Repository navigation
Write CI scratch files to $TMPDIR instead of the sandbox's read-only /tmp - #4063
Merged
Merged
Conversation
…y /tmp
The agent sandbox introduced in tend 0.2.3 mounts root /tmp read-only, so the codecov-investigation and statusline cache-check recipes fail at their first redirect. Point them at ${TMPDIR:-/tmp}, which is writable in CI and falls back to /tmp for a local run.
max-sixty
pushed a commit
that referenced
this pull request
Sep 11, 2026
Regenerates the `tend-*` workflows against tend 0.2.6 (from 0.2.5). The
workflow files themselves only move the `max-sixty/tend/claude@` pin and
the generated-by header; the adopter-visible changes ride in the action
and its bundled skills, plus one generated `tend-mention` condition.
**The agent sandbox gets a writable `TMPDIR`.** Root `/tmp` is read-only
for the agent, and until now bundled scripts and skill recipes wrote
there anyway — this repo carries a note in
`.claude/skills/running-tend/SKILL.md` telling sessions to route scratch
paths through `${TMPDIR:-/tmp}` for exactly that reason (#4063). 0.2.6
exports a standard writable `TMPDIR` under the sandbox user's home and
moves the bundled scripts onto it, so a recipe that reaches for a plain
`/tmp` path no longer dies on `Read-only file system`
([max-sixty/tend#1199](max-sixty/tend#1199)).
**A review the bot leaves on its own PR no longer summons a second
session.** `tend-mention`'s dispatch filter now returns early when the
review author is the bot, and `tend-review` applies its own findings on
PRs with no human author instead — the same rule step 9 of the review
skill already used for Dependabot and renovate PRs. Previously each
self-review round cost a cold `tend-mention` boot that re-read the whole
PR to apply fixes the reviewer had just written, then pushed and fired
another review
([max-sixty/tend#1203](max-sixty/tend#1203)).
This is the one change visible in the generated YAML — the
`tend-mention.yaml` diff below.
**The maintainer-tier check reads `authorAssociation` correctly.** The
shared skill block claimed `gh pr view --json` doesn't expose the field
at all; it does, nested on the comment and review objects, and only the
top-level key is rejected. Sessions deciding whether a requester may
direct a destructive action were being pushed to the REST API
unnecessarily
([max-sixty/tend#1178](max-sixty/tend#1178)).
Full comparison:
<max-sixty/tend@0.2.5...0.2.6>.
<details><summary>Generated <code>tend-mention.yaml</code> condition
change</summary>
The dispatch filter gains an early bail on a bot-authored review:
```python
# A review the bot wrote hands work to nobody: the review session
# applies the findings it raised. The mention checks run first, so
# naming the bot in a review still summons a session.
if review_author == bot:
return verdict(False)
```
replacing the prior participation branch, which dispatched when the PR
author was also the bot and the review carried a body or fresh inline
comments. The prompt for a genuine `pull_request_review` dispatch drops
the clause that told the session to action a review it had authored
itself.
</details>
Co-authored-by: worktrunk-bot <254187624+worktrunk-bot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two CI-facing recipes in this repo write scratch files to a path the agent sandbox no longer allows, so each fails at its first redirect. This points them at
${TMPDIR:-/tmp}— writable inside the sandbox, and still/tmpfor a local run.Since tend 0.2.3 the agent runs inside a sandbox with an allowlisted write set, and root
/tmpis not in it. This repo picked that up with the 0.2.5 regeneration in #4057, merged yesterday at 10:37. Verified from inside a tend session on this repo:The affected recipes:
tests/CLAUDE.md→ Coverage Investigation —curl … > /tmp/codecov.jsonplus the twojqreads of it. This block exists for exactly the case that now breaks: it names "running in CI, wheretask coverageisn't installed" as one of its two reasons to query Codecov directly, and.claude/skills/running-tend/SKILL.mdsends every CI session investigating acodecov/patchfailure here..claude/skills/running-tend/SKILL.md— thecode-coverage-reportartifact download (/tmp/coverage.zip,unzip -d /tmp/coverage) and the weekly statusline cache-check's stdin fixture (/tmp/statusline-input.json).Both rewritten forms were run in this session before committing: the codecov query against
#4058's base→head pair returns the real per-file patch table, andjq -n … > "${TMPDIR:-/tmp}/statusline-input.json"plus the<redirect back out both work.This is not the upstream bug. The same
/tmpassumption in tend's own bundled scripts and skills is max-sixty/tend#1192, fixed by max-sixty/tend#1199 and merged 2026-09-09T08:23Z — about two hours after 0.2.5 tagged, so it reaches this repo at the next release plus regeneration. That fix covers bundled files only, and its own test asserts that root/tmpstays read-only, so these repo-local recipes stay broken until they change here.One sentence was added next to the existing "don't
cargo installin the sandbox" note, so the next author editing these recipes knows why the paths look like that.Evidence and gate assessment
Found by the daily review-runs sweep, run 34451797174.
Confidence — structural, not stochastic: the write fails on the same syscall every time, for every session, and it is reproduced above rather than projected. Thirteen sessions in this window hit read-only
/tmpon other paths; the nightly 34446121464 hit it eight times, includingtee: /tmp/tend-check.txt: Read-only file systemand anOSError: [Errno 30] Read-only file systemtraceback out ofnightly_workflow_update.py. Neither of the two recipes changed here was exercised in this window — notend-weeklyrun, and no coverage dispute — so the specific sites are unfired rather than observed failing.Magnitude — targeted fix: seven path substitutions and one sentence, no new section and no new machinery.
Cost — waste-class, with a false-claim edge. A session whose codecov recipe dies mid-investigation either improvises or, per
running-in-ci's rule on unrun gates, has to report the gate as unrun; the weekly statusline check is the one that could otherwise read as clean. The remedy is a literal swap in existing lines, which clears the bar a waste-class finding sets.