Observed with cli-dispatch 4.27.0 in a managed workspace-write sandbox on macOS.\n\n1. cli-dispatch-run failed before worker launch because it tried to create the session under the default user cache, which was outside writable roots. Setting XDG_CACHE_HOME to an allowed /tmp directory made the run work. The runner could detect this permission failure and fall back to a writable temp cache, or document/print the required override.\n\n2. After that runner completed with a failed verify gate, ds-agent --resume using the session ID printed by claude-ds-stream failed with: No conversation found with session ID. The wrapper found and rewrote the same session metadata, but the underlying Claude CLI did not recognize that wrapper session UUID as a conversation ID. This blocks the documented failed-gate escalation path.\n\nExpected: the printed cli-dispatch session ID should be sufficient for the documented resume flow, or cli-dispatch should persist/translate the underlying conversation ID.\n\nNo repository-specific source, secrets, or absolute workspace paths are included here.
Observed with cli-dispatch 4.27.0 in a managed workspace-write sandbox on macOS.\n\n1. cli-dispatch-run failed before worker launch because it tried to create the session under the default user cache, which was outside writable roots. Setting XDG_CACHE_HOME to an allowed /tmp directory made the run work. The runner could detect this permission failure and fall back to a writable temp cache, or document/print the required override.\n\n2. After that runner completed with a failed verify gate, ds-agent --resume using the session ID printed by claude-ds-stream failed with: No conversation found with session ID. The wrapper found and rewrote the same session metadata, but the underlying Claude CLI did not recognize that wrapper session UUID as a conversation ID. This blocks the documented failed-gate escalation path.\n\nExpected: the printed cli-dispatch session ID should be sufficient for the documented resume flow, or cli-dispatch should persist/translate the underlying conversation ID.\n\nNo repository-specific source, secrets, or absolute workspace paths are included here.