From 3b05b50b47db0c302bcdbf6b045aebb255dbd43a Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Wed, 29 Jul 2026 08:52:53 +0200 Subject: [PATCH] tools: pipe stdin JSON via heredoc for elevated calls The elevation broker protocol doesn't support stdin piping. When a promoted tool runs elevated, wrap the command as: cat <<'OLLIE_EOF' | /path/to/tool {json} OLLIE_EOF This ensures elevated tools receive their JSON args. --- pkg/tools/execute/server.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkg/tools/execute/server.go b/pkg/tools/execute/server.go index 9352ccf..0c2c408 100644 --- a/pkg/tools/execute/server.go +++ b/pkg/tools/execute/server.go @@ -306,7 +306,9 @@ func (e *Server) callPromotedTool(ctx context.Context, tool string, args json.Ra e.wdMu.RLock() workDir := e.cwd e.wdMu.RUnlock() - result, err = e.executeElevated(ctx, code, workDir, 30) + // Broker protocol has no stdin support; pipe JSON via heredoc. + elevatedCode := fmt.Sprintf("cat <<'OLLIE_EOF' | %s\n%s\nOLLIE_EOF", code, stdinData) + result, err = e.executeElevated(ctx, elevatedCode, workDir, 30) } else { result, err = e.executeWithStdin(ctx, code, "bash", 30, "default", false, stdinData) }