fix(agent): isolate conversation workspaces

tests/routes/chatPermissionPolicy.test.ts

@@ -129,4 +129,42 @@ describe("permission approval policy", () => {
       title: "已按始终允许模式放行",
     });
   });
+
+  it.each([
+    "rm -rf ./target",
+    "rm  -rf ./target",
+    "rm -Rf ./target",
+    "/bin/rm -rf ./target",
+    "command rm --force --recursive ./target",
+    "env LANG=C rm -r -f ./target",
+    "SAFE=1 rm -rf ./target",
+    "env -u HOME rm -rf ./target",
+    "r\"\"m -rf ./target",
+    "(rm -rf ./target)",
+    "! rm -rf ./target",
+    "npm test && rm --recursive --force ./target",
+  ])("rejects direct recursive force removal in always mode: %s", (command) => {
+    expect(
+      resolvePermissionApproval("always", "bash", {
+        metadata: { command },
+        patterns: [command],
+      }),
+    ).toMatchObject({
+      autoApprove: false,
+      autoReject: true,
+      title: "已拒绝递归强制删除",
+    });
+  });
+
+  it.each(["rm tmp.txt", "rm -f tmp.txt", "rm -r tmp-dir", "echo 'rm -rf tmp'"])(
+    "keeps non-recursive or non-executed removal text available for confirmation: %s",
+    (command) => {
+      expect(
+        resolvePermissionApproval("always", "bash", {
+          metadata: { command },
+          patterns: [command],
+        }),
+      ).toMatchObject({ autoApprove: false, autoReject: false });
+    },
+  );
 });