Pass every Claude goal to the CLI as a structured message

[ppXD]

Summary

• On a text stdin the pinned Claude CLI 2.1.263 acts on the goal before the model sees it, in plan mode as in bypass. It reads every @path in the goal into the model request and the session transcript: absolute and ~ paths, directory listings, symlinks out of the workspace, and ~/.mcp.json, which under bubblewrap is the run's MCP declaration and token. It also runs a goal that starts with /word as a command: /security-review runs git, and an unknown word ends the run with exit 0 and no model turn, which the run records as Completed. ClaudeCodeHarness.BuildInvocation (backend/src/CodeSpace.Core/Services/Agents/Harnesses/Claude/ClaudeCodeHarness.cs) now passes --input-format stream-json and writes one NDJSON user message. The goal is the first text block, byte for byte; the constant Begin with the task above. is the last. The CLI parses mentions and commands only from the last block. Fresh, --resume, revise and reviewer prompts all take this path.
• A goal the CLI would treat as blank is refused. In a structured message the CLI drops a block that JavaScript's trim() empties (U+FEFF and every Zs included), then runs the model on the trailer alone and reports success. IsBlankToTheCli treats .NET whitespace plus U+FEFF as blank. Invisible characters the CLI keeps (U+200B, U+3164) are still sent.
• The message is serialized with relaxed escaping because the launch pipe re-encodes stdin with its own JSON encoder: non-ASCII text is escaped once, by the pipe. Characters the message must escape itself (quotes, backslashes, control characters, U+FEFF/U+2028, non-BMP characters) are escaped again on the pipe and cost at most twice the goal's pipe size. Launch-size accounting measures the encoded message.

Test plan

• Unit: argv and message shape; 9 adversarial goals reach the first block byte for byte; trailer pinned; blank refusal, including U+FEFF, and a theory over every character ECMAScript trim() removes; U+200B/U+3164 still sent; non-ASCII escaped once and JSON-escaped characters bounded at 2x on the pipe; launch preflight measures the message. Full unit suite: 11755 passed, 1 skipped.
• Integration: the real executor hands the goal through byte for byte, and a shared awk goal reader with a drift detector covers the 6 Claude-dialect fake CLIs. The 21 classes that exercise the Claude harness: 405 passed, 1 skipped.
• E2E GoalChannelE2ETests (real CLI 2.1.263, stub model on loopback, fake secrets): mentions, resumed session, /fix, /security-review. 4/4 in plan mode and 4/4 in bypass on macOS. The text-channel positive control reads all 14 planted secrets. For a slash word it must reach its result with no model turn and record the word as its own command; mutations with empty control stdin or an unknown control flag turn it red.
• Linux sandbox-isolation lanes: root (bwrap, floor 96) and non-root uid 1654 (floor 15), each with the four [goal-channel-e2e] ran markers