@pushpalsdev/cli 1.0.44 → 1.0.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushpalsdev/cli",
-  "version": "1.0.44",
+  "version": "1.0.45",
   "description": "PushPals terminal CLI for LocalBuddy -> RemoteBuddy orchestration",
   "license": "MIT",
   "repository": {

package/runtime/prompts/workerpals/openai_codex_runtime_policy_appendix.md

@@ -4,3 +4,4 @@ Runtime policy guardrails (mandatory):
 - Never bypass Codex usage by changing tests/code expectations.
 - If Codex CLI auth/execution is unavailable, hard-fail and stop.
 - Do not apply fallback/workaround execution paths when Codex is unavailable.
+- Use direct commands without shell wrappers; do not rely on `/bin/bash -lc`, `sh -lc`, `cmd /c`, `powershell -Command`, pipelines, or `awk` when a plain command will do.

package/runtime/prompts/workerpals/openai_codex_task_execute_system_prompt.md

@@ -12,4 +12,8 @@ Execution rules:
 
 - Keep edits minimal, correct, and scoped to the requested task.
 - Read relevant files before editing, then run focused validation.
+- Use direct commands without shell wrappers. Prefer plain commands like `git diff -- path`, `git add <path>`, `git status --porcelain`, and `pwd`.
+- Do not wrap commands in `/bin/bash -lc`, `sh -lc`, `cmd /c`, or `powershell -Command`, and avoid pipelines, `awk`, heredocs, or multi-command shell snippets unless they are truly unavoidable.
+- If the command router rejects a command, simplify it to a single direct command instead of retrying more shell wrappers.
+- When a prepared merge-conflict sandbox is paused mid-rebase, explicitly finish it with `git add <resolved-files>` and `git -c core.editor=true rebase --continue` before returning.
 - Report blockers explicitly; do not hide platform/runtime issues with workaround edits.

package/runtime/sandbox/apps/workerpals/src/backends/openai_codex/test_openai_codex_runtime_config.py

@@ -170,6 +170,7 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
     def test_loads_openai_codex_task_prompt_template(self) -> None:
         template = _load_prompt_template("workerpals/openai_codex_task_execute_system_prompt.md")
         self.assertIn("Codex CLI is required infrastructure", template)
+        self.assertIn("Use direct commands without shell wrappers", template)
 
     def test_extracts_usage_counts_from_nested_json_event(self) -> None:
         usage = _extract_usage_counts(

package/runtime/sandbox/apps/workerpals/src/merge_conflict_job.ts

@@ -174,6 +174,9 @@ function buildPlannerGuidance(
     if (conflictPaths.length > 0) {
       lines.push(`- Unresolved conflict files: ${conflictPaths.join(", ")}`);
     }
+    lines.push(
+      "- Use direct commands only while resolving this rebase. Prefer `git diff -- <path>`, `git add <path>`, and `git -c core.editor=true rebase --continue` instead of `/bin/bash -lc`, `sh -lc`, `awk`, or chained shell snippets.",
+    );
     lines.push(
       "- After editing, run `git add <files>` and `git -c core.editor=true rebase --continue` until the rebase completes.",
     );

package/runtime/sandbox/prompts/workerpals/openai_codex_runtime_policy_appendix.md

@@ -4,3 +4,4 @@ Runtime policy guardrails (mandatory):
 - Never bypass Codex usage by changing tests/code expectations.
 - If Codex CLI auth/execution is unavailable, hard-fail and stop.
 - Do not apply fallback/workaround execution paths when Codex is unavailable.
+- Use direct commands without shell wrappers; do not rely on `/bin/bash -lc`, `sh -lc`, `cmd /c`, `powershell -Command`, pipelines, or `awk` when a plain command will do.

package/runtime/sandbox/prompts/workerpals/openai_codex_task_execute_system_prompt.md

@@ -12,4 +12,8 @@ Execution rules:
 
 - Keep edits minimal, correct, and scoped to the requested task.
 - Read relevant files before editing, then run focused validation.
+- Use direct commands without shell wrappers. Prefer plain commands like `git diff -- path`, `git add <path>`, `git status --porcelain`, and `pwd`.
+- Do not wrap commands in `/bin/bash -lc`, `sh -lc`, `cmd /c`, or `powershell -Command`, and avoid pipelines, `awk`, heredocs, or multi-command shell snippets unless they are truly unavoidable.
+- If the command router rejects a command, simplify it to a single direct command instead of retrying more shell wrappers.
+- When a prepared merge-conflict sandbox is paused mid-rebase, explicitly finish it with `git add <resolved-files>` and `git -c core.editor=true rebase --continue` before returning.
 - Report blockers explicitly; do not hide platform/runtime issues with workaround edits.