[jkbennitt]

Problem

On Windows, raw-grok with --harness-opt binary=.../grok-docker.cmd produced instant 0-action ticks.

cmd.exe re-parses argv from asyncio.create_subprocess_exec and drops or mangles a large -p prompt. grok-docker.cmd then launches PowerShell with empty %*. The image entrypoint defaults to mcp list and exits 0, so Crashlanded ticks report 0 tokens / 0 actions / success.

The grok-build docker wrapper already supports a side-channel: when RLE_GROK_ARGV_JSON is set to a UTF-8 JSON file path (a JSON array of argv strings after the wrapper path), grok-docker.ps1 reads that file instead of %*. Host grok.exe via create_subprocess_exec does not need this.

Change

raw-grok now detects a Windows .cmd / .bat binary (path suffix, including C:\...\grok-docker.cmd) and:

1. Writes the grok argv (everything after the wrapper path) as UTF-8 JSON
2. Sets RLE_GROK_ARGV_JSON on the subprocess env (clears any stale value first)
3. Invokes the wrapper with no grok CLI args, so cmd.exe never sees the prompt
4. Deletes the temp JSON after the turn (success, nonzero exit, or cancel)

Host grok / grok.exe is unchanged: full argv, no sidecar, inherited env.

TURN_RULES / model-baseline semantics are unchanged. Felix and grok-build product behavior are not modified.

How to verify

Unit (no game, mocked subprocess):

pytest tests/unit/test_raw_grok.py -v
ruff check src/ tests/ scripts/
mypy src/

Live Windows proof (RimWorld + RIMAPI + docker wrapper):

python scripts/run_scenario.py crashlanded --harness raw-grok --model grok-4.6 --ticks 2 ^
  --harness-opt binary=C:\path\to\rle-harness-grok-build\docker\grok-docker.cmd ^
  --harness-opt turn_timeout_s=300 ^
  --harness-opt mcp_container_reachable=true ^
  --harness-opt mcp_advertise_url=http://host.docker.internal:8766/mcp

Expect tokens > 0 and the wrapper to receive -p plus the full prompt from the JSON sidecar. Host grok.exe (no .cmd) should still work without RLE_GROK_ARGV_JSON.

Contrast (pre-fix): create_subprocess_exec(grok-docker.cmd, "-p", long_prompt, ...) fails or returns empty; the same wrapper with RLE_GROK_ARGV_JSON written returns OK + tokens.