Conversation
macOS's /tmp is a symlink to /private/tmp, and it is what os.TempDir answers whenever TMPDIR is unset — an ssh session, a launchd job, a shell started outside the login environment. The runtime-directory fallback refused any symlink there, so hey tui failed with "temporary directory is not a directory" while every other command worked. Resolve the link and inspect the directory it names; the per-user directory under it is still created and validated as before.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟢 Approval recommended
The focused fix preserves private-directory validation and includes appropriate regression coverage.
Pull request overview
Fixes TUI startup on macOS when the temporary directory is symlinked.
Changes:
- Resolves the temporary root before validating it.
- Adds portable regression coverage for symlinked temporary directories.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
internal/tui/open_remote_unix.go |
Resolves and validates the real temporary directory. |
internal/tui/open_remote_unix_test.go |
Tests symlinked temporary-root fallback. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Fixes #394
Repro
hey tuiplaces its open-request socket under a per-user directory in the temp root whenXDG_RUNTIME_DIRis unset, andtuiRuntimeDirrefused a temp root that is a symlink. On macOS/tmpis a symlink to/private/tmp, and/tmpis exactly whatos.TempDir()answers wheneverTMPDIRis unset — an ssh session, a launchd job, a shell started outside the login environment, or a fresh machine where the terminal was not launched from a session that exports it. Every other command works because only the TUI touches the socket path;hey tuifails withError: temporary directory is not a directory.Reproduced on this Mac on
mainwithTMPDIRcleared:tuiSocketPath("")returns that error.TestTopicRemoteFallbackFollowsSymlinkedTemporaryDirectorypins the same shape portably (aTMPDIRthat is a symlink to a real directory) and fails onmain.Fix
Resolve the temp root with
filepath.EvalSymlinksand inspect the directory it names. The sticky-bit/world-writable check now runs against the real directory (/private/tmpis1777, so it passes), and the per-userhey-cli-<uid>directory is created and validated under the resolved path exactly as before — the symlink rejection on that directory is unchanged, since it is the one an attacker in a shared temp root could swap.Summary by cubic
Fixes
hey tuifailing on macOS when the temporary directory is a symlink (as/tmpis to/private/tmp). The runtime-dir fallback now resolves symlinks before validating the directory, so the socket path works whenTMPDIRis unset. The per-user directory is still created and validated as before, and a test covers this case.Written for commit 4e97da7. Summary will update on new commits.