fix(rescue): forbid node-based prompt writes and pgrep wait loops

plugins/codex/agents/codex-rescue.md

@@ -41,6 +41,11 @@ Forwarding rules:
 - Return the stdout of the `codex-companion` command exactly as-is.
 - If the Bash call fails or Codex cannot be invoked, return nothing.
 
+Prompt assembly and background handling:
+
+- Pass the task prompt inline as positional arguments to `task`. Do not write prompt files to disk using `node`, `fs`, shell heredocs, or any other interpreter in order to consume them with `--prompt-file`.
+- Do not poll, `pgrep`, `watch`, `tail` logs, or run wait loops for a background task. If the task is run with `--background`, or if the Bash harness moves the call to the background after the timeout, return the printed job ID and the suggested `/codex:status <id>` command exactly as output and stop.
+
 Response style:
 
 - Do not add commentary before or after the forwarded `codex-companion` output.

plugins/codex/skills/codex-cli-runtime/SKILL.md

@@ -35,8 +35,12 @@ Command selection:
 - `--effort`: accepted values are `none`, `minimal`, `low`, `medium`, `high`, `xhigh`.
 - `task --resume-last`: internal helper for "keep going", "resume", "apply the top fix", or "dig deeper" after a previous rescue run.
 
+Prompt and background handling:
+- Pass the prompt inline as positional arguments to `task`. Do not write prompt files to disk with `node`, `fs`, shell heredocs, or any other interpreter in order to consume them with `--prompt-file`.
+- Do not poll, `pgrep`, `watch`, `tail` logs, or run wait loops for a background task. If `task` is invoked with `--background`, or if the Bash harness moves the call to the background, return the job ID and suggested `/codex:status <id>` command exactly as output and stop.
+
 Safety rules:
-- Default to write-capable Codex work in `codex:codex-rescue` unless the user explicitly asks for read-only behavior.
+- Default to write-capable Codex work in `codex:codex-rescue` unless the user explicitly asks for read-only behavior or only wants review, diagnosis, or research without edits.
 - Preserve the user's task text as-is apart from stripping routing flags.
 - Do not inspect the repository, read files, grep, monitor progress, poll status, fetch results, cancel jobs, summarize output, or do any follow-up work of your own.
 - Return the stdout of the `task` command exactly as-is.

tests/commands.test.mjs

@@ -187,6 +187,19 @@ test("transfer, result, and cancel commands are exposed as deterministic runtime
   assert.match(resultHandling, /if Codex was never successfully invoked, do not generate a substitute answer at all/i);
 });
 
+test("rescue agent forbids node-based prompt writes and pgrep background wait loops", () => {
+  const agent = read("agents/codex-rescue.md");
+  const runtimeSkill = read("skills/codex-cli-runtime/SKILL.md");
+
+  assert.match(agent, /Do not write prompt files to disk/i);
+  assert.match(agent, /node[^\n]*fs/i);
+  assert.match(agent, /Do not poll.*pgrep/i);
+  assert.match(agent, /return the printed job ID/i);
+  assert.match(runtimeSkill, /Do not write prompt files to disk/i);
+  assert.match(runtimeSkill, /Do not poll.*pgrep/i);
+  assert.match(runtimeSkill, /return the job ID and suggested/i);
+});
+
 test("internal docs use task terminology for rescue runs", () => {
   const runtimeSkill = read("skills/codex-cli-runtime/SKILL.md");
   const promptingSkill = read("skills/gpt-5-4-prompting/SKILL.md");