@the-open-engine/zeroshot 6.39.0 → 6.39.2

package/src/agent-cli-provider/provider-registry.ts

@@ -128,6 +128,7 @@ interface ProviderRegistryEntryBase {
   readonly authInstructions: string;
   readonly credentialPaths: readonly string[];
   readonly credentialEnvKeys: readonly string[];
+  readonly configurationEnvKeys?: readonly string[];
   readonly settingsFields: readonly string[];
   readonly settingsDefaults?: Readonly<Record<string, unknown>>;
   readonly settingsValidator?: (
@@ -185,6 +186,12 @@ const STANDARD_CAPABILITIES: Readonly<
 
 const CLAUDE_DOCKER_ENV_PASSTHROUGH = [
   'ANTHROPIC_API_KEY',
+  'ANTHROPIC_AUTH_TOKEN',
+  'ANTHROPIC_BASE_URL',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+  'CLAUDE_CODE_SUBAGENT_MODEL',
   'AWS_BEARER_TOKEN_BEDROCK',
   'AWS_REGION',
   'CLAUDE_CODE_USE_BEDROCK',
@@ -198,7 +205,7 @@ const PI_EXPLICIT_DOCKER_CREDENTIALS = new Set([
   'GOOGLE_APPLICATION_CREDENTIALS',
 ]);
 
-const PI_DOCKER_CONFIGURATION_ENV = [
+const PI_AGENT_CONFIGURATION_ENV = [
   'AWS_BEDROCK_FORCE_CACHE',
   'AWS_BEDROCK_FORCE_HTTP1',
   'AWS_BEDROCK_SKIP_AUTH',
@@ -504,7 +511,7 @@ export const providerRegistry = [
       configRoots: ['$HOME/.pi/agent'],
       envPassthrough: [
         ...piAdapter.credentialEnvKeys.filter((name) => !PI_EXPLICIT_DOCKER_CREDENTIALS.has(name)),
-        ...PI_DOCKER_CONFIGURATION_ENV,
+        ...PI_AGENT_CONFIGURATION_ENV,
       ],
     },
     defaultLevels: {
@@ -527,6 +534,7 @@ export const providerRegistry = [
       'Manually edit providerSettings.omp in ZEROSHOT_SETTINGS_FILE or $HOME/.zeroshot/settings.json (file 0600, parent directory 0700). Use declared environment or broker variables, an explicit host-only OMP agent directory containing agent.db, or keyless mode; Zeroshot never logs in or stores credential values.',
     credentialPaths: ['~/.omp'],
     credentialEnvKeys: ompAdapter.credentialEnvKeys,
+    configurationEnvKeys: PI_AGENT_CONFIGURATION_ENV,
     settingsFields: [
       'transport',
       'minLevel',

package/src/agent-cli-provider/single-agent-runtime.ts

@@ -4,6 +4,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { getProviderAdapter } from './adapters';
+import { providerCredentialEnv } from './contract-env';
 import { UnsupportedProviderCapabilityError } from './errors';
 import { normalizeGatewayBuildOptions, resolveGatewayConfiguration } from './gateway-tools';
 import { isRecord } from './json';
@@ -21,6 +22,7 @@ import {
   parseExactOmpModelSelector,
   resolveOmpSdkSettings,
 } from './omp/sdk-settings';
+import { ompSdkEnvironmentPolicy } from './omp/sdk-environment-policy';
 import type { ConfiguredOmpSdkSettings } from './omp/sdk-settings';
 import {
   getDefaultProviderId,
@@ -124,6 +126,10 @@ const commandExistsFn = moduleFunction(providerDetectionModule, 'commandExists')
 const getHelpOutputFn = moduleFunction(providerDetectionModule, 'getHelpOutput');
 const getVersionOutputFn = moduleFunction(providerDetectionModule, 'getVersionOutput');
 const resolveOmpSdkRuntimeFn = moduleFunction(ompSdkRuntimeModule, 'resolveOmpSdkRuntime');
+const resolveOmpSdkContainerRuntimeFn = moduleFunction(
+  ompSdkRuntimeModule,
+  'resolveOmpSdkContainerRuntime'
+);
 
 export const resolveOmpTransport = (runtimeSettings?: Record<string, unknown>): 'sdk' | 'rpc' => {
   const settings = runtimeSettings ?? loadRuntimeSettings();
@@ -325,14 +331,7 @@ function prepareOmpProviderCommand(
   }
 
   const usesContainerRuntime = executionContext === 'docker' || executionContext === 'benchmark';
-  const runtime = usesContainerRuntime
-    ? {
-        bunExecutable: '/opt/zeroshot/node_modules/bun/bin/bun.exe',
-        bunVersion: OMP_SDK_BUN_VERSION,
-        ompVersion: OMP_SDK_BACKEND_VERSION,
-        sidecarPath: '/opt/zeroshot/scripts/omp/sidecar.ts',
-      }
-    : ompSdkRuntimeAssets();
+  const runtime = usesContainerRuntime ? ompSdkContainerRuntimeAssets() : ompSdkRuntimeAssets();
   let privateRoot: string | undefined;
   try {
     privateRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-omp-sdk-request-'));
@@ -356,10 +355,7 @@ function prepareOmpProviderCommand(
         webSearch: { requested: false, effective: false },
       },
       invoke,
-      environmentPolicy: {
-        inherit: 'minimal',
-        values: Object.freeze({}),
-      },
+      environmentPolicy: ompSdkEnvironmentPolicy(),
       credentialNames,
       privateArtifacts: {
         root: privateRoot,
@@ -483,7 +479,14 @@ function requiredStringValue(value: unknown, field: string): string {
 }
 
 function ompSdkRuntimeAssets(): OmpSdkRuntimeAssets {
-  const value = resolveOmpSdkRuntimeFn();
+  return validatedOmpSdkRuntime(resolveOmpSdkRuntimeFn());
+}
+
+function ompSdkContainerRuntimeAssets(): OmpSdkRuntimeAssets {
+  return validatedOmpSdkRuntime(resolveOmpSdkContainerRuntimeFn());
+}
+
+function validatedOmpSdkRuntime(value: unknown): OmpSdkRuntimeAssets {
   if (!isRecord(value))
     throw new Error('Pinned OMP SDK runtime resolver returned invalid evidence.');
   const runtime = {
@@ -640,7 +643,8 @@ function mergeAcpFailClosedCliFeatures(
 export function probeRuntimeProviderCli(
   provider: string,
   evidence?: RuntimeProbeEvidence,
-  runtimeSettings?: Record<string, unknown>
+  runtimeSettings?: Record<string, unknown>,
+  context: { readonly executionContext?: OmpSdkExecutionContext } = {}
 ): RuntimeProviderProbe {
   const adapter = getProviderAdapter(provider);
   if (adapter.id === 'gateway') {
@@ -651,7 +655,11 @@ export function probeRuntimeProviderCli(
   if (adapter.id === 'omp' && resolveOmpTransport(settings) === 'sdk') {
     const capabilities = adapter.detectCliFeatures('', '');
     try {
-      const runtime = ompSdkRuntimeAssets();
+      const executionContext = ompExecutionContext(context.executionContext);
+      const runtime =
+        executionContext === 'docker' || executionContext === 'benchmark'
+          ? ompSdkContainerRuntimeAssets()
+          : ompSdkRuntimeAssets();
       return {
         available: true,
         helpText: 'Pinned bundled OMP SDK sidecar',
@@ -881,6 +889,7 @@ function resolveRuntimeAuthEnv(
   provider: ProviderId,
   settings: Record<string, unknown>
 ): Readonly<Record<string, string>> {
+  if (provider === 'codex') return providerCredentialEnv(provider);
   if (provider !== 'claude') return {};
   const claudeAuthModule: unknown = require('../../lib/settings/claude-auth');
   const resolveClaudeAuth = moduleFunction(claudeAuthModule, 'resolveClaudeAuth');

package/src/agent-cli-provider/types.ts

@@ -131,6 +131,7 @@ export interface CodexCliFeatures extends BaseCliFeatures {
   readonly supportsIgnoreUserConfig: boolean;
   readonly supportsIgnoreRules: boolean;
   readonly supportsStrictConfig: boolean;
+  readonly supportsAddDir: boolean;
 }
 
 export interface GeminiCliFeatures extends BaseCliFeatures {
@@ -447,6 +448,8 @@ export interface BuildProviderCommandOptions {
   readonly outputFormat?: OutputFormat;
   readonly jsonSchema?: unknown;
   readonly cwd?: string;
+  /** Host paths Codex must be able to write in addition to cwd during normal unattended runs. */
+  readonly additionalWritableDirectories?: readonly string[];
   readonly agentName?: string;
   readonly autoApprove?: boolean;
   readonly resumeSessionId?: string;

package/src/agents/git-pusher-template.js

@@ -277,6 +277,7 @@ return hasSufficientEvidence;`;
 const { readRepoSettings } = require('../../lib/repo-settings');
 const { normalizeGitRemoteName, quoteShellArgument } = require('../../lib/git-remote-utils');
 const { resolveRequiredQualityGates } = require('../quality-gates');
+const { renderPullRequestBody, resolveIssueContext } = require('../pr-body-template');
 
 function getSafeBranchName(value) {
   if (typeof value !== 'string') {
@@ -314,35 +315,6 @@ function normalizeCloseIssueMode(value) {
   return null;
 }
 
-function normalizeIssueNumber(value) {
-  const candidate = typeof value === 'number' ? String(value) : value;
-  if (typeof candidate !== 'string') return 'unknown';
-  const trimmed = candidate.trim();
-  return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(trimmed) ? trimmed : 'unknown';
-}
-
-function normalizeIssueTitle(value) {
-  if (typeof value !== 'string' || value.trim() === '') return 'Implementation';
-  const normalized = [...value]
-    .map((character) => {
-      const codePoint = character.codePointAt(0);
-      return codePoint < 0x20 || codePoint === 0x7f ? ' ' : character;
-    })
-    .join('')
-    .trim();
-  return normalized || 'Implementation';
-}
-
-function resolveIssueContext(options) {
-  const issueNumber = normalizeIssueNumber(options.issueNumber);
-  const issueTitle = normalizeIssueTitle(options.issueTitle);
-  const issueReference =
-    options.includeIssueReference === false || issueNumber === 'unknown'
-      ? ''
-      : `Closes #${issueNumber}`;
-  return { issueNumber, issueTitle, issueReference };
-}
-
 /**
  * Resolve GitHub configuration from CLI options and repo settings.
  * Priority: CLI options > repo settings (.zeroshot/settings.json) > defaults
@@ -355,6 +327,7 @@ function resolveIssueContext(options) {
  * @param {string|number} [options.issueNumber] - Typed issue identifier for prompt commands
  * @param {string} [options.issueTitle] - Typed issue title for prompt commands
  * @param {boolean} [options.includeIssueReference] - Include the closing reference in PR text
+ * @param {string} [options.prBody] - Literal PR body template with supported issue tokens
  * @returns {Object} Resolved configuration
  */
 function resolveGitHubConfig(options = {}) {
@@ -385,16 +358,23 @@ function resolveGitHubConfig(options = {}) {
     options.autoMerge === true ||
     (options.autoMerge !== false && parseBool(repoGithub.autoMerge) === true);
 
+  const issueContext = resolveIssueContext(options);
+
   return {
     prBase,
     useMergeQueue,
     closeIssueMode,
     autoMerge,
     gitRemote,
-    issueContext: resolveIssueContext(options),
+    issueContext,
+    prBody: renderPullRequestBody(options.prBody, options),
   };
 }
 
+function resolvedPrBody(config, issueContext) {
+  return typeof config.prBody === 'string' ? config.prBody : issueContext.issueReference;
+}
+
 /**
  * Generate platform-specific configuration based on resolved GitHub config.
  *
@@ -406,13 +386,15 @@ function getPlatformConfig(platform, config = {}) {
   const { prBase, useMergeQueue, closeIssueMode, autoMerge, gitRemote } = config;
   const issueContext = config.issueContext || resolveIssueContext({});
   const issueTitleArgument = quoteShellArgument(`feat: ${issueContext.issueTitle}`);
-  const issueReferenceArgument = quoteShellArgument(issueContext.issueReference);
+  const prBodyArgument = quoteShellArgument(resolvedPrBody(config, issueContext));
 
   const PLATFORM_CONFIGS = {
     github: {
       prName: 'PR',
       prNameLower: 'pull request',
-      createCmd: `gh pr create${prBase ? ` --base ${prBase}` : ''} --title ${issueTitleArgument} --body ${issueReferenceArgument}`,
+      createCmd:
+        `gh pr create${prBase ? ` --base ${prBase}` : ''} ` +
+        `--title ${issueTitleArgument} --body ${prBodyArgument}`,
       mergeCmd: useMergeQueue
         ? `PR_ID="$(timeout 30 gh pr view --json id --jq .id)"
 gh api graphql -f query='mutation($id:ID!){enqueuePullRequest(input:{pullRequestId:$id}){mergeQueueEntry{state}}}' -f id="$PR_ID"
@@ -434,7 +416,7 @@ for i in $(seq 1 90); do if timeout 30 gh pr view --json mergedAt --jq .mergedAt
     gitlab: {
       prName: 'MR',
       prNameLower: 'merge request',
-      createCmd: `glab mr create --title ${issueTitleArgument} --description ${issueReferenceArgument}`,
+      createCmd: `glab mr create --title ${issueTitleArgument} --description ${prBodyArgument}`,
       mergeCmd: 'glab mr merge --auto-merge',
       mergeFallbackCmd: 'glab mr merge',
       prUrlExample: 'https://gitlab.com/owner/repo/-/merge_requests/123',
@@ -447,7 +429,7 @@ for i in $(seq 1 90); do if timeout 30 gh pr view --json mergedAt --jq .mergedAt
     'azure-devops': {
       prName: 'PR',
       prNameLower: 'pull request',
-      createCmd: `az repos pr create --title ${issueTitleArgument} --description ${issueReferenceArgument}`,
+      createCmd: `az repos pr create --title ${issueTitleArgument} --description ${prBodyArgument}`,
       mergeCmd: 'az repos pr update --id <PR_ID> --auto-complete true',
       mergeFallbackCmd: 'az repos pr update --id <PR_ID> --status completed',
       prUrlExample: 'https://dev.azure.com/org/project/_git/repo/pullrequest/123',
@@ -475,18 +457,27 @@ for i in $(seq 1 90); do if timeout 30 gh pr view --json mergedAt --jq .mergedAt
  */
 const SUPPORTED_PLATFORMS = ['github', 'gitlab', 'azure-devops'];
 
-/**
- * Generate the review-mode prompt (--pr without --ship): create the PR/MR and STOP.
- * No merge step, no issue-closing - the PR is left open for human review.
- * @param {Object} config - Platform configuration from PLATFORM_CONFIGS
- * @returns {string} The complete review-mode prompt
- */
-function generateReviewModePrompt(config) {
+function buildPushCommand(config, gitRemoteArgument) {
+  if (config.prName !== 'PR' || !config.createCmd.startsWith('gh pr create')) {
+    return `git push -u -- ${gitRemoteArgument} HEAD`;
+  }
+
+  const gitConfig = [
+    'url.https://github.com/.insteadOf=git@github.com:',
+    'url.https://github.com/.insteadOf=ssh://git@github.com/',
+    'credential.helper=',
+    'credential.helper=!gh auth git-credential',
+  ]
+    .map((value) => `-c ${quoteShellArgument(value)}`)
+    .join(' ');
+  return `git ${gitConfig} push -u -- ${gitRemoteArgument} HEAD`;
+}
+
+function generateDeliverySteps(config, createNote = '') {
   const {
     prName,
     prNameLower,
     createCmd,
-    prUrlExample,
     outputFields,
     requiresPrIdExtraction,
     gitRemote,
@@ -496,28 +487,13 @@ function generateReviewModePrompt(config) {
   const commitMessageArgument = quoteShellArgument(
     `feat: implement #${issueContext.issueNumber} - ${issueContext.issueTitle}`
   );
+  const pushCommand = buildPushCommand(config, gitRemoteArgument);
+  const createCommandName = createCmd.split(' ').slice(0, 3).join(' ');
+  const prUrlInstruction = requiresPrIdExtraction
+    ? ''
+    : ` Save the actual ${prName} URL from the output.`;
 
-  return `CRITICAL: ALL VALIDATORS APPROVED. YOU ARE A TRANSPORT-ONLY GIT PUSHER.
-
-Your job is to preserve validator ownership: stage, commit, push, and create the ${prName} for HUMAN REVIEW.
-
-Do NOT edit source files, tests, configs, generated artifacts, or lockfiles.
-Do NOT inspect CI logs to debug product code.
-Do NOT resolve merge conflicts or rebase conflicts.
-Do NOT run implementation/debugging workflows after validators hand off.
-Do NOT merge the ${prName} - it is left OPEN for human review.
-Do NOT close the linked issue - it stays open until a human merges the ${prName}.
-
-Allowed after validation:
-- git add/status/commit/push
-- ${createCmd.split(' ').slice(0, 3).join(' ')}
-- status-only commands such as ${prName === 'PR' ? 'gh pr view/gh pr checks' : 'the platform PR/MR status command'}
-
-If commit hooks, push, ${prName} creation, or conflict handling requires code changes, STOP and report the blocked state in JSON. The implementation and validator agents must fix code and rerun quality gates.
-
-## MANDATORY STEPS - EXECUTE EACH ONE IN ORDER - DO NOT SKIP ANY STEP
-
-### STEP 1: Stage ALL changes (MANDATORY)
+  return `### STEP 1: Stage ALL changes (MANDATORY)
 \`\`\`bash
 git add -A
 \`\`\`
@@ -537,7 +513,7 @@ Run this command. Do not skip it.
 
 ### STEP 4: Push to ${gitRemote} (MANDATORY)
 \`\`\`bash
-git push -u -- ${gitRemoteArgument} HEAD
+${pushCommand}
 \`\`\`
 Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output blocked JSON with the failure summary.
 
@@ -547,9 +523,42 @@ Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output b
 \`\`\`bash
 ${createCmd}
 \`\`\`
-🚨 YOU MUST RUN \`${createCmd.split(' ').slice(0, 3).join(' ')}\`! Outputting a link is NOT creating a ${prName}! 🚨
+🚨 YOU MUST RUN \`${createCommandName}\`! Outputting a link is NOT creating a ${prName}! 🚨
 The push output shows a "Create a ${prNameLower}" link - IGNORE IT.
-You MUST run the \`${createCmd.split(' ').slice(0, 3).join(' ')}\` command above.${requiresPrIdExtraction ? '' : ` Save the actual ${prName} URL from the output.`}
+You MUST run the \`${createCommandName}\` command above.${prUrlInstruction}${createNote}`;
+}
+
+/**
+ * Generate the review-mode prompt (--pr without --ship): create the PR/MR and STOP.
+ * No merge step, no issue-closing - the PR is left open for human review.
+ * @param {Object} config - Platform configuration from PLATFORM_CONFIGS
+ * @returns {string} The complete review-mode prompt
+ */
+function generateReviewModePrompt(config) {
+  const { prName, createCmd, prUrlExample, outputFields } = config;
+  const deliverySteps = generateDeliverySteps(config);
+
+  return `CRITICAL: ALL VALIDATORS APPROVED. YOU ARE A TRANSPORT-ONLY GIT PUSHER.
+
+Your job is to preserve validator ownership: stage, commit, push, and create the ${prName} for HUMAN REVIEW.
+
+Do NOT edit source files, tests, configs, generated artifacts, or lockfiles.
+Do NOT inspect CI logs to debug product code.
+Do NOT resolve merge conflicts or rebase conflicts.
+Do NOT run implementation/debugging workflows after validators hand off.
+Do NOT merge the ${prName} - it is left OPEN for human review.
+Do NOT close the linked issue - it stays open until a human merges the ${prName}.
+
+Allowed after validation:
+- git add/status/commit/push
+- ${createCmd.split(' ').slice(0, 3).join(' ')}
+- status-only commands such as ${prName === 'PR' ? 'gh pr view/gh pr checks' : 'the platform PR/MR status command'}
+
+If commit hooks, push, ${prName} creation, or conflict handling requires code changes, STOP and report the blocked state in JSON. The implementation and validator agents must fix code and rerun quality gates.
+
+## MANDATORY STEPS - EXECUTE EACH ONE IN ORDER - DO NOT SKIP ANY STEP
+
+${deliverySteps}
 
 ⚠️ AFTER THE ${prName} IS CREATED, YOU ARE DONE. DO NOT MERGE. DO NOT CLOSE THE ISSUE. ⚠️
 
@@ -596,7 +605,6 @@ If blocked before creating a ${prName}, output:
 function generatePrompt(config) {
   const {
     prName,
-    prNameLower,
     createCmd,
     mergeCmd,
     mergeFallbackCmd,
@@ -607,14 +615,9 @@ function generatePrompt(config) {
     usesMergeQueue,
     closeIssueMode,
     autoMerge,
-    gitRemote,
     issueContext,
   } = config;
-  const gitRemoteArgument = quoteShellArgument(gitRemote);
   const issueNumberArgument = quoteShellArgument(issueContext.issueNumber);
-  const commitMessageArgument = quoteShellArgument(
-    `feat: implement #${issueContext.issueNumber} - ${issueContext.issueTitle}`
-  );
 
   if (!autoMerge) {
     return generateReviewModePrompt(config);
@@ -626,6 +629,7 @@ function generatePrompt(config) {
 Look for output like: "Created PR 123" or parse the URL for the PR number.
 Save the PR ID to a variable for step 6.`
     : '';
+  const deliverySteps = generateDeliverySteps(config, azurePrIdNote);
 
   // Azure uses different merge terminology
   const mergeDescription = requiresPrIdExtraction
@@ -684,39 +688,7 @@ If commit hooks, push, ${prName} creation, merge, CI, or conflict handling requi
 
 ## MANDATORY STEPS - EXECUTE EACH ONE IN ORDER - DO NOT SKIP ANY STEP
 
-### STEP 1: Stage ALL changes (MANDATORY)
-\`\`\`bash
-git add -A
-\`\`\`
-Run this command. Do not skip it. If commit fails because hooks/checks fail, do not edit files. Output blocked JSON with the failure summary.
-
-### STEP 2: Check what's staged
-\`\`\`bash
-git status
-\`\`\`
-Run this. If nothing to commit, output JSON with ${outputFields.urlField}: null and stop.
-
-### STEP 3: Commit the changes (MANDATORY if there are changes)
-\`\`\`bash
-git commit -m ${commitMessageArgument}
-\`\`\`
-Run this command. Do not skip it.
-
-### STEP 4: Push to ${gitRemote} (MANDATORY)
-\`\`\`bash
-git push -u -- ${gitRemoteArgument} HEAD
-\`\`\`
-Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output blocked JSON with the failure summary.
-
-⚠️ AFTER PUSH YOU ARE NOT DONE! CONTINUE TO STEP 5! ⚠️
-
-### STEP 5: CREATE THE ${prName.toUpperCase()} (MANDATORY - YOU MUST RUN THIS COMMAND)
-\`\`\`bash
-${createCmd}
-\`\`\`
-🚨 YOU MUST RUN \`${createCmd.split(' ').slice(0, 3).join(' ')}\`! Outputting a link is NOT creating a ${prName}! 🚨
-The push output shows a "Create a ${prNameLower}" link - IGNORE IT.
-You MUST run the \`${createCmd.split(' ').slice(0, 3).join(' ')}\` command above.${requiresPrIdExtraction ? '' : ` Save the actual ${prName} URL from the output.`}${azurePrIdNote}
+${deliverySteps}
 
 ⚠️ AFTER ${prName} CREATION YOU ARE NOT DONE! CONTINUE TO STEP 6! ⚠️
 
@@ -803,6 +775,7 @@ If blocked before creating a ${prName}, output:
  * @param {string|number} [options.issueNumber] - Typed issue identifier for prompt commands
  * @param {string} [options.issueTitle] - Typed issue title for prompt commands
  * @param {boolean} [options.includeIssueReference] - Include the closing reference in PR text
+ * @param {string} [options.prBody] - Literal PR body template with supported issue tokens
  * @param {Array} [options.requiredQualityGates] - Required handoff quality gates
  * @param {boolean} [options.autoMerge] - Merge the PR (--ship). False stops after PR creation (--pr).
  * @returns {Object} Agent configuration object

package/src/attach/socket-paths.js

@@ -3,7 +3,7 @@ const crypto = require("crypto");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
-const SOCKET_ROOT = process.platform === 'win32' ? null : '/tmp';
+const SOCKET_ROOT = process.platform === 'win32' ? null : path.resolve(os.tmpdir());
 const SOCKET_DIR_MODE = 0o700;
 function shortHash(value) {
     return crypto.createHash('sha256').update(value).digest('hex').slice(0, 16);

package/src/attach/socket-paths.ts

@@ -3,7 +3,7 @@ import fs = require('fs');
 import os = require('os');
 import path = require('path');
 
-const SOCKET_ROOT = process.platform === 'win32' ? null : '/tmp';
+const SOCKET_ROOT = process.platform === 'win32' ? null : path.resolve(os.tmpdir());
 const SOCKET_DIR_MODE = 0o700;
 
 function shortHash(value: string): string {