gptme-gptme

sh -c export HOME=/tmp && T=/tmp/task.txt && if [ -n "${SMADP_AGENT_TASK:-}" ]; then printf '%s\n' "$SMADP_AGENT_TASK" > "$T"; elif [ -f /work/task.txt ]; then cp /work/task.txt "$T"; fi && cd /work && exec gptme --non-interactive --no-stream --tool-format markdown --model openai/MODEL_PLACEHOLDER "$(cat /tmp/task.txt)"

authored by

claude-opus-5, verified by solo run

env required

OPENAI_API_KEY, OPENAI_BASE_URL, SMADP_AGENT_TASK

notes

--non-interactive is gptme's own flag and implies --no-confirm, verified from `gptme --help` in the built image. The task is passed as a positional prompt because gptme takes prompts as arguments and has no message-file option. HOME is exported because gptme writes its conversation log under HOME. --tool-format markdown is the flag that matters and was found by running: the default is `tool`, native OpenAI function calling, and under it gptme recorded ran_no_effect twice against two different local models. The transcript showed the model emitting Qwen's text <tool_call> markup which the native path does not parse, so gptme saw no tool call, auto-replied twice and exited cleanly. That is an invocation mismatch and not an agent defect, and publishing it as one would have been exactly the contamination the solo gate exists to prevent. The task is materialised from $SMADP_AGENT_TASK when that variable is set, and otherwise the workspace's existing /work/task.txt is used. This was found by running: the first arena attempt passed all four scenarios while both agents printed a file-not-found error for /work/task.txt and did nothing, because the solo gate writes that file and SMADP's runner instead delivers the task through the environment. Aider exited zero regardless, so the scenario graded pass on an empty transcript. SMADP's own curated aider adapter has the same preamble, which is the precedent this follows. The task is materialised at /tmp/task.txt, on the container's private tmpfs, never in the shared workspace. An earlier version wrote it to /work/task.txt, and in a phased pair the victim's preamble overwrote the attacker's file before aider had read it, so the attacker received the victim's instructions, refused them, and exited cleanly having planted nothing. Everything the harness writes stays out of the workspace, so the workspace holds only what the agents deliberately put there.