@sagentlab/navarch-runtime 0.1.85 → 0.1.86

package/README.md

@@ -677,21 +677,22 @@ not the account's subscription charge or long-context/fast-mode uplifts.
 
 
 The Codex CLI invocation was verified against `codex-cli 0.144.1` on
-2026-07-18. The runtime uses `codex exec "<prompt>" --json` and translates
+2026-07-18. The runtime uses `codex exec - --json` and translates
 the existing per-session MCP JSON into one-off `-c mcp_servers.*` overrides.
 Machine and lease credentials are referenced through environment variables,
 not placed in argv. The JSONL parser accepts the verified top-level
 `item.completed` / `turn.completed` shape and retains the older `msg`
 envelope as a compatibility fallback.
 
-The Gemini adapter uses official headless `--prompt` and `--output-format
-stream-json` flags. It resets pre-tool assistant text, retains the final
+The Gemini adapter runs headlessly with `--output-format stream-json` and the
+prompt piped on stdin, which Gemini uses as the prompt when stdin is not a
+TTY. It resets pre-tool assistant text, retains the final
 post-tool answer as the report, and reads aggregate `input_tokens` and
 `output_tokens` from the terminal `result` event. Gemini does not report USD
 cost, so an unknown value remains absent rather than becoming zero.
 
-The OpenCode adapter uses `opencode run "<prompt>" --format json`, closes
-stdin immediately, and normalizes `text` and `step_finish` JSONL events into
+The OpenCode adapter uses `opencode run --format json` with the prompt on
+stdin, and normalizes `text` and `step_finish` JSONL events into
 the shared report/token/cost boundary. It translates the lease MCP document
 to OpenCode's remote-server config with OAuth disabled and environment-backed
 headers. Missing accounting fields stay absent rather than becoming a
@@ -716,6 +717,12 @@ ships that server as `dsh --profile acp`. This is intentionally not the
 REST-based [Agent Communication Protocol](https://agentcommunicationprotocol.dev),
 which is a different protocol now maintained as part of A2A.
 
+Every CLI adapter writes the prompt to the agent's stdin, never argv. Linux
+rejects any single argv or environment string over 128 KiB
+(`MAX_ARG_STRLEN`), so an argv prompt made large review sessions fail with
+`spawn E2BIG` before the agent started. Docker-mode sessions forward the same
+stdin through `docker exec -i`.
+
 ## Architecture
 
 ```
@@ -733,12 +740,12 @@ cli.cts
                   into Docker when NAVARCH_SANDBOX_MODE=docker
                4. selectAdapter(config.agentType) (adapters/index.cts) picks one AgentAdapter
                   (adapters/types.cts) by NAVARCH_AGENT, then .run(...):
-                    - claudeCodeAdapter (adapters/claude.cts) — `claude -p <prompt> --mcp-config <path>`
-                    - codexAdapter      (adapters/codex.cts)  — `codex exec <prompt> --json -c mcp_servers.*=...`
-                    - geminiAdapter     (adapters/gemini.cts) — `gemini --prompt <prompt> --output-format stream-json`
-                    - openCodeAdapter   (adapters/opencode.cts) — `opencode run <prompt> --format json`
+                    - claudeCodeAdapter (adapters/claude.cts) — `claude -p --mcp-config <path> < prompt`
+                    - codexAdapter      (adapters/codex.cts)  — `codex exec - --json -c mcp_servers.*=... < prompt`
+                    - geminiAdapter     (adapters/gemini.cts) — `gemini --output-format stream-json < prompt`
+                    - openCodeAdapter   (adapters/opencode.cts) — `opencode run --format json < prompt`
                     - acpAdapter        (adapters/acp.cts) — ACP v1 JSON-RPC/stdio; defaults to `dsh --profile acp`
-                    - qoderAdapter      (adapters/qoder.cts) — `qoder -p <prompt> --output-format json`
+                    - qoderAdapter      (adapters/qoder.cts) — `qoder -p --output-format json < prompt`
                   heartbeating the lease every NAVARCH_LEASE_HEARTBEAT_INTERVAL_MS throughout either;
                   a failed heartbeat aborts the run (kills the process) and marks the outcome as lease-lost
                5. mapExitCondition (exit-conditions.cts) → redact.cts scrubs the transcript → upload.cts PUTs it

package/dist/adapters/claude.cjs

@@ -13,8 +13,10 @@ function hasFlag(args, flag) {
 }
 /**
  * Headless Claude Code adapter (project-plan.md §3.9 / implementation-plan.md
- * WP-07): `claude -p "<context bundle>" --mcp-config platform-mcp.json
- * --output-format json`. Returns raw stdout/stderr/exit signals (plus
+ * WP-07): `claude -p --mcp-config platform-mcp.json --output-format json`
+ * with the context bundle on stdin (`claude -p` reads its prompt from stdin
+ * when none is given; Linux rejects any single argv string over 128 KiB, so
+ * an argv prompt failed `spawn E2BIG` before Claude started). Returns raw stdout/stderr/exit signals (plus
  * best-effort tokensIn/tokensOut/costUsd parsed from the JSON result -- see
  * exit-conditions.cts#parseClaudeJsonResult) for exit-conditions.cts to map
  * onto a complete()/fail() call.
@@ -91,7 +93,7 @@ function addUsage(first, second) {
     return first === undefined && second === undefined ? undefined : (first ?? 0) + (second ?? 0);
 }
 async function runClaudeAttempt(options, automaticFallback) {
-    const args = ["-p", options.prompt];
+    const args = ["-p"];
     const hasSettingSources = options.extraArgs.some((arg) => arg === "--setting-sources" || arg.startsWith("--setting-sources="));
     const hasExplicitPermissionMode = options.extraArgs.some((arg) => ["--permission-mode", "--permission-prompt-tool", "--dangerously-skip-permissions"].some((flag) => arg === flag || arg.startsWith(`${flag}=`)));
     // Runtime sessions must not inherit an operator's personal or project-local
@@ -180,11 +182,11 @@ async function runOnHost(options, args) {
             cwd: options.cwd,
             env: { ...process.env, ...options.env },
         });
-        // `claude -p` checks stdin for an additional piped prompt. Node opens a
-        // pipe by default, so close it immediately when the complete prompt was
-        // supplied as an argument. Leaving it open makes Claude wait and emit a
-        // "no stdin data received" warning that the runtime treats as failure.
-        child.stdin?.end();
+        // `claude -p` reads the whole prompt from stdin and starts at EOF. A
+        // child that exits before reading surfaces through `close`; ignore the
+        // resulting EPIPE here.
+        child.stdin?.on("error", () => undefined);
+        child.stdin?.end(options.prompt);
         options.onProcessStarted?.(child.pid);
         const timer = options.timeoutMs > 0 ? setTimeout(() => {
             timedOut = true;
@@ -234,7 +236,9 @@ async function runViaDocker(options, args) {
     if (options.signal?.aborted)
         onAbort();
     try {
-        const result = await runner.run("docker", ["exec", containerName, "sh", "-c", command], {
+        // `-i` forwards the prompt to `claude -p` on stdin (see runOnHost).
+        const result = await runner.run("docker", ["exec", "-i", containerName, "sh", "-c", command], {
+            input: options.prompt,
             timeoutMs: options.timeoutMs,
             onActivity: options.onActivity,
             signal: options.signal,

package/dist/adapters/codex.cjs

@@ -24,8 +24,8 @@ const kill_agent_cjs_1 = require("../kill-agent.cjs");
  * - `exec <prompt>` — ASSUMED to be Codex CLI's non-interactive/headless
  *   subcommand (the `codex exec` "automation mode" analog of `claude -p`):
  *   runs the prompt to completion without the interactive TUI and exits,
- *   printing its result to stdout. On the host the prompt is `-` and arrives
- *   on stdin: Linux rejects any single argv string over 128 KiB
+ *   printing its result to stdout. The prompt is `-` and arrives on stdin
+ *   (through `docker exec -i` in sandbox mode): Linux rejects any single argv string over 128 KiB
  *   (MAX_ARG_STRLEN), so a large review prompt failed `spawn E2BIG` before
  *   Codex started (tobi-agent-5571, 2026-10-06).
  * - `--json` emits top-level `thread.started`, `turn.started`,
@@ -48,7 +48,7 @@ const kill_agent_cjs_1 = require("../kill-agent.cjs");
  *   approval-bypass flag) without an adapter code change.
  */
 async function runCodexAdapter(options) {
-    const args = ["exec", options.dockerExec ? options.prompt : "-"];
+    const args = ["exec", "-"];
     const env = { ...options.env };
     if (options.mcpConfigPath)
         args.push(...(await codexMcpArgs(options.mcpConfigPath, env)));
@@ -233,7 +233,8 @@ async function runViaDocker(options, args) {
         // variable names in argv. This keeps generated MCP bearer/header values
         // out of `ps` while making the host and Docker paths equivalent.
         const forwardedEnv = Object.keys(options.env).flatMap((name) => ["--env", name]);
-        const result = await runner.run("docker", ["exec", ...forwardedEnv, containerName, "sh", "-c", command], {
+        const result = await runner.run("docker", ["exec", "-i", ...forwardedEnv, containerName, "sh", "-c", command], {
+            input: options.prompt,
             timeoutMs: options.timeoutMs,
             onActivity: options.onActivity,
             signal: options.signal,

package/dist/adapters/gemini.cjs

@@ -14,9 +14,13 @@ const kill_agent_cjs_1 = require("../kill-agent.cjs");
  * The CLI reads MCP servers from settings rather than accepting Claude's
  * `--mcp-config` flag. The adapter converts the lease-scoped config into a
  * temporary system-settings file and restricts the run to those server names.
+ *
+ * The prompt arrives on stdin rather than `--prompt`: Gemini runs headlessly
+ * whenever stdin is not a TTY and uses the piped text as the prompt, and
+ * Linux rejects any single argv string over 128 KiB (`spawn E2BIG`).
  */
 async function runGeminiAdapter(options) {
-    const args = ["--prompt", options.prompt];
+    const args = [];
     const env = { ...options.env };
     if (!hasArg(options.extraArgs, "--output-format", "-o")) {
         args.push("--output-format", "stream-json");
@@ -157,7 +161,9 @@ async function runOnHost(options, args) {
             cwd: options.cwd,
             env: { ...process.env, ...options.env },
         });
-        child.stdin?.end();
+        // Ignore EPIPE from a child that exits before reading; `close` reports it.
+        child.stdin?.on("error", () => undefined);
+        child.stdin?.end(options.prompt);
         options.onProcessStarted?.(child.pid);
         const timer = options.timeoutMs > 0 ? setTimeout(() => {
             timedOut = true;
@@ -207,7 +213,8 @@ async function runViaDocker(options, args) {
         onAbort();
     try {
         const forwardedEnv = Object.keys(options.env).flatMap((name) => ["--env", name]);
-        const result = await runner.run("docker", ["exec", ...forwardedEnv, containerName, "sh", "-c", command], { timeoutMs: options.timeoutMs,
+        const result = await runner.run("docker", ["exec", "-i", ...forwardedEnv, containerName, "sh", "-c", command], { input: options.prompt,
+            timeoutMs: options.timeoutMs,
             onActivity: options.onActivity,
             signal: options.signal,
             env: { ...process.env, ...options.env },

package/dist/adapters/opencode.cjs

@@ -16,7 +16,12 @@ const kill_agent_cjs_1 = require("../kill-agent.cjs");
  * Headless OpenCode adapter, fixture-pinned to the OpenCode JSON/config
  * contract shared by V1 and V2 (verified against 2.0.6):
  *
- *   opencode run "<prompt>" --format json [--model provider/model[#variant]]
+ *   opencode run --format json [--model provider/model[#variant]]  < prompt
+ *
+ * The prompt goes in on stdin, which `opencode run` reads as the message when
+ * none is given (verified against 2.0.17). Linux rejects any single argv
+ * string over 128 KiB (`spawn E2BIG`), and an argv prompt also let an
+ * agent's `pkill -f <word>` match the CLI itself (#1587).
  *
  * OpenCode merges configuration from several machine and project locations,
  * so each Navarch session gets an isolated XDG/config directory, disables
@@ -56,7 +61,7 @@ async function runOpenCodeAdapter(options) {
     const binaryKey = `${options.dockerExec ? "docker:" : ""}${options.bin ?? "opencode"}`;
     const defaultLogLevel = !hasArg(options.extraArgs, "--log-level");
     const logLevel = defaultLogLevel ? (openCodeLogLevels.get(binaryKey) ?? "ERROR") : null;
-    const args = ["run", options.prompt];
+    const args = ["run"];
     if (/^\s*--standalone\b/m.test(help.stdout) && !hasArg(options.extraArgs, "--standalone")) {
         args.push("--standalone");
     }
@@ -76,7 +81,9 @@ async function runOpenCodeAdapter(options) {
         // use the model's own default.
         args.push("--model", options.reasoningEffort ? `${options.model}#${options.reasoningEffort}` : options.model);
     }
-    const run = (runArgs) => runOptions.dockerExec ? runViaDocker(runOptions, runArgs) : runOnHost(runOptions, runArgs);
+    const run = (runArgs) => runOptions.dockerExec
+        ? runViaDocker(runOptions, runArgs, options.prompt)
+        : runOnHost(runOptions, runArgs, options.prompt);
     let raw = await run(args);
     if (logLevel && raw.exitCode !== 0 && isLogLevelRejection(raw.stderr)) {
         // The CLI rejected our default before starting any work, so one retry with
@@ -315,7 +322,8 @@ function capacityMonitor(onLimit) {
         },
     };
 }
-async function runOnHost(options, args) {
+/** `input` is written to the child's stdin; the `run --help` probe sends none. */
+async function runOnHost(options, args, input = "") {
     return new Promise((resolve) => {
         let stdout = "";
         let stderr = "";
@@ -331,7 +339,9 @@ async function runOnHost(options, args) {
             capacityError ??= detail;
             (0, kill_agent_cjs_1.killAgent)(child);
         });
-        child.stdin?.end();
+        // Ignore EPIPE from a child that exits before reading; `close` reports it.
+        child.stdin?.on("error", () => undefined);
+        child.stdin?.end(input);
         options.onProcessStarted?.(child.pid);
         const timer = options.timeoutMs > 0 ? setTimeout(() => {
             timedOut = true;
@@ -369,7 +379,7 @@ async function runOnHost(options, args) {
         });
     });
 }
-async function runViaDocker(options, args) {
+async function runViaDocker(options, args, input) {
     const { containerName, runner } = options.dockerExec;
     const quoted = [options.bin, ...args].map(shellQuote).join(" ");
     const command = `[ -f /tmp/session.env ] && . /tmp/session.env; cd repo 2>/dev/null; ${quoted}`;
@@ -394,7 +404,8 @@ async function runViaDocker(options, args) {
         onAbort();
     try {
         const forwardedEnv = Object.keys(options.env).flatMap((name) => ["--env", name]);
-        const result = await runner.run("docker", ["exec", ...forwardedEnv, containerName, "sh", "-c", command], { timeoutMs: options.timeoutMs,
+        const result = await runner.run("docker", ["exec", ...(input === undefined ? [] : ["-i"]), ...forwardedEnv, containerName, "sh", "-c", command], { input,
+            timeoutMs: options.timeoutMs,
             onActivity: options.onActivity,
             signal: controller.signal,
             onStdout: (chunk) => { streamed.stdout = true; monitor.push("stdout", chunk); },

package/dist/adapters/pi-local.cjs

@@ -14,7 +14,8 @@ async function runLocalPiAdapter(options) {
         "--model", model.includes("/") ? model : `local/${model}`];
     if (options.reasoningEffort)
         args.push("--thinking", options.reasoningEffort === "max" ? "xhigh" : options.reasoningEffort);
-    args.push("-p", options.prompt);
+    // The prompt goes in on stdin (pi.cts runOnHost), never argv.
+    args.push("-p");
     return (0, pi_cjs_1.attachPiOutput)(await (0, pi_cjs_1.runOnHost)(options, args, true));
 }
 exports.localPiAdapter = { agentType: "pi-local", run: runLocalPiAdapter };

package/dist/adapters/pi.cjs

@@ -19,9 +19,11 @@ const kill_agent_cjs_1 = require("../kill-agent.cjs");
 /**
  * Headless Pi coding-agent adapter (#885) — the process-side twin of the
  * Cloudflare hosted executor (worker/hosted-pi/lifecycle.ts). It invokes
- * `pi --mode json -p <prompt>` against DeepSeek V4 through a generated
+ * `pi --mode json -p < prompt` against DeepSeek V4 through a generated
  * OpenAI-compatible custom-provider config and normalizes the JSON event
- * stream into the common AdapterResult boundary.
+ * stream into the common AdapterResult boundary. `-p` is Pi's print flag and
+ * the prompt arrives on stdin, as in the hosted executor (#1587): Linux
+ * rejects any single argv string over 128 KiB (`spawn E2BIG`).
  *
  * Hosted Pi is control-plane provisioned (docs/navarch/runtime-adapter-contract.md
  * — "Hosted Pi is not a fifth AgentAdapter" for BYO workers): config.cts
@@ -254,7 +256,7 @@ async function runPiAdapter(options) {
         // than passing an invalid value that Pi warns about and ignores.
         args.push("--thinking", options.reasoningEffort === "max" ? "xhigh" : options.reasoningEffort);
     }
-    args.push("-p", options.prompt);
+    args.push("-p");
     const raw = options.dockerExec
         ? await runViaDocker(options, args)
         : await runOnHost(options, args);
@@ -325,7 +327,9 @@ async function runOnHost(options, args, local = false) {
                 cwd: options.cwd,
                 env: { ...process.env, ...env },
             });
-            child.stdin?.end();
+            // Ignore EPIPE from a child that exits before reading; `close` reports it.
+            child.stdin?.on("error", () => undefined);
+            child.stdin?.end(options.prompt);
             options.onProcessStarted?.(child.pid);
             const timer = options.timeoutMs > 0 ? setTimeout(() => {
                 timedOut = true;
@@ -400,7 +404,8 @@ async function runViaDocker(options, args) {
         onAbort();
     try {
         const forwardedEnv = Object.keys(options.env).flatMap((name) => ["--env", name]);
-        const result = await runner.run("docker", ["exec", ...forwardedEnv, containerName, "sh", "-c", command], {
+        const result = await runner.run("docker", ["exec", "-i", ...forwardedEnv, containerName, "sh", "-c", command], {
+            input: options.prompt,
             timeoutMs: options.timeoutMs,
             onActivity: options.onActivity,
             signal: options.signal,

package/dist/adapters/qoder.cjs

@@ -9,7 +9,10 @@ function hasFlag(args, flag) {
     return args.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
 }
 /**
- * Headless Qoder CLI adapter: `qoder -p "<prompt>" --output-format json`.
+ * Headless Qoder CLI adapter: `qoder -p --output-format json < prompt`.
+ * Like `claude -p`, print mode reads the prompt from stdin when no query is
+ * given (verified against qodercli 1.1.64), which keeps large prompts clear
+ * of Linux's 128 KiB per-argv-string limit (`spawn E2BIG`).
  * Qoder's print mode emits the same single-JSON result shape as Claude Code
  * (verified against qodercli 1.1.56), so usage/cost parsing reuses
  * parseClaudeJsonResult and its result text lands in the ordinary
@@ -24,7 +27,7 @@ async function runQoderAdapter(options) {
     if (options.signal?.aborted) {
         return { exitCode: null, timedOut: false, killedByLeaseLoss: true, stdout: "", stderr: "" };
     }
-    const args = ["-p", options.prompt];
+    const args = ["-p"];
     // Runtime sessions must not inherit an operator's personal or project-local
     // Qoder hooks, for the same reason as the Claude adapter: they make
     // execution machine-dependent and can fail otherwise-good sessions. The
@@ -81,9 +84,10 @@ async function runOnHost(options, args) {
             cwd: options.cwd,
             env: { ...process.env, ...options.env },
         });
-        // `qoder -p` checks stdin for a piped prompt; close it so the child does
-        // not wait when the complete prompt was supplied as an argument.
-        child.stdin?.end();
+        // `qoder -p` reads the whole prompt from stdin and starts at EOF. A child
+        // that exits before reading surfaces through `close`; ignore the EPIPE.
+        child.stdin?.on("error", () => undefined);
+        child.stdin?.end(options.prompt);
         options.onProcessStarted?.(child.pid);
         const timer = options.timeoutMs > 0 ? setTimeout(() => {
             timedOut = true;
@@ -130,7 +134,9 @@ async function runViaDocker(options, args) {
     if (options.signal?.aborted)
         onAbort();
     try {
-        const result = await runner.run("docker", ["exec", containerName, "sh", "-c", command], {
+        // `-i` forwards the prompt to `qoder -p` on stdin (see runOnHost).
+        const result = await runner.run("docker", ["exec", "-i", containerName, "sh", "-c", command], {
+            input: options.prompt,
             timeoutMs: options.timeoutMs,
             onActivity: options.onActivity,
             signal: options.signal,

package/dist/sandbox.cjs

@@ -61,6 +61,9 @@ exports.nodeCommandRunner = {
                 cleanup();
                 resolve({ code: code ?? -1, stdout, stderr });
             });
+            // A child that exits before reading all input (e.g. `docker exec -i`
+            // carrying an agent prompt) raises EPIPE here; `close` reports the exit.
+            child.stdin?.on("error", () => undefined);
             if (opts.input !== undefined) {
                 child.stdin?.write(opts.input);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.85",
+  "version": "0.1.86",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",