Repository navigation
chore: update tend workflows (0.2.9 → 0.2.10) - #6330
Merged
Merged
Conversation
Regenerates the tend workflows from tend 0.2.10 (was 0.2.9).
0.2.10 restores sandbox launch. bubblewrap's CVE-2026-87766 fix
(`0.9.0-1ubuntu0.2` on noble) opens each component of a bind destination
with `O_DIRECTORY` where it used to stat it, so an intermediate directory
now needs read permission and not just search. Tend left the agent
workspace container traverse-only, so from the afternoon of 2026-09-17,
when the Ubuntu archive began serving the update, every session died
before the agent turn started:
bwrap: Can't mkdir parents for /tmp/tend-agent-workspace-*/checkout: Permission denied
0.2.10 opens that container to `0o755`; the checkout inside it stays
`0o700` until the handoff (max-sixty/tend#1277).
That fix does not appear in this diff — it lives inside the composite
action, which these workflows pin to an immutable release tag, so
regenerating onto 0.2.10 is what carries it here. The one visible change
beyond the pin is in the `tend-notifications` preflight: its bot-PR
conflict scan now counts only a settled `CONFLICTING`. GitHub computes
`mergeable` lazily, so the first read after the base branch moves returns
`UNKNOWN`, which was booting a session after every merge into the default
branch (max-sixty/tend#1276).
The pin carries the rest of 0.2.10 too — bundled skill changes, and the
sandbox seeding the agent's Git commit identity before the turn starts,
among others.
Release notes: https://github.com/max-sixty/tend/releases/tag/0.2.10
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Regenerates the tend workflows from tend 0.2.10 (was 0.2.9).
0.2.10 restores sandbox launch. bubblewrap's CVE-2026-87766 fix
(
0.9.0-1ubuntu0.2on noble) opens each component of a bind destinationwith
O_DIRECTORYwhere it used to stat it, so an intermediate directorynow needs read permission and not just search. Tend left the agent
workspace container traverse-only, so from the afternoon of 2026-09-17,
when the Ubuntu archive began serving the update, every session died
before the agent turn started:
0.2.10 opens that container to
0o755; the checkout inside it stays0o700until the handoff (#1277).That fix does not appear in this diff — it lives inside the composite
action, which these workflows pin to an immutable release tag, so
regenerating onto 0.2.10 is what carries it here. The one visible change
beyond the pin is in the
tend-notificationspreflight: its bot-PRconflict scan now counts only a settled
CONFLICTING. GitHub computesmergeablelazily, so the first read after the base branch moves returnsUNKNOWN, which was booting a session after every merge into the defaultbranch (#1276).
The pin carries the rest of 0.2.10 too — bundled skill changes, and the
sandbox seeding the agent's Git commit identity before the turn starts,
among others.
Release notes: https://github.com/max-sixty/tend/releases/tag/0.2.10
🤖 Generated with Claude Code