team-tier -C /tmp isolation (reverted by #332)

[liususan091219]

PR #331 added -C /tmp, reverted by #332. Buggy: 507a02a, Fixed: 5400fc1. POC: 5/5

[liususan091219]

Test Script: scripts/test-pr331-team-tier-ctmp.sh

#!/bin/bash
# POC test for PR #331: team-tier codex invocation with -C /tmp
# NOTE: PR #331 was REVERTED by PR #332.
# Phase 0: confirm -C /tmp was NOT in team-tier block before PR #331
# Phase 1: show what PR #331 added (the problematic change)
# Phase 2: confirm PR #332 reverted it (team-tier back to plain invocation)

set -eu

PASS=0
FAIL=0

PRE_COMMIT="507a02a"    # last commit before PR #331
PR331_COMMIT="5400fc1"  # PR #331 merge (the change, later reverted)
PR332_COMMIT="b060cb7"  # PR #332 merge (revert of #331)

# Extract team-tier block from a commit's discord-bridge.py
team_block() {
  git show "${1}:src/discord-bridge.py" 2>/dev/null \
    | awk '/"team":/{found=1} found && /"other":/{exit} found{print}'
}

echo "=== PR #331 (reverted by #332): team-tier -C /tmp isolation test ==="
echo "Pre-#331   : $PRE_COMMIT"
echo "PR #331    : $PR331_COMMIT  <-- the problematic change"
echo "PR #332    : $PR332_COMMIT  <-- revert"
echo

echo "[Phase 0] Before PR #331: team-tier command had no -C /tmp flag"
echo "---"
if team_block "$PRE_COMMIT" | grep -q "\-C /tmp"; then
  echo "FAIL: -C /tmp already in team-tier block at ${PRE_COMMIT} — baseline wrong"
  ((FAIL++))
else
  echo "PASS: -C /tmp absent from team-tier block at ${PRE_COMMIT} (baseline confirmed)"
  ((PASS++))
fi
echo

echo "[Phase 1] PR #331 added -C /tmp to team-tier invocation (the change)"
echo "---"
if team_block "$PR331_COMMIT" | grep -q "\-C /tmp"; then
  echo "PASS: -C /tmp present in team-tier block at ${PR331_COMMIT} (PR #331 change confirmed)"
  ((PASS++))
else
  echo "FAIL: -C /tmp not found in team-tier block at ${PR331_COMMIT} — unexpected"
  ((FAIL++))
fi
echo

echo "[Phase 1b] PR #332 notes that -C /tmp doesn't block absolute-path reads"
echo "---"
PR332_BODY=$(gh pr view 332 --json body --jq '.body' 2>/dev/null || true)
if echo "$PR332_BODY" | grep -qi "absolute path"; then
  echo "PASS: PR #332 body explains absolute-path bypass (confirms why #331 was reverted)"
  ((PASS++))
else
  echo "FAIL: PR #332 body does not mention absolute path bypass"
  ((FAIL++))
fi
echo

echo "[Phase 2] After PR #332 (current state): -C /tmp removed from team-tier"
echo "---"
if team_block "$PR332_COMMIT" | grep -q "\-C /tmp"; then
  echo "FAIL: -C /tmp still present in team-tier block at ${PR332_COMMIT}"
  ((FAIL++))
else
  echo "PASS: -C /tmp absent from team-tier block at ${PR332_COMMIT} (revert confirmed)"
  ((PASS++))
fi

if grep -A5 '"team":' src/discord-bridge.py 2>/dev/null \
    | grep "codex exec" | grep -q "read-only --"; then
  echo "PASS: team-tier uses plain 'codex exec --sandbox read-only --' in working tree"
  ((PASS++))
else
  echo "FAIL: expected team-tier command not found in working-tree discord-bridge.py"
  ((FAIL++))
fi
echo

echo "=== Results: PASS=$PASS FAIL=$FAIL ==="
[ "$FAIL" -eq 0 ] && exit 0 || exit 1

Buggy: git checkout 507a02a | Fixed: git checkout 5400fc1

[sonichi]

Already fixed — see linked PR in the issue description.