controllerswap: stdin tee write + narrow FELHOM_CONTROLLERSWAP grants (non-root, v0.45.0)

writeImage drops bash -c/printf for GuestExecStdin(img+\n -> tee /etc/felhom-controller-image);
new Runner.RunStdin/GuestExecStdin route stdin through the fenced sudo -n runner. 5 narrow,
auditable sudoers grants (no general pct exec, no bash -c) + capability manifest entries (Critical)
so the self-probe watches them and the build-test asserts coverage (companion red-proof). No
controller change; swap orchestration/rollback/state unchanged. Spike GO.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

internal/localapi/controllerswap_test.go

@@ -6,7 +6,6 @@ import (
 	"io"
 	"log/slog"
 	"net/http/httptest"
-	"regexp"
 	"strings"
 	"sync"
 	"testing"
@@ -24,12 +23,11 @@ type fakeGuestExec struct {
 	present       map[string]bool // images pulled into the guest
 	good          map[string]bool // images that report healthy when running
 	containerImg  string          // image the running container currently has
+	teeStdin      []string        // raw bytes piped into each `tee` write (the swap's write vector)
 	failRestart   bool
 	noHealthBlock bool // if set, .State.Health is absent ("none")
 }
 
-var writeImgRe = regexp.MustCompile(`'([^']+)' >`)
-
 func (f *fakeGuestExec) GuestExec(_ context.Context, _ int, args ...string) (string, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
@@ -42,13 +40,6 @@ func (f *fakeGuestExec) GuestExec(_ context.Context, _ int, args ...string) (str
 			return args[3], nil
 		}
 		return "", fmt.Errorf("no such image: %s", args[3])
-	case len(args) >= 3 && args[0] == "bash" && args[1] == "-c":
-		m := writeImgRe.FindStringSubmatch(args[2])
-		if m == nil {
-			return "", fmt.Errorf("fake: unparseable write cmd %q", args[2])
-		}
-		f.imageFile = m[1]
-		return "", nil
 	case len(args) >= 3 && args[0] == "systemctl" && args[1] == "restart":
 		if f.failRestart {
 			return "", fmt.Errorf("fake: systemctl restart failed")
@@ -70,17 +61,50 @@ func (f *fakeGuestExec) GuestExec(_ context.Context, _ int, args ...string) (str
 	return "", fmt.Errorf("fake: unexpected exec %v", args)
 }
 
+// GuestExecStdin models the swap's write vector: `tee /etc/felhom-controller-image` with the image
+// piped on stdin. It records the raw stdin bytes and sets the modeled file content (newline-stripped,
+// as the bootstrap's `IMAGE=$(cat …)` read would see it).
+func (f *fakeGuestExec) GuestExecStdin(_ context.Context, _ int, stdin io.Reader, args ...string) (string, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.calls = append(f.calls, args)
+	b, _ := io.ReadAll(stdin)
+	if len(args) >= 2 && args[0] == "tee" && args[1] == controllerImageFile {
+		f.teeStdin = append(f.teeStdin, string(b))
+		f.imageFile = strings.TrimSpace(string(b))
+		return string(b), nil // tee echoes stdin to stdout
+	}
+	return "", fmt.Errorf("fake: unexpected exec-stdin args=%v stdin=%q", args, string(b))
+}
+
+// wrote reports whether the image was written via the stdin `tee` vector with the exact `image\n`
+// bytes (byte-identical to the golden's printf '%s\n').
 func (f *fakeGuestExec) wrote(image string) bool {
 	f.mu.Lock()
 	defer f.mu.Unlock()
-	for _, c := range f.calls {
-		if len(c) >= 3 && c[0] == "bash" && strings.Contains(c[2], "'"+image+"'") {
+	for _, w := range f.teeStdin {
+		if w == image+"\n" {
 			return true
 		}
 	}
 	return false
 }
 
+// usedShell reports whether ANY exec used a shell vector (bash/-c/printf/sh) — the thing the swap
+// rewrite removes. A regression to `bash -c "printf … >"` would make this true.
+func (f *fakeGuestExec) usedShell() bool {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for _, c := range f.calls {
+		for _, a := range c {
+			if a == "bash" || a == "sh" || a == "-c" || strings.HasPrefix(a, "printf") {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func newTestSwapper(t *testing.T, fe *fakeGuestExec) *ControllerSwapper {
 	t.Helper()
 	s := NewControllerSwapper(fe, t.TempDir(), nil)
@@ -122,6 +146,38 @@ func TestControllerSwap_Happy(t *testing.T) {
 	}
 }
 
+// The write vector must be the stdin `tee` with byte-identical `image\n` and NO shell — the
+// controllerswap.go writeImage rewrite. This would FAIL on the pre-change `bash -c "printf … >"` impl.
+func TestControllerSwap_WriteViaStdinTee_NoShell(t *testing.T) {
+	fe := &fakeGuestExec{
+		imageFile: prevImg,
+		present:   map[string]bool{newImg: true},
+		good:      map[string]bool{newImg: true, prevImg: true},
+	}
+	s := newTestSwapper(t, fe)
+	if st := s.Swap(context.Background(), 9201, newImg); st.State != "done" {
+		t.Fatalf("state = %q, want done", st.State)
+	}
+	if !fe.wrote(newImg) {
+		t.Errorf("expected a tee write of %q+\\n; teeStdin=%q", newImg, fe.teeStdin)
+	}
+	sawTee := false
+	for _, c := range fe.calls {
+		if len(c) >= 2 && c[0] == "tee" {
+			sawTee = true
+			if c[1] != controllerImageFile {
+				t.Errorf("tee target = %q, want fixed %q", c[1], controllerImageFile)
+			}
+		}
+	}
+	if !sawTee {
+		t.Error("no tee call recorded — writeImage did not use the stdin tee vector")
+	}
+	if fe.usedShell() {
+		t.Errorf("swap used a shell vector (bash/-c/printf) — must be stdin tee only; calls=%v", fe.calls)
+	}
+}
+
 // The load-bearing failure path: an unhealthy target must roll back to the previous image.
 func TestControllerSwap_RollbackOnUnhealthy(t *testing.T) {
 	fe := &fakeGuestExec{