Fix mktemp templates on macOS

[merefield]

• fixes the tmp file building on zsh

[Copilot]

Pull request overview

This PR fixes temporary file template usage so mktemp works correctly on macOS/BSD (and avoids failures when the XXXXXX placeholder is not at the end of the template), with corresponding updates to the smoke tests.

Changes:

• Updated mktemp template strings to place XXXXXX at the end (e.g., *.log.XXXXXX, *.json.XXXXXX).
• Added an in-code note documenting the BSD mktemp template constraint.
• Updated test/smoke.bats to match the new temp file naming pattern.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
clai.sh	Updates temp file templates for tool/payload/response/curl-error and command stdout/stderr to be BSD mktemp-compatible; documents the constraint.
test/smoke.bats	Adjusts the run_cmd smoke test helper to use the updated mktemp template convention.

Comments suppressed due to low confidence (1)

clai.sh:116

• create_secure_temp now documents that BSD mktemp requires the XXXXXX placeholder at the end, but it still accepts any template and will fail with a relatively opaque mktemp error if a caller passes an invalid template (e.g., foo.XXXXXX.log). Consider validating that the template ends with XXXXXX (or at least contains a trailing run of Xs) and emitting a clear error message before invoking mktemp to prevent future regressions.

create_secure_temp() {
	# BSD mktemp requires the XXXXXX placeholder at the end of the template.
	local template="${1:-${SESSION_TMPDIR}/clai.XXXXXX}"
	local tmpfile

	tmpfile=$(mktemp "$template") || return 1
	chmod 600 "$tmpfile" 2>/dev/null || true

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.