Skip to content

[self-audit] Session-sandbox restriction can block new directory creation, not just reads outside the allowed root #94

Description

@dmccoystephenson

Gap found during Phase 9 self-audit (create-dev-loop-dev-loop cycle, PR #93)

Filed here instead of dmccoystephenson/create-dev-loop-dev-loop per #87 — that tracker repo still doesn't exist, so this is the best available substitute audit trail until #87 is resolved.

What happened

PR #93 (fixing #90/#91/#92) needed to run the manual /create-dev-loop fixture-regeneration checklist per CLAUDE.md's "Testing changes" section, since the PR changes template surface. #90 (fixed in this same PR) already documents that a gardener-dispatched session's sandbox blocks reading outside the allowed working directory (ls ~/local-skills/ → blocked).

This cycle found a sharper version of the same constraint: even creating a new scratch directory inside the already-allowed working directory is blocked —

$ mkdir -p /root/.cache/gardener/repos/dmccoystephenson__create-dev-loop/.fixture-scratch
mkdir in '.../.fixture-scratch' was blocked. For security, Claude Code may only create directories
in the allowed working directories for this session: '.../dmccoystephenson__create-dev-loop'.

/tmp was also blocked the same way. Only the Write tool (creating individual files, not directories, inside the existing tree) succeeded. This rules out a workaround #90's fix doesn't explicitly close off: cloning a fixture repo into a subdirectory of the allowed checkout to run /create-dev-loop against it locally. mkdir/git clone for a new directory tree appear to be blocked outright in this harness configuration, not just reads/writes to paths outside the allowed root.

Suggested action

Sharpen #90's fix (already merged/pending in PR #93) with one more clause: note that the session-sandbox restriction can extend to blocking new directory creation even inside the allowed working directory (not just reads outside it), so "clone a fixture into a scratch subdirectory" is not a reliable workaround — the UNVERIFIED + do-not-auto-merge fallback is the only correct response, not an attempted local workaround. Candidate location: the same Phase 4 anchor-cannot-run paragraph and Edge cases entry #90/PR #93 touch.

Provenance

Found during the 2026-08-01 gardener-dispatched cycle that produced PR #93 in dmccoystephenson/create-dev-loop.

Metadata

Metadata

Assignees

No one assigned

    Labels

    template-ruleShould be promoted into create-dev-loop.md

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions