fix(exec): prompt on stdin TTY even with stdout piped

Author: TheGreatAxios

docs/ARCHITECTURE.md

@@ -131,7 +131,7 @@ A worker deny-on-ask registers a harness-owned denied-call envelope (`src/permis
 - Bootstrap consumes the shared session assembly (`src/session/assemble-runtime.ts`, layered over `src/session/runtime-assembly.ts`) instead of hand-wiring a second copy. Intentional deltas vs TUI:
   - No workflow controller (`isWorkflowActive` is always false)
   - Non-interactive permission gate by default
-  - `ask_operator` is unmounted when stdin/stdout are not TTYs (no cancel stub on the wire); TTY exec still prompts on stdin
+  - `ask_operator` is unmounted when stdin is not a TTY (no cancel stub on the wire); TTY-stdin exec still prompts on stdin even with stdout piped
   - MCP connect is awaited before workflow resume and first inference, abort-capped at 15s so a hung handshake cannot block the run. A rejected batch does not disarm that abort while sibling dials are still in flight. A 1s log fires if connect is still in progress; remaining dials keep running until settle or abort. The TUI still fire-and-forgets connect (no rewrite). `tool_search` does not treat an empty catalog as a definitive miss while servers are still connecting.
 - Entry: `corbits exec "prompt"` (alias `corbits run`); `loadConfig` sets `command: "exec"`
 - Streams assistant text deltas to stdout; lifecycle errors to stderr

src/exec/runner.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
 import type { AgentTool } from "@intx/agent";
 import { submitOutputDefinition } from "../agent/director.js";
 import { DIRECTOR_REGISTRY } from "../agent/directors/registry.js";
@@ -19,6 +19,7 @@ import {
 } from "../auth/codex/session.js";
 import type { Config } from "../config/index.js";
 import { CREDENTIAL_FAILURE_USER_MESSAGE } from "../inference-error-message.js";
+import type { PermissionRequest } from "../permission/types.js";
 import {
   clearActiveRun,
   getActiveRun,
@@ -44,9 +45,11 @@ import {
   createExecToolPromoter,
   execUserFailureMessage,
   isExecOverlayToolAllowed,
+  promptPermission,
   refreshSelectedProviderCredential,
   resolveExecDirectorOverlay,
   resolveExecDirectorOverlayForPackage,
+  resolveExecInteractive,
   runExec,
 } from "./runner.js";
 
@@ -815,3 +818,63 @@ describe("exec tool call gate and promoter", () => {
     ).not.toContain("list_dir");
   });
 });
+
+describe("exec permission prompt gating (CL-9002)", () => {
+  test("piped stdout with a stdin TTY still prompts", () => {
+    expect(resolveExecInteractive({ stdinTTY: true, stdoutTTY: false })).toBe(
+      true,
+    );
+  });
+
+  test("full TTY prompts", () => {
+    expect(resolveExecInteractive({ stdinTTY: true, stdoutTTY: true })).toBe(
+      true,
+    );
+  });
+
+  test("headless stdin never prompts, whatever stdout is", () => {
+    expect(resolveExecInteractive({ stdinTTY: false, stdoutTTY: false })).toBe(
+      false,
+    );
+    expect(resolveExecInteractive({ stdinTTY: false, stdoutTTY: true })).toBe(
+      false,
+    );
+    expect(
+      resolveExecInteractive({ stdinTTY: undefined, stdoutTTY: true }),
+    ).toBe(false);
+  });
+
+  test("headless permission seam fails closed with an explicit stderr denial", async () => {
+    const request: PermissionRequest = {
+      tool: "run_shell",
+      action: "Run shell",
+      subject: "rm -rf /tmp/work",
+      scopes: [],
+    };
+    const errWrites: string[] = [];
+    const outWrites: string[] = [];
+    const stderrSpy = spyOn(process.stderr, "write").mockImplementation(((
+      chunk: unknown,
+    ) => {
+      errWrites.push(String(chunk));
+      return true;
+    }) as typeof process.stderr.write);
+    const stdoutSpy = spyOn(process.stdout, "write").mockImplementation(((
+      chunk: unknown,
+    ) => {
+      outWrites.push(String(chunk));
+      return true;
+    }) as typeof process.stdout.write);
+    try {
+      const outcome = await promptPermission(request, false);
+      expect(outcome).toEqual({ allow: false });
+    } finally {
+      stderrSpy.mockRestore();
+      stdoutSpy.mockRestore();
+    }
+    const denial = errWrites.join("");
+    expect(denial).toContain("Run shell");
+    expect(denial).toContain("--dangerously-skip-permissions");
+    expect(outWrites).toEqual([]);
+  });
+});

src/exec/runner.ts

@@ -670,7 +670,10 @@ export async function runExec(config: Config): Promise<ExecResult> {
       resolveSessionMode(config.settings, localSettingsForMode) ??
       "orchestrator";
 
-    const interactive = input.isTTY === true && output.isTTY === true;
+    const interactive = resolveExecInteractive({
+      stdinTTY: input.isTTY,
+      stdoutTTY: output.isTTY,
+    });
 
     if (config.skipPermissionsFromSettings) {
       stderr.write(
@@ -1407,6 +1410,21 @@ export async function runExec(config: Config): Promise<ExecResult> {
   }
 }
 
+/**
+ * Whether exec may prompt the operator. Permission and operator prompts read
+ * stdin and write stderr, so a piped stdout must not disable them: stdin TTY
+ * alone means an operator can answer. Fully headless (stdin not a TTY) fails
+ * closed — denials name the action and the remedy on stderr instead of
+ * prompting. stdoutTTY rides along so the call site stays explicit that a
+ * piped stdout is a supported prompting configuration, not an oversight.
+ */
+export function resolveExecInteractive(stdio: {
+  stdinTTY: boolean | undefined;
+  stdoutTTY: boolean | undefined;
+}): boolean {
+  return stdio.stdinTTY === true;
+}
+
 async function promptOperator(
   question: string,
   options: string[],
@@ -1432,11 +1450,22 @@ async function promptOperator(
   }
 }
 
-async function promptPermission(
+export async function promptPermission(
   request: PermissionRequest,
   interactive: boolean,
 ): Promise<ApprovalOutcome> {
-  if (!interactive) return { allow: false };
+  if (!interactive) {
+    // Fail closed and say so on stderr (never stdout: piped stdout may feed
+    // JSON consumers — see printResumeHint). A headless ask has no operator
+    // to answer, so the denial names the action and the bypass instead of
+    // vanishing into a generic block. Same sentence as the gate's
+    // non-interactive deny reasons (src/permission/gate.ts) by intent; the
+    // gate stays canonical for model-facing text, this seam for the operator.
+    stderr.write(
+      `Permission denied: ${request.action} requires operator approval, which is unavailable in a non-interactive run. Re-run with --dangerously-skip-permissions to bypass, or narrow the action.\n`,
+    );
+    return { allow: false };
+  }
   // Same freeze-while-deciding contract as the TUI gate: the tool wall-clock
   // budget must not run down while the operator reads the prompt.
   const budget = getToolApprovalBudget();