From c382c17a92d9cbaf67a94b706fb4345fdc2fa2a5 Mon Sep 17 00:00:00 2001
From: callebtc <93376500+callebtc@users.noreply.github.com>
Date: Wed, 29 Jul 2026 13:54:50 +0200
Subject: [PATCH] mesh-lab: fail closed when evidence dir is empty

A bare `test -n` does not abort in a shell without set -e, so a failed
mktemp would let `--out ""` resolve to the repository root and write
private evidence there. Guard with an explicit exit instead.
---
 .agents/skills/mesh-lab/SKILL.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.agents/skills/mesh-lab/SKILL.md b/.agents/skills/mesh-lab/SKILL.md
index a8977a55..40e14de3 100644
--- a/.agents/skills/mesh-lab/SKILL.md
+++ b/.agents/skills/mesh-lab/SKILL.md
@@ -111,13 +111,17 @@ participant belongs to the controlled lab.
 
 Run either the selected scenario or the full suite. Run this entire block in one
 shell invocation so the temporary-directory variable cannot disappear between
-agent shell calls. Verify it is non-empty before passing it to `--out`; otherwise
-an empty path can put private evidence in the repository. Replace `dm` with
+agent shell calls. Abort the block if the directory is empty or missing before
+passing it to `--out`; otherwise an empty path can put private evidence in the
+repository. Replace `dm` with
 `all` only when full-suite data clearing has been authorized.
 
 ```sh
 MESH_EVIDENCE_DIR="$(mktemp -d /tmp/meshlab-evidence.XXXXXX)"
-test -n "$MESH_EVIDENCE_DIR"
+if [ -z "$MESH_EVIDENCE_DIR" ] || [ ! -d "$MESH_EVIDENCE_DIR" ]; then
+  echo "mktemp failed; aborting so evidence cannot land in the repository" >&2
+  exit 1
+fi
 chmod 700 "$MESH_EVIDENCE_DIR"
 
 python3 tools/release_gate/mesh_lab.py scenario dm \