feat(cli): stream non-TTY exec input before EOF

crates/openshell-cli/src/main.rs

@@ -1702,6 +1702,13 @@ enum SandboxCommands {
         #[arg(long, overrides_with = "tty")]
         no_tty: bool,
 
+        /// Stream stdin as it arrives without allocating a pseudo-terminal.
+        /// Starts the command before stdin closes. Input is limited to 4 MiB
+        /// per command. Exceeding the limit cancels execution; input may already
+        /// have been processed.
+        #[arg(long, conflicts_with = "tty")]
+        stream_stdin: bool,
+
         /// Run the command without sourcing shell login/profile startup files.
         ///
         /// Default sources them so tool-specific env (`VIRTUAL_ENV`, etc.) is
@@ -3574,6 +3581,7 @@ async fn run_async() -> Result<()> {
                             timeout,
                             tty,
                             no_tty,
+                            stream_stdin,
                             envs,
                             command,
                             no_login_shell,
@@ -3595,6 +3603,7 @@ async fn run_async() -> Result<()> {
                                 workdir.as_deref(),
                                 timeout,
                                 tty_override,
+                                stream_stdin,
                                 &env_map,
                                 no_login_shell,
                                 &tls,
@@ -4205,6 +4214,55 @@ mod tests {
     use std::ffi::OsString;
     use std::fs;
 
+    #[test]
+    fn sandbox_exec_stream_stdin_is_explicit() {
+        for flags in [
+            vec![],
+            vec!["--stream-stdin"],
+            vec!["--stream-stdin", "--no-tty"],
+            vec!["--no-tty", "--stream-stdin"],
+            vec!["--stream-stdin", "--tty", "--no-tty"],
+            vec!["--tty", "--no-tty", "--stream-stdin"],
+        ] {
+            let mut args = vec!["openshell", "sandbox", "exec", "-n", "sandbox-1"];
+            args.extend(flags.iter().copied());
+            args.extend(["--", "cat"]);
+            let cli = Cli::try_parse_from(args).expect("exec options should parse");
+            let Some(Commands::Sandbox {
+                command:
+                    Some(SandboxCommands::Exec {
+                        stream_stdin,
+                        tty,
+                        no_tty,
+                        ..
+                    }),
+            }) = cli.command
+            else {
+                panic!("expected sandbox exec");
+            };
+            assert_eq!(stream_stdin, flags.contains(&"--stream-stdin"));
+            assert!(!tty);
+            assert_eq!(no_tty, flags.contains(&"--no-tty"));
+        }
+    }
+
+    #[test]
+    fn sandbox_exec_stream_stdin_conflicts_with_tty() {
+        for flags in [
+            vec!["--stream-stdin", "--tty"],
+            vec!["--tty", "--stream-stdin"],
+            vec!["--stream-stdin", "--no-tty", "--tty"],
+            vec!["--no-tty", "--tty", "--stream-stdin"],
+        ] {
+            let mut args = vec!["openshell", "sandbox", "exec", "-n", "sandbox-1"];
+            args.extend(flags);
+            args.extend(["--", "cat"]);
+            let error =
+                Cli::try_parse_from(args).expect_err("streaming stdin must not allocate a PTY");
+            assert_eq!(error.kind(), clap::error::ErrorKind::ArgumentConflict);
+        }
+    }
+
     #[test]
     fn policy_update_parses_explicit_l7_scope_and_endpoint_path() {
         let cli = Cli::try_parse_from([