@pushpalsdev/cli 1.1.21 → 1.1.22

package/runtime/sandbox/apps/workerpals/src/backends/openai_codex/test_openai_codex_runtime_config.py

@@ -40,6 +40,7 @@ from openai_codex_executor import (
     _detect_offtrack_rollout,
     _detect_codex_workaround_signal,
     _extract_usage_counts,
+    _has_credible_shell_wrapper_progress,
     _load_prompt_template,
     _mask_repo_local_codex_files,
     _repo_root_for_prompt_loading,
@@ -672,6 +673,130 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
         self.assertIn("src/", str(result.get("stdout") or ""))
         self.assertNotIn("Recovered after Codex attempts", str(result.get("stdout") or ""))
 
+    def test_shell_wrapper_progress_guard_rejects_broad_noisy_path_sets(self) -> None:
+        self.assertTrue(
+            _has_credible_shell_wrapper_progress(
+                [
+                    "src/change.ts",
+                    "src/change.test.ts",
+                    "docs/change.md",
+                ]
+            )
+        )
+        self.assertFalse(
+            _has_credible_shell_wrapper_progress(
+                [f"src/generated-{index}.ts" for index in range(9)]
+            )
+        )
+        self.assertFalse(
+            _has_credible_shell_wrapper_progress(
+                [
+                    "app/main.ts",
+                    "components/card.tsx",
+                    "docs/readme.md",
+                    "scripts/check.ts",
+                    "tests/card.test.ts",
+                ]
+            )
+        )
+        self.assertFalse(
+            _has_credible_shell_wrapper_progress(
+                [f"area{index}/" for index in range(5)]
+            )
+        )
+
+    def test_run_codex_task_recovers_instead_of_handing_noisy_wrapper_diff_to_gates(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-wrapper-noisy-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# wrapper noisy test\n", encoding="utf-8")
+            for index in range(9):
+                (repo / f"noisy-{index}.txt").write_text("baseline\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "."], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed wrapper noisy repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+
+            stub_path = Path(temp_dir) / "fake_codex_wrapper_noisy.py"
+            stub_path.write_text(
+                "\n".join(
+                    [
+                        "from pathlib import Path",
+                        "import sys",
+                        "import time",
+                        "",
+                        "argv = sys.argv[1:]",
+                        "last_message_path = None",
+                        "for index, arg in enumerate(argv):",
+                        "    if arg == '--output-last-message' and index + 1 < len(argv):",
+                        "        last_message_path = argv[index + 1]",
+                        "        break",
+                        "",
+                        "prompt = sys.stdin.read()",
+                        "if 'Command-router recovery:' in prompt:",
+                        "    Path('src').mkdir(exist_ok=True)",
+                        "    Path('src/recovered.txt').write_text('direct recovery\\n', encoding='utf-8')",
+                        "    if last_message_path:",
+                        "        Path(last_message_path).write_text(",
+                        "            'Recovered after noisy shell-wrapper path detection using direct commands.',",
+                        "            encoding='utf-8',",
+                        "        )",
+                        "    print('item.completed | Recovered with direct-command guidance.', flush=True)",
+                        "    sys.exit(0)",
+                        "",
+                        "for index in range(9):",
+                        "    Path(f'noisy-{index}.txt').write_text('noisy path\\n', encoding='utf-8')",
+                        "for line in (",
+                        "    'error=exec_command failed for `/bin/bash -lc pwd`: CreateProcess { message: \"Rejected\" }',",
+                        "    'error=exec_command failed for `/bin/bash -lc \\'git status --porcelain\\'`: CreateProcess { message: \"Rejected\" }',",
+                        "    'error=exec_command failed for `/bin/bash -lc \\'sed -n 1,40p README.md\\'`: CreateProcess { message: \"Rejected\" }',",
+                        "):",
+                        "    print(line, file=sys.stderr, flush=True)",
+                        "time.sleep(10)",
+                    ]
+                ),
+                encoding="utf-8",
+            )
+
+            env_overrides = {
+                "PUSHPALS_OPENAI_CODEX_BIN_JSON": json.dumps([sys.executable, str(stub_path)]),
+                "PUSHPALS_OPENAI_CODEX_AUTH_MODE": "api_key",
+                "OPENAI_API_KEY": "pushpals-wrapper-noisy-test-key",
+                "WORKERPALS_OPENAI_CODEX_TIMEOUT_S": "10",
+                "WORKERPALS_OPENAI_CODEX_PROGRESS_LOG_INTERVAL_S": "1",
+            }
+            with mock.patch.dict(os.environ, env_overrides, clear=False):
+                result = _run_codex_task(
+                    str(repo),
+                    "Recover from a shell-wrapper loop after noisy repo changes.",
+                    [],
+                )
+
+        self.assertTrue(result.get("ok"), result)
+        stdout = str(result.get("stdout") or "")
+        self.assertIn("Recovered after Codex attempts hit command-router shell-wrapper rejections.", stdout)
+        self.assertIn("Recovered after noisy shell-wrapper path detection", stdout)
+        self.assertNotIn("ValidationGate/CriticGate", stdout)
+
     def test_run_codex_task_hands_changed_worktree_to_gates_after_timeout(self) -> None:
         with tempfile.TemporaryDirectory(prefix="pushpals-codex-timeout-changed-") as temp_dir:
             repo = Path(temp_dir) / "repo"
@@ -749,6 +874,76 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
         self.assertIn("src/", str(result.get("stdout") or ""))
         self.assertIn("Made a small patch before timeout", str(result.get("stdout") or ""))
 
+    def test_run_codex_task_rejects_broad_timeout_partial_patch(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-timeout-noisy-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# timeout noisy repo\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "README.md"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed timeout noisy repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+
+            stub_path = Path(temp_dir) / "fake_codex_timeout_noisy.py"
+            stub_path.write_text(
+                "\n".join(
+                    [
+                        "from pathlib import Path",
+                        "import sys",
+                        "import time",
+                        "",
+                        "sys.stdin.read()",
+                        "for index in range(5):",
+                        "    root = Path(f'area{index}')",
+                        "    root.mkdir(exist_ok=True)",
+                        "    (root / 'changed.txt').write_text('broad change before timeout\\n', encoding='utf-8')",
+                        "print('item.completed | Touched a broad set of files before timeout.', flush=True)",
+                        "time.sleep(5)",
+                    ]
+                ),
+                encoding="utf-8",
+            )
+
+            env_overrides = {
+                "PUSHPALS_OPENAI_CODEX_BIN_JSON": json.dumps([sys.executable, str(stub_path)]),
+                "PUSHPALS_OPENAI_CODEX_AUTH_MODE": "api_key",
+                "OPENAI_API_KEY": "pushpals-timeout-noisy-test-key",
+                "WORKERPALS_OPENAI_CODEX_TIMEOUT_S": "1",
+                "WORKERPALS_OPENAI_CODEX_NO_EDIT_WATCHDOG_S": "0",
+                "WORKERPALS_OPENAI_CODEX_PROGRESS_LOG_INTERVAL_S": "1",
+            }
+            with mock.patch.dict(os.environ, env_overrides, clear=False):
+                result = _run_codex_task(
+                    str(repo),
+                    "Create a broad unfocused patch, then continue thinking too long.",
+                    [],
+                )
+
+        self.assertFalse(result.get("ok"), result)
+        self.assertEqual(result.get("exitCode"), 124)
+        self.assertIn("broad/noisy publishable-looking changes", str(result.get("summary") or ""))
+        self.assertIn("too broad/noisy", str(result.get("stderr") or ""))
+        self.assertIn("area0", str(result.get("stderr") or ""))
+
     def test_run_codex_task_retries_once_when_no_edit_watchdog_fires(self) -> None:
         with tempfile.TemporaryDirectory(prefix="pushpals-codex-no-edit-watchdog-") as temp_dir:
             repo = Path(temp_dir) / "repo"
@@ -892,6 +1087,95 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
         self.assertEqual(result.get("exitCode"), 124)
         self.assertIn("no publishable changes", str(result.get("summary") or ""))
 
+    def test_run_codex_task_no_edit_watchdog_rechecks_transient_publishable_progress(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-no-edit-recheck-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# no edit recheck repo\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "README.md"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed no-edit recheck repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+
+            stub_path = Path(temp_dir) / "fake_codex_no_edit_recheck.py"
+            stub_path.write_text(
+                "\n".join(
+                    [
+                        "from pathlib import Path",
+                        "import sys",
+                        "import time",
+                        "",
+                        "argv = sys.argv[1:]",
+                        "last_message_path = None",
+                        "for index, arg in enumerate(argv):",
+                        "    if arg == '--output-last-message' and index + 1 < len(argv):",
+                        "        last_message_path = argv[index + 1]",
+                        "        break",
+                        "",
+                        "prompt = sys.stdin.read()",
+                        "if 'No-edit watchdog recovery' in prompt:",
+                        "    Path('src').mkdir(exist_ok=True)",
+                        "    Path('src/no-edit-recheck-retry.txt').write_text('patched after recheck\\n', encoding='utf-8')",
+                        "    if last_message_path:",
+                        "        Path(last_message_path).write_text('Patched after transient no-edit recheck.', encoding='utf-8')",
+                        "    print('item.completed | Patched after transient no-edit recheck.', flush=True)",
+                        "    sys.exit(0)",
+                        "",
+                        "Path('src').mkdir(exist_ok=True)",
+                        "transient = Path('src/transient-progress.txt')",
+                        "transient.write_text('temporary progress\\n', encoding='utf-8')",
+                        "print('item.completed | Created transient publishable progress.', flush=True)",
+                        "time.sleep(1.4)",
+                        "transient.unlink()",
+                        "Path('node_modules').mkdir(exist_ok=True)",
+                        "Path('node_modules/linked.txt').write_text('artifact only\\n', encoding='utf-8')",
+                        "print('item.completed | Lost patch while still thinking.', flush=True)",
+                        "time.sleep(10)",
+                    ]
+                ),
+                encoding="utf-8",
+            )
+
+            env_overrides = {
+                "PUSHPALS_OPENAI_CODEX_BIN_JSON": json.dumps([sys.executable, str(stub_path)]),
+                "PUSHPALS_OPENAI_CODEX_AUTH_MODE": "api_key",
+                "OPENAI_API_KEY": "pushpals-no-edit-recheck-test-key",
+                "WORKERPALS_OPENAI_CODEX_TIMEOUT_S": "20",
+                "WORKERPALS_OPENAI_CODEX_NO_EDIT_WATCHDOG_S": "1",
+                "WORKERPALS_OPENAI_CODEX_NO_EDIT_RECHECK_S": "1",
+                "WORKERPALS_OPENAI_CODEX_PROGRESS_LOG_INTERVAL_S": "1",
+            }
+            with mock.patch.dict(os.environ, env_overrides, clear=False):
+                result = _run_codex_task(
+                    str(repo),
+                    "Polish the first-entry home shell with a compact visual patch.",
+                    [],
+                )
+
+        self.assertTrue(result.get("ok"), result)
+        self.assertEqual(result.get("exitCode"), 0)
+        self.assertIn("Patched after transient no-edit recheck", str(result.get("stdout") or ""))
+        self.assertIn("src/", str(result.get("stdout") or ""))
+
     def test_codex_changed_paths_filters_dependency_artifacts_from_publishable_delta(self) -> None:
         with tempfile.TemporaryDirectory(prefix="pushpals-codex-artifact-delta-") as temp_dir:
             repo = Path(temp_dir) / "repo"
@@ -1081,6 +1365,77 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
         self.assertIn("Patched after rollout coach guidance", str(result.get("stdout") or ""))
         self.assertIn("scripts/", str(result.get("stdout") or ""))
 
+    def test_run_codex_task_rollout_coach_fails_fast_on_broad_small_task_changes(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-rollout-noisy-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# rollout noisy repo\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "README.md"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed rollout noisy repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+
+            stub_path = Path(temp_dir) / "fake_codex_rollout_noisy.py"
+            stub_path.write_text(
+                "\n".join(
+                    [
+                        "from pathlib import Path",
+                        "import sys",
+                        "import time",
+                        "",
+                        "sys.stdin.read()",
+                        "for index in range(5):",
+                        "    root = Path(f'area{index}')",
+                        "    root.mkdir(exist_ok=True)",
+                        "    (root / 'changed.txt').write_text('broad rollout change\\n', encoding='utf-8')",
+                        "print('item.completed | Made broad edits for a supposedly small task.', flush=True)",
+                        "time.sleep(10)",
+                    ]
+                ),
+                encoding="utf-8",
+            )
+
+            env_overrides = {
+                "PUSHPALS_OPENAI_CODEX_BIN_JSON": json.dumps([sys.executable, str(stub_path)]),
+                "PUSHPALS_OPENAI_CODEX_AUTH_MODE": "api_key",
+                "OPENAI_API_KEY": "pushpals-rollout-noisy-test-key",
+                "WORKERPALS_OPENAI_CODEX_TIMEOUT_S": "700",
+                "WORKERPALS_OPENAI_CODEX_NO_EDIT_WATCHDOG_S": "10",
+                "WORKERPALS_OPENAI_CODEX_ROLLOUT_WATCHDOG_S": "1",
+                "WORKERPALS_OPENAI_CODEX_PROGRESS_LOG_INTERVAL_S": "1",
+            }
+            with mock.patch.dict(os.environ, env_overrides, clear=False):
+                result = _run_codex_task(
+                    str(repo),
+                    "Make a small low-risk repo-native patch.",
+                    [],
+                )
+
+        self.assertFalse(result.get("ok"), result)
+        self.assertEqual(result.get("exitCode"), 124)
+        self.assertIn("rollout coach", str(result.get("summary") or ""))
+        self.assertIn("broad/noisy", str(result.get("stderr") or ""))
+        self.assertIn("area0", str(result.get("stderr") or ""))
+
     def test_run_codex_task_timeout_reports_artifact_only_changes(self) -> None:
         with tempfile.TemporaryDirectory(prefix="pushpals-codex-artifact-timeout-") as temp_dir:
             repo = Path(temp_dir) / "repo"

package/runtime/sandbox/apps/workerpals/src/common/types.ts

@@ -18,6 +18,74 @@ export interface JobPublishBlockedInfo {
   stage: "sync" | "push";
 }
 
+export interface JobDiagnosticAttempt {
+  attempt: number;
+  workerId?: string | null;
+  backend?: string | null;
+  model?: string | null;
+  startedAt?: string | null;
+  finishedAt?: string | null;
+  durationMs?: number | null;
+  terminalReason?: string | null;
+  exitCode?: number | null;
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobTerminalDiagnostics {
+  failureClass?: string | null;
+  terminalStage?: string | null;
+  executorBackend?: string | null;
+  summary?: string | null;
+  watchdogFired?: boolean;
+  timeoutMs?: number | null;
+  publishableFileCount?: number | null;
+  artifactOnlyPathCount?: number | null;
+  changedPathSample?: string[];
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobPhaseSpanDiagnostics {
+  attempt?: number | null;
+  phase: string;
+  startedAt: string;
+  finishedAt: string;
+  durationMs: number;
+  outcome?: string | null;
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobValidationRunDiagnostics {
+  attempt?: number | null;
+  command: string;
+  exitCode?: number | null;
+  durationMs?: number | null;
+  passed: boolean;
+  failureClass?: string | null;
+  stdoutTail?: string | null;
+  stderrTail?: string | null;
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobPatchSnapshotDiagnostics {
+  attempt?: number | null;
+  phase?: string | null;
+  publishableFileCount?: number | null;
+  artifactOnlyPathCount?: number | null;
+  changedPathSample?: string[];
+  topLevelDirs?: string[];
+  capturedAt?: string | null;
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobDiagnostics {
+  attempts?: JobDiagnosticAttempt[];
+  terminal?: JobTerminalDiagnostics;
+  phaseSpans?: JobPhaseSpanDiagnostics[];
+  validationRuns?: JobValidationRunDiagnostics[];
+  patchSnapshots?: JobPatchSnapshotDiagnostics[];
+  metadata?: Record<string, unknown>;
+}
+
 export interface JobResult {
   ok: boolean;
   summary: string;
@@ -26,4 +94,5 @@ export interface JobResult {
   exitCode?: number;
   usage?: JobTokenUsage;
   publishBlocked?: JobPublishBlockedInfo;
+  diagnostics?: JobDiagnostics;
 }

package/runtime/sandbox/apps/workerpals/src/docker_executor.ts

@@ -18,7 +18,7 @@ import { homedir } from "os";
 import { isAbsolute, relative, resolve } from "path";
 import { loadPushPalsConfig } from "shared";
 import { resolveExecutor, type WorkerpalsRuntimeConfig } from "./common/executor_backend.js";
-import type { ExecutorBackend } from "./common/types.js";
+import type { ExecutorBackend, JobDiagnostics } from "./common/types.js";
 import { computeTimeoutWarningWindow, DEFAULT_DOCKER_TIMEOUT_MS } from "./timeout_policy.js";
 import {
   BACKEND_DOCKER_PASSTHROUGH_ENV,
@@ -237,6 +237,7 @@ export interface DockerJobResult {
     branch: string;
     sha: string;
   };
+  diagnostics?: JobDiagnostics;
 }
 
 export interface Job {
@@ -247,6 +248,37 @@ export interface Job {
   sessionId: string;
 }
 
+function compactDockerDiagnosticText(value: unknown, maxChars = 1000): string | null {
+  const text = String(value ?? "").replace(/\s+$/g, "").trim();
+  if (!text) return null;
+  return text.length <= maxChars ? text : text.slice(0, maxChars);
+}
+
+function dockerFallbackDiagnostics(
+  summary: string,
+  context: { timedOutByDocker: boolean; elapsedMs: number; timeoutMs: number },
+  exitCode: number,
+  failureClass: string,
+  metadata: Record<string, unknown> = {},
+): JobDiagnostics {
+  return {
+    terminal: {
+      failureClass,
+      terminalStage: "docker",
+      summary: compactDockerDiagnosticText(summary),
+      watchdogFired: context.timedOutByDocker,
+      timeoutMs: context.timeoutMs,
+      metadata: {
+        structuredResult: false,
+        elapsedMs: context.elapsedMs,
+        exitCode,
+        timedOutByDocker: context.timedOutByDocker,
+        ...metadata,
+      },
+    },
+  };
+}
+
 function readPositiveNumber(value: unknown): number | null {
   const parsed =
     typeof value === "number"
@@ -264,6 +296,10 @@ function maybeRecord(value: unknown): Record<string, unknown> | null {
     : null;
 }
 
+function isReadableByteStream(value: unknown): value is ReadableStream<Uint8Array> {
+  return value instanceof ReadableStream;
+}
+
 function collectValidationCommandHints(params: Record<string, unknown>): string[] {
   const planning = maybeRecord(params.planning);
   const values: unknown[] = [
@@ -1280,10 +1316,15 @@ export class DockerExecutor {
     const stderrLines: string[] = [];
 
     try {
+      const stdout = proc.stdout;
+      const stderr = proc.stderr;
+      if (!isReadableByteStream(stdout) || !isReadableByteStream(stderr)) {
+        throw new Error("docker exec stdout/stderr pipes were not available");
+      }
       await Promise.all([
         this.writeJobSpecToStdin(proc, base64Spec),
-        this.readStream(proc.stdout, "stdout", onLog, stdoutLines),
-        this.readStream(proc.stderr, "stderr", onLog, stderrLines),
+        this.readStream(stdout, "stdout", onLog, stdoutLines),
+        this.readStream(stderr, "stderr", onLog, stderrLines),
       ]);
     } catch (err) {
       try {
@@ -1343,7 +1384,7 @@ export class DockerExecutor {
       throw new Error("docker exec stdin pipe was not available");
     }
     const bytes = new TextEncoder().encode(base64Spec);
-    if ("getWriter" in stdin && typeof stdin.getWriter === "function") {
+    if (stdin instanceof WritableStream) {
       const writer = stdin.getWriter();
       try {
         await writer.write(bytes);
@@ -1359,12 +1400,17 @@ export class DockerExecutor {
       return;
     }
 
-    if (typeof stdin.write === "function" && typeof stdin.end === "function") {
-      await stdin.write(bytes);
-      if (typeof stdin.flush === "function") {
-        await stdin.flush();
+    const nodeStdin = stdin as {
+      write?: (chunk: Uint8Array | string) => unknown;
+      end?: () => unknown;
+      flush?: () => unknown;
+    };
+    if (typeof nodeStdin.write === "function" && typeof nodeStdin.end === "function") {
+      await nodeStdin.write(bytes);
+      if (typeof nodeStdin.flush === "function") {
+        await nodeStdin.flush();
       }
-      await stdin.end();
+      await nodeStdin.end();
       return;
     }
 
@@ -1648,44 +1694,57 @@ export class DockerExecutor {
         `Malformed ___RESULT___ payload: ${sentinelParseError || "unknown parse error"}`,
       ];
       if (stderr) details.push(stderr);
+      const summary = `Worker returned malformed structured result after ${context.elapsedMs}ms`;
       return {
         ok: false,
-        summary: `Worker returned malformed structured result after ${context.elapsedMs}ms`,
+        summary,
         stdout,
         stderr: details.join("\n"),
         exitCode,
+        diagnostics: dockerFallbackDiagnostics(summary, context, exitCode, "malformed_structured_result", {
+          sentinelParseError,
+        }),
       };
     }
 
     // No sentinel found, return generic result.
     if (context.timedOutByDocker) {
+      const summary = `Job timed out in Docker executor after ${context.elapsedMs}ms (limit ${context.timeoutMs}ms; terminated before structured result).`;
       return {
         ok: false,
-        summary: `Job timed out in Docker executor after ${context.elapsedMs}ms (limit ${context.timeoutMs}ms; terminated before structured result).`,
+        summary,
         stdout,
         stderr,
         exitCode,
+        diagnostics: dockerFallbackDiagnostics(summary, context, exitCode, "timeout"),
       };
     }
     if (exitCode === 143 || exitCode === 137) {
+      const summary = `Job process was terminated (exit ${exitCode}) after ${context.elapsedMs}ms before structured result was produced.`;
       return {
         ok: false,
-        summary: `Job process was terminated (exit ${exitCode}) after ${context.elapsedMs}ms before structured result was produced.`,
+        summary,
         stdout,
         stderr,
         exitCode,
+        diagnostics: dockerFallbackDiagnostics(summary, context, exitCode, "terminated"),
       };
     }
 
+    const summary =
+      exitCode === 0
+        ? `Job completed in ${context.elapsedMs}ms`
+        : `Job failed (exit ${exitCode}, elapsed ${context.elapsedMs}ms)`;
     return {
       ok: exitCode === 0,
-      summary:
-        exitCode === 0
-          ? `Job completed in ${context.elapsedMs}ms`
-          : `Job failed (exit ${exitCode}, elapsed ${context.elapsedMs}ms)`,
+      summary,
       stdout,
       stderr,
       exitCode,
+      diagnostics:
+        exitCode === 0
+          ? undefined
+          : dockerFallbackDiagnostics(summary, context, exitCode, "no_structured_result"),
     };
   }