@dungle-scrubs/harness-cli-normalizer 0.6.2 → 0.6.4

package/src/cli/inspect.ts

@@ -2,18 +2,33 @@ import { capabilitiesOf } from "../interpretation/capabilities.js";
 import { canonicalTable, mergeToolMaps } from "../interpretation/tool-vocabulary.js";
 import { HARNESS_MODES, type HarnessMode } from "../knowledge/descriptor.js";
 import { defaultDescriptors } from "../knowledge/overrides.js";
-import { splitPassthrough } from "./args.js";
+import { parseCommonFlags } from "./args.js";
 import { ConfigError, loadProjectConfig, loadUserConfig } from "./config.js";
 import { EXIT_REFUSAL } from "./exit-codes.js";
+import { inspectContextCommand } from "./inspect-context.js";
+import { inspectSessionRuntime } from "./inspect-session.js";
 import { planTurn, writePlanDiagnostics } from "./plan-turn.js";
 import { refuse } from "./refuse.js";
 import { resolveHarness } from "./resolve-harness.js";
+import { runtimeCompatibility } from "./runtime-compatibility.js";
 
 export const inspect = async (harnessName: string, rawArgs: string[]): Promise<void> => {
   const h = resolveHarness(harnessName);
-  const { normalized } = splitPassthrough(rawArgs);
+  let parsed: ReturnType<typeof parseCommonFlags>;
+  try {
+    parsed = parseCommonFlags(rawArgs);
+  } catch (err) {
+    // Preserve the shared prompt-injection and native-spelling diagnostics.
+    const outcome = await planTurn(h, rawArgs, { command: "inspect" });
+    if (outcome.kind === "refusal") {
+      refuse(outcome.refusal, outcome.wantJson && rawArgs.includes("--context"));
+      return;
+    }
+    throw err;
+  }
+  const values = parsed.values as Record<string, unknown>;
 
-  if (normalized.includes("--help") || normalized.includes("-h")) {
+  if (values.help === true) {
     const { INSPECT_HELP } = await import("./help.js");
     process.stdout.write(INSPECT_HELP);
     return;
@@ -22,41 +37,61 @@ export const inspect = async (harnessName: string, rawArgs: string[]): Promise<v
   // --argv: the preview is the plan the run command would spawn from, so
   // the two agree by construction (RFC-02 change 10). Refusals go through
   // the shared refuse path like every other command's.
-  if (normalized.includes("--argv")) {
-    if (normalized.includes("--capabilities")) {
-      process.stderr.write(`--capabilities and --argv are mutually exclusive; pick one\n`);
-      process.exitCode = EXIT_REFUSAL;
-      return;
-    }
+  if (
+    (values.capabilities && (values.argv || values.runtime || values.context)) ||
+    (values.context && (values.argv || values.runtime))
+  ) {
+    refuse(
+      {
+        issue: "invalid-option-value",
+        message: "--capabilities and --context are mutually exclusive with other inspection modes",
+      },
+      values.context === true && values.json === true,
+    );
+    return;
+  }
+  if (values.context && values.mode !== undefined && values.mode !== "headless-turn") {
+    refuse(
+      { issue: "invalid-option-value", message: "--context supports headless-turn only" },
+      values.json === true,
+    );
+    return;
+  }
+  if (values.context === true) {
+    await inspectContextCommand(h, rawArgs);
+    return;
+  }
+  if (values.argv === true || values.runtime === true) {
+    if (values.runtime === true && (await inspectSessionRuntime(h, rawArgs))) return;
     const outcome = await planTurn(h, rawArgs, { command: "inspect" });
     if (outcome.kind === "refusal") {
       refuse(outcome.refusal, false);
       return;
     }
     writePlanDiagnostics(h, outcome.plan, "argv");
+    if (values.runtime === true) {
+      const mode = parseCommonFlags(rawArgs).values.mode ?? "headless-turn";
+      if (mode !== "headless-turn" && mode !== "headless-session") {
+        refuse(
+          {
+            message: `invalid runtime mode: ${String(mode)}`,
+            issue: "invalid-option-value",
+            supported: ["headless-turn", "headless-session"],
+          },
+          false,
+        );
+        return;
+      }
+      const argv = outcome.plan.redactedArgv;
+      process.stdout.write(
+        `${JSON.stringify({ v: 1, argvKind: "redacted-preview", argv, ...(await runtimeCompatibility(h, outcome.plan.options)) })}\n`,
+      );
+      return;
+    }
     process.stdout.write(`${JSON.stringify(outcome.plan.redactedArgv)}\n`);
     return;
   }
 
-  // --capabilities path: pure capability record, no spawn, no config, no prompt
-  const { parseCommonFlags } = await import("./args.js");
-  let parsed: ReturnType<typeof parseCommonFlags>;
-  try {
-    parsed = parseCommonFlags(rawArgs);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    refuse(
-      {
-        message: `unknown flag: ${message}`,
-        issue: "invalid-option-value",
-        trailer: ["Run 'hcn inspect --help' for usage."],
-      },
-      false,
-    );
-    return;
-  }
-  const values = parsed.values as Record<string, unknown>;
-
   if (values.capabilities === true) {
     const mode = values.mode === undefined ? "headless-turn" : String(values.mode);
     if (!(HARNESS_MODES as readonly string[]).includes(mode)) {
@@ -118,11 +153,13 @@ export const inspect = async (harnessName: string, rawArgs: string[]): Promise<v
       baseFlags: h.launch.baseFlags,
       subcommands: h.launch.subcommands,
       streamFlags: h.launch.streamFlags,
+      stdinPrompt: h.launch.stdinPrompt ?? null,
       promptStyle: h.launch.promptStyle,
       toolsFlag: h.tools.includeFlag,
       idFlag: h.launch.idFlag,
     },
     resume: h.resume,
+    contextInspection: h.contextInspection ?? null,
     sessionMode: h.sessionMode,
     vocabulary: {
       models: h.vocabulary.models,

package/src/cli/plan-turn.ts

@@ -7,7 +7,7 @@
  * preview agree by construction, skill tokens and passthrough included.
  */
 import { redactArgv, type TurnRunOptions } from "../execution/stream-turn.js";
-import { buildSpawnArgv, promptTextOf } from "../interpretation/argv.js";
+import { buildSpawnArgv, promptTextOf, stdinPromptOf } from "../interpretation/argv.js";
 import { assertIsolationCombination } from "../interpretation/isolation.js";
 import { composeEscalatedPrompt } from "../interpretation/question.js";
 import { ArgvRefusalError } from "../interpretation/refusal.js";
@@ -320,7 +320,7 @@ export const planTurn = async (
       wantJson,
       options,
       argv,
-      redactedArgv: redactArgv(argv, promptTextOf(options)),
+      redactedArgv: redactArgv(argv, promptTextOf(options), stdinPromptOf(h, options) !== null),
       provenance,
       unrenderable,
       behavior,

package/src/cli/runtime-compatibility.ts

@@ -0,0 +1,55 @@
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { delimiter, isAbsolute, resolve } from "node:path";
+import { mergeEnvironment } from "../execution/environment.js";
+import type { HarnessDescriptor } from "../knowledge/descriptor.js";
+import { installedVersion } from "./check.js";
+
+function executablePath(bin: string, cwd: string, searchPath: string): string | null {
+  const candidates =
+    isAbsolute(bin) || bin.includes("/")
+      ? [resolve(cwd, bin)]
+      : searchPath.split(delimiter).map((dir) => resolve(cwd, dir, bin));
+  for (const candidate of candidates) {
+    try {
+      accessSync(candidate, constants.X_OK);
+      if (statSync(candidate).isFile()) return realpathSync(candidate);
+    } catch {
+      // PATH lookup continues when an earlier directory has no executable.
+    }
+  }
+  return null;
+}
+
+/** Exact verified versions establish support. Newer is not evidence of compatibility. */
+export async function runtimeCompatibility(
+  harness: HarnessDescriptor,
+  options: { readonly cwd?: string; readonly env?: Readonly<Record<string, string>> } = {},
+): Promise<{
+  readonly executable: { readonly path: string | null; readonly version: string | null };
+  readonly resume: { readonly status: "supported" | "unknown"; readonly reason: string | null };
+  readonly verifiedAgainst: string;
+}> {
+  const { cwd = process.cwd(), env: environment } = options;
+  const inheritedEnvironment = process.env;
+  const effectiveEnvironment = mergeEnvironment(inheritedEnvironment, environment);
+  // Node's Unix lookup uses this default when PATH has been removed.
+  const searchPath = effectiveEnvironment.PATH ?? "/usr/bin:/bin";
+  const path = executablePath(harness.bin, cwd, searchPath);
+  const version =
+    path === null ? null : await installedVersion(path, { cwd, env: effectiveEnvironment });
+  const supported = version !== null && version === harness.verifiedAgainst;
+  return {
+    executable: { path, version },
+    resume: {
+      status: supported ? "supported" : "unknown",
+      reason: supported
+        ? null
+        : path === null
+          ? "The selected executable could not be resolved."
+          : version === null
+            ? "The selected executable did not report a usable version."
+            : "The selected executable version does not match the verified adapter. Verify this version before native takeover.",
+    },
+    verifiedAgainst: harness.verifiedAgainst,
+  };
+}

package/src/execution/context-inspection.ts

@@ -0,0 +1,177 @@
+import type { ContextInspection } from "../interpretation/context-inspection.js";
+import { createContextProbe } from "../interpretation/context-inspection.js";
+import { detectAuthFailureInLine, detectLimitInLine } from "../interpretation/limits.js";
+import type { HarnessDescriptor } from "../knowledge/descriptor.js";
+
+export type { ContextInspection } from "../interpretation/context-inspection.js";
+
+import type { RunnerDeps, SpawnedProcess, TimerHandle } from "./deps.js";
+import { LineBuffer } from "./lines.js";
+import { KILL_GRACE_MS, superviseTermination } from "./supervisor.js";
+
+export interface ContextInspectionOptions {
+  /** Already validated, version-bound ephemeral argv. The CLI adapter owns
+   * no-persistence and fork-on-resume enforcement before this layer runs. */
+  readonly argv: readonly string[];
+  readonly cwd?: string;
+  readonly env?: Readonly<Record<string, string>>;
+  readonly harness: HarnessDescriptor;
+  readonly inputId: string;
+  readonly prompt: string;
+  readonly signal?: AbortSignal;
+}
+
+// Bounds serialized transport, not tokens. Native replay echoes the complete
+// user message; the ordinary event line bound would silently drop its ack.
+export const CONTEXT_TRANSPORT_MAX = 8 * 1024 * 1024;
+const INSPECTION_TIMEOUT_MS = 30_000;
+function deferred<TValue>(): {
+  readonly promise: Promise<TValue>;
+  readonly resolve: (value: TValue) => void;
+} {
+  let resolve!: (value: TValue) => void;
+  const promise = new Promise<TValue>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+/** One disposable native control channel. shouldQuery:false stages the
+ * pending task without asking the assistant to execute it. */
+export async function inspectContext(
+  options: ContextInspectionOptions,
+  deps: RunnerDeps,
+): Promise<ContextInspection> {
+  if (options.signal?.aborted) return { status: "unavailable", reason: "cancelled" };
+  const probe = createContextProbe(options.inputId, options.prompt);
+  if (new TextEncoder().encode(probe.staged).byteLength > CONTEXT_TRANSPORT_MAX) {
+    return { status: "unavailable", reason: "transport-limit" };
+  }
+  let child: SpawnedProcess;
+  try {
+    child = deps.spawn(options.argv, { cwd: options.cwd, env: options.env, stdin: "pipe" });
+  } catch {
+    return { status: "unavailable", reason: "transport" };
+  }
+  let finished = false;
+  let exited = false;
+  let exitCode: number | null = null;
+  let nativeFailure: "auth" | "limit" | null = null;
+  let disposalTimer: TimerHandle | undefined;
+  const result = deferred<ContextInspection>();
+  const stopped = deferred<boolean>();
+  const signal = (kind: "SIGTERM" | "SIGKILL"): void => {
+    try {
+      deps.signal(child, kind);
+    } catch {
+      /* Exit races are handled by exited. */
+    }
+  };
+  const termination = superviseTermination(deps.clock, signal);
+  const finish = (value: ContextInspection): void => {
+    if (finished) return;
+    finished = true;
+    result.resolve(value);
+    try {
+      child.stdin?.end();
+    } catch {
+      /* A broken pipe still needs cleanup. */
+    }
+    if (exited) {
+      stopped.resolve(true);
+      return;
+    }
+    termination.escalate();
+    disposalTimer = deps.clock.setTimeout(() => {
+      child.disposeOutput();
+      termination.settle();
+      stopped.resolve(false);
+    }, 2 * KILL_GRACE_MS);
+  };
+  const write = (line: string): void => {
+    try {
+      if (child.stdin === undefined) {
+        finish({ status: "unavailable", reason: "transport" });
+        return;
+      }
+      child.stdin.write(`${line}\n`);
+    } catch {
+      finish({ status: "unavailable", reason: "transport" });
+    }
+  };
+  const onLine = (line: string): void => {
+    if (finished) return;
+    const action = probe.accept(line);
+    if (action?.kind === "send") write(action.line);
+    else if (action?.kind === "complete") finish(action.accounting);
+  };
+  const deadline = deps.clock.setTimeout(
+    () => finish({ status: "unavailable", reason: "timeout" }),
+    deps.turnTimeoutMs && deps.turnTimeoutMs > 0 ? deps.turnTimeoutMs : INSPECTION_TIMEOUT_MS,
+  );
+  const abort = (): void => finish({ status: "unavailable", reason: "cancelled" });
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const stdout = (async (): Promise<void> => {
+    const lines = new LineBuffer(CONTEXT_TRANSPORT_MAX + 65_536);
+    try {
+      for await (const chunk of child.stdout) {
+        if (!finished) for (const line of lines.push(chunk)) onLine(line);
+      }
+      const tail = lines.flush();
+      if (tail !== null) onLine(tail);
+      finish({ status: "unavailable", reason: "transport" });
+    } catch {
+      finish({ status: "unavailable", reason: "transport" });
+    }
+  })();
+  const stderr = (async (): Promise<void> => {
+    const lines = new LineBuffer();
+    const classify = (line: string): void => {
+      if (detectAuthFailureInLine(options.harness, line) !== null) nativeFailure = "auth";
+      else if (nativeFailure === null && detectLimitInLine(options.harness, line) !== null)
+        nativeFailure = "limit";
+    };
+    try {
+      for await (const chunk of child.stderr) for (const line of lines.push(chunk)) classify(line);
+      const tail = lines.flush();
+      if (tail !== null) classify(tail);
+    } catch {
+      finish({ status: "unavailable", reason: "transport" });
+    }
+  })();
+  void child.inputError?.then(() => finish({ status: "unavailable", reason: "transport" }));
+  void child.exited.then(async (code) => {
+    exited = true;
+    exitCode = code;
+    if (code !== null && code !== 0) finish({ status: "unavailable", reason: "transport" });
+    termination.settle();
+    if (disposalTimer !== undefined) deps.clock.clearTimeout(disposalTimer);
+    // Exit can precede the final bytes reaching the runtime's read buffer.
+    // Drain naturally first; inherited pipes get a bounded disposal fallback.
+    let drainTimer: TimerHandle | undefined;
+    await Promise.race([
+      Promise.all([stdout, stderr]),
+      new Promise<void>((resolve) => {
+        drainTimer = deps.clock.setTimeout(resolve, KILL_GRACE_MS);
+      }),
+    ]);
+    if (drainTimer !== undefined) deps.clock.clearTimeout(drainTimer);
+    child.disposeOutput();
+    stopped.resolve(true);
+  });
+  write(probe.initial);
+  // Abort can arrive during spawn or listener registration.
+  if (options.signal?.aborted) abort();
+  const value = await result.promise;
+  deps.clock.clearTimeout(deadline);
+  options.signal?.removeEventListener("abort", abort);
+  const clean = await stopped.promise;
+  if (clean) await Promise.all([stdout, stderr]);
+  if (!clean) return { status: "unavailable", reason: "cleanup" };
+  if (value.status === "unavailable" && value.reason === "transport") {
+    return {
+      status: "unavailable",
+      reason: nativeFailure ?? (exitCode !== null && exitCode !== 0 ? "native-exit" : "transport"),
+    };
+  }
+  return value;
+}

package/src/execution/deps.ts

@@ -6,6 +6,9 @@
  */
 
 export interface SpawnedProcess {
+  /** Resolves on asynchronous stdin failure (for example EPIPE). The
+   * adapter always handles the native error event, even without a caller. */
+  readonly inputError?: Promise<void>;
   readonly stdout: AsyncIterable<string | Uint8Array>;
   readonly stderr: AsyncIterable<string | Uint8Array>;
   /** Idempotently terminate stdout and stderr reads without signalling the

package/src/execution/environment.ts

@@ -0,0 +1,15 @@
+/** Apply the spawn contract: an empty override removes the inherited key. */
+export function mergeEnvironment(
+  inherited: Readonly<Record<string, string | undefined>>,
+  overrides: Readonly<Record<string, string>> = {},
+): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const [key, value] of Object.entries(inherited)) {
+    if (value !== undefined) result[key] = value;
+  }
+  for (const [key, value] of Object.entries(overrides)) {
+    if (value === "") delete result[key];
+    else result[key] = value;
+  }
+  return result;
+}

package/src/execution/lines.ts

@@ -11,11 +11,11 @@
 export const LINE_MAX = 65_536;
 
 export class LineBuffer {
+  constructor(private readonly limit = LINE_MAX) {}
   // Per-instance and stateful ({stream:true}): a shared decoder would carry
   // partial-sequence state across two streams and corrupt both.
   private readonly decoder = new TextDecoder();
   private pending = "";
-  private scanFrom = 0;
   private discarding = false;
 
   push(chunk: string | Uint8Array): string[] {
@@ -24,39 +24,38 @@ export class LineBuffer {
   }
 
   private ingest(text: string): string[] {
-    this.pending += text;
     const lines: string[] = [];
+    let start = 0;
     while (true) {
-      const at = this.pending.indexOf("\n", this.scanFrom);
-      if (at === -1) break;
-      const line = this.pending.slice(0, at);
-      this.pending = this.pending.slice(at + 1);
-      this.scanFrom = 0;
-      if (this.discarding) {
-        // The truncated head of an over-long line ends here; drop it whole.
-        this.discarding = false;
-        continue;
-      }
-      // The bound applies to COMPLETE lines too - an oversized line whose
-      // newline arrived in the same chunk must not bypass it.
-      if (line.length <= LINE_MAX && !isBlank(line)) lines.push(line);
+      // Search only new bytes. Searching the accumulated rope on each pipe
+      // chunk repeatedly flattens large echoed prompts.
+      const at = text.indexOf("\n", start);
+      this.append(text.slice(start, at === -1 ? text.length : at));
+      if (at === -1) return lines;
+      if (!this.discarding && !isBlank(this.pending)) lines.push(this.pending);
+      this.pending = "";
+      this.discarding = false;
+      start = at + 1;
     }
-    this.scanFrom = this.pending.length;
-    if (this.pending.length > LINE_MAX) {
+  }
+
+  private append(text: string): void {
+    if (this.discarding) return;
+    if (this.pending.length + text.length > this.limit) {
       this.pending = "";
-      this.scanFrom = 0;
       this.discarding = true;
-    }
-    return lines;
+    } else this.pending += text;
   }
 
   /** The final partial line at stream close, if any. */
   flush(): string | null {
     const tail = this.decoder.decode();
-    if (tail !== "") this.pending += tail;
-    const rest = this.discarding || isBlank(this.pending) ? null : this.pending;
+    if (tail !== "") this.append(tail);
+    const rest =
+      this.discarding || this.pending.length > this.limit || isBlank(this.pending)
+        ? null
+        : this.pending;
     this.pending = "";
-    this.scanFrom = 0;
     this.discarding = false;
     return rest;
   }

package/src/execution/node-deps.ts

@@ -9,6 +9,7 @@
 import { type ChildProcess, spawn as nodeSpawn } from "node:child_process";
 import type { Readable } from "node:stream";
 import type { Clock, RunnerDeps, SpawnedProcess, SpawnOptions } from "./deps.js";
+import { mergeEnvironment } from "./environment.js";
 
 const children = new WeakMap<SpawnedProcess, ChildProcess>();
 
@@ -91,22 +92,7 @@ export const disposableOutputStream = (
 const realSpawn = (argv: readonly string[], opts: SpawnOptions): SpawnedProcess => {
   const [bin, ...args] = argv;
   if (bin === undefined) throw new Error("empty argv");
-  const env =
-    opts.env === undefined
-      ? undefined
-      : (() => {
-          const merged: Record<string, string | undefined> = { ...process.env };
-          for (const [k, v] of Object.entries(opts.env)) {
-            if (v === "") delete merged[k];
-            else merged[k] = v;
-          }
-          // Filter out undefined to satisfy Node's env type (string -> string)
-          const out: Record<string, string> = {};
-          for (const [k, v] of Object.entries(merged)) {
-            if (v !== undefined) out[k] = v;
-          }
-          return out;
-        })();
+  const env = mergeEnvironment(process.env, opts.env);
   const child = nodeSpawn(bin, args, {
     ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
     ...(env !== undefined ? { env } : {}),
@@ -116,7 +102,14 @@ const realSpawn = (argv: readonly string[], opts: SpawnOptions): SpawnedProcess
       "pipe",
     ],
   });
+  const inputError = new Promise<void>((resolve) => {
+    child.stdin?.once("error", () => resolve());
+  });
   let outputDisposed = false;
+  let outputDisposedResolve!: () => void;
+  const outputDisposal = new Promise<void>((resolve) => {
+    outputDisposedResolve = resolve;
+  });
   const stdoutDisposalCause = new Error("stdout disposed by runner");
   const stderrDisposalCause = new Error("stderr disposed by runner");
   let spawnError: Error | null = null;
@@ -150,10 +143,13 @@ const realSpawn = (argv: readonly string[], opts: SpawnOptions): SpawnedProcess
   // immediately while an async ENOENT remains the single spawn-error signal.
   const stderrWithError = async function* (): AsyncIterable<string | Uint8Array> {
     if (stderrOutput !== null) yield* stderrOutput.stream;
-    await exited;
+    // Terminal output disposal must also settle this tail when a child has
+    // closed stderr but has not exited. The caller owns signalling it.
+    await Promise.race([exited, outputDisposal]);
     if (spawnError !== null) yield `spawn failed: ${(spawnError as Error).message}\n`;
   };
   const proc: SpawnedProcess = {
+    inputError,
     stdout: stdoutOutput === null ? emptyStream() : stdoutOutput.stream,
     stderr: stderrWithError(),
     exited,
@@ -161,6 +157,7 @@ const realSpawn = (argv: readonly string[], opts: SpawnOptions): SpawnedProcess
     disposeOutput: (): void => {
       if (outputDisposed) return;
       outputDisposed = true;
+      outputDisposedResolve();
       stdoutOutput?.dispose();
       stderrOutput?.dispose();
     },

package/src/execution/stream-turn.ts

@@ -19,6 +19,7 @@ import {
   buildSpawnArgv,
   type LaunchOptions,
   promptTextOf,
+  stdinPromptOf,
   streamingGranularityOf,
   withPromptText,
 } from "../interpretation/argv.js";
@@ -72,14 +73,21 @@ const SECRETISH = /(sk-[A-Za-z0-9_-]{8,}|(?:token|key|secret|password)=\S+)/i;
  * other token is kept unless it is secret-shaped. Only the prompt's
  * positional slot is masked, so a one-word prompt that equals a flag
  * value does not cause that flag value to be masked. */
-export const redactArgv = (argv: readonly string[], prompt?: string): string[] => {
+export const redactArgv = (
+  argv: readonly string[],
+  prompt?: string,
+  viaStdin = false,
+): string[] => {
   const promptIndex = prompt !== undefined ? argv.lastIndexOf(prompt) : -1;
   const promptLabel = prompt !== undefined ? `[prompt:${prompt.length}ch]` : "";
-  return argv.map((token, index) => {
+  const redacted = argv.map((token, index) => {
     if (index === promptIndex) return promptLabel;
     if (SECRETISH.test(token)) return "[redacted]";
     return token;
   });
+  return viaStdin && prompt !== undefined
+    ? [...redacted, `[stdin prompt:${prompt.length}ch]`]
+    : redacted;
 };
 
 export interface TurnRunOptions extends LaunchOptions {
@@ -119,6 +127,7 @@ export async function* streamTurn(
     prompt: withPromptText(opts.prompt, composeEscalatedPrompt(promptTextOf(opts), questionMode)),
   };
   const promptText = promptTextOf(effective);
+  const stdinPrompt = stdinPromptOf(h, effective);
   let asked = false;
   let escalationDetection: EscalationDetection = "none";
 
@@ -209,7 +218,7 @@ export async function* streamTurn(
     event: "spawn",
     turnId,
     harness: h.name,
-    argv: redactArgv(argv, promptText),
+    argv: redactArgv(argv, promptText, stdinPrompt !== null),
     granularity,
     ...(matcherOverrides ? { matcherOverrides } : {}),
     ...(envKeys?.length ? { envKeys } : {}),
@@ -226,7 +235,7 @@ export async function* streamTurn(
   let proc: SpawnedProcess;
   try {
     proc = deps.spawn(argv, {
-      stdin: h.stdin === "close-required" ? "close" : "inherit",
+      stdin: stdinPrompt !== null ? "pipe" : h.stdin === "close-required" ? "close" : "inherit",
       ...(effective.cwd !== undefined ? { cwd: effective.cwd } : {}),
       ...(effective.env !== undefined ? { env: effective.env } : {}),
     });
@@ -367,6 +376,24 @@ export async function* streamTurn(
     }, PIPE_GRACE_MS);
   });
 
+  if (stdinPrompt !== null) {
+    let inputFailed = false;
+    const failInput = (): void => {
+      if (inputFailed || cancelled || exited) return;
+      inputFailed = true;
+      void pushFailure(failureFromTransport("native prompt stdin failed"));
+      sup.escalate();
+    };
+    void proc.inputError?.then(failInput);
+    try {
+      if (!proc.stdin) throw new Error("native prompt requires stdin");
+      proc.stdin.write(stdinPrompt);
+      proc.stdin.end();
+    } catch {
+      failInput();
+    }
+  }
+
   const pumpStdout = async (): Promise<void> => {
     const lines = new LineBuffer();
     let identitySeen = false;