@pushpalsdev/cli 1.0.86 → 1.0.94

package/runtime/sandbox/apps/workerpals/src/execute_job.ts

@@ -3,10 +3,9 @@
  * Used by both the host Worker (direct mode) and the Docker job runner.
  */
 
-import { existsSync, readFileSync, rmSync, unlinkSync } from "fs";
+import { existsSync, lstatSync, readFileSync, renameSync, rmSync, unlinkSync } from "fs";
 import { resolve } from "path";
 import {
-  deriveAutonomyComponentArea,
   buildGitCommitArgs as buildSourceControlGitCommitArgs,
   explicitSourceControlCommitIdentityFromEnv,
   loadPromptTemplate,
@@ -15,12 +14,9 @@ import {
   extractVisionKeyItems,
   formatToolRequirement,
   matchesGlob,
-  normalizeAutonomyComponentArea,
   normalizeTargetPath,
   requirementsForValidationCommand,
   sanitizeSourceControlIdentityField,
-  validateScopeInvariants,
-  type AutonomyComponentArea,
   type SourceControlCommitIdentity,
   type ToolRequirement,
 } from "shared";
@@ -389,13 +385,6 @@ export function shouldEnqueueNoChangeReviewCompletion(
   return extractReviewFixContext(params) == null;
 }
 
-function reviewAgentAllowsMultiRootScope(value: unknown): boolean {
-  const normalized = String(value ?? "")
-    .trim()
-    .toLowerCase();
-  return normalized === "review_fix" || normalized === "merge_conflict";
-}
-
 export function deriveQualityGatePolicy(
   params: Record<string, unknown> | null | undefined,
   runtimeConfig: WorkerpalsRuntimeConfig = DEFAULT_CONFIG,
@@ -1656,7 +1645,7 @@ async function runDeterministicQualityGate(
   if (scopedValidationFailure === "outside_task_scope") {
     onLog?.(
       "stderr",
-      "[ValidationGate] Required validation failures appear outside the task write scope; treating them as publish blockers, not repair instructions.",
+      "[ValidationGate] Required validation failures appear outside the task target/relevance hints; treating them as publish blockers, not repair instructions.",
     );
   }
 
@@ -2177,6 +2166,12 @@ export type WorkerGitCommitIdentity = SourceControlCommitIdentity;
 
 export const explicitWorkerCommitIdentityFromEnv = explicitSourceControlCommitIdentityFromEnv;
 
+async function unstageSandboxArtifactPaths(
+  repo: string,
+): Promise<{ ok: boolean; stdout: string; stderr: string }> {
+  return git(repo, ["reset", "-q", "--", ...SANDBOX_STAGE_ARTIFACT_PATHS]);
+}
+
 async function resolveGitConfigValue(repo: string, key: string): Promise<string> {
   const value = await git(repo, ["config", "--get", key]);
   return value.ok ? sanitizeSourceControlIdentityField(value.stdout) : "";
@@ -2293,19 +2288,21 @@ export async function createJobCommit(
         console.warn(
           `[WorkerPals] Stage target invalid/missing for ${job.kind}; retrying with fallback "git add -A".`,
         );
-        result = await git(repo, [
-          "add",
-          "-A",
-          "--",
-          ".",
-          ":(exclude)workspace/**",
-          ":(exclude)outputs/**",
-        ]);
+        result = await git(repo, ["add", "-A"]);
       }
       if (!result.ok) {
         return { ok: false, error: `Failed to stage changes: ${result.stderr || result.stdout}` };
       }
     }
+    if (job.kind === "task.execute") {
+      const unstageArtifacts = await unstageSandboxArtifactPaths(repo);
+      if (!unstageArtifacts.ok) {
+        return {
+          ok: false,
+          error: `Failed to unstage sandbox artifact paths: ${unstageArtifacts.stderr || unstageArtifacts.stdout}`,
+        };
+      }
+    }
 
     // Check if there are changes to commit
     result = await git(repo, ["diff", "--cached", "--quiet"]);
@@ -2503,12 +2500,12 @@ function buildStageTargets(kind: string, params?: Record<string, unknown>): stri
   }
 }
 
-function buildStageCommand(kind: string, params?: Record<string, unknown>): string[] | null {
+export function buildStageCommand(kind: string, params?: Record<string, unknown>): string[] | null {
+  if (kind === "task.execute") {
+    return ["add", "-A"];
+  }
   const targets = buildStageTargets(kind, params);
   if (targets.length === 0) {
-    if (kind === "task.execute") {
-      return ["add", "-A", "--", ".", ":(exclude)workspace/**", ":(exclude)outputs/**"];
-    }
     return null;
   }
   return ["add", "-A", "--", ...targets];
@@ -3050,25 +3047,11 @@ export async function resumePreparedMergeConflictRebase(
           "stdout",
           `[MergeConflict] Stage target invalid/missing for ${kind}; retrying with fallback "git add -A".`,
         );
-        stageResult = await git(repo, [
-          "add",
-          "-A",
-          "--",
-          ".",
-          ":(exclude)workspace/**",
-          ":(exclude)outputs/**",
-        ]);
+        stageResult = await git(repo, ["add", "-A"]);
       }
     }
   } else {
-    stageResult = await git(repo, [
-      "add",
-      "-A",
-      "--",
-      ".",
-      ":(exclude)workspace/**",
-      ":(exclude)outputs/**",
-    ]);
+    stageResult = await git(repo, ["add", "-A"]);
   }
   if (!stageResult.ok) {
     return {
@@ -3078,6 +3061,15 @@ export async function resumePreparedMergeConflictRebase(
         combinedGitOutput(stageResult),
     };
   }
+  const unstageArtifacts = await unstageSandboxArtifactPaths(repo);
+  if (!unstageArtifacts.ok) {
+    return {
+      ok: false,
+      error:
+        "Failed to unstage sandbox artifact paths before continuing rebase: " +
+        combinedGitOutput(unstageArtifacts),
+    };
+  }
 
   let rebaseContinue = await git(repo, ["-c", "core.editor=true", "rebase", "--continue"]);
   let continueOutput = combinedGitOutput(rebaseContinue);
@@ -3227,19 +3219,19 @@ async function createMergeConflictJobCommit(
       console.warn(
         `[WorkerPals] Stage target invalid/missing for merge-conflict job ${job.id}; retrying with fallback "git add -A".`,
       );
-      result = await git(repo, [
-        "add",
-        "-A",
-        "--",
-        ".",
-        ":(exclude)workspace/**",
-        ":(exclude)outputs/**",
-      ]);
+      result = await git(repo, ["add", "-A"]);
     }
     if (!result.ok) {
       return { ok: false, error: `Failed to stage merge-conflict changes: ${result.stderr || result.stdout}` };
     }
   }
+  const unstageArtifacts = await unstageSandboxArtifactPaths(repo);
+  if (!unstageArtifacts.ok) {
+    return {
+      ok: false,
+      error: `Failed to unstage sandbox artifact paths: ${unstageArtifacts.stderr || unstageArtifacts.stdout}`,
+    };
+  }
 
   const cachedDiffQuiet = await git(repo, ["diff", "--cached", "--quiet"]);
   let headSha = await currentRefSha(repo, "HEAD");
@@ -3602,6 +3594,85 @@ export function shouldUseCodexCliForExecutor(executor: string): boolean {
   return executor.trim().toLowerCase() === "openai_codex";
 }
 
+type MaskedRepoLocalCodexFile = {
+  codexPath: string;
+  backupPath: string;
+};
+
+function codexProjectConfigRoots(repo: string, env: Record<string, string>): string[] {
+  const roots: string[] = [];
+  const seen = new Set<string>();
+  const add = (raw: unknown) => {
+    const text = String(raw ?? "").trim();
+    if (!text) return;
+    const root = resolve(text);
+    const key = root.toLowerCase();
+    if (seen.has(key)) return;
+    seen.add(key);
+    roots.push(root);
+  };
+  add(repo);
+  for (const key of [
+    "PUSHPALS_REPO_ROOT_OVERRIDE",
+    "PUSHPALS_PROJECT_ROOT_OVERRIDE",
+    "PUSHPALS_ASSIGNED_REPO_ROOT",
+    "PUSHPALS_REPO_PATH",
+  ]) {
+    add(env[key]);
+  }
+  return roots;
+}
+
+function maskRepoLocalCodexFilesForCodexCli(
+  repo: string,
+  env: Record<string, string>,
+): MaskedRepoLocalCodexFile[] {
+  const masked: MaskedRepoLocalCodexFile[] = [];
+  for (const root of codexProjectConfigRoots(repo, env)) {
+    const codexPath = resolve(root, ".codex");
+    if (!existsSync(codexPath)) continue;
+    try {
+      if (lstatSync(codexPath).isDirectory()) continue;
+      let backupPath = resolve(root, `.codex.pushpals-masked-${process.pid}-${masked.length}`);
+      let suffix = 0;
+      while (existsSync(backupPath)) {
+        suffix += 1;
+        backupPath = resolve(
+          root,
+          `.codex.pushpals-masked-${process.pid}-${masked.length}-${suffix}`,
+        );
+      }
+      renameSync(codexPath, backupPath);
+      masked.push({ codexPath, backupPath });
+      console.warn(
+        `[WorkerPals] Temporarily masked repo-local .codex file so Codex CLI can use CODEX_HOME: ${codexPath}`,
+      );
+    } catch (error) {
+      console.warn(
+        `[WorkerPals] Failed to mask repo-local .codex file ${codexPath}: ${String(error)}`,
+      );
+    }
+  }
+  return masked;
+}
+
+function restoreRepoLocalCodexFilesForCodexCli(masked: MaskedRepoLocalCodexFile[]): void {
+  for (const entry of [...masked].reverse()) {
+    try {
+      if (existsSync(entry.codexPath)) {
+        rmSync(entry.codexPath, { recursive: true, force: true });
+      }
+      if (existsSync(entry.backupPath)) {
+        renameSync(entry.backupPath, entry.codexPath);
+      }
+    } catch (error) {
+      console.warn(
+        `[WorkerPals] Failed to restore repo-local .codex file ${entry.codexPath}: ${String(error)}`,
+      );
+    }
+  }
+}
+
 function normalizeCodexReasoningEffort(
   value: unknown,
   model = "",
@@ -3712,11 +3783,13 @@ async function generateCommitMessageFromDiffViaCodex(
   if (model) cmd.push("-m", model);
   cmd.push("-");
 
+  const env = buildWorkerSandboxWritableEnv(repo);
+  const codexMask = maskRepoLocalCodexFilesForCodexCli(repo, env);
   try {
     const stdinText = `${prompt.systemPrompt}\n\n${prompt.userMessage}`;
     const proc = Bun.spawn(cmd, {
       cwd: repo,
-      env: buildWorkerSandboxWritableEnv(repo),
+      env,
       stdout: "pipe",
       stderr: "pipe",
       stdin: new Blob([stdinText]),
@@ -3751,6 +3824,7 @@ async function generateCommitMessageFromDiffViaCodex(
   } catch {
     return null;
   } finally {
+    restoreRepoLocalCodexFilesForCodexCli(codexMask);
     try {
       unlinkSync(tmpOutputPath);
     } catch {
@@ -3930,9 +4004,7 @@ function hasInvalidRepoPathHint(values: string[]): boolean {
   return values.some((entry) => normalizeStagePath(entry) === null);
 }
 
-function asAutonomyComponentArea(value: unknown): AutonomyComponentArea | null {
-  return normalizeAutonomyComponentArea(value);
-}
+const SANDBOX_STAGE_ARTIFACT_PATHS = ["workspace", "outputs", ".codex"];
 
 function taskExecuteOrigin(params: Record<string, unknown>): "autonomy" | "user" {
   const explicit = String(params.origin ?? "")
@@ -3949,33 +4021,15 @@ function taskExecuteOrigin(params: Record<string, unknown>): "autonomy" | "user"
   return "user";
 }
 
-function collectWriteScopeIssuesFromChangedPaths(
+export function collectWriteScopeIssuesFromChangedPaths(
   changedPaths: string[],
   planning: TaskExecutePlanning,
 ): string[] {
-  const writeGlobs = toStringArray(planning.scope.writeGlobs ?? []);
-  if (writeGlobs.length === 0) return [];
-
-  const normalizedChangedPaths = changedPaths
-    .map((entry) => normalizeStagePath(entry))
-    .filter((entry): entry is string => Boolean(entry) && entry !== ".");
-  if (normalizedChangedPaths.length === 0) return [];
-
-  const forbidden = toStringArray(planning.scope.forbiddenGlobs ?? []);
-  const issues: string[] = [];
-  const outOfScope = normalizedChangedPaths.filter(
-    (path) => !writeGlobs.some((glob) => matchesGlob(path, glob)),
-  );
-  if (outOfScope.length > 0) {
-    issues.push(`modified paths outside writeGlobs: ${outOfScope.join(", ")}`);
-  }
-  const forbiddenTouched = normalizedChangedPaths.filter((path) =>
-    forbidden.some((glob) => matchesGlob(path, glob)),
-  );
-  if (forbiddenTouched.length > 0) {
-    issues.push(`modified paths matching forbiddenGlobs: ${forbiddenTouched.join(", ")}`);
-  }
-  return issues;
+  void changedPaths;
+  void planning;
+  // WorkerPals run in isolated worktrees and may write anywhere in that repo sandbox.
+  // Scope hints guide planning/review, but they are not hard write privileges.
+  return [];
 }
 
 function sanitizeTaskExecutePlanningPathHints(value: unknown): unknown {
@@ -4097,61 +4151,6 @@ function validateTaskExecutePlanning(
         message: "task.execute planning.targetPaths must contain literal repo-relative paths",
       };
     }
-    const normalizedWriteGlobs = isStringArray(scope.writeGlobs)
-      ? toStringArray(scope.writeGlobs)
-      : [];
-    const allowMultiRootAutonomyScope =
-      origin === "autonomy" &&
-      reviewAgentAllowsMultiRootScope(options?.reviewAgentResolutionType);
-    if (origin === "autonomy") {
-      const declaredComponentArea = asAutonomyComponentArea(options?.autonomyComponentArea);
-      const inferredComponentArea = allowMultiRootAutonomyScope
-        ? null
-        : deriveAutonomyComponentArea(normalizedTargetPaths, normalizedWriteGlobs);
-      const componentArea = allowMultiRootAutonomyScope
-        ? declaredComponentArea
-        : declaredComponentArea ?? inferredComponentArea;
-      if (!allowMultiRootAutonomyScope && !componentArea) {
-        return {
-          ok: false,
-          message:
-            "task.execute planning.targetPaths must resolve to a repo-relative componentArea",
-        };
-      }
-      if (
-        !allowMultiRootAutonomyScope &&
-        declaredComponentArea &&
-        inferredComponentArea &&
-        declaredComponentArea !== inferredComponentArea
-      ) {
-        return {
-          ok: false,
-          message: "task.execute planning.targetPaths do not match autonomy componentArea",
-        };
-      }
-      const validatedScope = validateScopeInvariants(
-        componentArea,
-        normalizedTargetPaths,
-        normalizedWriteGlobs,
-        { requireWriteGlobs: false, allowMultipleComponentRoots: allowMultiRootAutonomyScope },
-      );
-      if (!validatedScope.ok) {
-        return {
-          ok: false,
-          message: `task.execute scope invariants failed: ${validatedScope.errors.join("; ")}`,
-        };
-      }
-    } else if (normalizedWriteGlobs.length > 0) {
-      const uncoveredPaths = normalizedTargetPaths.filter(
-        (targetPath) => !normalizedWriteGlobs.some((glob) => matchesGlob(targetPath, glob)),
-      );
-      if (uncoveredPaths.length > 0) {
-        return {
-          ok: false,
-          message: `task.execute planning.targetPaths must be covered by planning.scope.writeGlobs: ${uncoveredPaths.join(", ")}`,
-        };
-      }
-    }
   }
 
   if (planning.discovery !== undefined) {
@@ -4378,10 +4377,12 @@ async function runCodexCriticReview(
     "-",
   ];
 
+  const env = buildWorkerSandboxWritableEnv(repo);
+  const codexMask = maskRepoLocalCodexFilesForCodexCli(repo, env);
   try {
     const proc = Bun.spawn(cmd, {
       cwd: repo,
-      env: buildWorkerSandboxWritableEnv(repo),
+      env,
       stdout: "pipe",
       stderr: "pipe",
       stdin: new Blob([criticInstruction]),
@@ -4461,6 +4462,13 @@ async function runCodexCriticReview(
   } catch (err) {
     onLog?.("stderr", `[CriticGate] Codex error: ${toSingleLine(err, 220)} (skipping).`);
     return null;
+  } finally {
+    restoreRepoLocalCodexFilesForCodexCli(codexMask);
+    try {
+      unlinkSync(tmpOutputPath);
+    } catch {
+      /* ignore */
+    }
   }
 }
 
@@ -4775,7 +4783,7 @@ export async function executeJob(
           [
             result.stderr ?? "",
             validationOutsideTaskScope
-              ? "Validation failures appear outside the task write scope and are treated as pre-existing repo blockers."
+              ? "Validation failures appear outside the task target/relevance hints and are treated as pre-existing repo blockers."
               : "",
             ...quality.validationRuns.flatMap((run) => [run.stdout, run.stderr]).filter(Boolean),
           ]

package/runtime/sandbox/apps/workerpals/src/workerpals_main.ts

@@ -65,6 +65,8 @@ type WorkerJobResult = JobResult & {
 
 const DEFAULT_LLM_MODEL = "local-model";
 const CODEX_UNAVAILABLE_WORKER_EXIT_CODE = 86;
+const CODEX_UNAVAILABLE_DOCKER_SHUTDOWN_GRACE_MS = 5_000;
+const CODEX_UNAVAILABLE_WORKER_FORCE_EXIT_MS = 4_000;
 const CONFIG = loadPushPalsConfig();
 const LOG = new Logger("WorkerPals");
 
@@ -360,6 +362,36 @@ function shouldRecycleWorkerForCodexUnavailableFailure(
   ].some((needle) => text.includes(needle));
 }
 
+async function shutdownDockerExecutorBeforeCodexRecycle(
+  dockerExecutor: DockerExecutor | null,
+): Promise<void> {
+  if (!dockerExecutor) return;
+
+  let timeout: ReturnType<typeof setTimeout> | null = null;
+  let timedOut = false;
+  try {
+    await Promise.race([
+      dockerExecutor.shutdown(),
+      new Promise<void>((resolvePromise) => {
+        timeout = setTimeout(() => {
+          timedOut = true;
+          resolvePromise();
+        }, CODEX_UNAVAILABLE_DOCKER_SHUTDOWN_GRACE_MS);
+      }),
+    ]);
+  } catch (err) {
+    console.error(`[WorkerPals] Docker shutdown cleanup failed: ${String(err)}`);
+  } finally {
+    if (timeout) clearTimeout(timeout);
+  }
+
+  if (timedOut) {
+    console.warn(
+      `[WorkerPals] Docker shutdown cleanup exceeded ${CODEX_UNAVAILABLE_DOCKER_SHUTDOWN_GRACE_MS}ms; exiting worker for Codex recycle anyway.`,
+    );
+  }
+}
+
 function parseArgs(): {
   server: string;
   pollMs: number;
@@ -1667,21 +1699,46 @@ async function workerLoop(
             }
           } finally {
             clearInterval(busyHeartbeat);
-            if (
-              !recycleWorkerAfterJob &&
-              job.sessionId &&
-              result?.cooldownMs &&
-              result.cooldownMs > 0
-            ) {
-              await transport.queueSessionCommand(job.sessionId, {
-                type: "assistant_message",
-                payload: {
-                  text: `WorkerPal is cooling down for ${formatDurationMs(result.cooldownMs)} after transient infrastructure failures.`,
+            if (recycleWorkerAfterJob) {
+              runtimeState.shutdownRequested = true;
+              const forceExitTimer = setTimeout(() => {
+                console.warn(
+                  `[WorkerPals] Forcing worker recycle ${CODEX_UNAVAILABLE_WORKER_FORCE_EXIT_MS}ms after Codex backend failure.`,
+                );
+                process.exit(CODEX_UNAVAILABLE_WORKER_EXIT_CODE);
+              }, CODEX_UNAVAILABLE_WORKER_FORCE_EXIT_MS);
+              try {
+                await maybeHeartbeat("offline", null, true);
+                if (directWorktreePath) {
+                  await removeIsolatedWorktree(opts.repo, directWorktreePath).catch((err) => {
+                    console.error(
+                      `[WorkerPals] Failed to remove isolated worktree before Codex recycle: ${String(
+                        err,
+                      )}`,
+                    );
+                  });
+                  directWorktreePath = null;
+                }
+                await shutdownDockerExecutorBeforeCodexRecycle(dockerExecutor);
+              } finally {
+                clearTimeout(forceExitTimer);
+                process.exit(CODEX_UNAVAILABLE_WORKER_EXIT_CODE);
+              }
+            }
+            if (job.sessionId && result?.cooldownMs && result.cooldownMs > 0) {
+              await transport.queueSessionCommand(
+                job.sessionId,
+                {
+                  type: "assistant_message",
+                  payload: {
+                    text: `WorkerPal is cooling down for ${formatDurationMs(result.cooldownMs)} after transient infrastructure failures.`,
+                  },
+                  from: `worker:${opts.workerId}`,
                 },
-                from: `worker:${opts.workerId}`,
-              }, { priority: "high" });
+                { priority: "high" },
+              );
             }
-            if (!recycleWorkerAfterJob && result?.cooldownMs && result.cooldownMs > 0) {
+            if (result?.cooldownMs && result.cooldownMs > 0) {
               const cooldownMs = Math.max(0, Math.floor(result.cooldownMs));
               console.warn(
                 `[WorkerPals] Entering cooldown for ${formatDurationMs(cooldownMs)} after retry exhaustion.`,
@@ -1697,18 +1754,6 @@ async function workerLoop(
                 console.error(`[WorkerPals] Failed to remove isolated worktree: ${String(err)}`);
               });
             }
-            if (recycleWorkerAfterJob) {
-              runtimeState.shutdownRequested = true;
-              await maybeHeartbeat("offline", null, true);
-              if (dockerExecutor) {
-                try {
-                  await dockerExecutor.shutdown();
-                } catch (err) {
-                  console.error(`[WorkerPals] Docker shutdown cleanup failed: ${String(err)}`);
-                }
-              }
-              process.exit(CODEX_UNAVAILABLE_WORKER_EXIT_CODE);
-            }
           }
         }
       }

package/runtime/sandbox/packages/shared/src/autonomy_policy.ts

@@ -319,7 +319,11 @@ export function validateScopeInvariants(
   componentArea: AutonomyComponentArea | null | undefined,
   targetPathsInput: unknown[],
   writeGlobsInput: unknown[],
-  options?: { requireWriteGlobs?: boolean; allowMultipleComponentRoots?: boolean },
+  options?: {
+    requireWriteGlobs?: boolean;
+    allowMultipleComponentRoots?: boolean;
+    hintsOnly?: boolean;
+  },
 ): ScopeValidationResult {
   const errors: string[] = [];
   const scopeSeeds = collectScopeSeedPaths(targetPathsInput, writeGlobsInput);
@@ -327,7 +331,8 @@ export function validateScopeInvariants(
     normalizeAutonomyComponentArea(componentArea) ??
     deriveAutonomyComponentArea(targetPathsInput, writeGlobsInput);
   const allowMultipleComponentRoots = options?.allowMultipleComponentRoots === true;
-  if (!normalizedComponentArea && scopeSeeds.length > 1 && !allowMultipleComponentRoots) {
+  const hintsOnly = options?.hintsOnly === true;
+  if (!hintsOnly && !normalizedComponentArea && scopeSeeds.length > 1 && !allowMultipleComponentRoots) {
     errors.push(
       `scope spans multiple component roots: ${scopeSeeds.slice(0, 6).join(", ")}`,
     );
@@ -341,7 +346,7 @@ export function validateScopeInvariants(
       errors.push(`invalid target_path: ${String(raw ?? "")}`);
       continue;
     }
-    if (rootPrefix && !underRoot(normalized, rootPrefix)) {
+    if (!hintsOnly && rootPrefix && !underRoot(normalized, rootPrefix)) {
       errors.push(`target_path outside component root: ${normalized}`);
       continue;
     }
@@ -362,20 +367,21 @@ export function validateScopeInvariants(
       errors.push(`invalid write_glob: ${String(raw ?? "")}`);
       continue;
     }
-    if (hasForbiddenBroadGlob(normalized)) {
+    if (!hintsOnly && hasForbiddenBroadGlob(normalized)) {
       errors.push(`forbidden broad write_glob: ${normalized}`);
       continue;
     }
     const prefix = literalPrefix(normalized);
-    if (!prefix) {
+    if (!hintsOnly && !prefix) {
       errors.push(`write_glob literal prefix cannot be empty: ${normalized}`);
       continue;
     }
-    if (rootPrefix && !underRoot(prefix, rootPrefix)) {
+    if (!hintsOnly && rootPrefix && !underRoot(prefix, rootPrefix)) {
       errors.push(`write_glob outside component root: ${normalized}`);
       continue;
     }
     if (
+      !hintsOnly &&
       !normalizedTargetPaths.some(
         (targetPath) => targetPath === prefix || targetPath.startsWith(`${prefix}/`),
       )
@@ -393,13 +399,13 @@ export function validateScopeInvariants(
     errors.push("write_globs must be provided and non-empty");
   }
 
-  if (normalizedTargetPaths.length > 0 && normalizedWriteGlobs.length > 0) {
+  if (!hintsOnly && normalizedTargetPaths.length > 0 && normalizedWriteGlobs.length > 0) {
     for (const targetPath of normalizedTargetPaths) {
       const covered = normalizedWriteGlobs.some((glob) => matchesGlob(targetPath, glob));
       if (!covered) errors.push(`target_path not covered by write_globs: ${targetPath}`);
     }
   }
-  if (!normalizedComponentArea && !allowMultipleComponentRoots) {
+  if (!hintsOnly && !normalizedComponentArea && !allowMultipleComponentRoots) {
     errors.push("component_area could not be derived from scope");
   }
 

package/runtime/sandbox/packages/shared/src/communication.ts

@@ -53,6 +53,7 @@ export interface CommunicationManagerOptions {
   sessionId: string;
   from: string;
   authToken?: string | null;
+  fetchImpl?: typeof fetch;
 }
 
 export class CommunicationManager {
@@ -60,12 +61,14 @@ export class CommunicationManager {
   private readonly sessionId: string;
   private readonly from: string;
   private readonly authToken: string | null;
+  private readonly fetchImpl: typeof fetch;
 
   constructor(opts: CommunicationManagerOptions) {
     this.serverUrl = opts.serverUrl;
     this.sessionId = opts.sessionId;
     this.from = opts.from;
     this.authToken = opts.authToken ?? null;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
   }
 
   private headers(): Record<string, string> {
@@ -121,7 +124,7 @@ export class CommunicationManager {
       if (meta.turnId) body.turnId = meta.turnId;
       if (meta.parentId) body.parentId = meta.parentId;
 
-      const response = await fetch(this.commandUrl(sessionId), {
+      const response = await this.fetchImpl(this.commandUrl(sessionId), {
         method: "POST",
         headers: this.headers(),
         body: JSON.stringify(body),

package/runtime/sandbox/packages/shared/src/config.ts

@@ -1929,7 +1929,7 @@ export function loadPushPalsConfig(options: LoadOptions = {}): PushPalsConfig {
         ),
         allowReadAnywhere:
           parseBoolEnv("REMOTEBUDDY_AUTONOMY_ALLOW_READ_ANYWHERE") ??
-          asBoolean(remoteAutonomyNode.allow_read_anywhere, false),
+          asBoolean(remoteAutonomyNode.allow_read_anywhere, true),
         prFeedbackCommentRows: Math.max(
           1,
           Math.min(

package/runtime/sandbox/prompts/workerpals/miniswe_completion_requirement.md

@@ -1 +1 @@
-Completion requirement: handle all requested edits across all explicit target paths before setting done=true.
+Completion requirement: solve the requested task before setting done=true. Target paths are relevance hints; edit other behavior-owning files when needed and explain why.

package/runtime/sandbox/prompts/workerpals/miniswe_explicit_targets_block.md

@@ -1,2 +1,2 @@
-Explicit target paths:
+Target path hints:
 {{targets_block}}