", "f=$(ls); grep -rn 'git reset --hard' docs",
 	]) assert.equal(classifyGuardedCommand(command, config), "not-guarded", command);
 	for (const [command, expected] of [
 		["git push origin main", "confirm"],
@@ -61,6 +144,15 @@ test("guarded words inside data-command arguments are not guarded operations (#2
 		["bash <<'EOF'\ngit push origin main\nEOF", "confirm"],
 		["python3 -c \"import os; os.system('git push')\"", "confirm"],
 		["echo $(git push origin main)", "confirm"],
+		["x=$(ls); git push origin main", "confirm"],
+		["x=$(git push origin main); grep 'git push' $x", "confirm"],
+		["f=$(ls); $f push origin main; grep 'git push' x", "confirm"],
+		["grep 'git push' $(cat x | sh)", "confirm"],
+		["grep 'git push' $(echo $(git push))", "confirm"],
+		["grep 'git push' $((1+2))", "confirm"],
+		["cat <<EOF\ndon't $(git push origin main)\nEOF", "confirm"],
+		["PATH=/x; git push origin main", "confirm"],
+		["x=$(ls); git reset --hard", "block"],
 		["grep 'git push origin main' f | sh", "confirm"],
 		["time git push origin main", "confirm"],
 		["sed 's/x/git push/e' file", "confirm"],
@@ -145,6 +237,36 @@ test("quoted separator arguments cannot waive hard denial or invent destruction"
 	}
 });
 
+// gentle-pi#2285: compound bodies, backticks and eval reach the data-loss
+// boundary, while the YOLO scratch waiver still covers leading direct `rm` only.
+test("removal after reserved words, in backticks and in eval needs fresh confirmation and is never scratch-waived", () => {
+	const config = { autonomousMode: true, guardedCommands: { gitPush: "allow" as const } };
+	for (const command of [`if true; then rm -rf data; fi`, `for d in a b; do rm -rf "$d"; done`, "echo `rm -rf data`", `eval 'rm -rf data'`]) {
+		const evaluation = evaluateGuardedCommand(command, config);
+		assert.equal(evaluation.action, "confirm", command);
+		assert.equal(evaluation.dataLoss, true, command);
+	}
+	for (const command of [`if true; then rm -rf ~; fi`, "echo `rm -rf /`", `eval 'rm -rf "$HOME"'`]) {
+		assert.equal(classifyGuardedCommand(command, config), "block", command);
+	}
+	for (const command of [`if [ -f x ]; then echo ok; fi`, `for f in *; do cat "$f"; done`, "echo `date`", `eval "$(ssh-agent -s)"`, `grep "then rm -rf" x`]) {
+		assert.equal(classifyGuardedCommand(command, config), "not-guarded", command);
+	}
+	const entry = { uid: 1000, isDirectory: () => true, isFile: () => false, isSymbolicLink: () => false };
+	const fs = { uid: 1000, tmpdir: "/tmp", home: "/home/user", lstat: () => entry };
+	const normal = { autonomousMode: false, guardedCommands: {} };
+	assert.equal(isReversibleYoloCommand("rm -rf /tmp/tmp.abcdef1234", evaluateGuardedCommand("rm -rf /tmp/tmp.abcdef1234", normal), fs), true);
+	for (const command of [
+		`if true; then rm -rf /tmp/tmp.abcdef1234; fi`, `for d in a; do rm -rf /tmp/tmp.abcdef1234; done`, `{ rm -rf /tmp/tmp.abcdef1234; }`,
+		`! rm -rf /tmp/tmp.abcdef1234`, "echo `rm -rf /tmp/tmp.abcdef1234`", `eval 'rm -rf /tmp/tmp.abcdef1234'`, `eval rm -rf /tmp/tmp.abcdef1234`,
+		"rm -rf /tmp/tmp.abcdef1234 && echo `rm -rf data`", `rm -rf /tmp/tmp.abcdef1234; eval 'rm -rf data'`,
+	]) {
+		const evaluation = evaluateGuardedCommand(command, normal);
+		assert.equal(evaluation.action, "confirm", command);
+		assert.equal(isReversibleYoloCommand(command, evaluation, fs), false, command);
+	}
+});
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -788,3 +910,23 @@ test("loadRuntimeGuardrailsConfig: autonomousMode:{} (object) in JSON does NOT a
 		rmSync(dir, { recursive: true, force: true });
 	}
 });
+
+test("evaluateSuperYoloCommand: waives data-loss and configured confirmations, keeps only catastrophic denies", () => {
+	const { evaluateSuperYoloCommand } = __testing;
+	// Ordinary data-loss commands run without confirmation.
+	assert.equal(evaluateSuperYoloCommand("rm -rf node_modules build"), "allow");
+	assert.equal(evaluateSuperYoloCommand("git rebase origin/main"), "allow");
+	assert.equal(evaluateSuperYoloCommand("git branch -D feature/x"), "allow");
+	assert.equal(evaluateSuperYoloCommand("npm publish"), "allow");
+	assert.equal(evaluateSuperYoloCommand("git push -u origin feature"), "allow");
+	// Code-level catastrophic denies survive: root/home removal and hard-coded
+	// destructive Git forms (reset --hard, forced clean, force push).
+	assert.equal(evaluateSuperYoloCommand("rm -rf /"), "block");
+	assert.equal(evaluateSuperYoloCommand("rm -rf ~"), "block");
+	assert.equal(evaluateSuperYoloCommand("rm -rf --no-preserve-root /"), "block");
+	assert.equal(evaluateSuperYoloCommand("git reset --hard HEAD~1"), "block");
+	assert.equal(evaluateSuperYoloCommand("git push --force origin main"), "block");
+	assert.equal(evaluateSuperYoloCommand("git clean -fd"), "block");
+	// Harmless commands are unaffected.
+	assert.equal(evaluateSuperYoloCommand("git status && npm test"), "allow");
+});

package/tests/bounded-writer-admission.test.ts

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import { mkdirSync, mkdtempSync, realpathSync, renameSync, rmSync, symlinkSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
 import { __testing } from "../extensions/gentle-ai.ts";
@@ -82,9 +82,17 @@ test("explicit review protects canonical HOME aliases, filesystem root and sensi
 	mkdirSync(home);
 	mkdirSync(join(home, ".ssh"));
 	symlinkSync(home, alias);
-	const previous = process.env.HOME;
+	const previousHome = process.env.HOME;
+	const previousProfile = process.env.USERPROFILE;
+	t.after(() => {
+		if (previousHome === undefined) delete process.env.HOME; else process.env.HOME = previousHome;
+		if (previousProfile === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = previousProfile;
+		rmSync(root, { recursive: true, force: true });
+	});
+	// Node resolves the home from USERPROFILE on Windows and HOME on POSIX.
 	process.env.HOME = home;
-	t.after(() => { if (previous === undefined) delete process.env.HOME; else process.env.HOME = previous; rmSync(root, { recursive: true, force: true }); });
+	process.env.USERPROFILE = home;
+	assert.equal(realpathSync(homedir()), home, "the protected home must be the isolated fixture");
 	let calls = 0;
 	const native = { reviewMode: async () => ({ operation: "status", status: { effective: "on", source: "global", global: "on", cloneLocal: "" } }), targetStatus: async () => { calls++; throw new Error("protected native invocation"); } } as unknown as NativeReviewCli;
 	for (const target of [home, alias, "/", join(home, ".ssh")]) {

package/tests/bundled-install.test.ts

@@ -17,7 +17,7 @@ const posixTest = (name: string, fn: (t: TestContext) => void | Promise<void>) =
 const NODE = "24.21.0";
 const PNPM = "11.1.1";
 const NPM = "11.19.0";
-const ENGRAM = "3.4.0";
+const ENGRAM = "3.5.2";
 
 // Every temporary home this file creates is removed when the file's tests end.
 const roots: string[] = [];
@@ -373,8 +373,8 @@ posixTest("ensureEngram downloads nothing when the prefix is missing", async ()
 });
 
 test("engramExecutable takes only the top-level engram from the tarball and engram.exe from the zip, regular files only", () => {
-	const tarball = { url: "https://github.com/Gentleman-Programming/engram/releases/download/v3.4.0/engram_3.4.0_linux_amd64.tar.gz" };
-	const zipped = { url: "https://github.com/Gentleman-Programming/engram/releases/download/v3.4.0/engram_3.4.0_windows_amd64.zip" };
+	const tarball = { url: "https://github.com/Gentleman-Programming/engram/releases/download/v3.5.2/engram_3.5.2_linux_amd64.tar.gz" };
+	const zipped = { url: "https://github.com/Gentleman-Programming/engram/releases/download/v3.5.2/engram_3.5.2_windows_amd64.zip" };
 	assert.deepEqual(engramExecutable(engramArchive, tarball), engramBytes);
 	const exe = Buffer.from("MZ engram");
 	assert.deepEqual(engramExecutable(zip([["tools/cloud-sync-projects.ps1", Buffer.from("x")], ["engram.exe", exe]]), zipped), exe);

package/tests/card-content-policy.test.ts

@@ -42,16 +42,26 @@ test("invalid or unreadable preference files read as default and are never overw
 	const dir = home();
 	mkdirSync(join(dir, "card-content.json"));
 	assert.equal(resolveCardContent({ gentlePiConfigHome: dir }).malformed, true, "a directory in its place is unreadable, not missing");
-	if (process.getuid?.() !== 0) {
-		const locked = home();
-		writeCardContent(CARD_CONTENT.MINIMAL, { gentlePiConfigHome: locked });
-		chmodSync(join(locked, "card-content.json"), 0o000);
-		try {
-			assert.deepEqual({ ...resolveCardContent({ gentlePiConfigHome: locked }), globalFile: "" }, { content: "default", source: "global_file", malformed: true, globalFile: "" });
-		} finally {
-			chmodSync(join(locked, "card-content.json"), 0o600);
-		}
+	assert.throws(() => writeCardContent(CARD_CONTENT.MINIMAL, { gentlePiConfigHome: dir }), /Cannot update malformed or unreadable card content preference/);
+	assert.deepEqual(readdirSync(dir), ["card-content.json"], "the rejected write must not create temporary files");
+	assert.deepEqual(readdirSync(join(dir, "card-content.json")), [], "the unreadable directory is preserved");
+});
+
+// chmod cannot deny reads on Windows; retain the portable directory case above.
+test("POSIX unreadable preference files read as default and are never overwritten", {
+	skip: process.platform === "win32" || process.getuid?.() === 0 ? "requires POSIX permissions and a non-root user" : false,
+}, () => {
+	const locked = home();
+	writeCardContent(CARD_CONTENT.MINIMAL, { gentlePiConfigHome: locked });
+	chmodSync(join(locked, "card-content.json"), 0o000);
+	try {
+		assert.deepEqual({ ...resolveCardContent({ gentlePiConfigHome: locked }), globalFile: "" }, { content: "default", source: "global_file", malformed: true, globalFile: "" });
+		assert.throws(() => writeCardContent(CARD_CONTENT.DEFAULT, { gentlePiConfigHome: locked }), /Cannot update malformed or unreadable card content preference/);
+	} finally {
+		chmodSync(join(locked, "card-content.json"), 0o600);
 	}
+	assert.equal(resolveCardContent({ gentlePiConfigHome: locked }).content, CARD_CONTENT.MINIMAL, "the rejected write preserves the stored preference");
+	assert.deepEqual(readdirSync(locked), ["card-content.json"], "the rejected write leaves no temporary files");
 });
 
 test("the live slot shares one content level per process and an unset slot reads default", (t) => {

package/tests/child-safety.test.ts

@@ -1,4 +1,7 @@
 import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import test from "node:test";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { createChildSafetyExtension } from "../extensions/child-safety.ts";
@@ -59,6 +62,23 @@ test("headless children reject corrected literal forms without prompting", async
 	}
 });
 
+// gentle-pi#2285: removal behind reserved words, in backticks or in eval is still data loss.
+test("children block destruction after reserved words, in backticks and in eval", async () => {
+	for (const primary of [false, true]) {
+		const h = harness(true, primary);
+		const ctx = context(async () => { throw new Error("child must never prompt"); }, false);
+		for (const command of [
+			`if true; then rm -rf data; fi`, `for d in a b; do rm -rf "$d"; done`, "echo `rm -rf data`", `eval 'rm -rf data'`,
+			`if true; then rm -rf ~; fi`, `{ rm -rf data; }`, `while true; do rm -rf data; done`,
+		]) {
+			assert.equal((await h.handlers[0](event(command), ctx) as { block?: boolean })?.block, true, command);
+		}
+		for (const command of [`if [ -f x ]; then echo ok; fi`, `for f in *; do cat "$f"; done`, "echo `date`", `grep "then rm -rf" x`]) {
+			assert.equal(await h.handlers[0](event(command), ctx), undefined, command);
+		}
+	}
+});
+
 test("primary requires fresh confirmation, cancellation and missing UI block", async () => {
 	const h = harness(false, true);
 	const command = `psql -c 'DROP TABLE users'`;
@@ -81,6 +101,25 @@ test("primary requires fresh confirmation, cancellation and missing UI block", a
 	assert.deepEqual(blockers, [true, false, true, false, true, false, true, false]);
 });
 
+// The YOLO temp-scratch waiver is primary-only: children still block it and
+// Normal mode still asks, whatever the targets look like on disk.
+test("temp scratch removal stays blocked in children and confirmed in Normal mode", async () => {
+	const scratch = mkdtempSync(join(tmpdir(), "tmp."));
+	try {
+		const command = `rm -rf ${scratch} /tmp/tmp.8phya1BpFr /tmp/ctx-backstop-pnpm-test.log; cd /tmp && git log --oneline -1`;
+		for (const primary of [false, true]) {
+			const result = await harness(true, primary).handlers[0](event(command), context(async () => { throw new Error("child must never prompt"); }));
+			assert.equal((result as { block?: boolean })?.block, true, `child via ${primary ? "primary" : "safety"} entry`);
+		}
+		const titles: string[] = [];
+		const normal = harness(false, true);
+		assert.equal(await normal.handlers[0](event(command), context(async (title) => { titles.push(title); return true; })), undefined);
+		assert.deepEqual(titles, ["Allow recognized data-loss command?"]);
+	} finally {
+		rmSync(scratch, { recursive: true, force: true });
+	}
+});
+
 test("children block recognized destructive commands sent to bash_background too", async () => {
 	const h = harness(true);
 	const result = await h.handlers[0]({ toolName: "bash_background", input: { command: "echo ok && rm -rf ./data" } }, context(async () => { throw new Error("child must never prompt"); }));