fix(scratch): fall back to $TMPDIR when /tmp cannot host the scratch root

[tmchow]

Summary

Skills that keep cross-invocation state (ce-babysit-pr resume, peer jobs, ce-work runs, ce-handoff, ce-compound research artifacts) now work inside Claude Code's macOS sandbox. Before this, every one of them aborted at setup with Operation not permitted: the sandbox allowlists writes only under $TMPDIR (/tmp/claude-<uid>), and the durable root lived directly under /tmp. #1305 fixed the per-run mktemp forms and deferred this durable root; this closes that gap.

The root is now resolved the same way everywhere: prefer /tmp/compound-engineering-<uid>, and fall back to ${TMPDIR:-/tmp}/compound-engineering-<uid> only when the /tmp root cannot be created, is a symlink, is not owned by the user, or is not writable. Unsandboxed users keep the readable /tmp path and their existing state.

Fixes #1294

Design decisions

• Prefer /tmp, fall back to $TMPDIR rather than always deriving from $TMPDIR. Unsandboxed macOS $TMPDIR is /var/folders/.../T/, which is hostile to inspection, and switching would orphan existing state. A user's sandbox setting is normally stable across sessions, so discovery stays consistent. The accepted residual: someone alternating sandboxed and unsandboxed sessions resolves different roots, so state written in one mode is not found from the other.
• Probe writability, not just creation. A root created earlier by an unsandboxed session passes mkdir -p (a no-op) and even chmod 700 under the sandbox, then denies the first inner write. [ -w ] in shell and os.access(W_OK) in Python are denied by the sandbox for that root, so the fallback fires where a create-only probe would have reported success and died one line later.
• One order in shell and Python. All 17 shell preambles, the six byte-identical peer-job-runner.py copies, and unit_workspace_state.py use the same candidates in the same order, so a job started from a skill's preamble is found by the runner's status/wait/result. ce-handoff resume enumerates both candidate roots.

Validation

• Reproduced with a sandbox-exec (Seatbelt) profile that allowlists writes only under a TMPDIR subdirectory: the shipped ce-compound preamble and the runner's default both resolved to the same $TMPDIR/compound-engineering-501 root; the same commands still resolve /tmp/compound-engineering-501 unsandboxed.
• New execution tests run every shipped preamble with the /tmp candidate occupied by a file (all hosts) and with an existing 0500 root (POSIX, non-root), asserting the fallback path; Python fallback tests for jobs_root_base() and ensure_root(); ce-prototype run-root test covers the fallback and the both-blocked fail-closed case.
• bun run test: 3117 pass; release:validate and plugin:validate pass.

Security Disclosure

Path handling in the scratch-root preambles and Python defaults changed. The fallback root keeps the same symlink, ownership, and 0700 checks as the primary; no new write location outside the user's own temp roots. One behavioral change: a symlinked or foreign-owned /tmp/compound-engineering-<uid> now silently redirects to the fallback instead of aborting with unsafe scratch root (safe direction; the fallback is still checked). No secrets, permissions, or dependency changes.

Agent Disclosure

• Model: Claude Code · claude-fable-5

---

[cursor]

PR Summary

^{Cursor Bugbot is generating a summary for commit a2c9866. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a2c9866ceb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 01d021eb08

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3350de8a6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3350de8. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed6c0c8f5d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".