Make /tmp writable inside the sandbox

[max-sixty]

SRT read-only-binds the whole root and rw-binds only what tend lists in allowWrite, which never included /tmp. Nothing protects on that — it was simply never listed — so every tool that hard-codes a path under /tmp has needed a workaround of its own: a TMPDIR override (#1199), a zsh TMPPREFIX override (#1211), skill text warning sessions off it (#1244), and now NuGet's build mutex (#1312), which no environment variable moves and which a consumer is working around per-repo. This fixes the layout instead, so the family ends.

/tmp is writable inside the sandbox now. The two runner-owned containers — the per-run SRT runtime and the disposable event checkout — move to /var/tmp, which is 1777 like /tmp but outside the write policy, so from inside they stay exactly as unwritable as before. The Claude auto-memory working copy moves with them, since the dispose step runs before the save that reads it. After the reap, that step also removes the top-level /tmp entries the sandbox uid owns: /tmp is sticky, so ownership is the whole test, and every runner-owned entry beside them stays. Reading a directory the whole runner shares races it, so an entry that disappears between the listing and the stat is treated as the gone thing it is rather than failing an always() step and filing a tend-outage issue over someone else's temp file. Ownership separates the two at the top level alone, which the security model now says.

Deleted with the constraint that produced them: the TMPPREFIX override and its reserved sandbox_env key, and the repo-wide test banning bare /tmp paths in shipped instructions. run-tend's temp-files section is down to the one fact a session still needs — $TMPDIR is /home/tend-sandbox/tmp. TMPDIR and AGENT_TMP_DIR themselves stay: the supervisor reads the step summary from that directory, and the shipped skills name $TMPDIR throughout. So does the CLAUDE_CODE_TMPDIR override, for a reason the comment now states — with filesystem policy on, SRT overwrites TMPDIR in the child environment with its own /tmp/claude default unless handed a path.

The check that matters is test-sandbox, which drives the real boundary on a hosted Ubuntu runner. Its probe for an unwritable path now aims at /var/tmp rather than at the 755 container directories, where a non-root uid would be refused on file permissions alone and the assertion would hold whether or not the boundary was still there. A runner-owned file planted before the lifecycle covers the other half: the sandbox must fail to unlink it — the sticky bit is all that protects runner state in the shared directory while the agent runs — and a new step then runs the real dispose against the real filesystem, where sandbox-written scratch goes and that file stays.

Closes #1312

This was written by Claude Code on behalf of max-sixty

🤖 Generated with Claude Code

[tend-agent]

#1313 is open against the same two tend.example.yaml files and states the opposite of this change: "/tmp itself is read-only there and no config key makes it writable", followed by the .NET EROFS walkthrough and an unshare --mount recipe for working around it. That PR's premise is #1312, which this one closes at the source. If both land, every consumer's example config ships a false claim about the sandbox write set plus a workaround for a failure that no longer happens — and the unshare recipe is the more expensive half, since a consumer who copies it wraps every build command in a mount namespace for nothing. The AF_UNIX/-m:1 MSBuild half of #1313 is independent of the write policy and still holds, so the two PRs aren't wholly redundant; it's the /tmp paragraphs that this supersedes.

The other point is on the new verify_srt probes, inline below.

[tend-agent]

Two things on the dispose sweep, which is what the widened /tmp rests on.

A /tmp entry vanishing mid-sweep fails the job. scratch_entries has to lstat every top-level entry in a shared world-writable directory, not just the sandbox's own, and FileNotFoundError lands in main's (OSError, subprocess.CalledProcessError, ValueError) handler. Any process still live on the runner that removes a temp file between iterdir() and lstat() — a background service a setup: step left up, a browser clearing its /tmp/.org.chromium.* — turns the always() dispose step red after the agent has already posted its work, and Report failure then files a tend-outage issue naming someone else's temp file. Suggestion inline; happy to push it instead if you'd rather.

The sweep is top-level only, so the docs/security-model.md guarantee is narrower than it reads. "the agent's scratch is gone before a later step or a setup: action's POST step could read it" holds for entries directly in /tmp. A runner-owned directory there that the sandbox can write — one a setup: step created group- or world-writable — keeps whatever the sandbox put inside it, since the directory entry itself is runner-owned and stays. Either walk the tree for sandbox-owned files, or scope the sentence to /tmp's own entries so the threat model doesn't promise more than ownership-at-the-top-level delivers.