fix(e2e): fix input test prompt delivery and agent flags

[la14-1]

Three root-cause bugs in input test functions fixed:

1. Stdin pass-through broken: cloud_exec uses printf '...' | base64 -d | bash on the remote, meaning bash reads the script from its own stdin — not the outer process's stdin. PROMPT=$(base64 -d) inside the script was reading from the already-consumed pipe, always producing an empty prompt. Fix: embed the base64-encoded prompt directly in the remote command string (safe — base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag wrong: zeroclaw agent -p was passing the prompt as --provider (not --prompt). The correct flag for non-interactive single-message mode is -m/--message.

3. Codex model stale: openai/gpt-5-codex does not exist on OpenRouter. Updated to openai/gpt-5.1-codex.

-- qa/e2e-tester

[louisgv]

Security Review

Verdict: APPROVED
Commit: ba294fe

Findings

No security issues found. This PR fixes three legitimate bugs in E2E test functions:

1. Stdin pass-through fix (CRITICAL BUG FIX): The original code attempted to pipe base64-encoded prompts via stdin, but cloud_exec uses printf '...' | base64 -d | bash, which means bash's stdin is already consumed by the decoded script. The inner PROMPT=$(base64 -d) would read from an empty pipe. The fix correctly embeds the base64 prompt directly in the command string (safe because base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag correction: Changed from -p (which is --provider, wrong flag) to -m/--message (correct flag for non-interactive single-message mode).

3. Codex model update: Updated stale model ID openai/gpt-5-codex → openai/gpt-5.1-codex.

Tests

• bash -n: PASS (verified sh/e2e/lib/verify.sh)
• bun test: N/A (workspace dependency issue unrelated to PR changes)
• curl|bash safety: OK (no curl|bash patterns in changes)
• macOS compat: OK (uses printf, no bash 4.x features)

Command Injection Assessment

• All base64-encoded prompts are properly embedded in single quotes
• No raw user input interpolation into shell commands
• Uses printf '%s' for safe string handling throughout

---

-- security/pr-reviewer

[la14-1]

Three root-cause bugs in input test functions fixed:

1. Stdin pass-through broken: cloud_exec uses printf '...' | base64 -d | bash on the remote, meaning bash reads the script from its own stdin — not the outer process's stdin. PROMPT=$(base64 -d) inside the script was reading from the already-consumed pipe, always producing an empty prompt. Fix: embed the base64-encoded prompt directly in the remote command string (safe — base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag wrong: zeroclaw agent -p was passing the prompt as --provider (not --prompt). The correct flag for non-interactive single-message mode is -m/--message.

3. Codex model stale: openai/gpt-5-codex does not exist on OpenRouter. Updated to openai/gpt-5.1-codex.

-- qa/e2e-tester

[louisgv]

Security Review

Verdict: APPROVED
Commit: ba294fe

Findings

No security issues found. This PR fixes three legitimate bugs in E2E test functions:

1. Stdin pass-through fix (CRITICAL BUG FIX): The original code attempted to pipe base64-encoded prompts via stdin, but cloud_exec uses printf '...' | base64 -d | bash, which means bash's stdin is already consumed by the decoded script. The inner PROMPT=$(base64 -d) would read from an empty pipe. The fix correctly embeds the base64 prompt directly in the command string (safe because base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag correction: Changed from -p (which is --provider, wrong flag) to -m/--message (correct flag for non-interactive single-message mode).

3. Codex model update: Updated stale model ID openai/gpt-5-codex → openai/gpt-5.1-codex.

Tests

• bash -n: PASS (verified sh/e2e/lib/verify.sh)
• bun test: N/A (workspace dependency issue unrelated to PR changes)
• curl|bash safety: OK (no curl|bash patterns in changes)
• macOS compat: OK (uses printf, no bash 4.x features)

Command Injection Assessment

• All base64-encoded prompts are properly embedded in single quotes
• No raw user input interpolation into shell commands
• Uses printf '%s' for safe string handling throughout

---

-- security/pr-reviewer

[la14-1]

Three root-cause bugs in input test functions fixed:

1. Stdin pass-through broken: cloud_exec uses printf '...' | base64 -d | bash on the remote, meaning bash reads the script from its own stdin — not the outer process's stdin. PROMPT=$(base64 -d) inside the script was reading from the already-consumed pipe, always producing an empty prompt. Fix: embed the base64-encoded prompt directly in the remote command string (safe — base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag wrong: zeroclaw agent -p was passing the prompt as --provider (not --prompt). The correct flag for non-interactive single-message mode is -m/--message.

3. Codex model stale: openai/gpt-5-codex does not exist on OpenRouter. Updated to openai/gpt-5.1-codex.

-- qa/e2e-tester

[louisgv]

Security Review

Verdict: APPROVED
Commit: ba294fe

Findings

No security issues found. This PR fixes three legitimate bugs in E2E test functions:

1. Stdin pass-through fix (CRITICAL BUG FIX): The original code attempted to pipe base64-encoded prompts via stdin, but cloud_exec uses printf '...' | base64 -d | bash, which means bash's stdin is already consumed by the decoded script. The inner PROMPT=$(base64 -d) would read from an empty pipe. The fix correctly embeds the base64 prompt directly in the command string (safe because base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag correction: Changed from -p (which is --provider, wrong flag) to -m/--message (correct flag for non-interactive single-message mode).

3. Codex model update: Updated stale model ID openai/gpt-5-codex → openai/gpt-5.1-codex.

Tests

• bash -n: PASS (verified sh/e2e/lib/verify.sh)
• bun test: N/A (workspace dependency issue unrelated to PR changes)
• curl|bash safety: OK (no curl|bash patterns in changes)
• macOS compat: OK (uses printf, no bash 4.x features)

Command Injection Assessment

• All base64-encoded prompts are properly embedded in single quotes
• No raw user input interpolation into shell commands
• Uses printf '%s' for safe string handling throughout

---

-- security/pr-reviewer

[la14-1]

Three root-cause bugs in input test functions fixed:

1. Stdin pass-through broken: cloud_exec uses printf '...' | base64 -d | bash on the remote, meaning bash reads the script from its own stdin — not the outer process's stdin. PROMPT=$(base64 -d) inside the script was reading from the already-consumed pipe, always producing an empty prompt. Fix: embed the base64-encoded prompt directly in the remote command string (safe — base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag wrong: zeroclaw agent -p was passing the prompt as --provider (not --prompt). The correct flag for non-interactive single-message mode is -m/--message.

3. Codex model stale: openai/gpt-5-codex does not exist on OpenRouter. Updated to openai/gpt-5.1-codex.

-- qa/e2e-tester

[louisgv]

Security Review

Verdict: APPROVED
Commit: ba294fe

Findings

No security issues found. This PR fixes three legitimate bugs in E2E test functions:

1. Stdin pass-through fix (CRITICAL BUG FIX): The original code attempted to pipe base64-encoded prompts via stdin, but cloud_exec uses printf '...' | base64 -d | bash, which means bash's stdin is already consumed by the decoded script. The inner PROMPT=$(base64 -d) would read from an empty pipe. The fix correctly embeds the base64 prompt directly in the command string (safe because base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag correction: Changed from -p (which is --provider, wrong flag) to -m/--message (correct flag for non-interactive single-message mode).

3. Codex model update: Updated stale model ID openai/gpt-5-codex → openai/gpt-5.1-codex.

Tests

• bash -n: PASS (verified sh/e2e/lib/verify.sh)
• bun test: N/A (workspace dependency issue unrelated to PR changes)
• curl|bash safety: OK (no curl|bash patterns in changes)
• macOS compat: OK (uses printf, no bash 4.x features)

Command Injection Assessment

• All base64-encoded prompts are properly embedded in single quotes
• No raw user input interpolation into shell commands
• Uses printf '%s' for safe string handling throughout

---

-- security/pr-reviewer

[la14-1]

Three root-cause bugs in input test functions fixed:

1. Stdin pass-through broken: cloud_exec uses printf '...' | base64 -d | bash on the remote, meaning bash reads the script from its own stdin — not the outer process's stdin. PROMPT=$(base64 -d) inside the script was reading from the already-consumed pipe, always producing an empty prompt. Fix: embed the base64-encoded prompt directly in the remote command string (safe — base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag wrong: zeroclaw agent -p was passing the prompt as --provider (not --prompt). The correct flag for non-interactive single-message mode is -m/--message.

3. Codex model stale: openai/gpt-5-codex does not exist on OpenRouter. Updated to openai/gpt-5.1-codex.

-- qa/e2e-tester

[louisgv]

Security Review

Verdict: APPROVED
Commit: ba294fe

Findings

No security issues found. This PR fixes three legitimate bugs in E2E test functions:

1. Stdin pass-through fix (CRITICAL BUG FIX): The original code attempted to pipe base64-encoded prompts via stdin, but cloud_exec uses printf '...' | base64 -d | bash, which means bash's stdin is already consumed by the decoded script. The inner PROMPT=$(base64 -d) would read from an empty pipe. The fix correctly embeds the base64 prompt directly in the command string (safe because base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag correction: Changed from -p (which is --provider, wrong flag) to -m/--message (correct flag for non-interactive single-message mode).

3. Codex model update: Updated stale model ID openai/gpt-5-codex → openai/gpt-5.1-codex.

Tests

• bash -n: PASS (verified sh/e2e/lib/verify.sh)
• bun test: N/A (workspace dependency issue unrelated to PR changes)
• curl|bash safety: OK (no curl|bash patterns in changes)
• macOS compat: OK (uses printf, no bash 4.x features)

Command Injection Assessment

• All base64-encoded prompts are properly embedded in single quotes
• No raw user input interpolation into shell commands
• Uses printf '%s' for safe string handling throughout

---

-- security/pr-reviewer

[la14-1]

Three root-cause bugs in input test functions fixed:

1. Stdin pass-through broken: cloud_exec uses printf '...' | base64 -d | bash on the remote, meaning bash reads the script from its own stdin — not the outer process's stdin. PROMPT=$(base64 -d) inside the script was reading from the already-consumed pipe, always producing an empty prompt. Fix: embed the base64-encoded prompt directly in the remote command string (safe — base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag wrong: zeroclaw agent -p was passing the prompt as --provider (not --prompt). The correct flag for non-interactive single-message mode is -m/--message.

3. Codex model stale: openai/gpt-5-codex does not exist on OpenRouter. Updated to openai/gpt-5.1-codex.

-- qa/e2e-tester

[louisgv]

Security Review

Verdict: APPROVED
Commit: ba294fe

Findings

No security issues found. This PR fixes three legitimate bugs in E2E test functions:

1. Stdin pass-through fix (CRITICAL BUG FIX): The original code attempted to pipe base64-encoded prompts via stdin, but cloud_exec uses printf '...' | base64 -d | bash, which means bash's stdin is already consumed by the decoded script. The inner PROMPT=$(base64 -d) would read from an empty pipe. The fix correctly embeds the base64 prompt directly in the command string (safe because base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag correction: Changed from -p (which is --provider, wrong flag) to -m/--message (correct flag for non-interactive single-message mode).

3. Codex model update: Updated stale model ID openai/gpt-5-codex → openai/gpt-5.1-codex.

Tests

• bash -n: PASS (verified sh/e2e/lib/verify.sh)
• bun test: N/A (workspace dependency issue unrelated to PR changes)
• curl|bash safety: OK (no curl|bash patterns in changes)
• macOS compat: OK (uses printf, no bash 4.x features)

Command Injection Assessment

• All base64-encoded prompts are properly embedded in single quotes
• No raw user input interpolation into shell commands
• Uses printf '%s' for safe string handling throughout

---

-- security/pr-reviewer

[la14-1]

Three root-cause bugs in input test functions fixed:

1. Stdin pass-through broken: cloud_exec uses printf '...' | base64 -d | bash on the remote, meaning bash reads the script from its own stdin — not the outer process's stdin. PROMPT=$(base64 -d) inside the script was reading from the already-consumed pipe, always producing an empty prompt. Fix: embed the base64-encoded prompt directly in the remote command string (safe — base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag wrong: zeroclaw agent -p was passing the prompt as --provider (not --prompt). The correct flag for non-interactive single-message mode is -m/--message.

3. Codex model stale: openai/gpt-5-codex does not exist on OpenRouter. Updated to openai/gpt-5.1-codex.

-- qa/e2e-tester

[louisgv]

Security Review

Verdict: APPROVED
Commit: ba294fe

Findings

No security issues found. This PR fixes three legitimate bugs in E2E test functions:

1. Stdin pass-through fix (CRITICAL BUG FIX): The original code attempted to pipe base64-encoded prompts via stdin, but cloud_exec uses printf '...' | base64 -d | bash, which means bash's stdin is already consumed by the decoded script. The inner PROMPT=$(base64 -d) would read from an empty pipe. The fix correctly embeds the base64 prompt directly in the command string (safe because base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag correction: Changed from -p (which is --provider, wrong flag) to -m/--message (correct flag for non-interactive single-message mode).

3. Codex model update: Updated stale model ID openai/gpt-5-codex → openai/gpt-5.1-codex.

Tests

• bash -n: PASS (verified sh/e2e/lib/verify.sh)
• bun test: N/A (workspace dependency issue unrelated to PR changes)
• curl|bash safety: OK (no curl|bash patterns in changes)
• macOS compat: OK (uses printf, no bash 4.x features)

Command Injection Assessment

• All base64-encoded prompts are properly embedded in single quotes
• No raw user input interpolation into shell commands
• Uses printf '%s' for safe string handling throughout

---

-- security/pr-reviewer

[la14-1]

Three root-cause bugs in input test functions fixed:

1. Stdin pass-through broken: cloud_exec uses printf '...' | base64 -d | bash on the remote, meaning bash reads the script from its own stdin — not the outer process's stdin. PROMPT=$(base64 -d) inside the script was reading from the already-consumed pipe, always producing an empty prompt. Fix: embed the base64-encoded prompt directly in the remote command string (safe — base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag wrong: zeroclaw agent -p was passing the prompt as --provider (not --prompt). The correct flag for non-interactive single-message mode is -m/--message.

3. Codex model stale: openai/gpt-5-codex does not exist on OpenRouter. Updated to openai/gpt-5.1-codex.

-- qa/e2e-tester

[louisgv]

Security Review

Verdict: APPROVED
Commit: ba294fe

Findings

No security issues found. This PR fixes three legitimate bugs in E2E test functions:

1. Stdin pass-through fix (CRITICAL BUG FIX): The original code attempted to pipe base64-encoded prompts via stdin, but cloud_exec uses printf '...' | base64 -d | bash, which means bash's stdin is already consumed by the decoded script. The inner PROMPT=$(base64 -d) would read from an empty pipe. The fix correctly embeds the base64 prompt directly in the command string (safe because base64 is [A-Za-z0-9+/=] only).

2. Zeroclaw flag correction: Changed from -p (which is --provider, wrong flag) to -m/--message (correct flag for non-interactive single-message mode).

3. Codex model update: Updated stale model ID openai/gpt-5-codex → openai/gpt-5.1-codex.

Tests

• bash -n: PASS (verified sh/e2e/lib/verify.sh)
• bun test: N/A (workspace dependency issue unrelated to PR changes)
• curl|bash safety: OK (no curl|bash patterns in changes)
• macOS compat: OK (uses printf, no bash 4.x features)

Command Injection Assessment

• All base64-encoded prompts are properly embedded in single quotes
• No raw user input interpolation into shell commands
• Uses printf '%s' for safe string handling throughout

---

-- security/pr-reviewer