Skip to content

Fix logs MCP tool writing cache to inaccessible /tmp/gh-aw-logs-cache/#25777

Merged
pelikhan merged 2 commits intomainfrom
copilot/cli-tools-test-fix-inaccessible-log-path
Apr 11, 2026
Merged

Fix logs MCP tool writing cache to inaccessible /tmp/gh-aw-logs-cache/#25777
pelikhan merged 2 commits intomainfrom
copilot/cli-tools-test-fix-inaccessible-log-path

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 11, 2026

The logs MCP tool returns a file_path under /tmp/gh-aw-logs-cache/, which is outside the /tmp/gh-aw/ tree that agents can access. Agents following the tool's instruction to read the file get a not-found error.

  • pkg/cli/mcp_logs_guardrail.go: Move mcpLogsCacheDir from /tmp/gh-aw-logs-cache/tmp/gh-aw/logs-cache. Switch os.Mkdir to os.MkdirAll since the parent may not exist yet.
  • scratchpad/layout.md: Add /tmp/gh-aw/logs-cache to the file paths table.

Consistent with existing cache dirs (cache-memory, layout-cache, prompt-cache). Still separate from the artifact download dir (/tmp/gh-aw/aw-mcp/logs/).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 2012374/b205/_pkgit gLhb/hBEUOkjpLNrrev-parse 1/x64/bin/node git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw infocmp /usr/bin/git go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/git go env -json GO111MODULE modules/@npmcli/run-script/lib/node-gyp-bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name /tmp/go-build935-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name .js' --ignore-path .prettierignore GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD FFiles,SFiles,Sw-v go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --show-toplevel /usr/lib/git-core/git /usr/bin/git --pack_header=2,git -q /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/gh-aw-test-/bin/sh (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel x_amd64/link /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� GOMODCACHE W3/8XcR5E3yjbZpgTest User /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel sh /usr/bin/git ithub/workflows GOPROXY kflows/copilot-p--show-toplevel git rev-�� --show-toplevel node /usr/bin/git --check erena-mcp-serverrev-parse me: String!) { --show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha sistency_InlinedImports938147045/001/noflag-a.md rev-parse /usr/bin/git -json rk 64/bin/go git -C /tmp/gh-aw-test-runs/20260411-102109-31856/test-4191185916/.github/workflows rev-parse ache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha ErrorFormatting756316247/001 -buildtags /usr/bin/git l -ifaceassert -nilfunc git -C /tmp/TestGuardPolicyTrustedUsersExpressionCompiledOutput1108914372/001 config om/owner/repo.git remote.origin.urgit GO111MODULE k/gh-aw/gh-aw/ac--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha 25/001/test-frontmatter-with-env-template-expressions.md RR0X2oXnN ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xrepos/{owner}/{repo}/actions/runs/12346/artifacts env ortcfg GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a OhJqGnTLC 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a vohS5K4mu x_amd64/link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git runs/20260411-10git pkg/mod/github.crev-parse /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git runs/20260411-10git -trimpath /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha add origin /usr/bin/git ub/workflows .go x_amd64/compile git rev-�� --git-dir x_amd64/compile /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /github.com/owner/repo.git other /usr/bin/git repo1490566307/0git GO111MODULE 64/bin/go git conf�� user.name Test User /usr/bin/git echo "Running wagit GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git vaScript10017007git -ZkR/Y5KUpR6ZrQZrev-parse 2232044/b418=> git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/xrepos/{owner}/{repo}/actions/runs/5/artifacts /usr/bin/infocmp 7 -trimpath .lock.yml infocmp (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/link /usr/bin/git 25/001/test-frongit Hgqea9f-D ortcfg.link git rev-�� --show-toplevel ucaT9ZeFc2kAZlPn12345 /usr/bin/git ortcfg GO111MODULE g_.a git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel infocmp /usr/bin/git 6/001/noflag-a.mgit go k git rev-�� --show-toplevel gh /usr/bin/git /repos/actions/ugit --jq 1/x64/bin/node git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq .object.sha -goversion go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build2932012374/b206/importcfg -pack -F -L -S 64/bin/go 1 1 /var/log/sysstat/tmp/go-build2932012374/b223/_pkg_.a go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE s not exist yet"-test.v=true env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD ha8_stub.s go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --get remote.origin.url /usr/bin/git repo2664911748/0git 1.5.0/mcp/clientrev-parse x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /opt/hostedtoolcache/node/24.14.1/x64/bin/node m/workflows GO111MODULE 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha run --auto /usr/bin/git --detach GO111MODULE m-evolution-insi--show-toplevel git conf�� user.name Test User /usr/bin/git -json :latest x_amd64/vet git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha remove origin /usr/bin/git -json 1.5.0/oauthex/aurev-parse x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha github.event.inputs.branch go /opt/hostedtoolcache/node/24.14.1/x64/bin/node ithub/workflows GO111MODULE /opt/hostedtoolc--show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� No expressions here go /tmp/go-build1212749380/b452/workflow.test ithub/workflows GO111MODULE x_amd64/vet /tmp/go-build1212749380/b452/workflow.test (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha ithub/workflows/agentic-observability-kit.md -test.v=true 1/x64/bin/node -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel /usr/lib/git-core/git t-ha�� ithub/workflows/artifacts-summary.md l /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /tmp/go-build935git -trimpath 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha graphql -f /bin/sh -f owner=github -f /bin/sh -c git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmain_branch22-errorsas git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmain_branch22-ifaceassert /opt/hostedtoolcache/node/24.14.1/x64/bin/node */*.ts' '**/*.jsgit GO111MODULE 64/pkg/tool/linu--show-toplevel node (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v7
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha 2109-31856/test-2359014486/.gith@{u} rg/x/text@v0.35.0/internal/stringset/set.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD 2012374/b007/sym--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile ache�� 2012374/b251/_pkg_.a 7Ps3/Xuna8G_bMUX3GMM57Ps3 2012374/b251=> GOINSECURE GOMOD GOMODCACHE EX9YFJS/8Ul8ksxG-EkhvwV1KeYv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha 2012374/b184/_pkg_.a GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE 2012374/b011/rt0rev-parse ache/go/1.25.8/x--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile env 2232044/b408/_pkg_.a idHf/SNpM4ddnpkD5Lj-UidHf 1/x64/bin/node GOINSECURE b/gh-aw/pkg/envurev-parse GOMODCACHE /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuconfig (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha 2109-31856/test-3732387925 ZDcH/WlCyhVRj9mWQyquJZDcH 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link stat�� api-consumption-report.md b24G/6nfC8zN5c6kASggpb24G ortcfg.link GOSUMDB GOWORK 64/bin/go gG8mNLC_w4L8SzXdPK/3ZF0gOpIOEXsTrepos/{owner}/{repo}/actions/runs/1/artifacts (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha -json GO111MODULE de GOINSECURE GOMOD GOMODCACHE go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/docker/build-push-action/git/ref/tags/v7
    • Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v7 --jq .object.sha -json GO111MODULE $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE r: $owner, name:-f GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v7 --jq .object.sha 07a9d4d84ff7a3b GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/docker/metadata-action/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq .object.sha -json GO111MODULE r: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq .object.sha on' --ignore-patremote.origin.url GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq .object.sha on' --ignore-pat-f GO111MODULE x_amd64/cgo GOINSECURE GOMOD GOMODCACHE x_amd64/cgo env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility th .prettierignoremote.origin.url GO111MODULE r: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 1/x64/lib/node_modules/npm/node_-f GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha HEAD .github/workflows/test.md /usr/bin/git b/workflows nal.go x_amd64/compile git init�� bytealg/equal_wa-bool x_amd64/compile /usr/bin/git ub/workflows GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha run --auto /usr/bin/git --detach GO111MODULE urity-red-team.l--show-toplevel git rev-�� --show-toplevel go /usr/bin/git 72/001 GO111MODULE x_amd64/asm git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -bool -buildtags ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -errorsas -ifaceassert -nilfunc ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /tmp�� 2232044/b449/_pkg_.a -tests 2232044/b449=> /tmp/go-build935git -trimpath 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha runs/20260411-102853-48842/test-801280785/.github/workflows go ache/node/24.14.1/x64/bin/node l GO111MODULE 64/bin/sh git t-36�� k/gh-aw/gh-aw/.github/workflows/ai-moderator.md --initial-branch=master /usr/bin/git */*.ts' '**/*.jsgit GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -bool -buildtags ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -errorsas -ifaceassert -nilfunc ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile 150 origin my-default /usr/bin/git /tmp/go-build935git -trimpath 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --noprofile go /bin/sh -json GO111MODULE r: $owner, name:--show-toplevel /bin/sh -c git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealremote.origin.url l /usr/bin/git */*.ts' '**/*.jsgit GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 3732387925 B-Au8vNkW x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 til.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile env til.go til_test.go ger.test GOINSECURE GOMOD GOMODCACHE ger.test (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name rev-parse k -json GO111MODULE 64/bin/go git sRem�� architecture-guardian.md show kflows/smoke-agent-public-approved.lock.yml re GO111MODULE 64/bin/go gh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a z-hV-eFae ache/go/1.25.8/x64/bin/go GOINSECURE nal/poly1305 GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a hOYFQ3cxW 64/pkg/tool/linux_amd64/vet GOINSECURE bidirule GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name rev-parse /usr/bin/infocmp -json GO111MODULE 64/bin/go infocmp -1 k/gh-aw/gh-aw/.github/workflows go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a 6D-KwQuTc /opt/hostedtoolcache/go/1.25.8/x-test.short=true GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE ack abis 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name config /usr/bin/git l GO111MODULE 64/bin/go git -C k/gh-aw/gh-aw/.github/workflows rev-parse /usr/bin/git l GO111MODULE DiscussionsEnabl--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ylQP4Z8/vCNYLdc7D8RXanEmFBss env 3732387925 QyquJZDcH x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 /semver/semver.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 4119919296/.github/workflows J9_2Hh5RJ 64/pkg/tool/linux_amd64/vet GOINSECURE erutil GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name show /usr/bin/infocmp -json GO111MODULE 64/bin/go infocmp -1 artifacts-summary.md go 1/x64/bin/node l GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 3732387925 LZuHOSZyr /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 verutil.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 4119919296 QuPWq4ACQ 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name config er: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabl--show-toplevel remote.origin.urgit GO111MODULE 64/bin/go /usr/bin/gh api artifacts-summary.md -f /usr/bin/infocmp -f owner=github -f infocmp (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a kLZAPaMu6 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile 64/s�� e-analyzer.md 64jHUho52 64/pkg/tool/linux_amd64/compile GOINSECURE age/compact GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name -f /usr/bin/git -f owner=github -f git -C (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a JtV1iahb4 64/pkg/tool/linux_amd64/link GOINSECURE go-sdk/internal/rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 4/apic.go 64/pkg/tool/linu-importcfg GOINSECURE .o 64/src/internal//home/REDACTED/work/gh-aw/gh-aw/.github/workflows/ai-moderator.md 64/pkg/tool/linu/home/REDACTED/work/gh-aw/gh-aw/scripts/lint_error_messages_test.go env g_.a Y_7BzNNuM 64/pkg/tool/linux_amd64/compile GOINSECURE util GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name --jq 64/pkg/tool/linux_amd64/vet ath ../../../.prgit GO111MODULE 64/bin/go 64/pkg/tool/linux_amd64/vet -C k/gh-aw/gh-aw/.github/workflows show /usr/bin/gh l GO111MODULE 64/bin/go /usr/bin/gh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path /tmp/go-build935-p -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a bBouUBHdz ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm /usr/bin/git GC5KoXeF4 GO111MODULE ache/go/1.25.8/xgit-upload-pack 'origin' git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel git /usr/bin/gh edOutput11089143git show 64/pkg/tool/linu--show-toplevel gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts /usr/bin/git .artifacts[].nam/bin/sh --jq 64/pkg/tool/linugit-upload-pack 'origin' git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha edOutput812708759/001 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE 5519/field 64/src/runtime/m--show-toplevel 64/pkg/tool/linux_amd64/compile env 25/001/test-simple-frontmatter.md EmzJIsP8T ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE tants GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-buildtags (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha n/git/ref/tags/v4 sh er: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabl--show-toplevel tierignore git 64/bin/go git -C 1742910409/.github/workflows rev-parse /usr/bin/gh l --always 64/bin/go /usr/bin/gh (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha heck '**/*.cjs' -errorsas GO111MODULE r-merged-report.-nilfunc GOINSECURE GOMOD GOMODCACHE go 3669�� -json :latest repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha nly node /usr/bin/git /tmp/TestHashSta/usr/lib/git-core/git l /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json ase64.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha heck '**/*.cjs' '**/*.ts' '**/*.remote.origin.url GO111MODULE ache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node/tmp/TestGuardPolicyBlockedUsersApprovalLabelsCompiledOutput1938058254/001 GOINSECURE GOMOD GOMODCACHE go m/_n�� Gitmain_branch2223669372/001' Gitmain_branch2223669372/001' /opt/hostedtoolcache/go/1.25.8/x-f GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha --show-toplevel nly /usr/bin/git /tmp/gh-aw-test-git rev-parse om/myorg/myrepo.--bare git rev-�� --show-toplevel git /usr/bin/git --show-toplevel (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha edOutput812708759/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE empt_wasm.o 64/src/runtime/p--show-toplevel 64/pkg/tool/linux_amd64/vet env -json Q8gElMZ6A ache/go/1.25.8/x64/pkg/tool/linu-test.short=true GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha ithub/workflows sh (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link env ortcfg bt7zDc9ZF ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu--jq (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion -json GO111MODULE DiscussionsEnabl--show-toplevel /usr/bin/gh api OnlyCompiledOutput648001564/001 -f /usr/bin/docker -f owner=github -f docker (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion 0/x64"; export Pgit x_amd64/vet /usr/bin/git git rev-�� y_with_repos=public_2646049237/001 ..feature-branch /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD ha8_stub.s go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -nolocalimports -importcfg /tmp/go-build3352232044/b412/importcfg -pack /tmp/go-build3352232044/b412/_testmain.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env ithub/workflows GO111MODULE bin/sh GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3352232044/b397/cli.test /tmp/go-build3352232044/b397/cli.test -test.testlogfile=/tmp/go-build3352232044/b397/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build2932012374/b193/importcfg -pack -o /tmp/go-build935-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go (http block)
    • Triggering command: /tmp/go-build1212749380/b397/cli.test /tmp/go-build1212749380/b397/cli.test -test.testlogfile=/tmp/go-build1212749380/b397/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go 8d51�� -json GO111MODULE repository(owne-f GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /tmp/go-build3389928565/b001/cli.test /tmp/go-build3389928565/b001/cli.test -test.paniconexit0 -test.count=1 -test.timeout=1m0s rev-�� --show-toplevel bash /usr/bin/git --noprofile go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git PATH"; [ -n "$GOgit initial commit /usr/bin/git git (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name /tmp/go-build935-p -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE wasm.s (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name .js' --ignore-path .prettierigno-f GO111MODULE repository(owner: $owner, name:-f GOINSECURE GOMOD GOMODCACHE go env ithub/workflows GO111MODULE repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel git-receive-pack /usr/bin/git GOMODCACHE go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/gh-aw-test-iptables rev-parse /opt/hostedtoolc-t git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

…accessibility

The `logs` MCP tool was writing cache files to `/tmp/gh-aw-logs-cache/`
which is outside the standard `/tmp/gh-aw/` directory tree. Agents
running in sandboxed environments only have access to `/tmp/gh-aw/`,
making the returned `file_path` inaccessible.

- Move mcpLogsCacheDir from /tmp/gh-aw-logs-cache to /tmp/gh-aw/logs-cache
- Change os.Mkdir to os.MkdirAll for robustness (parent may not exist)
- Update layout documentation to include the new path

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2a146589-feea-42ac-baa4-3e334cb24f2e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix logs tool return of inaccessible file path Fix logs MCP tool writing cache to inaccessible /tmp/gh-aw-logs-cache/ Apr 11, 2026
Copilot AI requested a review from pelikhan April 11, 2026 10:38
@pelikhan pelikhan marked this pull request as ready for review April 11, 2026 10:39
Copilot AI review requested due to automatic review settings April 11, 2026 10:40
@pelikhan pelikhan merged commit 57195da into main Apr 11, 2026
53 of 54 checks passed
@pelikhan pelikhan deleted the copilot/cli-tools-test-fix-inaccessible-log-path branch April 11, 2026 10:40
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes an accessibility issue where the logs MCP tool cached its JSON output under /tmp/gh-aw-logs-cache/, which is outside the /tmp/gh-aw/ subtree that agents can access, causing agents to fail when attempting to read the returned file_path.

Changes:

  • Move the logs MCP cache directory under /tmp/gh-aw/logs-cache.
  • Create the cache directory with os.MkdirAll to ensure parent directories exist.
  • Document the new cache location in scratchpad/layout.md.
Show a summary per file
File Description
pkg/cli/mcp_logs_guardrail.go Relocates logs cache dir to an agent-accessible subtree and updates directory creation behavior.
scratchpad/layout.md Documents the new /tmp/gh-aw/logs-cache path in the repo’s file-path reference table.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 2/2 changed files
  • Comments generated: 1

Comment on lines 49 to 53
} else if os.IsNotExist(err) {
if mkErr := os.Mkdir(mcpLogsCacheDir, 0700); mkErr != nil && !os.IsExist(mkErr) {
if mkErr := os.MkdirAll(mcpLogsCacheDir, 0700); mkErr != nil && !os.IsExist(mkErr) {
mcpLogsGuardrailLog.Printf("Failed to create logs cache directory: %v", mkErr)
return buildLogsFileErrorResponse(fmt.Sprintf("failed to create logs cache directory: %v", mkErr))
}
Copy link

Copilot AI Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The symlink hardening for mcpLogsCacheDir can still be bypassed via a TOCTOU race: if the initial Lstat returns not-exist and an attacker creates a symlink at that path before MkdirAll, MkdirAll may succeed (it follows symlinks on subsequent Stat checks) and the code never re-Lstats to re-validate. Also, MkdirAll returns nil when the directory already exists, so the !os.IsExist(mkErr) guard is unnecessary and could mask races where the path becomes a non-directory (file/symlink) between checks. Consider: call MkdirAll and treat any non-nil error as fatal, then Lstat again and explicitly require !ModeSymlink and IsDir() (and return a clear error if it's not a directory).

See below for a potential fix:

	// Create the cache directory, then validate the final path with Lstat so we
	// do not trust any pre-creation check that could be raced via a symlink swap.
	if err := os.MkdirAll(mcpLogsCacheDir, 0700); err != nil {
		mcpLogsGuardrailLog.Printf("Failed to create logs cache directory: %v", err)
		return buildLogsFileErrorResponse(fmt.Sprintf("failed to create logs cache directory: %v", err))
	}

	info, err := os.Lstat(mcpLogsCacheDir)
	if err != nil {
		mcpLogsGuardrailLog.Printf("Failed to stat logs cache directory: %v", err)
		return buildLogsFileErrorResponse(fmt.Sprintf("failed to access logs cache directory: %v", err))
	}
	if info.Mode()&os.ModeSymlink != 0 {
		return buildLogsFileErrorResponse(fmt.Sprintf("logs cache path %q is a symlink; refusing to use it", mcpLogsCacheDir))
	}
	if !info.IsDir() {
		return buildLogsFileErrorResponse(fmt.Sprintf("logs cache path %q is not a directory; refusing to use it", mcpLogsCacheDir))
	}

Copilot uses AI. Check for mistakes.
@github-actions github-actions Bot mentioned this pull request Apr 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[cli-tools-test] logs tool returns file_path to inaccessible directory /tmp/gh-aw-logs-cache/

3 participants