fix(mcp): the scratch write roots are named, so the refusal test means the same on Linux

Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>
LemonCrow-Session: s1

Author: wongk

src/lemoncrow/gateway/adapters/mcp_server.py

@@ -6906,6 +6906,14 @@ def _collect_touched_paths(edits: list[dict[str, Any]], *, repo_root: str | Path
     return dict(sorted(paths.items()))
 
 
+# Scratch directories writes are allowed into besides the workspace and any
+# opted-in additional directory: staging a file before moving it in is ordinary
+# tool work, and refusing it would break callers that predate `root=`. One
+# literal covers macOS's /tmp -> /private/tmp symlink, because every root is
+# resolved before it is compared.
+_SCRATCH_EDIT_ROOTS: tuple[Path, ...] = (Path("/tmp"),)
+
+
 def _resolve_explicit_edit_root(raw_root: str, *, workspace_root: Path, extra_roots: list[Path]) -> Path | None:
     """Validate an explicit ``root=`` for edit resolution; None when out of bounds.
 
@@ -7853,9 +7861,10 @@ def tool_smart_edit(
     # Confine writes to the workspace root plus any additional directories from
     # Claude Code's additionalDirectories setting or LEMONCROW_ADDITIONAL_DIRS env.
     # Read tools accept any absolute path; writes need explicit opt-in.
-    # "/tmp" needs no twin "/private/tmp" entry: _allowed_edit_roots resolves
-    # every root before comparing, so one literal covers macOS's symlink.
-    _extra_roots = [*_claude_additional_dirs(repo_root), Path("/tmp")]
+    # _SCRATCH_EDIT_ROOTS carries the scratch allowance ("/tmp") and needs no
+    # twin "/private/tmp" entry: _allowed_edit_roots resolves every root before
+    # comparing, so one literal covers macOS's symlink.
+    _extra_roots = [*_claude_additional_dirs(repo_root), *_SCRATCH_EDIT_ROOTS]
     if _session_worktree is not None:
         _extra_roots.append(_session_worktree)
 

tests/gateway/test_edit_mcp_handler.py

@@ -1466,8 +1466,16 @@ def test_explicit_root_beats_the_inferred_worktree(workspace: Path, monkeypatch:
 def test_explicit_root_outside_the_workspace_is_refused(
     workspace: Path, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    """A root that is neither this workspace, a worktree of it, nor an allowed dir."""
+    """A root that is neither this workspace, a worktree of it, nor an allowed dir.
+
+    The scratch allowance is dropped for the duration: pytest's basetemp lives
+    under /tmp on Linux, which is a real allowed write root, so a directory
+    placed there is legitimately in bounds and the refusal under test would
+    never fire. Removing the allowance is what makes `outside` outside on every
+    platform -- the companion test below pins the allowance itself.
+    """
     wt = _repo_with_worktree(workspace)
+    monkeypatch.setattr(mcp_server, "_SCRATCH_EDIT_ROOTS", ())
     outside = tmp_path.parent / "outside-root"
     outside.mkdir(parents=True, exist_ok=True)
     (outside / "target.txt").write_text("OUTSIDE\n", encoding="utf-8")
@@ -1486,6 +1494,36 @@ def test_explicit_root_outside_the_workspace_is_refused(
     assert (outside / "target.txt").read_text(encoding="utf-8") == "OUTSIDE\n"
 
 
+def test_explicit_root_under_a_scratch_root_is_allowed(
+    workspace: Path, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A scratch root is a real write root, so naming one as `root` is in bounds.
+
+    Writes under the scratch allowance predate `root=` -- staging a file before
+    moving it in is ordinary tool work -- so validating the argument must not
+    quietly narrow what was already writable.
+    """
+    wt = _repo_with_worktree(workspace)
+    # Outside the workspace, or the workspace root would allow it on its own and
+    # the scratch allowance under test would carry nothing.
+    scratch = tmp_path.parent / "scratch-root"
+    scratch.mkdir(parents=True, exist_ok=True)
+    (scratch / "target.txt").write_text("SCRATCH\n", encoding="utf-8")
+    monkeypatch.setattr(mcp_server, "_SCRATCH_EDIT_ROOTS", (scratch,))
+    monkeypatch.setattr(mcp_server, "_last_session_cwd", str(wt))
+
+    payload = _edit(
+        {
+            "post_edit_hooks": False,
+            "root": str(scratch),
+            "edits": [{"file_path": "target.txt", "old_string": "SCRATCH", "new_string": "EDITED"}],
+        }
+    )
+
+    assert "failed" not in payload, payload
+    assert (scratch / "target.txt").read_text(encoding="utf-8") == "EDITED\n"
+
+
 def test_worktree_redirect_is_disclosed_to_the_model(workspace: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     """The redirect is inferred from the last bash cwd, so it is never silent.