@alecsibilia/luca 14.0.0-alpha.24 → 14.0.0-alpha.25

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @alecsibilia/luca
 
+## 14.0.0-alpha.25
+
+No changes in this release.
+
 ## 14.0.0-alpha.24
 
 No changes in this release.

package/board/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@luca/board",
-    "version": "14.0.0-alpha.24",
+    "version": "14.0.0-alpha.25",
     "private": true,
     "type": "module"
 }

package/board/server/luca-version.ts

@@ -1,2 +1,2 @@
 /** The Luca version of this board, stamped when the package was packed. */
-export const LUCA_VERSION: string = "14.0.0-alpha.24"
+export const LUCA_VERSION: string = "14.0.0-alpha.25"

package/engine/agents/claude-options.ts

@@ -173,7 +173,7 @@ export const resultJsonSchema = ({
  * hooks.
  *
  * @example
- * const options = agentOptions({ role, may_edit_tests, cwd, model: CLAUDE_MODEL, effort: 'xhigh', claude_path, config, common_git_dir, home, env, guard_hook, luca_server: null, delivery_hook: null })
+ * const options = agentOptions({ role, may_edit_tests, cwd, model: CLAUDE_MODEL, effort: 'xhigh', claude_path, config, common_git_dir, home, user_temp_dir, env, guard_hook, luca_server: null, delivery_hook: null })
  */
 export const agentOptions = ({
     role,
@@ -185,6 +185,7 @@ export const agentOptions = ({
     config,
     common_git_dir,
     home,
+    user_temp_dir,
     env,
     guard_hook,
     luca_server,
@@ -203,6 +204,8 @@ export const agentOptions = ({
     config: EngineConfig
     common_git_dir: string
     home: string
+    /** macOS's per-user temp folder (`darwinUserTempDir`), or `null`. */
+    user_temp_dir: string | null
     env: Record<string, string>
     guard_hook: HookCallback
     /** The engine's `luca` server (`createLucaServer`), or `null` for none. */
@@ -253,6 +256,7 @@ export const agentOptions = ({
             worktree: cwd,
             common_git_dir,
             home,
+            user_temp_dir,
             config,
         }),
         env,

package/engine/agents/launch-paths.ts

@@ -1,8 +1,10 @@
 /**
  * Where the Claude launcher finds things on disk: the real path of the
- * `claude` binary, and the repo's common git dir (shared by its worktrees).
+ * `claude` binary, the repo's common git dir (shared by its worktrees), and
+ * macOS's per-user temp folder.
  */
 import { realpathSync } from 'node:fs'
+import { isAbsolute } from 'node:path'
 
 import { runCommand } from '../shell/run-command'
 
@@ -27,3 +29,41 @@ export const commonGitDir = async ({
     }
     return realpathSync(result.stdout.trim())
 }
+
+/** The command that prints macOS's per-user temp folder. */
+export const GETCONF_USER_TEMP_DIR = ['getconf', 'DARWIN_USER_TEMP_DIR']
+
+/**
+ * The real path of macOS's per-user temp folder (`getconf
+ * DARWIN_USER_TEMP_DIR`, such as `/private/var/folders/ab/cd1234/T`), or
+ * `null` off macOS, or when `getconf` fails or names no folder there.
+ *
+ * A sandboxed writer needs it: Foundation stages every atomic write there,
+ * not in `$TMPDIR`, so `swift test` and `xcodebuild` can't rebuild without
+ * it ("unable to write manifest ... Operation not permitted").
+ *
+ * @example
+ * const user_temp_dir = await darwinUserTempDir({ platform: process.platform, getconf: GETCONF_USER_TEMP_DIR })
+ */
+export const darwinUserTempDir = async ({
+    platform,
+    getconf,
+}: {
+    platform: NodeJS.Platform
+    /** The command to ask; the launcher passes `GETCONF_USER_TEMP_DIR`. */
+    getconf: string[]
+}): Promise<string | null> => {
+    if (platform !== 'darwin') return null
+    try {
+        const result = await runCommand({
+            cmd: getconf,
+            cwd: '/',
+            timeout_ms: 10_000,
+        })
+        const path = result.stdout.trim()
+        if (result.exit_code !== 0 || !isAbsolute(path)) return null
+        return realpathSync(path)
+    } catch {
+        return null
+    }
+}

package/engine/agents/launch-session.ts

@@ -25,7 +25,12 @@ import {
 } from './claude-messages'
 import { agentEnv, agentOptions, checkLaunchModel } from './claude-options'
 import { createInputChannel } from './input-channel'
-import { commonGitDir, realClaudePath } from './launch-paths'
+import {
+    commonGitDir,
+    darwinUserTempDir,
+    GETCONF_USER_TEMP_DIR,
+    realClaudePath,
+} from './launch-paths'
 import { createDeliveryHook, createLucaServer } from './message-tool'
 import {
     nextOutcome,
@@ -116,6 +121,10 @@ export const createLaunch = ({
             config,
             common_git_dir: gitDir,
             home: realpathSync(homedir()),
+            user_temp_dir: await darwinUserTempDir({
+                platform: process.platform,
+                getconf: GETCONF_USER_TEMP_DIR,
+            }),
             env: agentEnv({ source: process.env }),
             guard_hook: createGuardHook({
                 role: guardRoleOf({ role }),

package/engine/guards/sandbox-settings.ts

@@ -2,6 +2,7 @@ import { isAbsolute, join } from 'node:path'
 
 import type { SandboxSettings } from '@anthropic-ai/claude-agent-sdk'
 
+import { isWriter } from './guard-roles'
 import { LOCKFILES, type GuardRole } from './role-rules'
 
 import type { EngineConfig } from '../config/engine-config'
@@ -37,8 +38,13 @@ const mustBeAbsolute = (paths: Record<string, string>): void => {
  * learner, and a test-writer that may not edit tests may not write the
  * worktree at all.
  *
+ * Test-writers and implementers, who run the test commands, may also write
+ * macOS's per-user temp folder (`user_temp_dir`), where Foundation stages
+ * atomic writes: without it, `swift test` and `xcodebuild` can't rebuild.
+ * Nothing else is opened, and nothing at all without that folder.
+ *
  * @example
- * const sandbox = sandboxSettings({ role: 'implementer', may_edit_tests: false, worktree, common_git_dir, home, config })
+ * const sandbox = sandboxSettings({ role: 'implementer', may_edit_tests: false, worktree, common_git_dir, home, user_temp_dir, config })
  */
 export const sandboxSettings = ({
     role,
@@ -46,6 +52,7 @@ export const sandboxSettings = ({
     worktree,
     common_git_dir,
     home,
+    user_temp_dir,
     config,
 }: {
     role: GuardRole
@@ -56,9 +63,19 @@ export const sandboxSettings = ({
     /** The repo's shared `.git` folder (`git rev-parse --git-common-dir`). */
     common_git_dir: string
     home: string
+    /**
+     * macOS's per-user temp folder (`darwinUserTempDir`), real and
+     * absolute, or `null` off macOS or when it can't be found.
+     */
+    user_temp_dir: string | null
     config: EngineConfig
 }): SandboxSettings => {
-    mustBeAbsolute({ worktree, common_git_dir, home })
+    mustBeAbsolute({
+        worktree,
+        common_git_dir,
+        home,
+        ...(user_temp_dir === null ? {} : { user_temp_dir }),
+    })
     const git = [common_git_dir, join(worktree, '.git')]
     const inWorktree = (patterns: string[]) =>
         patterns.map((pattern) => join(worktree, pattern))
@@ -87,6 +104,9 @@ export const sandboxSettings = ({
             allowLocalBinding: false,
         },
         filesystem: {
+            ...(user_temp_dir !== null && isWriter(role)
+                ? { allowWrite: [user_temp_dir] }
+                : {}),
             denyWrite: [...git, ...byRole[role]],
             denyRead: SECRET_PATHS.map((path) => join(home, path)),
         },

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@alecsibilia/luca",
     "description": "Luca: turns a spec on GitHub Issues into a reviewed pull request, run from Paseo with Claude Code",
-    "version": "14.0.0-alpha.24",
+    "version": "14.0.0-alpha.25",
     "license": "Apache-2.0",
     "author": "Alec Sibilia <sibilia.alec@gmail.com>",
     "homepage": "https://github.com/asibilia/luca-framework#readme",