@intelli-1113/stratos-sdk 1.3.4 → 1.3.6

package/src/enforcement.js

@@ -1,163 +1,182 @@
-// Network-level budget / lifecycle enforcement.
-//
-// WHY THE NETWORK LAYER, NOT THE SDK LAYER
-// -----------------------------------------------------------------------------
-// OpenAI, Anthropic, LangChain, Vercel AI, Google GenAI — every one of them
-// ultimately does the same thing: send an outbound HTTP request to the
-// provider's API. Traceloop's own instrumentation (which this SDK depends on
-// but does not own — @traceloop/instrumentation-openai et al.) exposes no
-// pre-call hook that can refuse a request; its config surface is
-// traceContent / enrichTokens / exceptionLogger / uploadBase64Image only.
-// Wrapping every provider SDK's call function individually is also a moving
-// target — a "custom agent" built directly on a raw SDK gets no protection
-// until someone ships a wrapper for that specific library.
-//
-// Patching global `fetch` (and `http`/`https` as a fallback for older
-// transports) catches all of them in ONE place, before the request leaves the
-// process, with no per-provider code and no dependency on Traceloop's
-// internals. This module is installed from register.js, before any provider
-// SDK is imported by the agent's own code — the same ordering guarantee the
-// Vercel AI ESM loader already relies on.
-//
-// This does NOT cover the MCP proxy path (src/mcp-proxy.js): that spawns a
-// separate child process and proxies its stdio, so patching fetch in THIS
-// process has no effect on the child's own network calls. The proxy has its
-// own, necessary check at the JSON-RPC `tools/call` boundary instead.
-
-import http from "node:http";
-import https from "node:https";
-
-export class StratosBudgetBlockedError extends Error {
-  constructor(reason) {
-    super(`[stratos] request blocked: ${reason || "budget or lifecycle limit reached"}`);
-    this.name = "StratosBudgetBlockedError";
-    this.stratosBlocked = true;
-  }
-}
-
-// Cached from the heartbeat response (see index.js / mcp-proxy.js). Starts
-// unblocked: an agent must never be frozen just because it hasn't heard back
-// from Stratos yet — same fail-open philosophy as the server's own enforcement
-// check (lib/quotaEnforce.ts: "fail open, loudly").
-let _blocked = false;
-let _reason = null;
-
-export function setBlocked(blocked, reason) {
-  _blocked = !!blocked;
-  _reason = reason || null;
-}
-
-export function isBlocked() {
-  return { blocked: _blocked, reason: _reason };
-}
-
-// Hostnames of LLM/agent providers to guard. Extend without an SDK release via
-// STRATOS_BLOCK_HOSTS (comma-separated substrings) — e.g. a private Azure
-// OpenAI deployment hostname, or a self-hosted gateway.
-const DEFAULT_PROVIDER_HOSTS = [
-  "api.openai.com",
-  "api.anthropic.com",
-  "generativelanguage.googleapis.com",
-  "aiplatform.googleapis.com",
-  "bedrock-runtime.", // *.amazonaws.com region-scoped, matched by substring
-  "api.cohere.ai",
-  "api.mistral.ai",
-  "openrouter.ai",
-  "api.together.xyz",
-  "api.groq.com",
-  "openai.azure.com",
-];
-
-function providerHosts() {
-  const extra = (process.env.STRATOS_BLOCK_HOSTS || "")
-    .split(",")
-    .map((s) => s.trim())
-    .filter(Boolean);
-  return [...DEFAULT_PROVIDER_HOSTS, ...extra];
-}
-
-// Never guard Stratos's own host: the agent has to be able to reach Stratos to
-// find out it has been unblocked. If this returned the wrong host the agent
-// would deadlock itself — checked defensively, not just assumed.
-function ownHost() {
-  try {
-    return new URL(process.env.STRATOS_URL || "http://localhost:4000").host;
-  } catch {
-    return "";
-  }
-}
-
-function hostFromInput(input) {
-  try {
-    if (typeof input === "string") return new URL(input).host;
-    if (input instanceof URL) return input.host;
-    if (input && typeof input === "object") {
-      if (input.url) return new URL(input.url).host; // Request-like
-      if (input.hostname || input.host) return String(input.hostname || input.host);
-    }
-  } catch {
-    // Not a parseable URL. Let it through — this guard only ever restricts
-    // requests to a known provider host, never anything it can't identify.
-  }
-  return "";
-}
-
-function isGuardedHost(host) {
-  if (!host) return false;
-  if (host === ownHost()) return false;
-  return providerHosts().some((h) => host.includes(h));
-}
-
-let installed = false;
-
-/**
- * Patch global fetch and http(s).request so a blocked agent cannot reach any
- * known LLM provider, regardless of which SDK it is using. Idempotent — safe
- * to call more than once, and safe to call when no provider SDK is present.
- */
-export function installNetworkGuard() {
-  if (installed) return;
-  installed = true;
-
-  if (typeof globalThis.fetch === "function" && !globalThis.fetch.__stratosGuarded) {
-    const realFetch = globalThis.fetch.bind(globalThis);
-    const guarded = function stratosGuardedFetch(input, init) {
-      if (isGuardedHost(hostFromInput(input))) {
-        const { blocked, reason } = isBlocked();
-        if (blocked) return Promise.reject(new StratosBudgetBlockedError(reason));
-      }
-      return realFetch(input, init);
-    };
-    guarded.__stratosGuarded = true;
-    globalThis.fetch = guarded;
-  }
-
-  patchRequestModule(http);
-  patchRequestModule(https);
-}
-
-/**
- * Secondary guard for legacy http(s)-based clients — the fetch guard above is
- * the primary path and already covers current OpenAI / Anthropic / Google /
- * Vercel AI SDKs, which all use fetch on Node 18+. A synchronous throw here is
- * non-standard for a network failure (Node normally emits an async 'error' on
- * the returned request), but building a spec-compliant fake ClientRequest for
- * a fallback path most agents never exercise is not worth the complexity —
- * callers of http(s).request that care will have it in a try/catch already,
- * since the real function can also throw synchronously for invalid options.
- */
-function patchRequestModule(mod) {
-  if (!mod || !mod.request || mod.request.__stratosGuarded) return;
-  const real = mod.request;
-  const guarded = function stratosGuardedRequest(...args) {
-    const opts = args.find((a) => a && typeof a === "object" && typeof a !== "function");
-    const host = opts ? String(opts.hostname || opts.host || "") : hostFromInput(args[0]);
-    if (isGuardedHost(host)) {
-      const { blocked, reason } = isBlocked();
-      if (blocked) throw new StratosBudgetBlockedError(reason);
-    }
-    return real.apply(mod, args);
-  };
-  guarded.__stratosGuarded = true;
-  mod.request = guarded;
-}
+// Network-level budget / lifecycle enforcement.
+//
+// WHY THE NETWORK LAYER, NOT THE SDK LAYER
+// -----------------------------------------------------------------------------
+// OpenAI, Anthropic, LangChain, Vercel AI, Google GenAI — every one of them
+// ultimately does the same thing: send an outbound HTTP request to the
+// provider's API. Traceloop's own instrumentation (which this SDK depends on
+// but does not own — @traceloop/instrumentation-openai et al.) exposes no
+// pre-call hook that can refuse a request; its config surface is
+// traceContent / enrichTokens / exceptionLogger / uploadBase64Image only.
+// Wrapping every provider SDK's call function individually is also a moving
+// target — a "custom agent" built directly on a raw SDK gets no protection
+// until someone ships a wrapper for that specific library.
+//
+// Patching global `fetch` (and `http`/`https` as a fallback for older
+// transports) catches all of them in ONE place, before the request leaves the
+// process, with no per-provider code and no dependency on Traceloop's
+// internals. This module is installed from register.js, before any provider
+// SDK is imported by the agent's own code — the same ordering guarantee the
+// Vercel AI ESM loader already relies on.
+//
+// This does NOT cover the MCP proxy path (src/mcp-proxy.js): that spawns a
+// separate child process and proxies its stdio, so patching fetch in THIS
+// process has no effect on the child's own network calls. The proxy has its
+// own, necessary check at the JSON-RPC `tools/call` boundary instead.
+
+import http from "node:http";
+import https from "node:https";
+
+export class StratosBudgetBlockedError extends Error {
+  constructor(reason) {
+    super(`[stratos] request blocked: ${reason || "budget or lifecycle limit reached"}`);
+    this.name = "StratosBudgetBlockedError";
+    this.stratosBlocked = true;
+  }
+}
+
+// Cached from the heartbeat response (see index.js / mcp-proxy.js). Starts
+// unblocked: an agent must never be frozen just because it hasn't heard back
+// from Stratos yet — same fail-open philosophy as the server's own enforcement
+// check (lib/quotaEnforce.ts: "fail open, loudly").
+let _blocked = false;
+let _reason = null;
+
+export function setBlocked(blocked, reason) {
+  _blocked = !!blocked;
+  _reason = reason || null;
+}
+
+export function isBlocked() {
+  return { blocked: _blocked, reason: _reason };
+}
+
+// Hostnames of LLM/agent providers to guard. Extend without an SDK release via
+// STRATOS_BLOCK_HOSTS (comma-separated substrings) — e.g. a private Azure
+// OpenAI deployment hostname, or a self-hosted gateway.
+const DEFAULT_PROVIDER_HOSTS = [
+  "api.openai.com",
+  "api.anthropic.com",
+  "generativelanguage.googleapis.com",
+  "aiplatform.googleapis.com",
+  "bedrock-runtime.", // *.amazonaws.com region-scoped, matched by substring
+  "api.cohere.ai",
+  "api.mistral.ai",
+  "openrouter.ai",
+  "api.together.xyz",
+  "api.groq.com",
+  "openai.azure.com",
+];
+
+function providerHosts() {
+  const extra = (process.env.STRATOS_BLOCK_HOSTS || "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  return [...DEFAULT_PROVIDER_HOSTS, ...extra];
+}
+
+// Never guard Stratos's own host: the agent has to be able to reach Stratos to
+// find out it has been unblocked. If this returned the wrong host the agent
+// would deadlock itself — checked defensively, not just assumed.
+function ownHost() {
+  try {
+    return new URL(process.env.STRATOS_URL || "http://localhost:4000").host;
+  } catch {
+    return "";
+  }
+}
+
+function hostFromInput(input) {
+  try {
+    if (typeof input === "string") return new URL(input).host;
+    if (input instanceof URL) return input.host;
+    if (input && typeof input === "object") {
+      if (input.url) return new URL(input.url).host; // Request-like
+      if (input.hostname || input.host) return String(input.hostname || input.host);
+    }
+  } catch {
+    // Not a parseable URL. Let it through — this guard only ever restricts
+    // requests to a known provider host, never anything it can't identify.
+  }
+  return "";
+}
+
+function isGuardedHost(host) {
+  if (!host) return false;
+  if (host === ownHost()) return false;
+  return providerHosts().some((h) => host.includes(h));
+}
+
+let installed = false;
+
+/**
+ * Patch global fetch and http(s).request so a blocked agent cannot reach any
+ * known LLM provider, regardless of which SDK it is using. Idempotent — safe
+ * to call more than once, and safe to call when no provider SDK is present.
+ */
+export function installNetworkGuard() {
+  if (installed) return;
+  installed = true;
+
+  if (typeof globalThis.fetch === "function" && !globalThis.fetch.__stratosGuarded) {
+    const realFetch = globalThis.fetch.bind(globalThis);
+    const guarded = function stratosGuardedFetch(input, init) {
+      if (isGuardedHost(hostFromInput(input))) {
+        const { blocked, reason } = isBlocked();
+        if (blocked) return Promise.reject(new StratosBudgetBlockedError(reason));
+      }
+      return realFetch(input, init);
+    };
+    guarded.__stratosGuarded = true;
+    globalThis.fetch = guarded;
+  }
+
+  patchRequestModule(http);
+  patchRequestModule(https);
+}
+
+/**
+ * Secondary guard for legacy http(s)-based clients — the fetch guard above is
+ * the primary path and already covers current OpenAI / Anthropic / Google /
+ * Vercel AI SDKs, which all use fetch on Node 18+. A synchronous throw here is
+ * non-standard for a network failure (Node normally emits an async 'error' on
+ * the returned request), but building a spec-compliant fake ClientRequest for
+ * a fallback path most agents never exercise is not worth the complexity —
+ * callers of http(s).request that care will have it in a try/catch already,
+ * since the real function can also throw synchronously for invalid options.
+ */
+function patchRequestModule(mod) {
+  if (!mod || !mod.request || mod.request.__stratosGuarded) return;
+  const real = mod.request;
+  const guarded = function stratosGuardedRequest(...args) {
+    const opts = args.find((a) => a && typeof a === "object" && typeof a !== "function");
+    const host = opts ? String(opts.hostname || opts.host || "") : hostFromInput(args[0]);
+    if (isGuardedHost(host)) {
+      const { blocked, reason } = isBlocked();
+      if (blocked) throw new StratosBudgetBlockedError(reason);
+    }
+    return real.apply(mod, args);
+  };
+  guarded.__stratosGuarded = true;
+  mod.request = guarded;
+
+  // P1-01: Also wrap .get() to catch https.get() and named imports like `import { get } from "node:https"`
+  if (mod.get && !mod.get.__stratosGuarded) {
+    const realGet = mod.get;
+    const guardedGet = function stratosGuardedGet(...args) {
+      const opts = args.find((a) => a && typeof a === "object" && typeof a !== "function");
+      const host = opts ? String(opts.hostname || opts.host || "") : hostFromInput(args[0]);
+      if (isGuardedHost(host)) {
+        const { blocked, reason } = isBlocked();
+        if (blocked) throw new StratosBudgetBlockedError(reason);
+      }
+      return realGet.apply(mod, args);
+    };
+    guardedGet.__stratosGuarded = true;
+    mod.get = guardedGet;
+  }
+
+  // Ensure named imports (import { request, get } from "node:https") see wrapped versions
+  module.syncBuiltinESMExports?.();
+}

package/src/execution-spans.js

@@ -0,0 +1,166 @@
+import { randomBytes } from "node:crypto";
+
+const TOKEN = process.env.STRATOS_TOKEN || "";
+const STRATOS_URL = process.env.STRATOS_URL || "http://localhost:4000";
+const SURFACE = process.env.STRATOS_SURFACE || "unknown";
+
+const hdr = { "Content-Type": "application/json", "x-stratos-token": TOKEN };
+
+export class ExecutionSpan {
+  constructor(opts = {}) {
+    this.type = opts.type; // skill, subagent, hook, cmd, plugin, mcp
+    this.name = opts.name;
+    this.startTime = opts.startTime || Date.now();
+    this.endTime = opts.endTime || null;
+    this.status = opts.status || "running"; // running, success, error
+    this.reason = opts.reason || null;
+    this.metadata = opts.metadata || {};
+  }
+
+  end(status = "success", reason = null) {
+    this.endTime = Date.now();
+    this.status = status;
+    this.reason = reason;
+  }
+
+  toOtlpSpan() {
+    const traceId = (randomBytes(16)).toString("hex");
+    const spanId = (randomBytes(8)).toString("hex");
+    const startNano = BigInt(this.startTime) * 1000000n;
+    const endNano = BigInt(this.endTime || Date.now()) * 1000000n;
+
+    const attr = (k, v) => ({
+      key: k,
+      value: {
+        stringValue: String(v),
+      },
+    });
+
+    const attributes = [
+      attr("traceloop.span.kind", this.type),
+      attr("traceloop.entity.name", this.name),
+      attr("stratos.surface", SURFACE),
+      attr("stratos.execution.type", this.type),
+      attr("stratos.execution.status", this.status),
+    ];
+
+    if (this.reason) {
+      attributes.push(attr("stratos.execution.reason", this.reason));
+    }
+
+    for (const [k, v] of Object.entries(this.metadata || {})) {
+      if (v != null && typeof v !== "object") {
+        attributes.push(attr(`stratos.${k}`, v));
+      }
+    }
+
+    return {
+      traceId,
+      spanId,
+      name: `${this.type}:${this.name}`,
+      startTimeUnixNano: startNano.toString(),
+      endTimeUnixNano: endNano.toString(),
+      attributes,
+    };
+  }
+
+  static async post(span) {
+    if (!TOKEN) return;
+
+    const otlpSpan = span.toOtlpSpan();
+    const payload = {
+      resourceSpans: [
+        {
+          resource: {
+            attributes: [{ key: "service.name", value: { stringValue: SURFACE } }],
+          },
+          scopeSpans: [
+            {
+              spans: [otlpSpan],
+            },
+          ],
+        },
+      ],
+    };
+
+    try {
+      const res = await fetch(`${STRATOS_URL}/api/ingest`, {
+        method: "POST",
+        headers: hdr,
+        body: JSON.stringify(payload),
+      });
+      if (!res.ok) {
+        console.error(`[execution-spans] Stratos returned ${res.status}`);
+      }
+    } catch (err) {
+      console.error(`[execution-spans] Failed to post span: ${err.message}`);
+    }
+  }
+}
+
+export async function postSkillSpan(skillName, status = "success", reason = null) {
+  const span = new ExecutionSpan({
+    type: "skill",
+    name: skillName,
+    status,
+    reason,
+  });
+  span.end(status, reason);
+  await ExecutionSpan.post(span);
+}
+
+export async function postSubagentSpan(subagentName, status = "success", reason = null, metadata = {}) {
+  const span = new ExecutionSpan({
+    type: "subagent",
+    name: subagentName,
+    status,
+    reason,
+    metadata,
+  });
+  span.end(status, reason);
+  await ExecutionSpan.post(span);
+}
+
+export async function postHookSpan(hookName, status = "success", reason = null) {
+  const span = new ExecutionSpan({
+    type: "hook",
+    name: hookName,
+    status,
+    reason,
+  });
+  span.end(status, reason);
+  await ExecutionSpan.post(span);
+}
+
+export async function postToolSpan(toolName, status = "success", reason = null) {
+  const span = new ExecutionSpan({
+    type: "mcp",
+    name: toolName,
+    status,
+    reason,
+  });
+  span.end(status, reason);
+  await ExecutionSpan.post(span);
+}
+
+export async function postCommandSpan(cmd, status = "success", reason = null) {
+  const span = new ExecutionSpan({
+    type: "cmd",
+    name: cmd,
+    status,
+    reason,
+  });
+  span.end(status, reason);
+  await ExecutionSpan.post(span);
+}
+
+export async function postPluginSpan(pluginName, status = "success", reason = null) {
+  const span = new ExecutionSpan({
+    type: "plugin",
+    name: pluginName,
+    status,
+    reason,
+  });
+  span.end(status, reason);
+  await ExecutionSpan.post(span);
+}

package/src/index.js

@@ -149,9 +149,11 @@ export function start(opts = {}) {
     process.env.STRATOS_APP_NAME ||
     process.env.npm_package_name ||
     "agent";
-  const heartbeatMs = Number(
+  // P1-03: Prevent STRATOS_HEARTBEAT_MS=0 from disabling heartbeat (unblockable agent)
+  // Minimum 1s to allow normal config but prevent 0
+  const heartbeatMs = Math.max(1000, Number(
     opts.heartbeatMs || process.env.STRATOS_HEARTBEAT_MS || 30000
-  );
+  ));
 
   if (!token) {
     console.warn(
@@ -161,13 +163,25 @@ export function start(opts = {}) {
   }
   started = true;
 
+  // Display SDK version on app startup
+  const SDK_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+  console.log(`[stratos] Stratos SDK v${SDK_VERSION} initialized`);
+
   const ingest = `${origin}/api/ingest`;
   const heartbeatUrl = `${origin}/api/heartbeat`;
 
+  // P1-04: Helper to check if a feature flag is enabled (matches Vercel AI convention)
+  function flagEnabled(key) {
+    const val = process.env[key];
+    return val !== "0" && val !== "false";
+  }
+
   traceloop.initialize({
     appName,
     disableBatch: true,
     logLevel: process.env.STRATOS_DEBUG ? "debug" : undefined,
+    // P1-04: Respect STRATOS_RECORD_INPUTS/OUTPUTS for all frameworks (not just Vercel AI)
+    traceContent: flagEnabled('STRATOS_RECORD_INPUTS') && flagEnabled('STRATOS_RECORD_OUTPUTS'),
     exporter: new OTLPTraceExporter({
       url: ingest,
       headers: { "x-stratos-token": token },
@@ -232,7 +246,14 @@ export function start(opts = {}) {
       },
       body: JSON.stringify(meta),
     })
-      .then((r) => r.json().catch(() => null))
+      .then((r) => {
+        // P1-03: Treat 401/403 (revoked token) as blocked state
+        if (r.status === 401 || r.status === 403) {
+          setBlocked(true, "token revoked or unauthorized");
+          return null;
+        }
+        return r.json().catch(() => null);
+      })
       .then((data) => {
         if (!data || typeof data.blocked !== "boolean") return;
         setBlocked(data.blocked, data.reason);

package/src/inspect-langchain.js

@@ -9,7 +9,7 @@
 //   npx stratos-inspect --fix --yes
 
 import { createRequire } from "node:module";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { createInterface } from "node:readline";
@@ -317,6 +317,12 @@ export async function fixLangChain(opts = {}) {
   console.log(`\n[stratos-inspect] Using package manager: ${pm}`);
   console.log(`[stratos-inspect] Uninstalling old LangChain packages…`);
 
+  // P1-07: Back up package.json and lockfile before making changes
+  const pkgPath = join(cwd, "package.json");
+  const lockPath = join(cwd, `${pm}-lock.${pm === "yarn" ? "yaml" : pm === "bun" ? "lock" : "json"}`);
+  const pkgBackup = readFileSync(pkgPath, "utf8");
+  const lockBackup = existsSync(lockPath) ? readFileSync(lockPath, "utf8") : null;
+
   let uninstallOk = true;
   if (toRemove.length) {
     if (pm === "npm") {
@@ -353,9 +359,23 @@ export async function fixLangChain(opts = {}) {
     installOk = runPm("bun", ["add", ...installList], cwd);
   }
 
+  // P1-07: If install failed, restore backups to leave project in consistent state
+  if (!installOk) {
+    console.log(`[stratos-inspect] Restoring package.json and lockfile…`);
+    writeFileSync(pkgPath, pkgBackup);
+    if (lockBackup) writeFileSync(lockPath, lockBackup);
+    return {
+      ok: false,
+      step: "install",
+      plan,
+      reportBefore: report,
+      message: "Install failed — backups restored. Fix manually and re-run stratos-inspect --fix",
+    };
+  }
+
   const after = inspectLangChain({ cwd });
   return {
-    ok: installOk && after.status === "ok",
+    ok: after.status === "ok",
     step: "install",
     plan,
     reportBefore: report,

package/src/mcp-proxy.js

@@ -21,7 +21,8 @@
 // CRITICAL: stdout is the MCP channel — keep it clean. Route all logging to stderr.
 console.log = console.info = (...a) => process.stderr.write(a.map(String).join(" ") + "\n");
 
-import { spawn } from "node:child_process";
+// P1-06: Use cross-spawn to safely handle arguments on Windows (avoids shell injection)
+import spawn from "cross-spawn";
 import { randomBytes } from "node:crypto";
 // The network guard installed by register.js (see enforcement.js) patches
 // THIS process's fetch/http — it has no effect on the target MCP server, which
@@ -98,10 +99,21 @@ hbTimer.unref?.();
 
 const pendingCalls = new Map();
 
-const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "inherit"], shell: process.platform === "win32" });
+// P1-06: cross-spawn handles Windows paths transparently without shell
+const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "inherit"] });
 child.on("error", (e) => { process.stderr.write(`[stratos-proxy] failed to start target: ${e.message}\n`); process.exit(1); });
 child.on("exit", (code) => { try { heartbeat(); clearInterval(hbTimer); } catch {} process.exit(code == null ? 0 : code); });
 
+// P1-05: Forward signals to child process and handle cleanup
+for (const sig of ["SIGINT", "SIGTERM"]) {
+  process.on(sig, () => {
+    if (child.pid && !child.killed) {
+      child.kill(sig);
+      setTimeout(() => { if (!child.killed) child.kill("SIGKILL"); }, 2000);
+    }
+  });
+}
+
 linePump(process.stdin, (line) => {
   let m; try { m = JSON.parse(line); } catch { child.stdin.write(line + "\n"); return; }
   if (m && m.id != null && m.method === "tools/call") {
@@ -148,5 +160,11 @@ function linePump(stream, onLine) {
       if (line.trim()) onLine(line);
     }
   });
-  stream.on("end", () => { if (buf.trim()) onLine(buf); });
+  stream.on("end", () => {
+    if (buf.trim()) onLine(buf);
+    // P1-05: When host disconnects (stdin ends), close child's stdin to signal EOF
+    if (stream === process.stdin && child.stdin) {
+      child.stdin.end();
+    }
+  });
 }