fix(test): stream resource fault configuration through stdin

scripts/inbound-plan-resource-fault-executor.test.mjs

@@ -29,6 +29,27 @@ test('renderer chunks complete payload and carries both proxy modules and review
   assert.deepEqual(config.scope,scope);assert.equal(config.action,'prepare');
   for(const key of ['proxySource','httpProxySource','commonSource','baseSource'])assert.ok(config[key].length>100);
   const runtime=Buffer.from(embedded[0].join(''),'base64').toString();assert.ok(runtime.includes('firstleg-test-lastleg'));
+  assert.match(groovy,/new ProcessBuilder\(\['python3','-c',new String\(.+?,'UTF-8'\)\]\)/s);
+  assert.match(groovy,/p\.outputStream\.withCloseable\{s->s\.write\(java\.util\.Base64\.decoder\.decode\(/);
+  assert.ok(Buffer.byteLength(runtime)<65536);
+  assert.ok(embedded[1].join('').length>131072,'prepare reproduces the old over-limit configuration argv');
+  assert.ok(runtime.includes('main(read_stdin_config())'));
+  assert.ok(!runtime.includes('base64.b64decode(sys.argv[1])'));
+});
+test('complete prepare configuration travels over stdin to actual Python with bounded argv and no config echo',()=>{
+  const rendered=renderInboundResourceAction('prepare',scope,'test-agent',{routing,expectedImageId:'sha256:'+'c'.repeat(64)});
+  const groovy=Buffer.from(arrays(rendered)[0].join(''),'base64').toString();const embedded=arrays(groovy);
+  const runtime=Buffer.from(embedded[0].join(''),'base64').toString();
+  const config=JSON.parse(Buffer.from(embedded[1].join(''),'base64').toString());
+  // Reject scope before locks/Docker/network. JSON still must consume the complete four-source body.
+  config.scope.environment='PROD';const input=JSON.stringify(config);
+  const argv=['-c',runtime];assert.equal(argv.length,2);assert.ok(argv.every(a=>Buffer.byteLength(a)<65536));
+  assert.ok(Buffer.byteLength(input)>100000);for(const key of ['baseSource','commonSource','proxySource','httpProxySource'])assert.ok(config[key].length>100);
+  const result=spawnSync(process.env.PYTHON||'python',argv,{input,encoding:'utf8',env:{...process.env,PYTHONDONTWRITEBYTECODE:'1'}});
+  assert.equal(result.status,0,result.stderr||result.error?.message);assert.equal(result.stderr,'');
+  const rows=result.stdout.trim().split(/\r?\n/);assert.equal(rows.length,1);assert.ok(rows[0].startsWith('INBOUND_RESOURCE_JSON='));
+  const value=JSON.parse(rows[0].slice('INBOUND_RESOURCE_JSON='.length));assert.equal(value.error,'EXPLICIT_TEST_SCOPE_REQUIRED');
+  assert.equal(value.diagnostic.stage,'READ_STDIN_CONFIG');assert.ok(!result.stdout.includes(config.baseSource.slice(0,80)));assert.ok(!result.stdout.includes('upstreams'));
 });
 test('origin/schema guards reject credential embedding, wrong imports and unbounded fault windows',()=>{
   for(const change of [r=>r.password='secret',r=>r.upstreams.IAM='http://offline.invalid',r=>r.nacos.baseUrl='http://user:secret@offline.invalid',r=>r.nacos.configPath='/fallback']){
@@ -46,6 +67,12 @@ test('transport unknown, duplicate result and malformed result each fail after e
   }
   assert.throws(()=>createInboundResourceRuntime({...env,CHONGCHONG_ENV:'prod'},scope));
 });
+test('structured remote process-start/stdin errors remain single results and never echo private payloads',async()=>{
+  for(const [code,stage] of [['REMOTE_PROCESS_START_FAILED','REMOTE_PROCESS_START'],['RUNTIME_STDIN_OUTCOME_UNKNOWN_USE_STATUS','REMOTE_PROCESS_STDIN']]){
+    let calls=0;const runtime=createInboundResourceRuntime(env,scope,async()=>{calls++;return{ok:true,text:async()=> 'INBOUND_RESOURCE_JSON='+JSON.stringify({ok:false,error:code,diagnostic:{stage,errorType:'IOException'}})}});
+    await assert.rejects(runtime('prepare',{routing,expectedImageId:'sha256:'+'c'.repeat(64)}),error=>{assert.equal(error.message,code);assert.deepEqual(error.runtimeDiagnostic,{stage,errorType:'IOException'});return true;});assert.equal(calls,1);
+  }
+});
 test('remote error preserves safe stage/type/status and strips untrusted diagnostic fields',async()=>{
   const runtime=createInboundResourceRuntime(env,scope,async()=>({ok:true,text:async()=> 'INBOUND_RESOURCE_JSON='+JSON.stringify({ok:false,error:'NACOS_CONFIG_READ_HTTP_404',diagnostic:{stage:'NACOS_CONFIG_READ',errorType:'HTTPError',httpStatus:404,token:'must-never-escape',body:'secret',url:'http://private.invalid'}})}));
   await assert.rejects(runtime('preflight',{routing}),error=>{