@pushpalsdev/cli 1.0.43 → 1.0.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushpalsdev/cli",
-  "version": "1.0.43",
+  "version": "1.0.45",
   "description": "PushPals terminal CLI for LocalBuddy -> RemoteBuddy orchestration",
   "license": "MIT",
   "repository": {

package/runtime/prompts/workerpals/openai_codex_runtime_policy_appendix.md

@@ -4,3 +4,4 @@ Runtime policy guardrails (mandatory):
 - Never bypass Codex usage by changing tests/code expectations.
 - If Codex CLI auth/execution is unavailable, hard-fail and stop.
 - Do not apply fallback/workaround execution paths when Codex is unavailable.
+- Use direct commands without shell wrappers; do not rely on `/bin/bash -lc`, `sh -lc`, `cmd /c`, `powershell -Command`, pipelines, or `awk` when a plain command will do.

package/runtime/prompts/workerpals/openai_codex_task_execute_system_prompt.md

@@ -12,4 +12,8 @@ Execution rules:
 
 - Keep edits minimal, correct, and scoped to the requested task.
 - Read relevant files before editing, then run focused validation.
+- Use direct commands without shell wrappers. Prefer plain commands like `git diff -- path`, `git add <path>`, `git status --porcelain`, and `pwd`.
+- Do not wrap commands in `/bin/bash -lc`, `sh -lc`, `cmd /c`, or `powershell -Command`, and avoid pipelines, `awk`, heredocs, or multi-command shell snippets unless they are truly unavoidable.
+- If the command router rejects a command, simplify it to a single direct command instead of retrying more shell wrappers.
+- When a prepared merge-conflict sandbox is paused mid-rebase, explicitly finish it with `git add <resolved-files>` and `git -c core.editor=true rebase --continue` before returning.
 - Report blockers explicitly; do not hide platform/runtime issues with workaround edits.

package/runtime/sandbox/apps/workerpals/src/backends/openai_codex/test_openai_codex_runtime_config.py

@@ -170,6 +170,7 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
     def test_loads_openai_codex_task_prompt_template(self) -> None:
         template = _load_prompt_template("workerpals/openai_codex_task_execute_system_prompt.md")
         self.assertIn("Codex CLI is required infrastructure", template)
+        self.assertIn("Use direct commands without shell wrappers", template)
 
     def test_extracts_usage_counts_from_nested_json_event(self) -> None:
         usage = _extract_usage_counts(

package/runtime/sandbox/apps/workerpals/src/execute_job.ts

@@ -92,7 +92,7 @@ export interface ReviewFixContext {
 }
 
 export interface QualityGatePolicy {
-  mode: "default" | "review_fix";
+  mode: "default" | "review_fix" | "merge_conflict";
   maxAutoRevisions: number;
   softPassOnExhausted: boolean;
   criticMinScore: number;
@@ -318,6 +318,15 @@ export function deriveQualityGatePolicy(
   })();
   const reviewFix = extractReviewFixContext(params);
   if (!reviewFix) {
+    const mergeConflict = extractMergeConflictReviewContext(params);
+    if (mergeConflict) {
+      return {
+        mode: "merge_conflict",
+        maxAutoRevisions: baseMaxAutoRevisions,
+        softPassOnExhausted: false,
+        criticMinScore: baseCriticMinScore,
+      };
+    }
     return {
       mode: "default",
       maxAutoRevisions: baseMaxAutoRevisions,
@@ -3340,6 +3349,7 @@ export async function executeJob(
   };
   const executionBudgetMs = Number(planning.executionBudgetMs);
   const finalizationBudgetMs = Number(planning.finalizationBudgetMs);
+  const mergeConflictContext = extractMergeConflictReviewContext(normalizedParams);
   const reviewFixContext = extractReviewFixContext(normalizedParams);
   const qualityGatePolicy = deriveQualityGatePolicy(normalizedParams, runtimeConfig);
   const qualityMaxAutoRevisions = qualityGatePolicy.maxAutoRevisions;
@@ -3363,6 +3373,11 @@ export async function executeJob(
       "stdout",
       `[QualityGate] review_fix override active: prior_score=${priorScore}, target_threshold=${threshold}, soft_pass_on_exhausted=false.`,
     );
+  } else if (qualityGatePolicy.mode === "merge_conflict") {
+    onLog?.(
+      "stdout",
+      "[QualityGate] merge_conflict override active: soft_pass_on_exhausted=false until the sandbox rebase is fully completed.",
+    );
   }
 
   let revisionAttempt = 0;
@@ -3393,6 +3408,22 @@ export async function executeJob(
       executeBudgets,
     );
     if (!result.ok) return result;
+    if (mergeConflictContext) {
+      const sequencer = await activeGitOperation(repo);
+      if (sequencer) {
+        const detail =
+          `Merge-conflict job returned with git ${sequencer} still in progress. ` +
+          `Finish the ${sequencer} before returning control to WorkerPals.`;
+        onLog?.("stderr", `[MergeConflict] ${detail}`);
+        return {
+          ok: false,
+          summary: detail,
+          stdout: result.stdout,
+          stderr: [result.stderr ?? "", detail].filter(Boolean).join("\n"),
+          exitCode: 4,
+        };
+      }
+    }
 
     const scopeCheck = await collectWriteScopeWarnings(repo, planning);
     for (const warning of scopeCheck.warnings) {

package/runtime/sandbox/apps/workerpals/src/merge_conflict_job.ts

@@ -174,6 +174,9 @@ function buildPlannerGuidance(
     if (conflictPaths.length > 0) {
       lines.push(`- Unresolved conflict files: ${conflictPaths.join(", ")}`);
     }
+    lines.push(
+      "- Use direct commands only while resolving this rebase. Prefer `git diff -- <path>`, `git add <path>`, and `git -c core.editor=true rebase --continue` instead of `/bin/bash -lc`, `sh -lc`, `awk`, or chained shell snippets.",
+    );
     lines.push(
       "- After editing, run `git add <files>` and `git -c core.editor=true rebase --continue` until the rebase completes.",
     );

package/runtime/sandbox/prompts/workerpals/openai_codex_runtime_policy_appendix.md

@@ -4,3 +4,4 @@ Runtime policy guardrails (mandatory):
 - Never bypass Codex usage by changing tests/code expectations.
 - If Codex CLI auth/execution is unavailable, hard-fail and stop.
 - Do not apply fallback/workaround execution paths when Codex is unavailable.
+- Use direct commands without shell wrappers; do not rely on `/bin/bash -lc`, `sh -lc`, `cmd /c`, `powershell -Command`, pipelines, or `awk` when a plain command will do.

package/runtime/sandbox/prompts/workerpals/openai_codex_task_execute_system_prompt.md

@@ -12,4 +12,8 @@ Execution rules:
 
 - Keep edits minimal, correct, and scoped to the requested task.
 - Read relevant files before editing, then run focused validation.
+- Use direct commands without shell wrappers. Prefer plain commands like `git diff -- path`, `git add <path>`, `git status --porcelain`, and `pwd`.
+- Do not wrap commands in `/bin/bash -lc`, `sh -lc`, `cmd /c`, or `powershell -Command`, and avoid pipelines, `awk`, heredocs, or multi-command shell snippets unless they are truly unavoidable.
+- If the command router rejects a command, simplify it to a single direct command instead of retrying more shell wrappers.
+- When a prepared merge-conflict sandbox is paused mid-rebase, explicitly finish it with `git add <resolved-files>` and `git -c core.editor=true rebase --continue` before returning.
 - Report blockers explicitly; do not hide platform/runtime issues with workaround edits.