GemSkillLinker: links minted under a sandboxed session point into ephemeral sandbox cache paths

[JPDuchesne]

Found during the plans#17 read-path live check.

Symptom

ai-flow/.agents/skills/gem-rspock--rspock pointed at
/private/var/folders/.../T/cursor-sandbox-cache/<hash>/bundle/ruby/3.3.0/gems/rspock-3.0.0/skills/rspock
— a Cursor sandbox cache path. The link survives on disk after the session; the target is purgeable temp state, so the skill silently dangles later. (dev's checkout had no .agents/skills at all — the linker had only ever run there from environments that didn't produce links.)

Mechanism

GemSkillLinker#bundled_gem_paths runs shadowenv exec -- bundle list --paths and links whatever paths bundler reports. Under a sandboxed agent session, bundler's env (BUNDLE_PATH / GEM_HOME pointed into the sandbox cache) resolves gems to ephemeral locations, and the linker writes machine-persistent symlinks to them. Same failure family as the runner-shell env leak fixed at ai-flow's agent spawn (ai-flow#38/#39/#40): a harness's toolchain env leaking into a child process that should see the project's own environment.

Fix directions

• Scrub the harness env for the bundle list --paths call (Bundler.original_env + unset of sandbox/bundler overrides), so paths resolve from the project's canonical bundler config — the same posture as ai-flow's worktree_env.
• Belt-and-suspenders: refuse to link any resolved path under Dir.tmpdir (warn and skip) — a persistent link to ephemeral state is never right, whatever produced it.

Repair done meanwhile

Re-ran dev install-deps in ai-flow and dev from a normal shell: both now link to durable ~/.gem/ruby/<version>/gems/rspock-3.0.0/skills/rspock targets.

[JPDuchesne]

/build

✅ /build — opened #90

🧠 drafted 1 learning in a learning proposal PR: #91

• harness-env-scrub

---

⚙️ workflow run · model: claude-fable-5-high

[JPDuchesne]

Review feedback on the drafted harness-env-scrub learning (#91): the lesson is partially superseded by fixes that landed after it was drafted, and should be revised before admission.

The draft prescribes per-call-site scrubbing ("unset those overrides explicitly in the child env" at each spawn, HARNESS_ENV_SCRUB.merge(...) as the Right example). That discipline is exactly what kept failing across this family — ai-flow#38 fixed the agent spawn only, then ai-flow#44 hit a later-added shell-out that missed the scrub. The durable doctrine that replaced it is boundary defenses, not per-spawn vigilance:

1. A tool that owns its toolchain scrubs at its own entrypoint — bin/dev now unsets foreign bundler activation before its Ruby half boots (bin/dev: self-defending entrypoint — scrub foreign bundler activation before Ruby boots #94/bin/dev: scrub foreign bundler activation before Ruby boots #95), protecting every caller at once.
2. An orchestrator applies the scrub at its one spawn seam, never per call site — ai-flow's Executor now bakes it into every spawn (Executor: bake the harness scrub into every spawn — env hygiene is the seam's job, not each caller's ai-flow#46/Adopt ai-flow per-command model config and refresh the caller header #47).
3. The other half of the draft stands unchanged: machine-persistent artifacts never point under Dir.tmpdir, whatever produced the path (GemSkillLinker: links minted under a sandboxed session point into ephemeral sandbox cache paths #90).

Also worth judging: this lesson now spans dev, ai-flow, and any future harness — it may be org-tier rather than repo-local.

[JPDuchesne]

/learn

✅ /learn — refined 1 learning in a proposal PR: #91

• harness-env-scrub
  ℹ️ harness-env-scrub was judged org-tier, but no knowledge_repo: is configured in .github/ai-flow.yml — kept repo-local.

---

⚙️ workflow run · model: claude-fable-5-high

[JPDuchesne]

/learn

✅ /learn — refined 1 learning in a proposal PR: #91

• harness-env-scrub
  🌐 harness-env-scrub → org-tier proposal on d3mlabs/knowledge: https://github.com/d3mlabs/knowledge/pull/38

---

⚙️ workflow run · model: cursor default

[JPDuchesne]

/learn --promote rbenv-libruby-rpath-hijack

✅ /learn --promote — rbenv-libruby-rpath-hijack → d3mlabs/knowledge: opened an org draft https://github.com/d3mlabs/knowledge/pull/39
🧹 paired removal draft in d3mlabs/dev: #97 — merge after the org PR lands and the knowledge sync ships it.

---

⚙️ workflow run · model: claude-fable-5-high