Merge branch 'master' of C:\projects\manual_slop into tier2/test_sandbox_hardening_20260619

tests/test_tier2_slash_command_spec.py

@@ -167,15 +167,28 @@ def test_config_fragment_has_top_level_permission() -> None:
 
 
 def test_config_fragment_denies_temp_writes() -> None:
- """Regression test (2026-06-17): the agent wrote audit output to
+ """Regression test (2026-06-17, expanded 2026-06-19 to catch all
+ env-var forms): the agent wrote audit output to
  C:\\Users\\Ed\\AppData\\Local\\Temp\\ which is outside the sandbox.
  Both the top-level and the tier2-autonomous agent's bash MUST deny
- commands targeting AppData\\Local\\Temp\\ so the agent cannot write
- there, and so the session-level 'ask' prompt is never triggered."""
+ commands targeting the global temp dir in ANY form (literal path,
+ $env:TEMP, $env:TMP, %TEMP%, %TMP%, GetTempPath, gettempdir,
+ mkstemp, NamedTemporaryFile)."""
  data = json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
  top_bash = data["permission"]["bash"]
  agent_bash = data["agent"]["tier2-autonomous"]["permission"]["bash"]
- temp_deny_keys = [k for k in top_bash if "Temp" in k and top_bash[k] == "deny"]
- assert temp_deny_keys, "top-level bash must have a deny rule for AppData\\Local\\Temp\\ paths"
- temp_deny_keys_agent = [k for k in agent_bash if "Temp" in k and agent_bash[k] == "deny"]
- assert temp_deny_keys_agent, "tier2-autonomous agent bash must have a deny rule for AppData\\Local\\Temp\\ paths"
+ # Required deny patterns (matched against the literal command string)
+ required = [
+  "*AppData\\*",
+  "*AppData\\Local\\Temp\\*",
+  "*$env:TEMP*",
+  "*$env:TMP*",
+  "*%TEMP%*",
+  "*%TMP%*",
+  "*GetTempPath*",
+  "*gettempdir*",
+  "*mkstemp*",
+ ]
+ for pat in required:
+  assert top_bash.get(pat) == "deny", f"top-level bash must deny pattern: {pat!r}"
+  assert agent_bash.get(pat) == "deny", f"tier2-autonomous agent bash must deny pattern: {pat!r}"