Agents cannot write scratch files in production: /tmp/opencode is owned by root #36

New issue

Closed

opened 2026-09-15 01:32:31 -04:00 by cmoriarty · 1 comment

cmoriarty commented

2026-09-15 01:32:31 -04:00

Owner

An agent in production tried to write /tmp/opencode/ws-test.mjs and got PermissionDenied: FileSystem.writeFile, from the Write tool and from bash.

opencode's own temp directory is os.tmpdir()/opencode, and its default permissions let agents write there without asking (verified in 1.18.21: external_directory allows Path.tmp/*). The image build created /tmp/opencode as root (drwxr-xr-x root root, present in :latest before any container starts), and runs execute as braid, so opencode's sanctioned scratch space is unwritable. /tmp/node-compile-cache is left root-owned the same way.

Opening all of /tmp is not the fix: every run in every slot shares the container's /tmp, so runs would collide and read each other's files, and nothing cleans it.

Proposed:

Each run's opencode server gets its own TMPDIR under the run directory, outside the worktree. opencode's scratch directory, mktemp, pytest and Node all follow it, and it goes away with the run.
The image build leaves nothing in /tmp.
Braid's rejection of an out-of-repo path names the run's scratch directory.

An agent in production tried to write `/tmp/opencode/ws-test.mjs` and got `PermissionDenied: FileSystem.writeFile`, from the Write tool and from bash. opencode's own temp directory is `os.tmpdir()/opencode`, and its default permissions let agents write there without asking (verified in 1.18.21: `external_directory` allows `Path.tmp/*`). The image build created `/tmp/opencode` as root (`drwxr-xr-x root root`, present in `:latest` before any container starts), and runs execute as `braid`, so opencode's sanctioned scratch space is unwritable. `/tmp/node-compile-cache` is left root-owned the same way. Opening all of `/tmp` is not the fix: every run in every slot shares the container's `/tmp`, so runs would collide and read each other's files, and nothing cleans it. **Proposed:** - Each run's opencode server gets its own `TMPDIR` under the run directory, outside the worktree. opencode's scratch directory, `mktemp`, pytest and Node all follow it, and it goes away with the run. - The image build leaves nothing in `/tmp`. - Braid's rejection of an out-of-repo path names the run's scratch directory.

cmoriarty referenced this issue from a commit

2026-09-15 02:08:31 -04:00

fix(runs): each run's agent gets its own temporary directory, and the image leaves /tmp empty (#36)

cmoriarty commented

2026-09-15 03:16:09 -04:00

Author

Owner

Fixed in a4f4ac7 (archived as runs-have-their-own-scratch-directory).

Per-run TMPDIR: each run's opencode serve gets TMPDIR=<run>/tmp, created before it starts and written last so a caller's TMPDIR cannot win. opencode's scratch directory, mktemp, tempfile, pytest and Node follow it, runs no longer share /tmp, and it is reclaimed with the run.
Clean image: the Dockerfile's last root step empties /tmp, and braid-selfcheck fails if the image leaves anything there.
Rejection message: Braid's rejection of an out-of-repo permission request names $TMPDIR and the run's path.
All of /tmp stays out of bounds.

On production after the deploy: the self-check passed, no root-owned entries in /tmp, and the run's server created runs/run_01M2HF4SNRBVJ6TA8ZX11T2Z4H/tmp/opencode owned by braid at startup.

Fixed in a4f4ac7 (archived as `runs-have-their-own-scratch-directory`). - **Per-run TMPDIR:** each run's `opencode serve` gets `TMPDIR=<run>/tmp`, created before it starts and written last so a caller's `TMPDIR` cannot win. opencode's scratch directory, `mktemp`, `tempfile`, pytest and Node follow it, runs no longer share `/tmp`, and it is reclaimed with the run. - **Clean image:** the Dockerfile's last root step empties `/tmp`, and `braid-selfcheck` fails if the image leaves anything there. - **Rejection message:** Braid's rejection of an out-of-repo permission request names `$TMPDIR` and the run's path. - All of `/tmp` stays out of bounds. On production after the deploy: the self-check passed, no root-owned entries in `/tmp`, and the run's server created `runs/run_01M2HF4SNRBVJ6TA8ZX11T2Z4H/tmp/opencode` owned by `braid` at startup.

cmoriarty closed this issue

2026-09-15 03:16:09 -04:00

cmoriarty referenced this issue

2026-09-27 18:09:40 -04:00

Two needs_opencode live tests are stale: the agent set predates the subagents, and the shape floors have drifted #97

cmoriarty referenced this issue from a commit

2026-09-27 18:18:56 -04:00

test(opencode): the live tests know the run's own subagents, MCP server and today's shape floors (#97)

cmoriarty referenced this issue

2026-10-01 23:12:37 -04:00

A step that hits its time limit fails with no reason: name the cause, show it in the console, and show the clock #116

cmoriarty referenced this issue