fn container_turn_exec(prompt_path: &str, cmd: Vec<String>) -> Vec<String>Expand description
Wrap the CLI argv so it reads the turn prompt from prompt_path, a file
already written into the container by
[ContainerManager::upload_turn_prompt].
Redirecting from a file is the only transport that satisfies all three
constraints at once (see upload_turn_prompt’s doc for the measurements):
the CLI gets a real stdin that really reaches EOF, the message never touches
argv or env — so docker top / host ps / /proc/<pid>/cmdline can’t see a
secret pasted into a chat message — and there is no MAX_ARG_STRLEN ceiling.
The CLI argv is passed through as "$@" rather than interpolated into the
script, so there is no shell quoting to get wrong, and it is passed
UNCHANGED — including a trailing - (codex) or a -p "" placeholder
(gemini/qwen/kimi/antigravity), both of which mean “read the prompt from
stdin” and are correct again now that stdin genuinely works (codex P1,
PR #2883).
The prompt file is removed after the CLI exits, and the CLI’s own exit
status is preserved for inspect_exec to classify the turn.
The directory the provider CLI is installed into on first start is appended
to PATH, after the image’s own, so a CLI baked into an older image still
wins over the installed one.