Shell: no `mktemp`, so agents improvise scratch paths they do not own

[trieloff]

What is missing

mktemp does not exist in the shell. Neither a just-bash builtin nor a supplemental command:

$ command -v mktemp
$ mktemp -p /tmp/memory-curator
bash: mktemp: command not found

xxd, unlink, cmp, df and which all made it into packages/webapp/src/shell/supplemental-commands/; the one command whose whole job is «give me a path I am allowed to write» did not.

Why it is worth a supplemental command

Agents reach for mktemp reflexively, and its absence does not fail cleanly ⸺ it cascades. From the memory curator's 2026-08-18 14:02 pass, three consecutive turns:

S=$(mktemp)                       →  bash: mktemp: command not found
sed '…' $F > $S                   →  bash: : Is a directory     # $S empty, redirect hits the cwd
sed '…' $F > /workspace/.s.txt    →  EACCES: sudo: approval denied '/workspace/.s.txt'

Command substitution swallows the first failure, so the agent does not learn that mktemp is missing ⸺ it learns that «> into a variable is a directory», concludes its scratch strategy is wrong, and improvises a path it does not own. The third line is a cone-mediated sudo prompt, which is the subject of #2164: an agent with no temp path of its own escalates into somebody else's tree. That pass was time-boxed at ten minutes and spent three turns on this.

The same shape shows up whenever a scoop needs an intermediate file. /tmp is not a safe guess: verified with throwaway scoops today, a /tmp write is denied both with writablePaths: [] and with an unrelated single-file grant (EACCES: sudo: approval denied '/tmp/filegrant-probe.js'), while an explicit ["/tmp/memory-curator/"] grant works.

Requested behaviour

Small surface, GNU-compatible where it costs nothing:

form	result
mktemp	create a unique empty file, print its absolute path
mktemp -d	same for a directory
mktemp -p DIR / --tmpdir=DIR	place it under DIR
mktemp TEMPLATE (…XXXXXX)	honour the template, ≥3 trailing X
mktemp -u	print a name without creating it

The part that actually matters for this runtime is which directory is the default, and the answer cannot be a hardcoded /tmp:

• For the cone, /tmp is writable and fine.
• For a scoop, /tmp is out of grant unless someone granted it, so a mktemp that returns /tmp/tmp.abc123 hands back a path the caller cannot write. That is worse than the current error, because the failure moves one step later, into whatever wrote to the path.

Proposal: resolve the default as $TMPDIR when set, otherwise the caller's own temp root ⸺ /tmp for the cone, /scoops/<folder>/tmp for a scoop, which already exists in the scoop tree and falls inside the default writablePaths of /scoops/<folder>/. And set TMPDIR in the scoop's environment so the convention is discoverable: echo $TMPDIR prints empty today, in cone and scoop alike.

Two smaller asks:

• Exit non-zero on an unrecognized flag, per Shell commands silently ignore unknown flags and exit 0 (sweep beyond sprinkle) #2255. A mktemp that ignores --suffix and prints a path anyway would be a fresh source of silent breakage.
• Mention it in man/commands output so an agent can find it without guessing.

Implementation pointers

• packages/webapp/src/shell/supplemental-commands/mktemp-command.ts, modelled on unlink-command.ts / cmp-command.ts (both are small, FS-only, defineCommand from just-bash).
• Register in packages/webapp/src/shell/supplemental-commands/index.ts, next to createUnlinkCommand().
• Test at packages/webapp/tests/shell/supplemental-commands/mktemp-command.test.ts: unique names across calls, -d, template expansion, -p, default resolution for cone vs scoop, unknown flag exits non-zero.

Related

• Memory curator has no writable scratch directory, so each pass gambles on a sudo prompt (/workspace/.s.txt, python3 -) #2164 ⸺ memory curator has no writable scratch directory; the mktemp failure above is its first domino.
• Memory curator: default timeoutSeconds is too low, and a killed pass leaves the memory over budget #2263 ⸺ curator prompt changes, including the finding that allowedCommands can neither deny a base command nor supply a missing one. Listing mktemp there would have done nothing; the command has to exist first.
• Shell commands silently ignore unknown flags and exit 0 (sweep beyond sprinkle) #2255 ⸺ shell commands silently ignoring unknown flags.

[github-actions]

The config file says it's innocent, but we all know better.

[trieloff]

Check the dependency before adding the command

mktemp is a plain POSIX utility with no SLICC-specific semantics, so the first question is whether the shell library already owns it. It does not, but almost everything of its kind does.

SLICC pins "just-bash": "^3.4.1" in packages/webapp/package.json. Upstream builtins live in packages/just-bash/src/commands/<name>/, and the set on main today is:

awk, base64, basename, cat, chmod, column, comm, cp, curl, cut, date, diff, dirname, du, echo, env, expand, expr, file, find, fold, grep, gzip, head, join, jq, ln, ls, md5sum, mkdir, mv, nl, od, paste, printf, pwd, readlink, rev, rg, rm, rmdir, sed, seq, sleep, sort, split, sqlite3, stat, strings, tac, tail, tar, tee, test, time, timeout, touch, tr, tree, uniq, wc, which, whoami, xargs, yq

No mktemp. Note that stat, readlink, touch, nl, du, date and diff are all there ⸺ the missing one is precisely the utility whose job is «hand me a path I am allowed to write».

Consequence for this issue

The work splits along the line between generic and sandbox-specific:

• Generic behaviour belongs upstream in vercel-labs/just-bash: packages/just-bash/src/commands/mktemp/mktemp.ts, the flags listed in the issue body, $TMPDIR honoured with a /tmp fallback, tests in the conventions of its neighbours. That is where every sibling utility lives, and a SLICC-local copy would be a fork of a dependency's job.
• Sandbox awareness is genuinely SLICC's: setting TMPDIR per agent so the default resolves to a path the caller may write ⸺ /tmp for the cone, /scoops/<folder>/tmp for a scoop. With TMPDIR set, an upstream mktemp needs no SLICC-specific knowledge at all, which is the cleanest shape available.
• A supplemental mktemp-command.ts in packages/webapp/src/shell/supplemental-commands/ is then only an interim shim until the upstream bump, and should be marked for deletion when it lands. Worth reading builtin-shadow-map.ts in that directory first, since SLICC already shadows some builtins.

Also worth confirming against the installed tree rather than upstream main alone: the pin is a caret range, so node_modules/just-bash may resolve newer than what I inspected. If mktemp turns out to exist there and simply is not reachable from the SLICC shell, the fix is the wiring, not a new command.

The bb thread working this issue has been re-steered accordingly.

[trieloff]

We are waiting on a decision on vercel-labs/just-bash#377 before we try this ourselves