@the-open-engine/zeroshot 6.39.1 → 6.40.0

package/src/agent-cli-provider/adapters/codex.ts

@@ -73,6 +73,7 @@ function detectCliFeatures(
     supportsIgnoreUserConfig: !unknown && /--ignore-user-config\b/.test(help),
     supportsIgnoreRules: !unknown && /--ignore-rules\b/.test(help),
     supportsStrictConfig: !unknown && /--strict-config\b/.test(help),
+    supportsAddDir: !unknown && /--add-dir\b/.test(help),
     unknown,
   };
 }
@@ -119,6 +120,14 @@ function addAutoApproveArgs(args: string[], options: BuildProviderCommandOptions
         ? 'danger-full-access'
         : 'workspace-write';
     args.push('--sandbox', sandboxMode, '--config', 'approval_policy="never"');
+    if (sandboxMode === 'workspace-write') {
+      args.push('--config', 'sandbox_workspace_write.network_access=true');
+    }
+    if (features.supportsAddDir) {
+      for (const directory of new Set(options.additionalWritableDirectories ?? [])) {
+        args.push('--add-dir', directory);
+      }
+    }
   }
 }
 
@@ -129,6 +138,18 @@ function addSkipGitArgs(args: string[], options: BuildProviderCommandOptions): v
   }
 }
 
+function codexExecAuthEnv(
+  authEnv: Readonly<Record<string, string>>
+): Readonly<Record<string, string>> {
+  const openAiApiKey = authEnv.OPENAI_API_KEY;
+  if (openAiApiKey === undefined) return authEnv;
+  const { OPENAI_API_KEY: _openAiApiKey, ...rest } = authEnv;
+  return {
+    ...rest,
+    CODEX_API_KEY: rest.CODEX_API_KEY ?? openAiApiKey,
+  };
+}
+
 function applySchemaArgs(
   args: string[],
   cleanup: string[],
@@ -175,6 +196,19 @@ function collectWarnings(options: BuildProviderCommandOptions): WarningMetadata[
       )
     );
   }
+  if (
+    options.autoApprove &&
+    (options.additionalWritableDirectories?.length ?? 0) > 0 &&
+    features.supportsAddDir === false
+  ) {
+    warnings.push(
+      warning(
+        'codex',
+        'codex-add-dir',
+        'Codex CLI does not support --add-dir; Git worktree metadata outside cwd may be read-only.'
+      )
+    );
+  }
   if (options.jsonSchema && features.supportsOutputSchema === false) {
     warnings.push(
       warning(
@@ -216,6 +250,7 @@ function buildCommand(context: string, options: BuildProviderCommandOptions = {}
   }
   const args: string[] = ['exec'];
   const cleanup: string[] = [];
+  const authEnv = options.authEnv ?? {};
   const resumeSessionId =
     options.resumeSessionId && optionFeatures(options).supportsResume !== false
       ? options.resumeSessionId
@@ -244,7 +279,7 @@ function buildCommand(context: string, options: BuildProviderCommandOptions = {}
   return commandSpec({
     binary: 'codex',
     args,
-    env: {},
+    env: codexExecAuthEnv(authEnv),
     ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
     cleanup,
     cleanupMetadata: cleanup.map((schemaFile) => ({

package/src/agent-cli-provider/adapters/omp.ts

@@ -73,7 +73,8 @@ const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {
 const CREDENTIAL_ENV_KEYS = OMP_CREDENTIAL_ENV_KEYS;
 
 const VERSION_TOKEN_PATTERN = /(?<![\w.])17\.2\.1(?![\w.])/;
-const MODEL_ID_PATTERN = /^@?[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
+const MODEL_ID_PATTERN =
+  /^(?=.{1,128}$)(?:@?[A-Za-z0-9][A-Za-z0-9._:/-]*|[a-z0-9][a-z0-9._-]*\/~[A-Za-z0-9][A-Za-z0-9._:/-]*)$/u;
 
 function detectCliFeatures(helpText?: string | null, versionText?: string | null): OmpCliFeatures {
   const help = helpText ?? '';

package/src/agent-cli-provider/log-prefix.ts

@@ -1,13 +1,18 @@
+interface TaskLogDecoder {
+  decodeTaskLogLine(line: string): { readonly content: string; readonly providerOutput: boolean };
+}
+
+// The canonical decoder is maintained JavaScript and remains at the same source path after build.
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+const taskLogDecoder: TaskLogDecoder = require('../../src/task-log-line');
+const { decodeTaskLogLine } = taskLogDecoder;
+
 export function stripTimestampPrefix(line: string): string {
-  let trimmed = line.trim().replace(/\r$/, '');
+  const decoded = decodeTaskLogLine(line.trim());
+  if (!decoded.providerOutput) return '';
+  let trimmed = decoded.content;
   if (!trimmed) return '';
 
-  const timestampMatch = /^\[(\d{13})\](.*)$/.exec(trimmed);
-  const timestampRemainder = timestampMatch?.[2];
-  if (typeof timestampRemainder === 'string') {
-    trimmed = timestampRemainder.trimStart();
-  }
-
   if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) {
     const pipeMatch = /^[^|]{1,40}\|\s*(.*)$/.exec(trimmed);
     const afterPipe = pipeMatch?.[1]?.trimStart();

package/src/agent-cli-provider/omp/sdk-environment-policy.ts

@@ -0,0 +1,38 @@
+import { getProviderRegistryEntry } from '../provider-registry';
+import type { PreparedEnvironmentPolicy } from '../types';
+
+const MINIMAL_ENV_NAMES = [
+  'ALL_PROXY',
+  'HTTP_PROXY',
+  'HTTPS_PROXY',
+  'LANG',
+  'LC_ALL',
+  'NO_PROXY',
+  'PATH',
+  'SSL_CERT_DIR',
+  'SSL_CERT_FILE',
+  'TZ',
+] as const;
+
+const ALLOWED_ENV_NAMES = new Set([
+  ...MINIMAL_ENV_NAMES,
+  ...(getProviderRegistryEntry('omp').configurationEnvKeys ?? []),
+]);
+
+export function isOmpSdkEnvironmentName(name: string): boolean {
+  return ALLOWED_ENV_NAMES.has(name.toUpperCase());
+}
+
+export function ompSdkEnvironmentPolicy(
+  environment: NodeJS.ProcessEnv = process.env
+): PreparedEnvironmentPolicy {
+  const values: Record<string, string> = {};
+  for (const name of ALLOWED_ENV_NAMES) {
+    const value = environment[name];
+    if (value !== undefined) values[name] = value;
+  }
+  return {
+    inherit: 'minimal',
+    values: Object.freeze(values),
+  };
+}

package/src/agent-cli-provider/omp/sdk-process-private-runtime.ts

@@ -19,6 +19,7 @@ import type {
   PreparedProviderInvoke,
 } from '../types';
 import type { ProcessResult, ProcessRunnerOptions } from '../process-runner';
+import { isOmpSdkEnvironmentName } from './sdk-environment-policy';
 import { OmpSdkProcessRunnerError } from './sdk-process-error';
 
 export { credentialPayload, redactDiagnostic } from './sdk-process-credentials';
@@ -33,19 +34,6 @@ const PRIVATE_ENV_NAMES = new Set([
   'XDG_STATE_HOME',
   'PI_CODING_AGENT_DIR',
 ]);
-const MINIMAL_ENV_NAMES = new Set([
-  'ALL_PROXY',
-  'HTTP_PROXY',
-  'HTTPS_PROXY',
-  'LANG',
-  'LC_ALL',
-  'NO_PROXY',
-  'PATH',
-  'SSL_CERT_DIR',
-  'SSL_CERT_FILE',
-  'TZ',
-]);
-
 export interface OmpSdkPreparedInvocation extends PreparedSingleAgentProviderCommand {
   readonly invoke: PreparedProviderInvoke & {
     readonly lane: 'spawn';
@@ -119,13 +107,13 @@ export function assertPrepared(
 }
 export function assertHostContainment(requirement: OmpSdkContainmentRequirement): void {
   if (
-    requirement.mode !== 'host-process-tree' ||
+    (requirement.mode !== 'host-process-tree' && requirement.mode !== 'container') ||
     process.platform !== 'linux' ||
     (process.arch !== 'x64' && process.arch !== 'arm64')
   ) {
     throw new OmpSdkProcessRunnerError(
       'containment-error',
-      'OMP SDK host spawn requires the packaged Linux subreaper/pidfd supervisor; container invocations require the container spawn owner.'
+      'OMP SDK spawn requires the packaged Linux subreaper/pidfd supervisor.'
     );
   }
 }
@@ -228,7 +216,7 @@ export function childEnvironment(
   for (const [name, value] of Object.entries(policy.values)) {
     const normalized = name.toUpperCase();
     if (
-      !MINIMAL_ENV_NAMES.has(normalized) ||
+      !isOmpSdkEnvironmentName(normalized) ||
       PRIVATE_ENV_NAMES.has(normalized) ||
       /(?:^|_)(?:AUTH|CREDENTIAL|KEY|PASSWORD|SECRET|TOKEN)(?:_|$)/i.test(name)
     ) {

package/src/agent-cli-provider/omp/sdk-process-result.ts

@@ -4,7 +4,7 @@ import type {
   OmpSdkProtocolCollector,
   OmpSdkSidecarRequest,
 } from './sdk-protocol';
-import type { OmpSdkCleanupAttestation } from '../types';
+import type { OmpSdkCleanupAttestation, OmpSdkContainmentRequirement } from '../types';
 import { cancelledTerminal, type ChildOutcome } from './sdk-process-io';
 import {
   OmpSdkProcessRunnerError,
@@ -35,6 +35,7 @@ interface OmpSdkResultContext {
   readonly secretValues: readonly string[];
   readonly startedAt: number;
   readonly externalAbort: () => void;
+  readonly containmentMode: OmpSdkContainmentRequirement['mode'];
 }
 
 export async function collectOmpSdkProcessResult(
@@ -52,6 +53,7 @@ export async function collectOmpSdkProcessResult(
     secretValues,
     startedAt,
     externalAbort,
+    containmentMode,
   } = context;
   let rootRemoved = false;
   try {
@@ -113,7 +115,7 @@ export async function collectOmpSdkProcessResult(
     await removePrivateRoot(privateRuntime);
     rootRemoved = true;
     const cleanupAttestation: OmpSdkCleanupAttestation = {
-      mode: 'host-process-tree',
+      mode: containmentMode,
       terminalBuffered: true,
       descendantsReaped: true,
       clean: true,

package/src/agent-cli-provider/omp/sdk-process-runner.ts

@@ -60,6 +60,10 @@ export async function spawnOmpSdkProcess(
     const environment = childEnvironment(prepared.environmentPolicy, privateRuntime);
     const { payload, secretValues } = credentialPayload(prepared.credentialNames, process.env);
     const requestProvider = request.modelSelector.slice(0, request.modelSelector.indexOf('/'));
+    const requestContainmentMode =
+      request.executionContext === 'docker' || request.executionContext === 'benchmark'
+        ? 'container'
+        : 'host-process-tree';
     const sidecarPath = prepared.commandSpec.args[0] ?? '';
     if (
       !isAbsolute(prepared.commandSpec.binary) ||
@@ -70,7 +74,8 @@ export async function spawnOmpSdkProcess(
       Object.keys(prepared.commandSpec.env).length !== 0 ||
       prepared.semanticIdentity.requestedModelSelector !== request.modelSelector ||
       prepared.semanticIdentity.reasoningEffort !== request.reasoningEffort ||
-      prepared.semanticIdentity.provider !== requestProvider
+      prepared.semanticIdentity.provider !== requestProvider ||
+      prepared.containmentRequirement.mode !== requestContainmentMode
     ) {
       payload.fill(0);
       throw new OmpSdkProcessRunnerError(
@@ -258,6 +263,7 @@ export async function spawnOmpSdkProcess(
       secretValues,
       startedAt,
       externalAbort,
+      containmentMode: prepared.containmentRequirement.mode,
     });
 
     return {

package/src/agent-cli-provider/provider-registry.ts

@@ -128,6 +128,7 @@ interface ProviderRegistryEntryBase {
   readonly authInstructions: string;
   readonly credentialPaths: readonly string[];
   readonly credentialEnvKeys: readonly string[];
+  readonly configurationEnvKeys?: readonly string[];
   readonly settingsFields: readonly string[];
   readonly settingsDefaults?: Readonly<Record<string, unknown>>;
   readonly settingsValidator?: (
@@ -185,6 +186,12 @@ const STANDARD_CAPABILITIES: Readonly<
 
 const CLAUDE_DOCKER_ENV_PASSTHROUGH = [
   'ANTHROPIC_API_KEY',
+  'ANTHROPIC_AUTH_TOKEN',
+  'ANTHROPIC_BASE_URL',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+  'CLAUDE_CODE_SUBAGENT_MODEL',
   'AWS_BEARER_TOKEN_BEDROCK',
   'AWS_REGION',
   'CLAUDE_CODE_USE_BEDROCK',
@@ -198,7 +205,7 @@ const PI_EXPLICIT_DOCKER_CREDENTIALS = new Set([
   'GOOGLE_APPLICATION_CREDENTIALS',
 ]);
 
-const PI_DOCKER_CONFIGURATION_ENV = [
+const PI_AGENT_CONFIGURATION_ENV = [
   'AWS_BEDROCK_FORCE_CACHE',
   'AWS_BEDROCK_FORCE_HTTP1',
   'AWS_BEDROCK_SKIP_AUTH',
@@ -504,7 +511,7 @@ export const providerRegistry = [
       configRoots: ['$HOME/.pi/agent'],
       envPassthrough: [
         ...piAdapter.credentialEnvKeys.filter((name) => !PI_EXPLICIT_DOCKER_CREDENTIALS.has(name)),
-        ...PI_DOCKER_CONFIGURATION_ENV,
+        ...PI_AGENT_CONFIGURATION_ENV,
       ],
     },
     defaultLevels: {
@@ -527,6 +534,7 @@ export const providerRegistry = [
       'Manually edit providerSettings.omp in ZEROSHOT_SETTINGS_FILE or $HOME/.zeroshot/settings.json (file 0600, parent directory 0700). Use declared environment or broker variables, an explicit host-only OMP agent directory containing agent.db, or keyless mode; Zeroshot never logs in or stores credential values.',
     credentialPaths: ['~/.omp'],
     credentialEnvKeys: ompAdapter.credentialEnvKeys,
+    configurationEnvKeys: PI_AGENT_CONFIGURATION_ENV,
     settingsFields: [
       'transport',
       'minLevel',

package/src/agent-cli-provider/single-agent-runtime.ts

@@ -4,6 +4,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { getProviderAdapter } from './adapters';
+import { providerCredentialEnv } from './contract-env';
 import { UnsupportedProviderCapabilityError } from './errors';
 import { normalizeGatewayBuildOptions, resolveGatewayConfiguration } from './gateway-tools';
 import { isRecord } from './json';
@@ -21,6 +22,7 @@ import {
   parseExactOmpModelSelector,
   resolveOmpSdkSettings,
 } from './omp/sdk-settings';
+import { ompSdkEnvironmentPolicy } from './omp/sdk-environment-policy';
 import type { ConfiguredOmpSdkSettings } from './omp/sdk-settings';
 import {
   getDefaultProviderId,
@@ -124,6 +126,10 @@ const commandExistsFn = moduleFunction(providerDetectionModule, 'commandExists')
 const getHelpOutputFn = moduleFunction(providerDetectionModule, 'getHelpOutput');
 const getVersionOutputFn = moduleFunction(providerDetectionModule, 'getVersionOutput');
 const resolveOmpSdkRuntimeFn = moduleFunction(ompSdkRuntimeModule, 'resolveOmpSdkRuntime');
+const resolveOmpSdkContainerRuntimeFn = moduleFunction(
+  ompSdkRuntimeModule,
+  'resolveOmpSdkContainerRuntime'
+);
 
 export const resolveOmpTransport = (runtimeSettings?: Record<string, unknown>): 'sdk' | 'rpc' => {
   const settings = runtimeSettings ?? loadRuntimeSettings();
@@ -325,14 +331,7 @@ function prepareOmpProviderCommand(
   }
 
   const usesContainerRuntime = executionContext === 'docker' || executionContext === 'benchmark';
-  const runtime = usesContainerRuntime
-    ? {
-        bunExecutable: '/opt/zeroshot/node_modules/bun/bin/bun.exe',
-        bunVersion: OMP_SDK_BUN_VERSION,
-        ompVersion: OMP_SDK_BACKEND_VERSION,
-        sidecarPath: '/opt/zeroshot/scripts/omp/sidecar.ts',
-      }
-    : ompSdkRuntimeAssets();
+  const runtime = usesContainerRuntime ? ompSdkContainerRuntimeAssets() : ompSdkRuntimeAssets();
   let privateRoot: string | undefined;
   try {
     privateRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-omp-sdk-request-'));
@@ -356,10 +355,7 @@ function prepareOmpProviderCommand(
         webSearch: { requested: false, effective: false },
       },
       invoke,
-      environmentPolicy: {
-        inherit: 'minimal',
-        values: Object.freeze({}),
-      },
+      environmentPolicy: ompSdkEnvironmentPolicy(),
       credentialNames,
       privateArtifacts: {
         root: privateRoot,
@@ -483,7 +479,14 @@ function requiredStringValue(value: unknown, field: string): string {
 }
 
 function ompSdkRuntimeAssets(): OmpSdkRuntimeAssets {
-  const value = resolveOmpSdkRuntimeFn();
+  return validatedOmpSdkRuntime(resolveOmpSdkRuntimeFn());
+}
+
+function ompSdkContainerRuntimeAssets(): OmpSdkRuntimeAssets {
+  return validatedOmpSdkRuntime(resolveOmpSdkContainerRuntimeFn());
+}
+
+function validatedOmpSdkRuntime(value: unknown): OmpSdkRuntimeAssets {
   if (!isRecord(value))
     throw new Error('Pinned OMP SDK runtime resolver returned invalid evidence.');
   const runtime = {
@@ -640,7 +643,8 @@ function mergeAcpFailClosedCliFeatures(
 export function probeRuntimeProviderCli(
   provider: string,
   evidence?: RuntimeProbeEvidence,
-  runtimeSettings?: Record<string, unknown>
+  runtimeSettings?: Record<string, unknown>,
+  context: { readonly executionContext?: OmpSdkExecutionContext } = {}
 ): RuntimeProviderProbe {
   const adapter = getProviderAdapter(provider);
   if (adapter.id === 'gateway') {
@@ -651,7 +655,11 @@ export function probeRuntimeProviderCli(
   if (adapter.id === 'omp' && resolveOmpTransport(settings) === 'sdk') {
     const capabilities = adapter.detectCliFeatures('', '');
     try {
-      const runtime = ompSdkRuntimeAssets();
+      const executionContext = ompExecutionContext(context.executionContext);
+      const runtime =
+        executionContext === 'docker' || executionContext === 'benchmark'
+          ? ompSdkContainerRuntimeAssets()
+          : ompSdkRuntimeAssets();
       return {
         available: true,
         helpText: 'Pinned bundled OMP SDK sidecar',
@@ -881,6 +889,7 @@ function resolveRuntimeAuthEnv(
   provider: ProviderId,
   settings: Record<string, unknown>
 ): Readonly<Record<string, string>> {
+  if (provider === 'codex') return providerCredentialEnv(provider);
   if (provider !== 'claude') return {};
   const claudeAuthModule: unknown = require('../../lib/settings/claude-auth');
   const resolveClaudeAuth = moduleFunction(claudeAuthModule, 'resolveClaudeAuth');

package/src/agent-cli-provider/types.ts

@@ -131,6 +131,7 @@ export interface CodexCliFeatures extends BaseCliFeatures {
   readonly supportsIgnoreUserConfig: boolean;
   readonly supportsIgnoreRules: boolean;
   readonly supportsStrictConfig: boolean;
+  readonly supportsAddDir: boolean;
 }
 
 export interface GeminiCliFeatures extends BaseCliFeatures {
@@ -447,6 +448,8 @@ export interface BuildProviderCommandOptions {
   readonly outputFormat?: OutputFormat;
   readonly jsonSchema?: unknown;
   readonly cwd?: string;
+  /** Host paths Codex must be able to write in addition to cwd during normal unattended runs. */
+  readonly additionalWritableDirectories?: readonly string[];
   readonly agentName?: string;
   readonly autoApprove?: boolean;
   readonly resumeSessionId?: string;

package/src/agents/git-pusher-template.js

@@ -457,18 +457,27 @@ for i in $(seq 1 90); do if timeout 30 gh pr view --json mergedAt --jq .mergedAt
  */
 const SUPPORTED_PLATFORMS = ['github', 'gitlab', 'azure-devops'];
 
-/**
- * Generate the review-mode prompt (--pr without --ship): create the PR/MR and STOP.
- * No merge step, no issue-closing - the PR is left open for human review.
- * @param {Object} config - Platform configuration from PLATFORM_CONFIGS
- * @returns {string} The complete review-mode prompt
- */
-function generateReviewModePrompt(config) {
+function buildPushCommand(config, gitRemoteArgument) {
+  if (config.prName !== 'PR' || !config.createCmd.startsWith('gh pr create')) {
+    return `git push -u -- ${gitRemoteArgument} HEAD`;
+  }
+
+  const gitConfig = [
+    'url.https://github.com/.insteadOf=git@github.com:',
+    'url.https://github.com/.insteadOf=ssh://git@github.com/',
+    'credential.helper=',
+    'credential.helper=!gh auth git-credential',
+  ]
+    .map((value) => `-c ${quoteShellArgument(value)}`)
+    .join(' ');
+  return `git ${gitConfig} push -u -- ${gitRemoteArgument} HEAD`;
+}
+
+function generateDeliverySteps(config, createNote = '') {
   const {
     prName,
     prNameLower,
     createCmd,
-    prUrlExample,
     outputFields,
     requiresPrIdExtraction,
     gitRemote,
@@ -478,28 +487,13 @@ function generateReviewModePrompt(config) {
   const commitMessageArgument = quoteShellArgument(
     `feat: implement #${issueContext.issueNumber} - ${issueContext.issueTitle}`
   );
+  const pushCommand = buildPushCommand(config, gitRemoteArgument);
+  const createCommandName = createCmd.split(' ').slice(0, 3).join(' ');
+  const prUrlInstruction = requiresPrIdExtraction
+    ? ''
+    : ` Save the actual ${prName} URL from the output.`;
 
-  return `CRITICAL: ALL VALIDATORS APPROVED. YOU ARE A TRANSPORT-ONLY GIT PUSHER.
-
-Your job is to preserve validator ownership: stage, commit, push, and create the ${prName} for HUMAN REVIEW.
-
-Do NOT edit source files, tests, configs, generated artifacts, or lockfiles.
-Do NOT inspect CI logs to debug product code.
-Do NOT resolve merge conflicts or rebase conflicts.
-Do NOT run implementation/debugging workflows after validators hand off.
-Do NOT merge the ${prName} - it is left OPEN for human review.
-Do NOT close the linked issue - it stays open until a human merges the ${prName}.
-
-Allowed after validation:
-- git add/status/commit/push
-- ${createCmd.split(' ').slice(0, 3).join(' ')}
-- status-only commands such as ${prName === 'PR' ? 'gh pr view/gh pr checks' : 'the platform PR/MR status command'}
-
-If commit hooks, push, ${prName} creation, or conflict handling requires code changes, STOP and report the blocked state in JSON. The implementation and validator agents must fix code and rerun quality gates.
-
-## MANDATORY STEPS - EXECUTE EACH ONE IN ORDER - DO NOT SKIP ANY STEP
-
-### STEP 1: Stage ALL changes (MANDATORY)
+  return `### STEP 1: Stage ALL changes (MANDATORY)
 \`\`\`bash
 git add -A
 \`\`\`
@@ -519,7 +513,7 @@ Run this command. Do not skip it.
 
 ### STEP 4: Push to ${gitRemote} (MANDATORY)
 \`\`\`bash
-git push -u -- ${gitRemoteArgument} HEAD
+${pushCommand}
 \`\`\`
 Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output blocked JSON with the failure summary.
 
@@ -529,9 +523,42 @@ Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output b
 \`\`\`bash
 ${createCmd}
 \`\`\`
-🚨 YOU MUST RUN \`${createCmd.split(' ').slice(0, 3).join(' ')}\`! Outputting a link is NOT creating a ${prName}! 🚨
+🚨 YOU MUST RUN \`${createCommandName}\`! Outputting a link is NOT creating a ${prName}! 🚨
 The push output shows a "Create a ${prNameLower}" link - IGNORE IT.
-You MUST run the \`${createCmd.split(' ').slice(0, 3).join(' ')}\` command above.${requiresPrIdExtraction ? '' : ` Save the actual ${prName} URL from the output.`}
+You MUST run the \`${createCommandName}\` command above.${prUrlInstruction}${createNote}`;
+}
+
+/**
+ * Generate the review-mode prompt (--pr without --ship): create the PR/MR and STOP.
+ * No merge step, no issue-closing - the PR is left open for human review.
+ * @param {Object} config - Platform configuration from PLATFORM_CONFIGS
+ * @returns {string} The complete review-mode prompt
+ */
+function generateReviewModePrompt(config) {
+  const { prName, createCmd, prUrlExample, outputFields } = config;
+  const deliverySteps = generateDeliverySteps(config);
+
+  return `CRITICAL: ALL VALIDATORS APPROVED. YOU ARE A TRANSPORT-ONLY GIT PUSHER.
+
+Your job is to preserve validator ownership: stage, commit, push, and create the ${prName} for HUMAN REVIEW.
+
+Do NOT edit source files, tests, configs, generated artifacts, or lockfiles.
+Do NOT inspect CI logs to debug product code.
+Do NOT resolve merge conflicts or rebase conflicts.
+Do NOT run implementation/debugging workflows after validators hand off.
+Do NOT merge the ${prName} - it is left OPEN for human review.
+Do NOT close the linked issue - it stays open until a human merges the ${prName}.
+
+Allowed after validation:
+- git add/status/commit/push
+- ${createCmd.split(' ').slice(0, 3).join(' ')}
+- status-only commands such as ${prName === 'PR' ? 'gh pr view/gh pr checks' : 'the platform PR/MR status command'}
+
+If commit hooks, push, ${prName} creation, or conflict handling requires code changes, STOP and report the blocked state in JSON. The implementation and validator agents must fix code and rerun quality gates.
+
+## MANDATORY STEPS - EXECUTE EACH ONE IN ORDER - DO NOT SKIP ANY STEP
+
+${deliverySteps}
 
 ⚠️ AFTER THE ${prName} IS CREATED, YOU ARE DONE. DO NOT MERGE. DO NOT CLOSE THE ISSUE. ⚠️
 
@@ -578,7 +605,6 @@ If blocked before creating a ${prName}, output:
 function generatePrompt(config) {
   const {
     prName,
-    prNameLower,
     createCmd,
     mergeCmd,
     mergeFallbackCmd,
@@ -589,14 +615,9 @@ function generatePrompt(config) {
     usesMergeQueue,
     closeIssueMode,
     autoMerge,
-    gitRemote,
     issueContext,
   } = config;
-  const gitRemoteArgument = quoteShellArgument(gitRemote);
   const issueNumberArgument = quoteShellArgument(issueContext.issueNumber);
-  const commitMessageArgument = quoteShellArgument(
-    `feat: implement #${issueContext.issueNumber} - ${issueContext.issueTitle}`
-  );
 
   if (!autoMerge) {
     return generateReviewModePrompt(config);
@@ -608,6 +629,7 @@ function generatePrompt(config) {
 Look for output like: "Created PR 123" or parse the URL for the PR number.
 Save the PR ID to a variable for step 6.`
     : '';
+  const deliverySteps = generateDeliverySteps(config, azurePrIdNote);
 
   // Azure uses different merge terminology
   const mergeDescription = requiresPrIdExtraction
@@ -666,39 +688,7 @@ If commit hooks, push, ${prName} creation, merge, CI, or conflict handling requi
 
 ## MANDATORY STEPS - EXECUTE EACH ONE IN ORDER - DO NOT SKIP ANY STEP
 
-### STEP 1: Stage ALL changes (MANDATORY)
-\`\`\`bash
-git add -A
-\`\`\`
-Run this command. Do not skip it. If commit fails because hooks/checks fail, do not edit files. Output blocked JSON with the failure summary.
-
-### STEP 2: Check what's staged
-\`\`\`bash
-git status
-\`\`\`
-Run this. If nothing to commit, output JSON with ${outputFields.urlField}: null and stop.
-
-### STEP 3: Commit the changes (MANDATORY if there are changes)
-\`\`\`bash
-git commit -m ${commitMessageArgument}
-\`\`\`
-Run this command. Do not skip it.
-
-### STEP 4: Push to ${gitRemote} (MANDATORY)
-\`\`\`bash
-git push -u -- ${gitRemoteArgument} HEAD
-\`\`\`
-Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output blocked JSON with the failure summary.
-
-⚠️ AFTER PUSH YOU ARE NOT DONE! CONTINUE TO STEP 5! ⚠️
-
-### STEP 5: CREATE THE ${prName.toUpperCase()} (MANDATORY - YOU MUST RUN THIS COMMAND)
-\`\`\`bash
-${createCmd}
-\`\`\`
-🚨 YOU MUST RUN \`${createCmd.split(' ').slice(0, 3).join(' ')}\`! Outputting a link is NOT creating a ${prName}! 🚨
-The push output shows a "Create a ${prNameLower}" link - IGNORE IT.
-You MUST run the \`${createCmd.split(' ').slice(0, 3).join(' ')}\` command above.${requiresPrIdExtraction ? '' : ` Save the actual ${prName} URL from the output.`}${azurePrIdNote}
+${deliverySteps}
 
 ⚠️ AFTER ${prName} CREATION YOU ARE NOT DONE! CONTINUE TO STEP 6! ⚠️
 

package/src/attach/socket-paths.js

@@ -3,7 +3,7 @@ const crypto = require("crypto");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
-const SOCKET_ROOT = process.platform === 'win32' ? null : '/tmp';
+const SOCKET_ROOT = process.platform === 'win32' ? null : path.resolve(os.tmpdir());
 const SOCKET_DIR_MODE = 0o700;
 function shortHash(value) {
     return crypto.createHash('sha256').update(value).digest('hex').slice(0, 16);

package/src/attach/socket-paths.ts

@@ -3,7 +3,7 @@ import fs = require('fs');
 import os = require('os');
 import path = require('path');
 
-const SOCKET_ROOT = process.platform === 'win32' ? null : '/tmp';
+const SOCKET_ROOT = process.platform === 'win32' ? null : path.resolve(os.tmpdir());
 const SOCKET_DIR_MODE = 0o700;
 
 function shortHash(value: string): string {