[dmoliveira]

Summary

• Hold live ast-grep installation, retries, recovery and probes until process containment, bounded draining and ownership-bound recovery and cleanup are qualified; preserve existing journals, stages and managed artifacts. A synthetic valid-journal test reproduced unlinking a file moved from outside the cache.
• Hold live Playwright CLI installation and retries, preserving its cache, npm config and attestations. Synthetic tests showed an attestation-stage symlink and a hardlinked npm config can overwrite or truncate and chmod outside files; the symlink issue also reproduced through the installer entry point with package calls mocked.
• Remove installer recommendations from active browser guides and the tracked browser skill. Warn that devtools diagnostics may still recommend held installers, and auto-slash can dispatch ast-grep through install all or execute held doctor diagnostics. Do not imply other backends are safe without independent assessment.

Validation

• Exact source plus final patch passed configured pre-commit (including make validate) and make selftest inside a no-host-mount Linux VM with a private PID namespace, a test-only config-lock parent, and an independently probed recursion guard. All 44 synthetic sentinels, external entries, and fixture Git refs/indexes were unchanged. The optional oc-dependent selftest was skipped because oc was unavailable in the VM.
• git diff --check, command documentation, active references, README layout and focused warning coverage passed. Mock-only checks confirmed auto-slash behavior and existing unsafe diagnostic recommendations without live state access or backend execution.
• No live background operation, untrusted job read, unrelated process signal, live ast-grep installation/probe/recovery, or real Playwright installation/package call was used. The separately staged retention worktree remained unchanged.

Scope

Documentation and skill guidance only; neither installer nor its runtime recommendations are repaired by this PR. Background, ast-grep and Playwright safety holds remain; tasks 182 and 184 stay open.

[dmoliveira]

Holding this PR in draft: an isolated synthetic test also reproduced external-file clobber and chmod through the Playwright CLI attestation temporary path. The current docs still recommend that installer. No live package, external user file, or signal was involved. The warning and validation will be expanded; checks on b15a516 are superseded.

[dmoliveira]

A second isolated synthetic test reproduced truncation and chmod of an outside file through a hardlinked Playwright npm config. The attestation-symlink issue also reproduced through the installer entry point with package calls mocked, returning success. No live file, package, network request, or signal was involved. The expanded warning remains under validation; earlier CI does not cover it.

[dmoliveira]

The expanded warning is validated at head 8414477: the isolated full VM gate and all three exact-head GitHub checks passed. It preserves the holds, removes active installer recommendations from the browser guides and skill, and records the synthetic symlink and hardlink evidence. Runtime installer and diagnostic fixes remain open under tasks 182 and 184.