Merge branch 'master' of C:\projects\manual_slop into tier2/result_migration_review_pass_20260617

tests/test_no_temp_writes.py

@@ -0,0 +1,35 @@
+"""Default-on regression test: no script under ./scripts/ may write to
+the global %TEMP% directory (C:\\Users\\Ed\\AppData\\Local\\Temp\\).
+
+The Tier 2 sandbox is supposed to keep all scratch / intermediate
+files inside its allowlist (C:\\projects\\manual_slop_tier2 +
+C:\\Users\\Ed\\AppData\\Local\\manual_slop\\tier2 +
+C:\\Users\\Ed\\AppData\\Local\\manual_slop\\tier2_failures). Writing
+to the global Temp dir breaks that boundary: the OpenCode session
+fires the 'ask' prompt for paths outside the project root, halting
+autonomous ops.
+
+The test delegates to scripts/audit_no_temp_writes.py --strict
+which exits 1 on any violation. If this test fails, a new script
+under ./scripts/ is using %TEMP% and the Tier 2 sandbox boundary
+has been violated.
+"""
+import subprocess
+from pathlib import Path
+
+import pytest
+
+
+def test_no_script_emits_to_temp() -> None:
+ audit = Path("scripts/audit_no_temp_writes.py").resolve()
+ assert audit.exists(), f"audit script missing: {audit}"
+ result = subprocess.run(
+  ["uv", "run", "python", str(audit), "--strict"],
+  capture_output=True, text=True, timeout=60,
+ )
+ assert result.returncode == 0, (
+  f"audit found %TEMP% usage in scripts:\n{result.stdout}\n{result.stderr}\n\n"
+  f"Fix: move scratch files to tests/artifacts/ or "
+  f"C:\\Users\\Ed\\AppData\\Local\\manual_slop\\tier2\\ instead of %TEMP%."
+ )
+ assert "CLEAN" in result.stdout, f"unexpected audit output: {result.stdout}"

tests/test_tier2_slash_command_spec.py

@@ -79,6 +79,18 @@ def test_agent_denies_destructive_git() -> None:
  assert '"git reset*": deny' in content
 
 
+def test_agent_denies_temp_writes() -> None:
+ """Regression test (2026-06-17): the agent wrote an audit JSON to
+ C:\\Users\\Ed\\AppData\\Local\\Temp\\, which is outside the sandbox
+ allowlist, triggering the OpenCode session-level 'ask' prompt and
+ halting ops. The agent's bash MUST now deny commands targeting
+ AppData\\Local\\Temp\\, and the agent prompt MUST tell the agent
+ to use the sandbox's app-data dir for temp files."""
+ content = AGENT_PATH.read_text(encoding="utf-8")
+ assert 'AppData\\Local\\Temp' in content, "agent prompt must include Temp deny rule in frontmatter bash"
+ assert 'AppData\\Local\\manual_slop\\tier2' in content or 'app-data' in content.lower(), "agent prompt must point agent at the app-data dir for temp files"
+
+
 def test_config_fragment_valid_json() -> None:
  data = json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
  assert data["default_agent"] == "tier2-autonomous"
@@ -122,3 +134,18 @@ def test_config_fragment_has_top_level_permission() -> None:
  assert top["bash"].get("git checkout*") == "deny"
  assert top["bash"].get("git restore*") == "deny"
  assert top["bash"].get("git reset*") == "deny"
+
+
+def test_config_fragment_denies_temp_writes() -> None:
+ """Regression test (2026-06-17): the agent wrote audit output to
+ C:\\Users\\Ed\\AppData\\Local\\Temp\\ which is outside the sandbox.
+ Both the top-level and the tier2-autonomous agent's bash MUST deny
+ commands targeting AppData\\Local\\Temp\\ so the agent cannot write
+ there, and so the session-level 'ask' prompt is never triggered."""
+ data = json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
+ top_bash = data["permission"]["bash"]
+ agent_bash = data["agent"]["tier2-autonomous"]["permission"]["bash"]
+ temp_deny_keys = [k for k in top_bash if "Temp" in k and top_bash[k] == "deny"]
+ assert temp_deny_keys, "top-level bash must have a deny rule for AppData\\Local\\Temp\\ paths"
+ temp_deny_keys_agent = [k for k in agent_bash if "Temp" in k and agent_bash[k] == "deny"]
+ assert temp_deny_keys_agent, "tier2-autonomous agent bash must have a deny rule for AppData\\Local\\Temp\\ paths"