Skip to main content

brett

Goodbye $HOME

I deleted my home directory

This was my first time using subagents with Pi. What I did not know was that, at the time, pi-subagents did not inherit global context and instructions the way parent agents did.

I had also become too comfortable giving coding agents unsandboxed autonomy. That was reckless.

A subagent executed this Bash as my user:

HOME=$(mktemp -d) node ...
status=$?
rm -rf /tmp/lifecycle-smoke.test.ts "$HOME"
exit $status

The inline HOME applied only to node. During cleanup, "$HOME" resolved to /Users/brett, so rm -rf recursively deleted my home directory. 💀

Pi reporting that a subagent recursively deleted my home directory
The parent agent blaming it on the subagent

The damage included private keys, dotfiles, repositories, Documents and most of Downloads. Without my global instructions to use Trash over rm, the subagent obliterated quite a bit on my machine.

It took me a moment to realize what was happening. I tried steering the agent instead of killing it because I had misdiagnosed the missing worktree. I didn’t interrupt the process until about 10 minutes later by killing the command’s descendants.

pkill -KILL -f '[r]m -rf .*Users/brett'
ps -axo pid,ppid,etime,command | grep -E '[r]m .*Users/brett'

Fortunately, just about everything on my machine is either clone-able or backed up.

What changed

First, I configured subagents to inherit the parent context. I narrowed their roles and tool access. My Pi configuration now has policies to block rm, variable-derived deletion, protected paths, malformed Bash, and some attempts to escape the project root. A second fail-closed check provides defense in depth along with interactive Trash checks.

These protections block the original configured Pi path. Real sandboxing, restricted mounts, and process-group termination are better containment options, but not quite the right fit for what I work on.

Clearly none of this is Pi’s fault. I love how configurable it is and I’ve had a blast making it my own. But this experience has been a good wake up call for security.

Maybe being willing to say goodbye to $HOME is also useful. 🫡