@pushpalsdev/cli 1.1.21 → 1.1.23

package/runtime/sandbox/apps/workerpals/src/backends/openai_codex/test_openai_codex_runtime_config.py

@@ -36,10 +36,12 @@ from openai_codex_executor import (
     _build_rollout_recovery_guidance,
     _collect_disallowed_shell_wrapper_rejections,
     _codex_changed_paths,
+    _capture_git_change_snapshot,
     _describe_non_publishable_paths,
     _detect_offtrack_rollout,
     _detect_codex_workaround_signal,
     _extract_usage_counts,
+    _has_credible_shell_wrapper_progress,
     _load_prompt_template,
     _mask_repo_local_codex_files,
     _repo_root_for_prompt_loading,
@@ -672,6 +674,130 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
         self.assertIn("src/", str(result.get("stdout") or ""))
         self.assertNotIn("Recovered after Codex attempts", str(result.get("stdout") or ""))
 
+    def test_shell_wrapper_progress_guard_rejects_broad_noisy_path_sets(self) -> None:
+        self.assertTrue(
+            _has_credible_shell_wrapper_progress(
+                [
+                    "src/change.ts",
+                    "src/change.test.ts",
+                    "docs/change.md",
+                ]
+            )
+        )
+        self.assertFalse(
+            _has_credible_shell_wrapper_progress(
+                [f"src/generated-{index}.ts" for index in range(9)]
+            )
+        )
+        self.assertFalse(
+            _has_credible_shell_wrapper_progress(
+                [
+                    "app/main.ts",
+                    "components/card.tsx",
+                    "docs/readme.md",
+                    "scripts/check.ts",
+                    "tests/card.test.ts",
+                ]
+            )
+        )
+        self.assertFalse(
+            _has_credible_shell_wrapper_progress(
+                [f"area{index}/" for index in range(5)]
+            )
+        )
+
+    def test_run_codex_task_recovers_instead_of_handing_noisy_wrapper_diff_to_gates(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-wrapper-noisy-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# wrapper noisy test\n", encoding="utf-8")
+            for index in range(9):
+                (repo / f"noisy-{index}.txt").write_text("baseline\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "."], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed wrapper noisy repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+
+            stub_path = Path(temp_dir) / "fake_codex_wrapper_noisy.py"
+            stub_path.write_text(
+                "\n".join(
+                    [
+                        "from pathlib import Path",
+                        "import sys",
+                        "import time",
+                        "",
+                        "argv = sys.argv[1:]",
+                        "last_message_path = None",
+                        "for index, arg in enumerate(argv):",
+                        "    if arg == '--output-last-message' and index + 1 < len(argv):",
+                        "        last_message_path = argv[index + 1]",
+                        "        break",
+                        "",
+                        "prompt = sys.stdin.read()",
+                        "if 'Command-router recovery:' in prompt:",
+                        "    Path('src').mkdir(exist_ok=True)",
+                        "    Path('src/recovered.txt').write_text('direct recovery\\n', encoding='utf-8')",
+                        "    if last_message_path:",
+                        "        Path(last_message_path).write_text(",
+                        "            'Recovered after noisy shell-wrapper path detection using direct commands.',",
+                        "            encoding='utf-8',",
+                        "        )",
+                        "    print('item.completed | Recovered with direct-command guidance.', flush=True)",
+                        "    sys.exit(0)",
+                        "",
+                        "for index in range(9):",
+                        "    Path(f'noisy-{index}.txt').write_text('noisy path\\n', encoding='utf-8')",
+                        "for line in (",
+                        "    'error=exec_command failed for `/bin/bash -lc pwd`: CreateProcess { message: \"Rejected\" }',",
+                        "    'error=exec_command failed for `/bin/bash -lc \\'git status --porcelain\\'`: CreateProcess { message: \"Rejected\" }',",
+                        "    'error=exec_command failed for `/bin/bash -lc \\'sed -n 1,40p README.md\\'`: CreateProcess { message: \"Rejected\" }',",
+                        "):",
+                        "    print(line, file=sys.stderr, flush=True)",
+                        "time.sleep(10)",
+                    ]
+                ),
+                encoding="utf-8",
+            )
+
+            env_overrides = {
+                "PUSHPALS_OPENAI_CODEX_BIN_JSON": json.dumps([sys.executable, str(stub_path)]),
+                "PUSHPALS_OPENAI_CODEX_AUTH_MODE": "api_key",
+                "OPENAI_API_KEY": "pushpals-wrapper-noisy-test-key",
+                "WORKERPALS_OPENAI_CODEX_TIMEOUT_S": "10",
+                "WORKERPALS_OPENAI_CODEX_PROGRESS_LOG_INTERVAL_S": "1",
+            }
+            with mock.patch.dict(os.environ, env_overrides, clear=False):
+                result = _run_codex_task(
+                    str(repo),
+                    "Recover from a shell-wrapper loop after noisy repo changes.",
+                    [],
+                )
+
+        self.assertTrue(result.get("ok"), result)
+        stdout = str(result.get("stdout") or "")
+        self.assertIn("Recovered after Codex attempts hit command-router shell-wrapper rejections.", stdout)
+        self.assertIn("Recovered after noisy shell-wrapper path detection", stdout)
+        self.assertNotIn("ValidationGate/CriticGate", stdout)
+
     def test_run_codex_task_hands_changed_worktree_to_gates_after_timeout(self) -> None:
         with tempfile.TemporaryDirectory(prefix="pushpals-codex-timeout-changed-") as temp_dir:
             repo = Path(temp_dir) / "repo"
@@ -749,6 +875,145 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
         self.assertIn("src/", str(result.get("stdout") or ""))
         self.assertIn("Made a small patch before timeout", str(result.get("stdout") or ""))
 
+    def test_run_codex_task_rejects_broad_timeout_partial_patch(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-timeout-noisy-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# timeout noisy repo\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "README.md"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed timeout noisy repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+
+            stub_path = Path(temp_dir) / "fake_codex_timeout_noisy.py"
+            stub_path.write_text(
+                "\n".join(
+                    [
+                        "from pathlib import Path",
+                        "import sys",
+                        "import time",
+                        "",
+                        "sys.stdin.read()",
+                        "for index in range(5):",
+                        "    root = Path(f'area{index}')",
+                        "    root.mkdir(exist_ok=True)",
+                        "    (root / 'changed.txt').write_text('broad change before timeout\\n', encoding='utf-8')",
+                        "print('item.completed | Touched a broad set of files before timeout.', flush=True)",
+                        "time.sleep(5)",
+                    ]
+                ),
+                encoding="utf-8",
+            )
+
+            env_overrides = {
+                "PUSHPALS_OPENAI_CODEX_BIN_JSON": json.dumps([sys.executable, str(stub_path)]),
+                "PUSHPALS_OPENAI_CODEX_AUTH_MODE": "api_key",
+                "OPENAI_API_KEY": "pushpals-timeout-noisy-test-key",
+                "WORKERPALS_OPENAI_CODEX_TIMEOUT_S": "1",
+                "WORKERPALS_OPENAI_CODEX_NO_EDIT_WATCHDOG_S": "0",
+                "WORKERPALS_OPENAI_CODEX_PROGRESS_LOG_INTERVAL_S": "1",
+            }
+            with mock.patch.dict(os.environ, env_overrides, clear=False):
+                result = _run_codex_task(
+                    str(repo),
+                    "Create a broad unfocused patch, then continue thinking too long.",
+                    [],
+                )
+
+        self.assertFalse(result.get("ok"), result)
+        self.assertEqual(result.get("exitCode"), 124)
+        self.assertIn("broad/noisy publishable-looking changes", str(result.get("summary") or ""))
+        self.assertIn("too broad/noisy", str(result.get("stderr") or ""))
+        self.assertIn("area0", str(result.get("stderr") or ""))
+
+    def test_run_codex_task_timeout_ignores_broad_dirty_baseline(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-timeout-dirty-baseline-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# timeout dirty baseline repo\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "README.md"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed timeout dirty baseline repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            for index in range(5):
+                root = repo / f"area{index}"
+                root.mkdir(exist_ok=True)
+                (root / "changed.txt").write_text("pre-existing dirty change\n", encoding="utf-8")
+
+            stub_path = Path(temp_dir) / "fake_codex_timeout_dirty_baseline.py"
+            stub_path.write_text(
+                "\n".join(
+                    [
+                        "import sys",
+                        "import time",
+                        "",
+                        "sys.stdin.read()",
+                        "print('item.completed | Still thinking without changing baseline files.', flush=True)",
+                        "time.sleep(5)",
+                    ]
+                ),
+                encoding="utf-8",
+            )
+
+            env_overrides = {
+                "PUSHPALS_OPENAI_CODEX_BIN_JSON": json.dumps([sys.executable, str(stub_path)]),
+                "PUSHPALS_OPENAI_CODEX_AUTH_MODE": "api_key",
+                "OPENAI_API_KEY": "pushpals-timeout-dirty-baseline-test-key",
+                "WORKERPALS_OPENAI_CODEX_TIMEOUT_S": "1",
+                "WORKERPALS_OPENAI_CODEX_NO_EDIT_WATCHDOG_S": "0",
+                "WORKERPALS_OPENAI_CODEX_PROGRESS_LOG_INTERVAL_S": "1",
+            }
+            with mock.patch.dict(os.environ, env_overrides, clear=False):
+                result = _run_codex_task(
+                    str(repo),
+                    "Make a compact scoped patch, then continue thinking too long.",
+                    [],
+                )
+
+        self.assertFalse(result.get("ok"), result)
+        self.assertEqual(result.get("exitCode"), 124)
+        self.assertIn("execution timed out", str(result.get("summary") or ""))
+        self.assertNotIn("broad/noisy", str(result.get("summary") or ""))
+        self.assertNotIn("too broad/noisy", str(result.get("stderr") or ""))
+
     def test_run_codex_task_retries_once_when_no_edit_watchdog_fires(self) -> None:
         with tempfile.TemporaryDirectory(prefix="pushpals-codex-no-edit-watchdog-") as temp_dir:
             repo = Path(temp_dir) / "repo"
@@ -892,6 +1157,95 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
         self.assertEqual(result.get("exitCode"), 124)
         self.assertIn("no publishable changes", str(result.get("summary") or ""))
 
+    def test_run_codex_task_no_edit_watchdog_rechecks_transient_publishable_progress(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-no-edit-recheck-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# no edit recheck repo\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "README.md"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed no-edit recheck repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+
+            stub_path = Path(temp_dir) / "fake_codex_no_edit_recheck.py"
+            stub_path.write_text(
+                "\n".join(
+                    [
+                        "from pathlib import Path",
+                        "import sys",
+                        "import time",
+                        "",
+                        "argv = sys.argv[1:]",
+                        "last_message_path = None",
+                        "for index, arg in enumerate(argv):",
+                        "    if arg == '--output-last-message' and index + 1 < len(argv):",
+                        "        last_message_path = argv[index + 1]",
+                        "        break",
+                        "",
+                        "prompt = sys.stdin.read()",
+                        "if 'No-edit watchdog recovery' in prompt:",
+                        "    Path('src').mkdir(exist_ok=True)",
+                        "    Path('src/no-edit-recheck-retry.txt').write_text('patched after recheck\\n', encoding='utf-8')",
+                        "    if last_message_path:",
+                        "        Path(last_message_path).write_text('Patched after transient no-edit recheck.', encoding='utf-8')",
+                        "    print('item.completed | Patched after transient no-edit recheck.', flush=True)",
+                        "    sys.exit(0)",
+                        "",
+                        "Path('src').mkdir(exist_ok=True)",
+                        "transient = Path('src/transient-progress.txt')",
+                        "transient.write_text('temporary progress\\n', encoding='utf-8')",
+                        "print('item.completed | Created transient publishable progress.', flush=True)",
+                        "time.sleep(1.4)",
+                        "transient.unlink()",
+                        "Path('node_modules').mkdir(exist_ok=True)",
+                        "Path('node_modules/linked.txt').write_text('artifact only\\n', encoding='utf-8')",
+                        "print('item.completed | Lost patch while still thinking.', flush=True)",
+                        "time.sleep(10)",
+                    ]
+                ),
+                encoding="utf-8",
+            )
+
+            env_overrides = {
+                "PUSHPALS_OPENAI_CODEX_BIN_JSON": json.dumps([sys.executable, str(stub_path)]),
+                "PUSHPALS_OPENAI_CODEX_AUTH_MODE": "api_key",
+                "OPENAI_API_KEY": "pushpals-no-edit-recheck-test-key",
+                "WORKERPALS_OPENAI_CODEX_TIMEOUT_S": "20",
+                "WORKERPALS_OPENAI_CODEX_NO_EDIT_WATCHDOG_S": "1",
+                "WORKERPALS_OPENAI_CODEX_NO_EDIT_RECHECK_S": "1",
+                "WORKERPALS_OPENAI_CODEX_PROGRESS_LOG_INTERVAL_S": "1",
+            }
+            with mock.patch.dict(os.environ, env_overrides, clear=False):
+                result = _run_codex_task(
+                    str(repo),
+                    "Polish the first-entry home shell with a compact visual patch.",
+                    [],
+                )
+
+        self.assertTrue(result.get("ok"), result)
+        self.assertEqual(result.get("exitCode"), 0)
+        self.assertIn("Patched after transient no-edit recheck", str(result.get("stdout") or ""))
+        self.assertIn("src/", str(result.get("stdout") or ""))
+
     def test_codex_changed_paths_filters_dependency_artifacts_from_publishable_delta(self) -> None:
         with tempfile.TemporaryDirectory(prefix="pushpals-codex-artifact-delta-") as temp_dir:
             repo = Path(temp_dir) / "repo"
@@ -931,6 +1285,86 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
         self.assertGreaterEqual(len(delta), 2)
         self.assertEqual(effective, [])
 
+    def test_codex_changed_paths_ignores_publishable_paths_dirty_at_baseline(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-dirty-baseline-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# dirty baseline repo\n", encoding="utf-8")
+            (repo / "src").mkdir()
+            (repo / "src" / "existing.ts").write_text("export const value = 1;\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "."], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed dirty baseline repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            (repo / "README.md").write_text("# dirty baseline repo\n\npre-existing edit\n", encoding="utf-8")
+            (repo / "src" / "existing.ts").write_text("export const value = 2;\n", encoding="utf-8")
+            baseline = _capture_git_change_snapshot(str(repo))
+
+            changed_paths, delta, effective = _codex_changed_paths(str(repo), baseline)
+
+        self.assertIn("README.md", changed_paths)
+        self.assertEqual(delta, [])
+        self.assertEqual(effective, [])
+
+    def test_codex_changed_paths_counts_worker_edits_to_dirty_baseline_paths(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-dirty-baseline-mutated-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# dirty baseline mutation repo\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "README.md"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed dirty baseline mutation repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            (repo / "README.md").write_text("# dirty baseline mutation repo\n\npre-existing edit\n", encoding="utf-8")
+            baseline = _capture_git_change_snapshot(str(repo))
+            (repo / "README.md").write_text(
+                "# dirty baseline mutation repo\n\npre-existing edit\nworker edit\n",
+                encoding="utf-8",
+            )
+
+            _, delta, effective = _codex_changed_paths(str(repo), baseline)
+
+        self.assertEqual(delta, ["README.md"])
+        self.assertEqual(effective, ["README.md"])
+
     def test_non_publishable_path_summary_names_artifact_only_dirty_paths(self) -> None:
         changed_paths = [
             "node_modules/react/index.js",
@@ -1081,6 +1515,77 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
         self.assertIn("Patched after rollout coach guidance", str(result.get("stdout") or ""))
         self.assertIn("scripts/", str(result.get("stdout") or ""))
 
+    def test_run_codex_task_rollout_coach_fails_fast_on_broad_small_task_changes(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-codex-rollout-noisy-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            (repo / "README.md").write_text("# rollout noisy repo\n", encoding="utf-8")
+            subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "config", "user.name", "PushPals Test"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "pushpals-tests@example.com"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            subprocess.run(["git", "add", "README.md"], cwd=repo, check=True, capture_output=True, text=True)
+            subprocess.run(
+                ["git", "commit", "-m", "chore: seed rollout noisy repo"],
+                cwd=repo,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+
+            stub_path = Path(temp_dir) / "fake_codex_rollout_noisy.py"
+            stub_path.write_text(
+                "\n".join(
+                    [
+                        "from pathlib import Path",
+                        "import sys",
+                        "import time",
+                        "",
+                        "sys.stdin.read()",
+                        "for index in range(5):",
+                        "    root = Path(f'area{index}')",
+                        "    root.mkdir(exist_ok=True)",
+                        "    (root / 'changed.txt').write_text('broad rollout change\\n', encoding='utf-8')",
+                        "print('item.completed | Made broad edits for a supposedly small task.', flush=True)",
+                        "time.sleep(10)",
+                    ]
+                ),
+                encoding="utf-8",
+            )
+
+            env_overrides = {
+                "PUSHPALS_OPENAI_CODEX_BIN_JSON": json.dumps([sys.executable, str(stub_path)]),
+                "PUSHPALS_OPENAI_CODEX_AUTH_MODE": "api_key",
+                "OPENAI_API_KEY": "pushpals-rollout-noisy-test-key",
+                "WORKERPALS_OPENAI_CODEX_TIMEOUT_S": "700",
+                "WORKERPALS_OPENAI_CODEX_NO_EDIT_WATCHDOG_S": "10",
+                "WORKERPALS_OPENAI_CODEX_ROLLOUT_WATCHDOG_S": "1",
+                "WORKERPALS_OPENAI_CODEX_PROGRESS_LOG_INTERVAL_S": "1",
+            }
+            with mock.patch.dict(os.environ, env_overrides, clear=False):
+                result = _run_codex_task(
+                    str(repo),
+                    "Make a small low-risk repo-native patch.",
+                    [],
+                )
+
+        self.assertFalse(result.get("ok"), result)
+        self.assertEqual(result.get("exitCode"), 124)
+        self.assertIn("rollout coach", str(result.get("summary") or ""))
+        self.assertIn("broad/noisy", str(result.get("stderr") or ""))
+        self.assertIn("area0", str(result.get("stderr") or ""))
+
     def test_run_codex_task_timeout_reports_artifact_only_changes(self) -> None:
         with tempfile.TemporaryDirectory(prefix="pushpals-codex-artifact-timeout-") as temp_dir:
             repo = Path(temp_dir) / "repo"

package/runtime/sandbox/apps/workerpals/src/common/types.ts

@@ -18,6 +18,74 @@ export interface JobPublishBlockedInfo {
   stage: "sync" | "push";
 }
 
+export interface JobDiagnosticAttempt {
+  attempt: number;
+  workerId?: string | null;
+  backend?: string | null;
+  model?: string | null;
+  startedAt?: string | null;
+  finishedAt?: string | null;
+  durationMs?: number | null;
+  terminalReason?: string | null;
+  exitCode?: number | null;
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobTerminalDiagnostics {
+  failureClass?: string | null;
+  terminalStage?: string | null;
+  executorBackend?: string | null;
+  summary?: string | null;
+  watchdogFired?: boolean;
+  timeoutMs?: number | null;
+  publishableFileCount?: number | null;
+  artifactOnlyPathCount?: number | null;
+  changedPathSample?: string[];
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobPhaseSpanDiagnostics {
+  attempt?: number | null;
+  phase: string;
+  startedAt: string;
+  finishedAt: string;
+  durationMs: number;
+  outcome?: string | null;
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobValidationRunDiagnostics {
+  attempt?: number | null;
+  command: string;
+  exitCode?: number | null;
+  durationMs?: number | null;
+  passed: boolean;
+  failureClass?: string | null;
+  stdoutTail?: string | null;
+  stderrTail?: string | null;
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobPatchSnapshotDiagnostics {
+  attempt?: number | null;
+  phase?: string | null;
+  publishableFileCount?: number | null;
+  artifactOnlyPathCount?: number | null;
+  changedPathSample?: string[];
+  topLevelDirs?: string[];
+  capturedAt?: string | null;
+  metadata?: Record<string, unknown>;
+}
+
+export interface JobDiagnostics {
+  attempts?: JobDiagnosticAttempt[];
+  terminal?: JobTerminalDiagnostics;
+  phaseSpans?: JobPhaseSpanDiagnostics[];
+  validationRuns?: JobValidationRunDiagnostics[];
+  patchSnapshots?: JobPatchSnapshotDiagnostics[];
+  metadata?: Record<string, unknown>;
+}
+
 export interface JobResult {
   ok: boolean;
   summary: string;
@@ -26,4 +94,5 @@ export interface JobResult {
   exitCode?: number;
   usage?: JobTokenUsage;
   publishBlocked?: JobPublishBlockedInfo;
+  diagnostics?: JobDiagnostics;
 }