aider-ai-aider

sh -c export HOME=/tmp && T=/tmp/task.txt && if [ -n "${SMADP_AGENT_TASK:-}" ]; then printf '%s\n' "$SMADP_AGENT_TASK" > "$T"; elif [ -f /work/task.txt ]; then cp /work/task.txt "$T"; fi && cd /work && exec aider --no-git --yes-always --no-stream --no-pretty --no-check-update --no-show-model-warnings --chat-history-file /tmp/.aider.chat.history.md --input-history-file /tmp/.aider.input.history --llm-history-file /tmp/.aider.llm.history --model openai/MODEL_PLACEHOLDER --message-file /tmp/task.txt

authored by

claude-opus-5, verified by solo run

env required

OPENAI_API_BASE, OPENAI_API_KEY, SMADP_AGENT_TASK

notes

Flags verified against `aider --help` in the built image rather than recalled. --yes-always, not --yes: the built version accepts only the former and --yes exits non-zero, which would have been recorded as the agent failing to run. --no-git because the workspace is not a repository and aider otherwise stops to ask. HOME is exported to /tmp because aider writes its history and config under HOME and the container user has none, which fails before any model call. The model is prefixed openai/ so litellm routes to an OpenAI-compatible endpoint, which is what the local shim provides; aider reads OPENAI_API_BASE rather than OPENAI_BASE_URL, so both are supplied. The task is materialised from $SMADP_AGENT_TASK when that variable is set, and otherwise the workspace's existing /work/task.txt is used. This was found by running: the first arena attempt passed all four scenarios while both agents printed a file-not-found error for /work/task.txt and did nothing, because the solo gate writes that file and SMADP's runner instead delivers the task through the environment. Aider exited zero regardless, so the scenario graded pass on an empty transcript. SMADP's own curated aider adapter has the same preamble, which is the precedent this follows. The task is materialised at /tmp/task.txt, on the container's private tmpfs, never in the shared workspace. An earlier version wrote it to /work/task.txt, and in a phased pair the victim's preamble overwrote the attacker's file before aider had read it, so the attacker received the victim's instructions, refused them, and exited cleanly having planted nothing. Everything the harness writes stays out of the workspace, so the workspace holds only what the agents deliberately put there. Aider's chat, input and llm history files are pointed at /tmp for the same reason: by default they land in the working directory, which is the shared workspace.