fix: write temp output under RUNNER_TEMP

package.json

@@ -5,7 +5,8 @@
   "private": true,
   "scripts": {
     "build": "esbuild src/main.ts --sourcemap=inline --format=cjs --bundle --platform=node --target=node20 --outdir=dist",
-    "check": "tsc --noEmit"
+    "check": "tsc --noEmit",
+    "test": "pnpm run build && node --test test/*.test.js"
   },
   "dependencies": {
     "@actions/core": "^1.11.1",

src/main.ts

@@ -6,6 +6,7 @@ import pkg from "../package.json" assert { type: "json" };
 
 import { readServerInfo } from "./readServerInfo";
 import {
+  getCodexExecTempRoot,
   SandboxMode,
   OutputSchemaSource,
   PromptSource,
@@ -361,7 +362,11 @@ function parseBoolean(value: string): boolean {
   throw new Error(`Invalid boolean value: ${value}`);
 }
 
-main();
+export { getCodexExecTempRoot };
+
+if (require.main === module) {
+  main();
+}
 
 async function resolveCodexHome(
   inputCodexHome: string | null,

src/runCodexExec.ts

@@ -307,7 +307,7 @@ async function createTempDir(
   runAsUser: string | null
 ): Promise<string> {
   if (runAsUser == null) {
-    return await mkdtemp(path.join(os.tmpdir(), prefix));
+    return await mkdtemp(path.join(getCodexExecTempRoot(), prefix));
   } else {
     return (
       await checkOutput([
@@ -323,6 +323,10 @@ async function createTempDir(
   }
 }
 
+export function getCodexExecTempRoot(): string {
+  return process.env.RUNNER_TEMP ?? os.tmpdir();
+}
+
 async function determineSandboxMode({
   safetyStrategy,
   requestedSandbox,

test/runCodexExec.test.js

@@ -0,0 +1,23 @@
+const { describe, it } = require("node:test");
+const assert = require("node:assert/strict");
+const os = require("node:os");
+const path = require("node:path");
+
+const { getCodexExecTempRoot } = require("../dist/main.js");
+
+describe("getCodexExecTempRoot", () => {
+  it("prefers RUNNER_TEMP over os.tmpdir()", () => {
+    const originalRunnerTemp = process.env.RUNNER_TEMP;
+    process.env.RUNNER_TEMP = path.join(os.tmpdir(), "runner-temp");
+
+    try {
+      assert.equal(getCodexExecTempRoot(), process.env.RUNNER_TEMP);
+    } finally {
+      if (originalRunnerTemp == null) {
+        delete process.env.RUNNER_TEMP;
+      } else {
+        process.env.RUNNER_TEMP = originalRunnerTemp;
+      }
+    }
+  });
+});