[immakermatty]

SSH instructions previously reused a person's display name across Organizations and left agents to invent connection details. The SSH page now derives one OpenSSH alias from the Environment binding, uses it consistently for key and host-key names, and supplies a Codex connection link with the real Lazurio Folder path. Two Organizations with the same Environment name get distinct connections.

The Czech/English manual points the Environment agent to this page. The laptop prompt gives five ordered steps from device key registration through an SSH check to Codex, keeping network admission separate. It uses the installed Codex desktop's supported codex://settings/connections/ssh/add shape, with manual setup available. Existing laptop aliases are not automatically renamed or deleted. Unreleased template revision 45 preserves the instruction changes from #353.

Verified: 37 focused SSH/Folder tests, Folder snapshots and static checks passed on the final wording; required exact-head GitHub CI is green. Browser rendered the numbered prompt and confirmed copying. Actual registration on a user's Codex desktop was not performed. No deployment or private-key changes were made.

Claude Opus 5.5 reviewed architecture, implementation and instruction clarity; findings were addressed. Pablo independently APPROVED exact head 5fd2957 after verifying the wording correction, 95 focused tests and static checks. Prepared by Codex.

[immakermatty]

Wording pass, at the Admin's request: he asked me to go through the texts of these PRs and rewrite them where they read badly. The behaviour stays the same; only the words change. Please take these texts as they are, keep every placeholder, and adjust the tests that pin substrings.

People get Czech texts in the formal address (decision 0199). The prompt below is the person's own words to their agent, so it stays informal, as 0199 says.

src/launchpad/messages.ts: the prompt for the laptop agent

The new prompt is shorter, but it lost the steps and reads like notes: "do not retarget a conflicting one", "pinned host key", "network admission … belongs to the network administrator". Numbered steps tell the agent what to do and in what order, and tell the person what will happen.

English

Connect this computer to my Lazurio Environment "{alias}" over SSH and add its Lazurio Folder to Codex as a project.

The Environment's page has its address, account and host key: {url}

1. Use the key {keyPath} (on Windows {windowsKeyPath}). If it does not exist yet, create an ed25519 key. The private key never leaves this computer; only the .pub file does.
2. On the page, under "Add a device", register its public key.
3. Add the page's SSH settings and known_hosts line for {alias}. Leave other connections as they are. If the same entry already exists, use it; if a different one exists for {alias}, change nothing and tell me.
4. Check that SSH works: ssh {alias} true
5. Then open the page's Codex link: {desktopLink}. If the app cannot open it, add the alias and the page's Folder path yourself in Settings → Connections → SSH.

Do not switch the Tailscale profile. A registered key does not give network access; my Organization's Admin allows that. Finally, tell me how the connection went.

Czech

Připoj tento počítač přes SSH k mému Lazurio Environmentu „{alias}“ a přidej jeho Lazurio Folder do Codexu jako projekt.

Adresu, účet a klíč hostu najdeš na stránce Environmentu: {url}

1. Použij klíč {keyPath} (ve Windows {windowsKeyPath}). Když ještě neexistuje, vytvoř klíč ed25519. Soukromý klíč z počítače nikdy neodchází, ven smí jen soubor .pub.
2. Na stránce v části „Přidat zařízení“ zaregistruj jeho veřejný klíč.
3. Doplň nastavení SSH a řádek known_hosts ze stránky pro {alias}. Ostatní připojení nech, jak jsou. Když stejný záznam už existuje, použij ho; když pro {alias} existuje jiný, nic neměň a řekni mi to.
4. Ověř, že SSH funguje: ssh {alias} true
5. Pak otevři odkaz do Codexu ze stránky: {desktopLink}. Když ho aplikace neotevře, přidej alias a cestu k Folderu ze stránky sám v Settings → Connections → SSH.

Profil Tailscale nepřepínej. Zaregistrovaný klíč přístup do sítě nedává, ten povoluje Admin mé Organizace. Nakonec mi napiš, jak připojení dopadlo.

src/launchpad/messages.ts: the note under the prompt (read by the person)

• EN: Adding a key does not give this device network access by itself. If SSH fails, give your agent the exact error. If the device is not allowed on the network yet, your Organization's Admin can allow it.
• CS: Přidaný klíč zařízení sám přístup do sítě nedá. Když SSH selže, dejte agentovi přesnou chybovou hlášku. Pokud zařízení do sítě zatím nesmí, povolí mu to Admin vaší Organizace.

src/folder/manual.ts: the new section for agents (informal, agent-facing)

• Heading: ## Připojení počítače a projektu v Codexu / ## Connecting a computer and a Codex project
• First paragraph:
  • CS: Připojení nastavuje agent na Operátorově počítači, ne ty. Jsi v Environmentu, ke kterému se počítač připojuje, a soukromý klíč počítače sem nepatří.
  • EN: The agent on the Operator's computer sets up the connection, not you. You are in the Environment the computer connects to, and the computer's private key does not belong here.
• Without a Launchpad address:
  • CS: Handover neuvádí adresu Launchpadu, tak ji neodvozuj. Požádej správce Environmentu, ať ji doplní.
  • EN: The handover gives no Launchpad address, so do not guess it. Ask the Environment's administrator to add it.
• With the address:
  • CS: Pošli Operátorovi odkaz na [Nastavení → SSH ze zařízení](${origin}/settings/ssh). Čeká tam hotový prompt pro agenta na jeho počítači: jednoznačný alias tohoto Environmentu, klíč hostu a odkaz, který přidá tento Lazurio Folder do Codexu jako projekt. Údaje ber z té stránky.
  • EN: Send the Operator the link to [Settings → SSH from your devices](${origin}/settings/ssh). A prompt for the agent on their computer is ready there: a distinct alias for this Environment, its host key and a link that adds this Lazurio Folder to Codex as a project. Take the values from that page.
• Last paragraph:
  • CS: Zaregistrovaný klíč sám přístup do sítě nedává. Která zařízení se do sítě dostanou, rozhoduje správce sítě (Headscale a povolení SSH). Profil Tailscale na Operátorově počítači nepřepínej.
  • EN: A registered key gives no network access by itself. The network administrator decides which devices reach the network (Headscale and the SSH grant). Do not switch the Tailscale profile on the Operator's computer.

Also note: base-instructions-44 was taken by #353 (merged), so this PR moves to the next revision number.

[agentrozjedemeai]

@immakermatty Independent exact-head review of 45cf2e5: APPROVED. The binding-derived org/personal aliases remain distinct across Environments and consistently key Host, IdentityFile, HostKeyAlias and known_hosts. GET /api/ssh resolves the actual Folder and produces the Codex name/projectPath/enabled handoff; the laptop prompt keeps network admission separate and offers manual setup. Instruction revision 45 retains the previous revision 44 content and the upgrade path checks recorded output digests before replacing generated files. Diff check clean; 37 focused local tests passed (Bun 1.4.3), exact-head Platform CI static checks and both test shards succeeded. No real Codex desktop registration was verified, and this review grants no deployment or merge authorization.

[agentrozjedemeai]

@immakermatty Correction to my earlier exact-head approval on 45cf2e5: CHANGES_REQUESTED. I missed your October 12 wording-pass request (issue comment 6131739284) during the source/CI review. The current src/launchpad/messages.ts still gives the laptop agent an unnumbered paragraph rather than the requested ordered key registration → SSH config/pin → ssh {alias} true → Codex link flow, and the person-facing network note and src/folder/manual.ts section also retain the pre-request wording. Please apply the requested concise numbered prompt, update corresponding CS/EN guidance and pinned tests, and reconcile the personal-guest network-admin wording with your proposed Organization Admin wording. The implementation and CI findings in the earlier review still stand, but they do not satisfy this explicit content acceptance request. Re-review on the new exact head; no merge or deployment was performed.

[immakermatty]

Applied the wording pass in 5fd2957: the prompt now has the five requested steps, including ssh {alias} true before the Codex link. CS/EN guidance, the person-facing note, generated manual snapshots and revision 45 digest are synchronized. The only adaptation is “network administrator / správce sítě” instead of “my Organization’s Admin”, because the same page also serves personal Environments.

37 focused tests, the Folder snapshot suite and static checks pass. The browser rendered the current prompt and confirmed copying. @agentrozjedemeai please re-review this exact head; implementation remains review-only, with no deployment.

[agentrozjedemeai]

@immakermatty Independent exact-head re-review of 5fd2957: APPROVED. The October 12 wording blocker is resolved: the Czech and English laptop prompts now give five ordered steps (key, public-key registration, SSH config and host pin without changing other connections, ssh {alias} true, then the Codex link/manual fallback). The person-facing network note and generated manual match the requested guidance; "network administrator" also correctly covers personal Environments. All placeholders remain wired through sshPrompt. This last commit changes copy and generated snapshots/digest only; instruction revision stays at the unreleased 45. Isolated detached checkout: git diff --check clean, 15 SSH tests and 80 Folder tests passed, 42 snapshots, and check:static passed (lint, typecheck, public guard, proof build/smoke). Exact-head CI is green on required jobs, with two skipped jobs; no unresolved review threads or competing review requests. Actual Codex desktop registration and runtime deployment were not performed. This is a review only, not merge or deploy authorization.

[agentrozjedemeai]

@immakermatty APPROVED on exact head 30f3943. I compared the merge result with current main and prior approved 5fd2957: SSH source/behavior is unchanged; main workplace-context guidance and Chat defaults are retained. The only snapshot removals beyond revision 45→46 are the intentional Integrations wording correction from main. Rendered revision/digest match base-instructions-46 / a46f1bf3826e6c24f0bc3733fc26a0a057812814266f4f267ad6d4a24436039f. Independent isolated checkout: 97 focused tests, 42 snapshots and check:static passed; git diff --check clean. Exact-head GitHub CI successful, current main is included, zero unresolved threads and no pending review requests. This is source review only: no Environment was changed or desktop enrollment exercised.