@pushpalsdev/cli 1.0.95 → 1.0.97

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushpalsdev/cli",
-  "version": "1.0.95",
+  "version": "1.0.97",
   "description": "PushPals terminal CLI for LocalBuddy -> RemoteBuddy orchestration",
   "license": "MIT",
   "repository": {

package/runtime/sandbox/apps/workerpals/src/backends/openai_codex/openai_codex_executor.py

@@ -369,21 +369,41 @@ def _normalize_choice(
     return default
 
 
-def _is_git_repo(repo: str) -> bool:
-    try:
-        proc = subprocess.run(
-            ["git", "rev-parse", "--is-inside-work-tree"],
-            cwd=repo,
-            capture_output=True,
-            text=True,
-            timeout=10,
-            check=False,
-        )
-        if proc.returncode != 0:
+def _is_git_repo(repo: str, timeout_seconds: float = 5.0, poll_seconds: float = 0.1) -> bool:
+    deadline = time.monotonic() + max(0.0, timeout_seconds)
+    last_detail = ""
+    attempts = 0
+
+    while True:
+        attempts += 1
+        try:
+            proc = subprocess.run(
+                ["git", "rev-parse", "--is-inside-work-tree"],
+                cwd=repo,
+                capture_output=True,
+                text=True,
+                timeout=10,
+                check=False,
+            )
+            if proc.returncode == 0 and (proc.stdout or "").strip().lower() == "true":
+                return True
+            last_detail = "\n".join(
+                part.strip()
+                for part in [proc.stderr or "", proc.stdout or ""]
+                if part and part.strip()
+            )
+        except Exception as exc:
+            last_detail = str(exc)
+
+        if time.monotonic() >= deadline:
+            if last_detail:
+                log.warning(
+                    "Git repository preflight failed "
+                    f"after {attempts} attempt(s) for {repo}: {to_single_line(last_detail, 240)}"
+                )
             return False
-        return (proc.stdout or "").strip().lower() == "true"
-    except Exception:
-        return False
+
+        time.sleep(max(0.01, poll_seconds))
 
 
 def _codex_project_config_roots(repo: str, env: Dict[str, str]) -> List[Path]:

package/runtime/sandbox/apps/workerpals/src/common/sandbox_env.ts

@@ -1,5 +1,5 @@
 import { createHash } from "crypto";
-import { existsSync, mkdirSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir, tmpdir } from "os";
 import { basename, resolve } from "path";
 
@@ -17,6 +17,14 @@ function safeRepoSlug(repo: string): string {
   return `${leaf}-${hash}`;
 }
 
+function browserCacheRepoKey(repo: string): string {
+  const normalized = resolve(repo).replace(/\\/g, "/");
+  const marker = "/.worktrees/";
+  const markerIndex = normalized.lastIndexOf(marker);
+  if (markerIndex < 0) return resolve(repo);
+  return normalized.slice(0, markerIndex);
+}
+
 function defaultExpoPortForRepo(repo: string): string {
   const hashPrefix = createHash("sha256").update(resolve(repo)).digest("hex").slice(0, 8);
   const offset = Number.parseInt(hashPrefix, 16) % 1_000;
@@ -33,6 +41,18 @@ function ensureDirs(paths: string[]): void {
   }
 }
 
+function ensureSandboxGitConfig(homeDir: string): void {
+  const gitConfigPath = resolve(homeDir, ".gitconfig");
+  try {
+    const existing = existsSync(gitConfigPath) ? readFileSync(gitConfigPath, "utf8") : "";
+    if (/(^|\n)\s*directory\s*=\s*\*/.test(existing)) return;
+    const prefix = existing.trim() ? `${existing.replace(/\s+$/, "")}\n\n` : "";
+    writeFileSync(gitConfigPath, `${prefix}[safe]\n\tdirectory = *\n`, "utf8");
+  } catch {
+    // Best effort: git will surface any remaining safe.directory blocker.
+  }
+}
+
 function resolveOriginalHome(env: Record<string, string>): string {
   return env.HOME || env.USERPROFILE || homedir();
 }
@@ -54,8 +74,18 @@ export function buildWorkerSandboxWritableEnv(
   const homeDir = resolve(baseDir, "home");
   const cacheDir = resolve(baseDir, "cache");
   const expoDir = resolve(baseDir, "expo");
+  const playwrightBrowsersDir =
+    env.PLAYWRIGHT_BROWSERS_PATH && env.PLAYWRIGHT_BROWSERS_PATH !== "0"
+      ? env.PLAYWRIGHT_BROWSERS_PATH
+      : resolve(
+          tmpdir(),
+          "pushpals-worker-env",
+          safeRepoSlug(browserCacheRepoKey(repo)),
+          "playwright-browsers",
+        );
   const defaultExpoPort = defaultExpoPortForRepo(repo);
-  ensureDirs([homeDir, cacheDir, expoDir, resolve(cacheDir, "npm")]);
+  ensureDirs([homeDir, cacheDir, expoDir, resolve(cacheDir, "npm"), playwrightBrowsersDir]);
+  ensureSandboxGitConfig(homeDir);
 
   return {
     ...env,
@@ -64,6 +94,7 @@ export function buildWorkerSandboxWritableEnv(
     USERPROFILE: homeDir,
     XDG_CACHE_HOME: cacheDir,
     npm_config_cache: resolve(cacheDir, "npm"),
+    PLAYWRIGHT_BROWSERS_PATH: env.PLAYWRIGHT_BROWSERS_PATH ?? playwrightBrowsersDir,
     EXPO_HOME: expoDir,
     EXPO_NO_TELEMETRY: env.EXPO_NO_TELEMETRY ?? "1",
     EXPO_NO_INTERACTIVE: env.EXPO_NO_INTERACTIVE ?? "1",

package/runtime/sandbox/apps/workerpals/src/execute_job.ts

@@ -601,42 +601,75 @@ export function tokenizeValidationCommandArgv(command: string): string[] | null
   return out;
 }
 
-async function runValidationCommand(
+async function terminateValidationProcessTree(
+  proc: ReturnType<typeof Bun.spawn>,
+): Promise<void> {
+  const pid = Number(proc.pid);
+  if (process.platform === "win32" && Number.isFinite(pid) && pid > 0) {
+    try {
+      Bun.spawnSync(["taskkill", "/PID", String(pid), "/T", "/F"], {
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      return;
+    } catch {
+      // Fall through to Bun's process handle.
+    }
+  }
+
+  if (process.platform !== "win32" && Number.isFinite(pid) && pid > 0) {
+    try {
+      process.kill(-pid, "SIGTERM");
+    } catch {
+      try {
+        proc.kill("SIGTERM");
+      } catch {
+        // ignore
+      }
+    }
+    await Bun.sleep(2_000);
+    try {
+      process.kill(-pid, "SIGKILL");
+    } catch {
+      try {
+        proc.kill("SIGKILL");
+      } catch {
+        // ignore
+      }
+    }
+    return;
+  }
+
+  try {
+    proc.kill();
+  } catch {
+    // ignore
+  }
+}
+
+async function runValidationArgv(
   repo: string,
   command: string,
+  argv: string[],
+  env: Record<string, string>,
   timeoutMs: number,
   outputPolicy: Partial<OutputCompactionPolicy>,
+  timeoutMessage: string,
 ): Promise<ValidationExecutionResult> {
-  const env = buildWorkerSandboxWritableEnv(repo);
-  const argv = prepareValidationCommandArgv(command, env);
-  if (!argv) {
-    return {
-      step: command,
-      command,
-      ok: false,
-      exitCode: 2,
-      stdout: "",
-      stderr:
-        "Validation command could not be parsed safely. Use a plain command without shell chaining/pipes.",
-      elapsedMs: 1,
-    };
-  }
   const startedAt = Date.now();
   const proc = Bun.spawn(argv, {
     cwd: repo,
     env,
+    stdin: "ignore",
     stdout: "pipe",
     stderr: "pipe",
+    detached: process.platform !== "win32",
   });
   let timedOut = false;
   const timer = setTimeout(
     () => {
       timedOut = true;
-      try {
-        proc.kill();
-      } catch {
-        // ignore
-      }
+      void terminateValidationProcessTree(proc);
     },
     Math.max(1_000, timeoutMs),
   );
@@ -657,9 +690,7 @@ async function runValidationCommand(
     stderr: compactJobOutput(
       [
         stderr.trim(),
-        timedOut
-          ? `Validation command timed out after ${Math.max(1_000, timeoutMs)}ms. Captured output is the process output emitted before PushPals terminated the command.`
-          : "",
+        timedOut ? timeoutMessage : "",
       ]
         .filter(Boolean)
         .join("\n"),
@@ -669,6 +700,38 @@ async function runValidationCommand(
   };
 }
 
+async function runValidationCommand(
+  repo: string,
+  command: string,
+  timeoutMs: number,
+  outputPolicy: Partial<OutputCompactionPolicy>,
+): Promise<ValidationExecutionResult> {
+  const env = buildWorkerSandboxWritableEnv(repo);
+  const argv = prepareValidationCommandArgv(command, env);
+  if (!argv) {
+    return {
+      step: command,
+      command,
+      ok: false,
+      exitCode: 2,
+      stdout: "",
+      stderr:
+        "Validation command could not be parsed safely. Use a plain command without shell chaining/pipes.",
+      elapsedMs: 1,
+    };
+  }
+
+  return runValidationArgv(
+    repo,
+    command,
+    argv,
+    env,
+    timeoutMs,
+    outputPolicy,
+    `Validation command timed out after ${Math.max(1_000, timeoutMs)}ms. Captured output is the process output emitted before PushPals terminated the command and its process tree.`,
+  );
+}
+
 export function isLongRunningBrowserValidationCommand(command: string): boolean {
   const normalized = validationCommandKey(command);
   if (!normalized) return false;
@@ -681,6 +744,168 @@ export function isLongRunningBrowserValidationCommand(command: string): boolean
   );
 }
 
+function readPackageJson(repo: string): {
+  scripts?: Record<string, unknown>;
+  dependencies?: Record<string, unknown>;
+  devDependencies?: Record<string, unknown>;
+  optionalDependencies?: Record<string, unknown>;
+  peerDependencies?: Record<string, unknown>;
+} | null {
+  const packagePath = resolve(repo, "package.json");
+  if (!existsSync(packagePath)) return null;
+  try {
+    return JSON.parse(readFileSync(packagePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function packageJsonDeclaresPlaywright(repo: string): boolean {
+  const parsed = readPackageJson(repo);
+  if (!parsed) return false;
+  const dependencyGroups = [
+    parsed.dependencies,
+    parsed.devDependencies,
+    parsed.optionalDependencies,
+    parsed.peerDependencies,
+  ];
+  return dependencyGroups.some((group) =>
+    Boolean(group && (group.playwright || group["@playwright/test"])),
+  );
+}
+
+function resolvePackageScriptForValidationCommand(
+  repo: string,
+  command: string,
+): { script: string; cwd: string } | null {
+  const argv = tokenizeValidationCommandArgv(command);
+  if (!argv || argv.length === 0) return null;
+  const first = argv[0]?.toLowerCase();
+  let cwd = repo;
+  let scriptName = "";
+
+  const consumeCwdOption = (index: number): number | null => {
+    const token = argv[index] ?? "";
+    if ((token === "--cwd" || token === "-C" || token === "--prefix") && argv[index + 1]) {
+      cwd = resolve(repo, argv[index + 1] ?? "");
+      return index + 2;
+    }
+    for (const prefix of ["--cwd=", "-C=", "--prefix="]) {
+      if (token.startsWith(prefix)) {
+        cwd = resolve(repo, token.slice(prefix.length));
+        return index + 1;
+      }
+    }
+    return null;
+  };
+
+  if (first === "bun") {
+    let index = 1;
+    while (index < argv.length) {
+      const consumed = consumeCwdOption(index);
+      if (consumed !== null) {
+        index = consumed;
+        continue;
+      }
+      if ((argv[index] ?? "").startsWith("--")) {
+        index += 1;
+        continue;
+      }
+      break;
+    }
+    if ((argv[index] ?? "").toLowerCase() === "run") {
+      scriptName = argv[index + 1] ?? "";
+    } else {
+      const candidate = argv[index] ?? "";
+      if (candidate && !["install", "test", "x"].includes(candidate.toLowerCase())) {
+        scriptName = candidate;
+      }
+    }
+  } else if (first === "npm" || first === "pnpm" || first === "yarn") {
+    let index = 1;
+    while (index < argv.length) {
+      const consumed = consumeCwdOption(index);
+      if (consumed !== null) {
+        index = consumed;
+        continue;
+      }
+      if ((argv[index] ?? "").toLowerCase() === "run") {
+        scriptName = argv[index + 1] ?? "";
+        break;
+      }
+      if (!(argv[index] ?? "").startsWith("-")) {
+        scriptName = argv[index] ?? "";
+        break;
+      }
+      index += 1;
+    }
+  }
+
+  if (!scriptName) return null;
+  const script = readPackageJson(cwd)?.scripts?.[scriptName];
+  if (typeof script !== "string" || !script.trim()) return null;
+  return { script, cwd };
+}
+
+function readReferencedValidationScriptText(cwd: string, script: string): string {
+  const texts: string[] = [];
+  const tokens = tokenizeValidationCommandArgv(script) ?? script.split(/\s+/).filter(Boolean);
+  for (const rawToken of tokens) {
+    const token = rawToken
+      .trim()
+      .replace(/^['"`]+|['"`]+$/g, "")
+      .replace(/\\/g, "/");
+    if (!/\.(cjs|cts|js|jsx|mjs|mts|ts|tsx)$/i.test(token)) continue;
+    if (token.includes("://") || token.includes("node_modules/")) continue;
+    const scriptPath = resolve(cwd, token);
+    if (!existsSync(scriptPath)) continue;
+    try {
+      texts.push(readFileSync(scriptPath, "utf8").slice(0, 64_000));
+    } catch {
+      // Best effort: the validation command will surface unreadable files.
+    }
+  }
+  return texts.join("\n");
+}
+
+export function shouldEnsurePlaywrightBrowserRuntime(repo: string, command: string): boolean {
+  if (!isLongRunningBrowserValidationCommand(command)) return false;
+  if (/\bplaywright\b/i.test(command)) return true;
+
+  const script = resolvePackageScriptForValidationCommand(repo, command);
+  const scriptCwd = script?.cwd ?? repo;
+  if (packageJsonDeclaresPlaywright(repo) || packageJsonDeclaresPlaywright(scriptCwd)) {
+    return true;
+  }
+  if (!script) return false;
+  return /(?:^|[^A-Za-z0-9_-])(?:@playwright\/test|playwright)(?:$|[^A-Za-z0-9_-])/i.test(
+    `${script.script}\n${readReferencedValidationScriptText(script.cwd, script.script)}`,
+  );
+}
+
+export function playwrightBrowserInstallArgv(): string[] {
+  return ["bunx", "playwright", "install", "chromium"];
+}
+
+async function runPlaywrightBrowserRuntimePreflight(
+  repo: string,
+  command: string,
+  timeoutMs: number,
+  outputPolicy: Partial<OutputCompactionPolicy>,
+): Promise<ValidationExecutionResult> {
+  const env = buildWorkerSandboxWritableEnv(repo);
+  const timeout = Math.max(120_000, Math.min(600_000, timeoutMs));
+  return runValidationArgv(
+    repo,
+    command,
+    playwrightBrowserInstallArgv(),
+    env,
+    timeout,
+    outputPolicy,
+    `Browser runtime preflight timed out after ${timeout}ms while ensuring Playwright Chromium. Captured output is the process output emitted before PushPals terminated the installer process tree.`,
+  );
+}
+
 export function resolveValidationCommandTimeoutMs(command: string, baseTimeoutMs: number): number {
   const normalizedBase = Number.isFinite(Number(baseTimeoutMs))
     ? Math.max(1_000, Math.min(7_200_000, Math.floor(Number(baseTimeoutMs))))
@@ -927,12 +1152,16 @@ function detectValidationBlocker(runs: ValidationExecutionResult[]): ValidationB
     combined.includes("missing required tool") ||
     combined.includes("command not found") ||
     combined.includes("executable not found") ||
+    combined.includes("browser runtime preflight failed") ||
+    combined.includes("playwright install") ||
+    combined.includes("executable doesn't exist") ||
+    combined.includes("please run the following command to download new browsers") ||
     combined.includes("not recognized as an internal or external command")
   ) {
     return {
       category: "environment",
       detail:
-        "Validation is blocked by missing required toolchain executables in the worker environment. Install/provision the missing tools or declare a supported repo toolchain before retrying this job.",
+        "Validation is blocked by missing required toolchain executables or browser runtime support in the worker environment. Install/provision the missing tools or browser runtime before retrying this job.",
     };
   }
 
@@ -1121,6 +1350,10 @@ export function extractValidationFailureDigest(run: {
     /\bFailed to resolve import\s+['"`][^'"`\r\n]+['"`][^\r\n]*/i,
     /\bCould not resolve\s+['"`]?[^'"`\r\n]+['"`]?[^\r\n]*/i,
     /\bModule not found[^\r\n]*/i,
+    /\bbrowserType\.launch:[^\r\n]*/i,
+    /\bExecutable doesn't exist[^\r\n]*/i,
+    /\bPlease run the following command to download new browsers:[^\r\n]*(?:\r?\n\s+[^\r\n]+)?/i,
+    /\bRun ["`]?npx playwright install[^'"`\r\n]*["`]?[^\r\n]*/i,
     /\bERR_SOCKET_BAD_PORT[^\r\n]*/i,
     /\berror TS\d+:[^\r\n]*/i,
     /\bError:\s+[^\r\n]*/i,
@@ -1539,6 +1772,7 @@ async function runDeterministicQualityGate(
         )}`,
       );
     }
+    let playwrightBrowserRuntimeReady = false;
     for (const command of commandsToRun) {
       const commandMissingTools = requirementsForValidationCommand(toolchainPlan, command).filter(
         (requirement) =>
@@ -1563,6 +1797,48 @@ async function runDeterministicQualityGate(
         );
         continue;
       }
+      const commandNeedsPlaywrightBrowserRuntime = shouldEnsurePlaywrightBrowserRuntime(
+        repo,
+        command,
+      );
+      let commandBrowserRuntimeEnsured =
+        playwrightBrowserRuntimeReady && commandNeedsPlaywrightBrowserRuntime;
+      if (!playwrightBrowserRuntimeReady && commandNeedsPlaywrightBrowserRuntime) {
+        const browserEnv = buildWorkerSandboxWritableEnv(repo);
+        onLog?.(
+          "stdout",
+          `[ValidationGate] Browser runtime preflight: ensuring Playwright Chromium for "${command}" at ${browserEnv.PLAYWRIGHT_BROWSERS_PATH ?? "(default browser cache)"}`,
+        );
+        const browserPreflight = await runPlaywrightBrowserRuntimePreflight(
+          repo,
+          command,
+          resolveValidationCommandTimeoutMs(command, qualityValidationStepTimeoutMs),
+          outputPolicy,
+        );
+        if (!browserPreflight.ok) {
+          const digest = extractValidationFailureDigest(browserPreflight);
+          validationRuns.push({
+            ...browserPreflight,
+            stderr: [
+              `Browser runtime preflight failed before validation command "${command}". WorkerPals could not ensure Playwright Chromium in PLAYWRIGHT_BROWSERS_PATH=${browserEnv.PLAYWRIGHT_BROWSERS_PATH ?? "(default)"}.`,
+              browserPreflight.stderr,
+            ]
+              .filter(Boolean)
+              .join("\n"),
+          });
+          onLog?.(
+            "stderr",
+            `[ValidationGate] Browser runtime preflight failed for "${command}"${digest ? ` - ${digest}` : ""}`,
+          );
+          continue;
+        }
+        playwrightBrowserRuntimeReady = true;
+        onLog?.(
+          "stdout",
+          `[ValidationGate] Browser runtime preflight passed for "${command}"`,
+        );
+        commandBrowserRuntimeEnsured = true;
+      }
       const previousDigest = validationRetryState?.previousFailureDigests?.get(
         validationCommandKey(command),
       );
@@ -1570,7 +1846,8 @@ async function runDeterministicQualityGate(
         previousDigest &&
         Number(validationRetryState?.revisionAttempt ?? 0) > 0 &&
         isLongRunningBrowserValidationCommand(command) &&
-        isBrowserValidationInfrastructureDigest(previousDigest)
+        isBrowserValidationInfrastructureDigest(previousDigest) &&
+        !commandBrowserRuntimeEnsured
       ) {
         const stderr =
           `Skipped repeated browser validation after the same command failed in an earlier revision: ${previousDigest}. ` +