feat(bash): add stdin + extra env to the executor seam as a trusted-plugin surface

The hooks subsystem runs external hook commands the Claude Code / Codex way:
JSON payload on stdin, context in CLAUDE_PROJECT_DIR / CLAUDE_PLUGIN_ROOT env.
Reusing the ctx.bash seam for that needs two new inputs — but stdin and arbitrary
env are exactly what dsh-bash-local's credential scrub exists to keep away from
model-driven commands. So this adds them as a TRUSTED-PLUGIN surface:

- BashExecRequest + BashExecSpec gain optional `stdin` and `env`. They are plain
  optionals on the resolved spec (not required-but-nullable like `owner`): a
  missing one means "none", the safe default, not a security footgun.
- dsh-bash-local threads them through resolve/run/start. `env` merges AFTER the
  credential scrub, so a trusted caller's explicit entry wins even on a
  credential-shaped name — the scrub guards the harness's OWN ambient creds from
  model-driven commands, not a trusted plugin. stdin is always a pipe, closed
  immediately (with bytes when supplied, empty otherwise — EOF as before); an
  EPIPE from a child that exits without reading is swallowed.
- The model-facing dsh-tool-bash NEVER forwards model input into stdin/env (its
  request is command/workdir/timeoutMs/signal/owner only). A regression guard
  drives the real tool with adversarial args and asserts the request carries
  neither field — proven to go red if the consumer ever forwards them.

Configurable scrub (in an earlier sketch) is dropped as speculative: the explicit
`env` field already gives a trusted caller full control, and no caller needs to
broaden the ambient scrub. Documented in a new architecture RFC, the bash.md
type-equiv blocks, and the three bash READMEs.

packages/bash/bash-local/tests/executor.spec.ts

@@ -106,6 +106,23 @@ describe('LocalBashExecutor.run', () => {
     const { bash } = await setup()
     await expect(bash.run(bash.resolve({ command: 'true', workdir: '/nonexistent-dsh' }))).rejects.toThrow(/ENOENT/)
   })
+
+  it('resolve() carries stdin/env onto the spec, and run() threads them to the command', async () => {
+    const { bash } = await setup()
+    const spec = bash.resolve({ command: 'cat; echo "[$DSH_SEAM_VAR]"', stdin: 'piped\n', env: { DSH_SEAM_VAR: 'env-ok' } })
+    // resolve() keeps the trusted-plugin fields verbatim (optional, no default).
+    expect(spec.stdin).toBe('piped\n')
+    expect(spec.env).toEqual({ DSH_SEAM_VAR: 'env-ok' })
+    const result = await bash.run(spec)
+    expect(result.stdout.text).toBe('piped\n[env-ok]\n')
+  })
+
+  it('resolve() omits stdin/env when the request supplies neither', async () => {
+    const { bash } = await setup()
+    const spec = bash.resolve({ command: 'true' })
+    expect('stdin' in spec).toBe(false)
+    expect('env' in spec).toBe(false)
+  })
 })
 
 describe('LocalBashExecutor background tasks', () => {
@@ -131,6 +148,19 @@ describe('LocalBashExecutor background tasks', () => {
     await Promise.all([first.done, second.done])
   })
 
+  it('threads stdin and extra env into a background task', async () => {
+    const { bash } = await setup()
+    const task = bash.start(bash.resolve({
+      command: 'cat; echo "[$DSH_BG_VAR]"',
+      stdin: 'bg-stdin\n',
+      env: { DSH_BG_VAR: 'bg-env' },
+    }))
+    const read = await readUntil(bash, task.id, '[bg-env]')
+    expect(read.delta).toContain('bg-stdin')
+    await task.done
+    expect(task.exitCode).toBe(0)
+  })
+
   it('readOutput returns increments without re-delivery', async () => {
     const { bash } = await setup()
     const task = bash.start(bash.resolve({ command: 'echo first; sleep 1; echo second' }))

packages/bash/bash-local/tests/run.spec.ts

@@ -158,6 +158,49 @@ describe('runBash', () => {
   })
 })
 
+describe('stdin and extra env (trusted-plugin surface)', () => {
+  it('writes stdin to the command and closes it', async () => {
+    const result = await runBash(spec('cat', { stdin: 'hello from stdin\n' })).done
+    expect(result.exitCode).toBe(0)
+    expect(result.stdout.text).toBe('hello from stdin\n')
+  })
+
+  it('a command that reads stdin sees EOF when none is supplied', async () => {
+    // No stdin → the always-piped-but-empty stdin closes immediately, so `cat`
+    // reads EOF and exits 0 with no output (it does NOT block).
+    const result = await runBash(spec('cat')).done
+    expect(result.exitCode).toBe(0)
+    expect(result.stdout.text).toBe('')
+  })
+
+  it('merges extra env entries onto the scrubbed environment', async () => {
+    const result = await runBash(spec('echo "$DSH_EXTRA_ONE/$DSH_EXTRA_TWO"', {
+      env: { DSH_EXTRA_ONE: 'alpha', DSH_EXTRA_TWO: 'beta' },
+    })).done
+    expect(result.stdout.text).toBe('alpha/beta\n')
+  })
+
+  it('an explicit extra env entry overrides the model-friendly override and the scrub', async () => {
+    // TERM is a model-friendly OVERRIDE (dumb); an explicit extra entry wins.
+    // DSH_OVERRIDE_KEY matches the credential scrub pattern, yet an explicit
+    // entry is still honored — the scrub only drops AMBIENT process.env creds.
+    const result = await runBash(spec('echo "$TERM/$DSH_OVERRIDE_KEY"', {
+      env: { TERM: 'xterm-256color', DSH_OVERRIDE_KEY: 'explicit-wins' },
+    })).done
+    expect(result.stdout.text).toBe('xterm-256color/explicit-wins\n')
+  })
+
+  it('does not crash or reject when the child ignores a large stdin (EPIPE)', async () => {
+    // The child exits immediately without reading; closing our end of a stdin
+    // pipe still holding ~1MiB triggers EPIPE on the write. The handler must
+    // swallow it: `done` resolves normally with the child's real exit.
+    const big = 'x'.repeat(1024 * 1024)
+    const result = await runBash(spec('exit 7', { stdin: big })).done
+    expect(result.exitCode).toBe(7)
+    expect(result.aborted).toBe(false)
+  })
+})
+
 describe('output truncation and spill', () => {
   it('keeps the tail and spills the full stream to disk', async () => {
     // 200 numbered lines of ~10 bytes; cap at 500 bytes keeps a late tail.