@pushpalsdev/cli 1.1.15 → 1.1.17

package/dist/pushpals-cli.js

@@ -1637,9 +1637,11 @@ var DEFAULT_RUNTIME_BOOT_TIMEOUT_MS = 90000;
 var DEFAULT_RUNTIME_BOOT_POLL_MS = 1000;
 var DEFAULT_SERVER_BOOT_TIMEOUT_MS = 20000;
 var DEFAULT_SERVICE_STABILITY_GRACE_MS = 4000;
+var DEFAULT_REMOTEBUDDY_CONSUMER_STARTUP_GRACE_MS = 8000;
 var DEFAULT_COMMAND_OUTPUT_DRAIN_TIMEOUT_MS = 2000;
 var DEFAULT_COMMAND_OUTPUT_MAX_CHARS = 512000;
 var DEFAULT_REMOTEBUDDY_SILENT_STARTUP_FALLBACK_MS = 20000;
+var DEFAULT_WORKERPAL_STARTUP_STATUS_FETCH_TIMEOUT_MS = 2000;
 var WINDOWS_TASKKILL_TIMEOUT_MS2 = 5000;
 var RUNTIME_BINARY_DOWNLOAD_ATTEMPTS = 3;
 var DEFAULT_STARTUP_GIT_PROBE_TIMEOUT_MS = 5000;
@@ -1647,6 +1649,7 @@ var DEFAULT_STARTUP_GIT_REMOTE_TIMEOUT_MS = 1e4;
 var DEFAULT_EMBEDDED_SERVICE_LAUNCH_WARN_MS = 5000;
 var EMBEDDED_SERVICE_RESTART_MAX_ATTEMPTS = 4;
 var WORKERPAL_STARTUP_READINESS_PROBE_MAX_MS = 15000;
+var BLOCKING_WORKERPAL_IMAGE_BUILD_ENV = "PUSHPALS_BLOCKING_WORKERPAL_IMAGE_BUILD";
 var CLI_SESSION_JOB_LOG_MAX_CHARS = 700;
 var CLI_SESSION_SHOW_JOB_EVENTS_ENV = "PUSHPALS_CLI_SHOW_JOB_EVENTS";
 var EMBEDDED_RUNTIME_SAFETY_CAP_DISABLE_ENV = "PUSHPALS_DISABLE_EMBEDDED_SAFETY_CAPS";
@@ -3450,7 +3453,7 @@ function isWorkerpalEphemeralWorktreePath(repoRoot, worktreePath) {
   if (!normalizedPath.startsWith(expectedPrefix))
     return false;
   const leaf = basename(normalizedPath);
-  return /^(job|selfcheck)-.*-workerpal-[a-z0-9._-]+/i.test(leaf);
+  return /^(job|selfcheck)-[a-z0-9][a-z0-9._-]*$/i.test(leaf);
 }
 function resolveConfiguredDockerExecutable(env, platform = process.platform) {
   const configured = String(env.PUSHPALS_DOCKER_BIN_ABSOLUTE ?? env.PUSHPALS_DOCKER_BIN ?? (platform === "win32" ? "docker.exe" : "docker")).trim();
@@ -3899,6 +3902,13 @@ function resolveWorkerpalCapacityTimeoutMs(config) {
 function resolveWorkerpalStartupReadinessProbeTimeoutMs(config) {
   return Math.max(5000, Math.min(resolveWorkerpalCapacityTimeoutMs(config), WORKERPAL_STARTUP_READINESS_PROBE_MAX_MS));
 }
+function shouldPrepareEmbeddedWorkerpalDockerImageBlocking(opts = {}) {
+  const env = opts.env ?? process.env;
+  const explicit = String(env[BLOCKING_WORKERPAL_IMAGE_BUILD_ENV] ?? "").trim();
+  if (explicit)
+    return isTruthyCliEnvValue(explicit);
+  return (opts.platform ?? process.platform) !== "win32";
+}
 function shouldRunEmbeddedRuntimeStartupPrechecks(opts) {
   return !opts.serverHealthy && !opts.noAutoStart;
 }
@@ -4248,6 +4258,16 @@ function extractRemoteBuddySessionConsumerHealth(statusPayload, sessionId) {
     detail: `No connected RemoteBuddy session consumer found for session ${sessionId}`
   };
 }
+function shouldDeferRemoteBuddySessionConsumerReadiness(opts) {
+  if (opts.localBuddyEnabled)
+    return false;
+  if (opts.remoteBuddyReady)
+    return false;
+  if (!opts.remoteBuddyServiceRunning)
+    return false;
+  const startupGraceMs = Math.max(0, opts.startupGraceMs ?? DEFAULT_REMOTEBUDDY_CONSUMER_STARTUP_GRACE_MS);
+  return opts.readinessElapsedMs >= startupGraceMs;
+}
 async function probeRemoteBuddySessionConsumer(serverUrl, sessionId) {
   try {
     const response = await fetchWithTimeout(`${serverUrl}/system/status`, {}, 1e4);
@@ -4276,8 +4296,8 @@ async function probeSourceControlManager(port) {
     return false;
   }
 }
-async function fetchWorkerStatusRows(serverUrl, ttlMs) {
-  const payload = await fetchJsonWithTimeout(`${serverUrl}/workers?ttlMs=${Math.max(1000, Math.floor(ttlMs))}`, {}, 1e4);
+async function fetchWorkerStatusRows(serverUrl, ttlMs, timeoutMs = 1e4) {
+  const payload = await fetchJsonWithTimeout(`${serverUrl}/workers?ttlMs=${Math.max(1000, Math.floor(ttlMs))}`, {}, Math.max(250, Math.floor(timeoutMs)));
   if (!payload?.ok || !Array.isArray(payload.workers)) {
     return [];
   }
@@ -4287,7 +4307,8 @@ async function waitForWorkerpalCapacity(opts) {
   const deadline = Date.now() + Math.max(1000, opts.timeoutMs);
   let lastObservedOnline = 0;
   while (Date.now() < deadline) {
-    const workers = await (opts.fetchWorkersFn ?? fetchWorkerStatusRows)(opts.serverUrl, opts.ttlMs);
+    const remainingMs = Math.max(250, deadline - Date.now());
+    const workers = await (opts.fetchWorkersFn ?? fetchWorkerStatusRows)(opts.serverUrl, opts.ttlMs, Math.min(DEFAULT_WORKERPAL_STARTUP_STATUS_FETCH_TIMEOUT_MS, remainingMs));
     const summary = summarizeWorkerStatusRows(workers);
     if (summary.onlineWorkers > 0) {
       lastObservedOnline = Math.max(lastObservedOnline, summary.onlineWorkers);
@@ -4716,6 +4737,7 @@ ${tail}` : ""}`);
   const optionalServiceExitWarned = new Set;
   let lastReadinessWaitLogAt = 0;
   let lastReadinessWaitDetail = "";
+  let deferredRemoteBuddyConsumerLogged = false;
   while (Date.now() < deadline) {
     reportRemoteBuddyAutonomousEngineState();
     if (maybeActivateRemoteBuddyWindowsFallback("silent_startup")) {
@@ -4759,7 +4781,15 @@ ${tail}` : ""}`);
     }
     const health = localBuddyEnabled ? await probeLocalBuddy(opts.localAgentUrl) : null;
     const remoteBuddyHealth2 = await probeRemoteBuddySessionConsumer(opts.serverUrl, opts.sessionId);
-    if (localBuddyEnabled && !health?.ok || !remoteBuddyHealth2.ok) {
+    const remoteBuddyServiceRunning = serviceManager.getServices().some((service) => service.name === "remotebuddy" && !service.exited);
+    const deferRemoteBuddyConsumer = shouldDeferRemoteBuddySessionConsumerReadiness({
+      localBuddyEnabled,
+      remoteBuddyReady: remoteBuddyHealth2.ok,
+      remoteBuddyServiceRunning,
+      readinessElapsedMs: Date.now() - readinessPhaseStartedAt
+    });
+    const remoteBuddyReadyForCli = remoteBuddyHealth2.ok || deferRemoteBuddyConsumer;
+    if (localBuddyEnabled && !health?.ok || !remoteBuddyReadyForCli) {
       const localBuddyDetail = localBuddyEnabled ? health?.ok ? "LocalBuddy ready" : "LocalBuddy not ready" : "LocalBuddy skipped";
       const readinessDetail = `${localBuddyDetail}; ${remoteBuddyHealth2.detail}`;
       const now = Date.now();
@@ -4770,7 +4800,11 @@ ${tail}` : ""}`);
         lastReadinessWaitLogAt = now;
       }
     }
-    if ((!localBuddyEnabled || health?.ok) && remoteBuddyHealth2.ok) {
+    if ((!localBuddyEnabled || health?.ok) && remoteBuddyReadyForCli) {
+      if (deferRemoteBuddyConsumer && !deferredRemoteBuddyConsumerLogged) {
+        appendRuntimeServicesLogLine(runtimeServicesLogPath, `[pushpals] continuing startup after ${Date.now() - readinessPhaseStartedAt}ms without a connected RemoteBuddy session consumer; embedded RemoteBuddy is running and the CLI session will connect after startup (${remoteBuddyHealth2.detail}).`);
+        deferredRemoteBuddyConsumerLogged = true;
+      }
       reportRemoteBuddyAutonomousEngineState();
       const stabilityDeadline = Date.now() + DEFAULT_SERVICE_STABILITY_GRACE_MS;
       while (Date.now() < stabilityDeadline) {
@@ -5702,7 +5736,10 @@ async function main() {
     console.error("[pushpals] Precheck failed: start Docker Desktop or the Docker daemon, then retry pushpals.");
     process.exit(1);
   }
-  if (runEmbeddedRuntimeStartupPrechecks && workerpalDockerPrecheck.status !== "failed") {
+  if (runEmbeddedRuntimeStartupPrechecks && workerpalDockerPrecheck.status !== "failed" && shouldPrepareEmbeddedWorkerpalDockerImageBlocking({
+    platform: process.platform,
+    env: process.env
+  })) {
     const workerpalImagePrecheck = await prepareEmbeddedWorkerpalDockerImageIfNeeded({
       preparedRuntime,
       config,
@@ -5716,6 +5753,8 @@ async function main() {
     if (workerpalImagePrecheck.runtimeTag) {
       resolvedRuntimeTagForAutoStart = workerpalImagePrecheck.runtimeTag;
     }
+  } else if (runEmbeddedRuntimeStartupPrechecks && workerpalDockerPrecheck.status !== "failed") {
+    console.log(`[pushpals] Skipping blocking WorkerPal sandbox image build during CLI startup; WorkerPal warmup will prepare it in the background. Set ${BLOCKING_WORKERPAL_IMAGE_BUILD_ENV}=1 to force the old foreground behavior.`);
   }
   let remoteBuddyConsumerHealth = {
     ok: false,
@@ -6040,6 +6079,8 @@ export {
   shouldShowCliSessionOperationalEvents,
   shouldRunEmbeddedRuntimeStartupPrechecks,
   shouldRestartEmbeddedService,
+  shouldPrepareEmbeddedWorkerpalDockerImageBlocking,
+  shouldDeferRemoteBuddySessionConsumerReadiness,
   runCommandWithEnv,
   resolveWorkerpalDockerProbe,
   resolveWorkerExecutionReadiness,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushpalsdev/cli",
-  "version": "1.1.15",
+  "version": "1.1.17",
   "description": "PushPals terminal CLI for LocalBuddy -> RemoteBuddy orchestration",
   "license": "MIT",
   "repository": {

package/runtime/sandbox/.pushpals-remotebuddy-fallback.js

@@ -4276,6 +4276,9 @@ var IDEATION_SYSTEM_PROMPT = loadPromptTemplate("remotebuddy/autonomy_ideation_s
 var SCORING_SYSTEM_PROMPT = loadPromptTemplate("remotebuddy/autonomy_scoring_system_prompt.md").trim();
 var PLANNING_SYSTEM_PROMPT = loadPromptTemplate("remotebuddy/autonomy_planning_system_prompt.md").trim();
 var IDEATION_TIMEOUT_RECOVERY_INSTRUCTION = "Previous ideation timed out before you returned JSON. For this round only, stay within the time budget: prioritize the top 1-3 highest-confidence candidates, keep reasoning brief, avoid exhaustive exploration, and return valid JSON as soon as possible.";
+var IDEATION_NORMAL_MAX_TOKENS = 1800;
+var IDEATION_RETRY_MAX_TOKENS = 900;
+var IDEATION_NORMAL_MAX_CANDIDATES = 5;
 var STARTUP_FAST_TICK_MAX_ATTEMPTS = 4;
 var STARTUP_FAST_TICK_MAX_DELAY_MS = 15000;
 var STARTUP_STALE_LOCK_AFTER_MS = 30000;
@@ -7371,17 +7374,17 @@ ${JSON.stringify(input.messages ?? [])}`),
       this.setPhase("ideation");
       const buildIdeationInput = (ideationRecovery2, compactRetry) => {
         const reduced = compactRetry || Boolean(ideationRecovery2);
-        const ideationTopSignals = snapshot.top_signals.slice(0, reduced ? 5 : 16);
-        const ideationStateTraits = snapshot.state_traits.slice(0, reduced ? 6 : 24);
-        const ideationFeedbackPriors = snapshot.feedback_priors.slice(0, reduced ? 4 : 20);
-        const ideationEngineIdeaPriors = (snapshot.engine_idea_priors ?? []).slice(0, reduced ? 4 : 20);
-        const ideationOpenObjectives = snapshot.open_objectives.slice(0, reduced ? 4 : 20);
-        const ideationActiveCooldowns = snapshot.active_cooldowns.slice(0, reduced ? 4 : 20);
-        const ideationRepoTargets = repoTargets.slice(0, reduced ? 4 : repoTargets.length);
+        const ideationTopSignals = snapshot.top_signals.slice(0, reduced ? 5 : 10);
+        const ideationStateTraits = snapshot.state_traits.slice(0, reduced ? 6 : 12);
+        const ideationFeedbackPriors = snapshot.feedback_priors.slice(0, reduced ? 4 : 8);
+        const ideationEngineIdeaPriors = (snapshot.engine_idea_priors ?? []).slice(0, reduced ? 4 : 8);
+        const ideationOpenObjectives = snapshot.open_objectives.slice(0, reduced ? 4 : 8);
+        const ideationActiveCooldowns = snapshot.active_cooldowns.slice(0, reduced ? 4 : 8);
+        const ideationRepoTargets = repoTargets.slice(0, reduced ? 4 : 8);
         return {
           system: IDEATION_SYSTEM_PROMPT,
           json: true,
-          maxTokens: reduced ? 900 : 2800,
+          maxTokens: reduced ? IDEATION_RETRY_MAX_TOKENS : IDEATION_NORMAL_MAX_TOKENS,
           temperature: 0.2,
           messages: [
             ...ideationRecovery2 ? [
@@ -7402,7 +7405,7 @@ ${JSON.stringify(input.messages ?? [])}`),
                   open_objectives: ideationOpenObjectives,
                   active_cooldowns: ideationActiveCooldowns
                 },
-                vision: reduced ? compactVisionContextForIdeationRetry(visionContext) : visionContext,
+                vision: compactVisionContextForIdeationRetry(visionContext),
                 repo_targets: ideationRepoTargets.map((target) => ({
                   component_area: target.component_area,
                   target_paths: target.target_paths,
@@ -7410,12 +7413,12 @@ ${JSON.stringify(input.messages ?? [])}`),
                   label: target.label,
                   keywords: target.keywords.slice(0, reduced ? 4 : 8)
                 })),
-                engine_inspiration: reduced ? compactEngineInspirationForIdeationRetry(engineInspiration) : engineInspiration,
+                engine_inspiration: compactEngineInspirationForIdeationRetry(engineInspiration),
                 limits: {
-                  ideation_max_candidates: reduced ? Math.max(1, Math.min(3, this.cfg.ideationMaxCandidates)) : this.cfg.ideationMaxCandidates,
+                  ideation_max_candidates: reduced ? Math.max(1, Math.min(3, this.cfg.ideationMaxCandidates)) : Math.max(1, Math.min(IDEATION_NORMAL_MAX_CANDIDATES, this.cfg.ideationMaxCandidates)),
                   min_confidence: this.cfg.minConfidence
                 }
-              }, null, reduced ? 0 : 2)
+              }, null, 0)
             }
           ]
         };

package/runtime/sandbox/apps/workerpals/src/docker_executor.ts

@@ -428,13 +428,20 @@ export class DockerExecutor {
 
       // Step 3: Run Docker container with the worktree mounted
       for (let attempt = 1; attempt <= this.jobRetryMaxAttempts; attempt++) {
+        const attemptStartedAtMs = Date.now();
         try {
           this.logExecutionConfig();
           const result = await this.runInWarmContainer(worktreePath, base64Spec, job, onLog);
           if (result.ok) return result;
 
           const retryableFailure = this.isRetryableJobFailure(result);
-          if (attempt >= this.jobRetryMaxAttempts || !retryableFailure) {
+          const attemptElapsedMs = Math.max(1, Date.now() - attemptStartedAtMs);
+          const timeoutMs = resolveDockerJobTimeoutMs(this.options.timeoutMs, job);
+          const hasBudgetForRetry =
+            retryableFailure &&
+            attempt < this.jobRetryMaxAttempts &&
+            this.hasBudgetForJobRetry(attempt, attemptElapsedMs, timeoutMs, onLog);
+          if (attempt >= this.jobRetryMaxAttempts || !retryableFailure || !hasBudgetForRetry) {
             if (
               retryableFailure &&
               attempt >= this.jobRetryMaxAttempts &&
@@ -458,7 +465,13 @@ export class DockerExecutor {
           await this.sleep(retryInMs);
         } catch (err) {
           const retryableError = this.isRetryableError(err);
-          if (attempt >= this.jobRetryMaxAttempts || !retryableError) {
+          const attemptElapsedMs = Math.max(1, Date.now() - attemptStartedAtMs);
+          const timeoutMs = resolveDockerJobTimeoutMs(this.options.timeoutMs, job);
+          const hasBudgetForRetry =
+            retryableError &&
+            attempt < this.jobRetryMaxAttempts &&
+            this.hasBudgetForJobRetry(attempt, attemptElapsedMs, timeoutMs, onLog);
+          if (attempt >= this.jobRetryMaxAttempts || !retryableError || !hasBudgetForRetry) {
             if (
               retryableError &&
               attempt >= this.jobRetryMaxAttempts &&
@@ -1208,17 +1221,28 @@ export class DockerExecutor {
       "bun",
       "run",
       "/workspace/apps/workerpals/src/job_runner.ts",
-      base64Spec,
+      "--spec-stdin",
     ];
 
     console.log(
       `[DockerExecutor] Running job in warm container: ${this.warmContainerName} (${this.executionConfigSummary()})`,
     );
 
-    const proc = Bun.spawn([resolveDockerExecutable(), ...args], {
-      stdout: "pipe",
-      stderr: "pipe",
-    });
+    const dockerArgv = [resolveDockerExecutable(), ...args];
+    let proc: ReturnType<typeof Bun.spawn>;
+    try {
+      proc = Bun.spawn(dockerArgv, {
+        stdin: "pipe",
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+    } catch (err) {
+      throw new Error(
+        `failed to spawn warm-container docker exec (${this.warmContainerName}, cwd=${containerWorktreePath}, argv_chars=${dockerArgv.join("\u0000").length}, spec_chars=${base64Spec.length}): ${this.compactError(
+          err,
+        )}`,
+      );
+    }
     const timeoutMs = resolveDockerJobTimeoutMs(this.options.timeoutMs, job);
     if (timeoutMs !== this.options.timeoutMs) {
       const verb = timeoutMs > this.options.timeoutMs ? "Extended" : "Capped";
@@ -1263,10 +1287,24 @@ export class DockerExecutor {
     const stdoutLines: string[] = [];
     const stderrLines: string[] = [];
 
-    await Promise.all([
-      this.readStream(proc.stdout, "stdout", onLog, stdoutLines),
-      this.readStream(proc.stderr, "stderr", onLog, stderrLines),
-    ]);
+    try {
+      await Promise.all([
+        this.writeJobSpecToStdin(proc, base64Spec),
+        this.readStream(proc.stdout, "stdout", onLog, stdoutLines),
+        this.readStream(proc.stderr, "stderr", onLog, stderrLines),
+      ]);
+    } catch (err) {
+      try {
+        proc.kill();
+      } catch {
+        // Ignore cleanup errors after stream setup failures.
+      }
+      throw new Error(
+        `failed while streaming warm-container job execution (${this.warmContainerName}, spec_chars=${base64Spec.length}): ${this.compactError(
+          err,
+        )}`,
+      );
+    }
 
     clearTimeout(warningTimer);
     clearTimeout(timer);
@@ -1283,6 +1321,28 @@ export class DockerExecutor {
     return result;
   }
 
+  private async writeJobSpecToStdin(
+    proc: ReturnType<typeof Bun.spawn>,
+    base64Spec: string,
+  ): Promise<void> {
+    const stdin = proc.stdin as WritableStream<Uint8Array> | undefined;
+    if (!stdin) {
+      throw new Error("docker exec stdin pipe was not available");
+    }
+    const writer = stdin.getWriter();
+    try {
+      await writer.write(new TextEncoder().encode(base64Spec));
+      await writer.close();
+    } catch (err) {
+      try {
+        await writer.abort(err);
+      } catch {
+        // Ignore abort failures; the original write error is more useful.
+      }
+      throw err;
+    }
+  }
+
   private async ensureWorktreeDependencyArtifacts(
     containerWorktreePath: string,
     onLog?: (stream: "stdout" | "stderr", line: string) => void,
@@ -1785,6 +1845,23 @@ export class DockerExecutor {
     return transientPatterns.some((pattern) => pattern.test(text));
   }
 
+  private hasBudgetForJobRetry(
+    attempt: number,
+    attemptElapsedMs: number,
+    timeoutMs: number,
+    onLog?: (stream: "stdout" | "stderr", line: string) => void,
+  ): boolean {
+    if (attempt >= this.jobRetryMaxAttempts) return false;
+    const consumedRatio = timeoutMs > 0 ? attemptElapsedMs / timeoutMs : 1;
+    if (attemptElapsedMs < Math.max(300_000, timeoutMs * 0.8) && consumedRatio < 0.8) return true;
+    const note = `[DockerExecutor] Skipping retry attempt ${
+      attempt + 1
+    }/${this.jobRetryMaxAttempts}: prior attempt consumed ${attemptElapsedMs}ms of ${timeoutMs}ms budget.`;
+    console.warn(note);
+    onLog?.("stderr", note);
+    return false;
+  }
+
   /**
    * Convert Windows path to Docker-compatible path
    * C:\foo\bar → /c/foo/bar
@@ -1839,10 +1916,9 @@ export class DockerExecutor {
   }
 
   private buildEphemeralWorktreeName(prefix: "job" | "selfcheck", token: string): string {
-    const safeWorker = this.sanitizeWorktreeToken(this.options.workerId, 24);
-    const safeToken = this.sanitizeWorktreeToken(token, 40);
-    const nonce = `${Date.now().toString(36)}-${randomUUID().slice(0, 8).toLowerCase()}`;
-    return `${prefix}-${safeToken}-${safeWorker}-${nonce}`;
+    const safeToken = this.sanitizeWorktreeToken(token, prefix === "job" ? 8 : 12);
+    const nonce = `${Date.now().toString(36).slice(-6)}-${randomUUID().slice(0, 6).toLowerCase()}`;
+    return `${prefix}-${safeToken}-${nonce}`;
   }
 
   private sanitizeWorktreeToken(value: string, maxLength: number): string {

package/runtime/sandbox/apps/workerpals/src/execute_job.ts

@@ -191,6 +191,34 @@ export function qualityRevisionLoopUpperBound(policy: {
   );
 }
 
+export function qualityRevisionBudgetDecision(opts: {
+  jobElapsedMs: number;
+  executionBudgetMs: number;
+}): {
+  shouldStart: boolean;
+  remainingBudgetMs: number;
+  minimumRevisionBudgetMs: number;
+} {
+  const executionBudgetMs = Number(opts.executionBudgetMs);
+  if (!Number.isFinite(executionBudgetMs) || executionBudgetMs <= 0) {
+    return {
+      shouldStart: true,
+      remainingBudgetMs: Number.POSITIVE_INFINITY,
+      minimumRevisionBudgetMs: 0,
+    };
+  }
+  const elapsedMs = Math.max(0, Number(opts.jobElapsedMs) || 0);
+  const remainingBudgetMs = Math.max(0, Math.floor(executionBudgetMs - elapsedMs));
+  const minimumRevisionBudgetMs = Math.floor(
+    Math.min(executionBudgetMs, Math.max(180_000, Math.min(600_000, executionBudgetMs * 0.35))),
+  );
+  return {
+    shouldStart: remainingBudgetMs >= minimumRevisionBudgetMs,
+    remainingBudgetMs,
+    minimumRevisionBudgetMs,
+  };
+}
+
 function taskRequestsBrowserValidation(params: Record<string, unknown>): boolean {
   const candidates: string[] = [];
   const collect = (value: unknown) => {
@@ -384,6 +412,11 @@ function isNonPublishableArtifactPath(path: string): boolean {
   );
 }
 
+function isNestedNodeModulesChange(path: string): boolean {
+  const normalized = path.replace(/\\/g, "/").replace(/^\.?\//, "").replace(/\/+$/, "");
+  return /(^|\/)node_modules\/.+/i.test(normalized);
+}
+
 export function publishableChangedPaths(changedPaths: string[]): string[] {
   return changedPaths.filter((path) => !isNonPublishableArtifactPath(path));
 }
@@ -1578,6 +1611,45 @@ function pathMatchesScopeHint(path: string, hint: string): boolean {
   return normalizedPath === prefix || normalizedPath.startsWith(`${prefix}/`);
 }
 
+function isValidationScopeTestPathHint(path: string): boolean {
+  const normalized = path.trim().replace(/\\/g, "/").replace(/^\.\/+/, "");
+  return /(^|\/)(__tests__|tests?)(\/|$)|\.(test|spec)\.[cm]?[jt]sx?$/i.test(normalized);
+}
+
+function shouldTreatBrowserAssertionAsTaskScope(
+  planning: TaskExecutePlanning,
+  changedPaths: string[],
+  targetPath?: string,
+): boolean {
+  const pathHints = [
+    targetPath ?? "",
+    ...changedPaths,
+    ...(planning.targetPaths ?? []),
+    ...(planning.scope.writeGlobs ?? []),
+  ]
+    .map((entry) => entry.trim().replace(/\\/g, "/"))
+    .filter(Boolean);
+  const allHintsAreTests =
+    pathHints.length > 0 && pathHints.every((hint) => isValidationScopeTestPathHint(hint));
+  const planningText = collectPlanningText(planning);
+  const explicitlyBrowserValidation =
+    /\b(browser|web:e2e|e2e|playwright|smoke)\b/i.test(planningText);
+  if (allHintsAreTests && !explicitlyBrowserValidation) return false;
+
+  const productPathChanged = changedPaths.some((path) => {
+    const normalized = path.trim().replace(/\\/g, "/").replace(/^\.\/+/, "");
+    return (
+      !isValidationScopeTestPathHint(normalized) &&
+      /^(app|components|screens|styles|utils)\//i.test(normalized)
+    );
+  });
+  if (productPathChanged) return true;
+
+  return /\b(ui|visual|render(?:ing)?|style|screen|route|home|settings|shop|game|battlefield|component|control panel|control-panel)\b/i.test(
+    planningText,
+  );
+}
+
 export function classifyValidationFailureScope(
   runs: ValidationExecutionResult[],
   planning: TaskExecutePlanning,
@@ -1600,12 +1672,14 @@ export function classifyValidationFailureScope(
     .flatMap((run) => [run.stdout, run.stderr])
     .filter(Boolean)
     .join("\n");
+  const hasBrowserAssertionFailure = failedRuns.some(
+    (run) =>
+      isLongRunningBrowserValidationCommand(run.command) &&
+      isBrowserAssertionDigest([run.stdout, run.stderr].filter(Boolean).join("\n")),
+  );
   if (
-    failedRuns.some(
-      (run) =>
-        isLongRunningBrowserValidationCommand(run.command) &&
-        isBrowserAssertionDigest([run.stdout, run.stderr].filter(Boolean).join("\n")),
-    )
+    hasBrowserAssertionFailure &&
+    shouldTreatBrowserAssertionAsTaskScope(planning, changedPaths, targetPath)
   ) {
     return "task_scope";
   }
@@ -1620,7 +1694,9 @@ export function classifyValidationFailureScope(
   const pathTokens = extractPathTokensFromValidationOutput(combined).filter(
     (token) => !/^(node_modules|\.bun|bun|npm|pnpm|yarn)\//i.test(token),
   );
-  if (pathTokens.length === 0) return "none";
+  if (pathTokens.length === 0) {
+    return hasBrowserAssertionFailure ? "outside_task_scope" : "none";
+  }
   if (pathTokens.some((token) => scopeHints.some((hint) => pathMatchesScopeHint(token, hint)))) {
     return "task_scope";
   }
@@ -2901,7 +2977,7 @@ export function collectPrePublishHygieneIssues(params: {
     }
   }
 
-  if (changedPaths.some((path) => /(^|\/)node_modules(\/|$)/i.test(path))) {
+  if (changedPaths.some((path) => isNestedNodeModulesChange(path))) {
     issues.push("attempted to publish node_modules changes; dependency installs must not become PR content.");
   }
 
@@ -6741,6 +6817,7 @@ export async function executeJob(
 
   let revisionAttempt = 0;
   let revisionHint = "";
+  const jobStartedAt = Date.now();
   const previousValidationFailureDigests = new Map<string, string>();
   const failureJobFamily = buildTaskFailureJobFamily(normalizedParams);
   while (revisionAttempt <= qualityRevisionLoopMax) {
@@ -6854,7 +6931,7 @@ export async function executeJob(
       );
       return {
         ok: false,
-        summary: "Executor produced no publishable code changes",
+        summary: `Executor produced no publishable code changes (${detail})`,
         stdout: result.stdout,
         stderr: [result.stderr ?? "", detail].filter(Boolean).join("\n"),
         exitCode: 4,
@@ -7180,6 +7257,38 @@ export async function executeJob(
       };
     }
 
+    const revisionBudget = qualityRevisionBudgetDecision({
+      jobElapsedMs: Date.now() - jobStartedAt,
+      executionBudgetMs,
+    });
+    if (!revisionBudget.shouldStart) {
+      const budgetSummary = `Quality gate needs revision ${
+        revisionAttempt + 1
+      }/${activeMaxAutoRevisions}, but remaining execution budget is ${
+        revisionBudget.remainingBudgetMs
+      }ms (< ${revisionBudget.minimumRevisionBudgetMs}ms); stopping before another worker turn to preserve a structured result: ${toSingleLine(
+        issueSummary,
+        220,
+      )}`;
+      onLog?.("stderr", `[QualityGate] ${budgetSummary}`);
+      return {
+        ok: false,
+        summary: budgetSummary,
+        stdout: result.stdout,
+        stderr: truncate(
+          [
+            result.stderr ?? "",
+            ...quality.validationRuns.flatMap((run) => [run.stdout, run.stderr]).filter(Boolean),
+            critic ? `Critic raw: ${critic.raw}` : "",
+          ]
+            .filter(Boolean)
+            .join("\n"),
+          outputPolicyForRuntime(runtimeConfig),
+        ),
+        exitCode: 4,
+      };
+    }
+
     revisionAttempt += 1;
     revisionHint = buildQualityRevisionHint(
       issues,

package/runtime/sandbox/apps/workerpals/src/job_runner.ts

@@ -7,6 +7,7 @@
  *
  * Usage (inside container):
  *   bun run job_runner.ts <base64-encoded-job-spec>
+ *   bun run job_runner.ts --spec-stdin
  *
  * The job spec is base64-encoded JSON: { jobId, taskId, kind, params, workerId }
  *
@@ -116,11 +117,19 @@ echo "password=${token}"
 
 async function main(): Promise<void> {
   const args = process.argv.slice(2);
-  const base64Spec = args[0];
+  const rawSpecArg = args[0];
 
+  if (!rawSpecArg) {
+    // eslint-disable-next-line no-console
+    console.error("Usage: bun run job_runner.ts <base64-encoded-job-spec>|--spec-stdin");
+    process.exit(1);
+  }
+
+  const base64Spec =
+    rawSpecArg === "--spec-stdin" ? (await Bun.stdin.text()).trim() : rawSpecArg;
   if (!base64Spec) {
     // eslint-disable-next-line no-console
-    console.error("Usage: bun run job_runner.ts <base64-encoded-job-spec>");
+    console.error("Job spec was empty");
     process.exit(1);
   }
 

package/runtime/sandbox/apps/workerpals/src/workerpals_main.ts

@@ -100,6 +100,14 @@ function estimateTokensFromText(text: string): number {
   return Math.max(0, Math.ceil(String(text ?? "").length / 3));
 }
 
+function compactWorkerError(error: unknown, maxLength = 220): string {
+  const raw = error instanceof Error ? error.message : String(error ?? "");
+  const normalized = raw.replace(/\s+/g, " ").trim();
+  if (!normalized) return "unknown error";
+  if (normalized.length <= maxLength) return normalized;
+  return `${normalized.slice(0, maxLength - 3)}...`;
+}
+
 async function postJsonWithTimeout(
   url: string,
   headers: Record<string, string>,
@@ -693,10 +701,17 @@ async function createIsolatedWorktree(
 ): Promise<string> {
   const worktreeRoot = resolve(repo, ".worktrees");
   mkdirSync(worktreeRoot, { recursive: true });
+  const safeJobId = jobId
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "")
+    .slice(0, 8);
+  const nonce = `${Date.now().toString(36).slice(-6)}-${Math.random()
+    .toString(36)
+    .slice(2, 6)}`;
 
   const worktreePath = resolve(
     worktreeRoot,
-    `host-job-${jobId}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
+    `job-${safeJobId || "host"}-${nonce}`,
   );
 
   const addResult = await git(repo, ["worktree", "add", "--detach", worktreePath, baseRef]);
@@ -1532,9 +1547,10 @@ async function workerLoop(
                   Number.isFinite(err.cooldownMs) ? err.cooldownMs : 0,
                 );
               }
+              const errorSummary = compactWorkerError(err);
               result = {
                 ok: false,
-                summary: "Job execution failed before completion",
+                summary: `Job execution failed before completion: ${errorSummary}`,
                 stderr: String(err),
                 ...(cooldownAfterJobMs > 0 ? { cooldownMs: cooldownAfterJobMs } : {}),
               };