Plumb the exec request's stdin through sandbox.ExecContext so agent prompts leave the shell's argv

[waynesun09]

What happened

sandbox.ExecContext / ExecStreamReader run openshell sandbox exec … -- sh -c <command> and wire no stdin at all, so every caller that needs to hand text to a process in the sandbox builds it into the command string:

• internal/runtime/codex_run.go — printf '%s' <quoted prompt> | codex exec … -
• internal/runtime/steer_session.go — printf '%s\n' <quoted line> >> <mailbox> for the steer mailbox (feat(dispatch)!: steer the agent run already in flight on work-item updates #6959)

The text never reaches the agent CLI's own argv, which is what those comments were guarding against, but it is in the intermediate sh -c argv: readable in /proc inside the sandbox by the sandbox user, and included in OpenShell's host-side command preview (first ~120 chars). The text is attacker-influenced (PR bodies, comments, commit messages, validation failures), so it is worth keeping out of both.

Inside the sandbox the reader is the agent itself, which is the intended recipient, so this is not a privilege boundary today. It becomes one as soon as a second, less-trusted process shares a sandbox, and the log preview is a disclosure regardless.

Proposed change

Add an optional stdin payload to the sandbox exec helpers (the OpenShell exec request already carries a stdin field) and use it for:

• the codex prompt (- sentinel already reads stdin)
• the steer mailbox write, which becomes cat >> <mailbox> with the line on stdin

Then the "never argv" claim in ADR 0101 and in the codex runtime comments is true as written.

Validation criteria

ps//proc inside the sandbox during a run shows no prompt or steer text in any command line, and an OpenShell command preview for those execs contains none either.

Refs #6959, ADR 0101.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 6:25 PM UTC · Completed 6:29 PM UTC

Commit: 48eac1a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.81

[fullsend-ai-triage]

Severity: medium — defense-in-depth hardening. No privilege boundary is crossed today, but the OpenShell command preview is an unconditional disclosure, and the /proc exposure becomes a real vector if multi-tenant sandboxes land.

Proposed test case

func TestExecContext_StdinNotInArgv(t *testing.T) {
    // When executing a command with sensitive text provided via stdin
    // Then the openshell command-line args must NOT contain the payload
    // and the command must still receive the text on stdin.
    //
    // Edge cases:
    // - nil stdin reader: no regression, behaves like current ExecContext
    // - multi-line / binary stdin: passed faithfully
    // - timeout still fires with stdin provided
}

Note on #6959: The steer-session caller (steer_session.go) is part of the in-flight steer feature (#6959). The codex prompt path in codex_run.go can be plumbed independently; the steer path can follow when #6959 merges.

---

Labels: Security hardening of sandbox exec touching runner and sandbox components, with medium priority as it is defense-in-depth.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance