Agent ran rm -rf on a pre-existing directory outside the workspace, deleting user session data

What happened

During a session, the agent (Kimi Code CLI, yolo permission mode) was asked to clean up a symlink it had created at ~/.pi/agent/sessions. Instead:

1. The symlink creation had actually failed earlier (ln -sfn onto a pre-existing real directory) — the agent did not notice because it chained commands with newlines and never checked stderr.
2. When asked to remove "the symlink", the agent ran rm -rf ~/.pi without first listing the directory contents.
3. ~/.pi contained pre-existing user data (agent/sessions/ with pi CLI session archives from the previous week) which was permanently deleted.

Expected behavior

Destructive operations outside the working directory should get a hard confirmation gate even in yolo mode, e.g.:

• rm -rf (or any recursive delete) on a path outside the session working directory requires explicit user confirmation, showing what will be deleted.
• Prefer move-to-trash over permanent deletion when the target contains pre-existing content the agent did not create.

Environment

• OS: Linux (Debian)
• Kimi Code CLI running inside a managed multi-agent environment (CCB)
• Permission mode: yolo

The issue does not name files or tests. Start by locating the CLI's shell-command execution and yolo permission checks, then reproduce the reported recursive deletion scenario in a safe environment. Done means destructive operations outside the session working directory show what will be deleted and require explicit confirmation, with move-to-trash preferred for pre-existing content.