@pushpalsdev/cli 1.1.31 → 1.1.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushpalsdev/cli",
-  "version": "1.1.31",
+  "version": "1.1.34",
   "description": "PushPals terminal CLI for LocalBuddy -> RemoteBuddy orchestration",
   "license": "MIT",
   "repository": {

package/runtime/sandbox/apps/workerpals/src/backends/openai_codex/test_openai_codex_runtime_config.py

@@ -350,6 +350,28 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
             self.assertIn("Home shell startup is assertable", guidance)
             self.assertIn("bun run web:e2e", guidance)
 
+    def test_parse_payload_accepts_file_backed_payload_transport(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="pushpals-payload-file-") as temp_dir:
+            repo = Path(temp_dir) / "repo"
+            repo.mkdir(parents=True, exist_ok=True)
+            payload = {
+                "kind": "task.execute",
+                "repo": str(repo),
+                "params": {"instruction": "Make one small publishable change"},
+            }
+            encoded = base64.b64encode(json.dumps(payload).encode("utf-8")).decode("ascii")
+            payload_file = Path(temp_dir) / "payload.b64"
+            payload_file.write_text(encoded, encoding="utf-8")
+
+            task = parse_task_execute_payload(
+                ["executor", "--payload-file", str(payload_file)],
+                logger=Logger("[test]"),
+            )
+
+            self.assertEqual(task.kind, "task.execute")
+            self.assertEqual(task.repo, str(repo.resolve()))
+            self.assertEqual(task.instruction, "Make one small publishable change")
+
     def test_parse_payload_prefers_helper_tests_for_visual_derivation_tasks(self) -> None:
         with tempfile.TemporaryDirectory(prefix="pushpals-visual-guidance-") as temp_dir:
             repo = Path(temp_dir) / "repo"

package/runtime/sandbox/apps/workerpals/src/backends/openhands_task_execute.ts

@@ -17,6 +17,10 @@ import {
   filterResultLines,
 } from "../common/execution_utils.js";
 import { buildWorkerSandboxWritableEnv } from "../common/sandbox_env.js";
+import {
+  createPythonPayloadTransport,
+  type PythonPayloadTransport,
+} from "../common/python_payload_transport.js";
 import { computeTimeoutWarningWindow } from "../timeout_policy.js";
 
 // ---- Script path (resolved relative to this file) ----------------------------
@@ -274,6 +278,7 @@ export async function executeWithOpenHands(
   let timeoutTimer: ReturnType<typeof setTimeout> | null = null;
   let stuckNudgeStartTimer: ReturnType<typeof setTimeout> | null = null;
   let stuckNudgeTimer: ReturnType<typeof setInterval> | null = null;
+  let payloadTransport: PythonPayloadTransport | null = null;
   const outputPolicy = {
     maxOutputChars: runtimeConfig.workerpals.outputMaxChars,
     maxOutputLines: runtimeConfig.workerpals.outputMaxLines,
@@ -282,7 +287,8 @@ export async function executeWithOpenHands(
   };
 
   try {
-    const proc = Bun.spawn([pythonBin, scriptPath, payload], {
+    payloadTransport = createPythonPayloadTransport(payload);
+    const proc = Bun.spawn([pythonBin, scriptPath, ...payloadTransport.args], {
       cwd: repo,
       stdout: "pipe",
       stderr: "pipe",
@@ -623,5 +629,6 @@ export async function executeWithOpenHands(
     if (stuckNudgeTimer) {
       clearInterval(stuckNudgeTimer);
     }
+    payloadTransport?.cleanup();
   }
 }

package/runtime/sandbox/apps/workerpals/src/backends/shared/executor_base.py

@@ -163,6 +163,20 @@ def decode_payload(raw: str) -> Dict[str, Any]:
     return payload
 
 
+def read_encoded_payload_arg(argv: List[str]) -> str:
+    if len(argv) < 2:
+        raise ValueError("missing base64 job payload")
+    mode = argv[1]
+    if mode == "--payload-file":
+        if len(argv) < 3 or not str(argv[2] or "").strip():
+            raise ValueError("missing payload file path")
+        path = Path(str(argv[2])).expanduser()
+        return path.read_text(encoding="utf-8").strip()
+    if mode == "--payload-stdin":
+        return sys.stdin.read().strip()
+    return mode
+
+
 def resolve_repo_within_assigned_root(repo: str) -> Tuple[Optional[str], Optional[str]]:
     raw_repo = str(repo or "").strip()
     if not raw_repo:
@@ -968,11 +982,8 @@ def parse_task_execute_payload(
     don't need to handle them.
     """
     log = logger or Logger("[Executor]")
-    if len(argv) < 2:
-        raise SystemExit(fail("Missing base64 job payload", exit_code=2))
-
     try:
-        payload = decode_payload(argv[1])
+        payload = decode_payload(read_encoded_payload_arg(argv))
     except Exception as exc:
         raise SystemExit(fail(f"Failed to decode job payload: {exc}", exit_code=2))
 

package/runtime/sandbox/apps/workerpals/src/common/generic_python_executor.ts

@@ -19,6 +19,10 @@ import {
   streamLines,
 } from "./execution_utils.js";
 import { buildWorkerSandboxWritableEnv } from "./sandbox_env.js";
+import {
+  createPythonPayloadTransport,
+  type PythonPayloadTransport,
+} from "./python_payload_transport.js";
 
 interface GenericPythonExecutorConfig {
   backendName: string;
@@ -357,7 +361,6 @@ export function createGenericPythonExecutor(
       }),
       "utf-8",
     ).toString("base64");
-    const args = [pythonBin, scriptPath, payloadBase64];
     const childTimeoutMs = resolveGenericPythonExecutorChildTimeoutMs({
       backendName,
       hostTimeoutMs: timeoutMs,
@@ -379,12 +382,15 @@ export function createGenericPythonExecutor(
           )}ms`
         : "";
 
-    onLog?.(
-      "stdout",
-      `[${backendLabel}Executor] Spawning ${backendName} executor (timeout=${timeoutMs}ms; ${timeoutDetail}${childTimeoutDetail})`,
-    );
-
+    let payloadTransport: PythonPayloadTransport | null = null;
     try {
+      payloadTransport = createPythonPayloadTransport(payloadBase64);
+      const args = [pythonBin, scriptPath, ...payloadTransport.args];
+      onLog?.(
+        "stdout",
+        `[${backendLabel}Executor] Spawning ${backendName} executor (timeout=${timeoutMs}ms; ${timeoutDetail}${childTimeoutDetail})`,
+      );
+
       const outputPolicy = {
         maxOutputChars: runtimeConfig.workerpals.outputMaxChars,
         maxOutputLines: runtimeConfig.workerpals.outputMaxLines,
@@ -539,6 +545,8 @@ export function createGenericPythonExecutor(
           "",
         ),
       };
+    } finally {
+      payloadTransport?.cleanup();
     }
   };
 }

package/runtime/sandbox/apps/workerpals/src/common/python_payload_transport.ts

@@ -0,0 +1,26 @@
+import { mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+
+export interface PythonPayloadTransport {
+  args: string[];
+  filePath: string;
+  cleanup: () => void;
+}
+
+export function createPythonPayloadTransport(payloadBase64: string): PythonPayloadTransport {
+  const dir = mkdtempSync(join(tmpdir(), "pushpals-python-payload-"));
+  const filePath = join(dir, "payload.b64");
+  writeFileSync(filePath, payloadBase64, { encoding: "utf8", mode: 0o600 });
+
+  let cleaned = false;
+  return {
+    args: ["--payload-file", filePath],
+    filePath,
+    cleanup: () => {
+      if (cleaned) return;
+      cleaned = true;
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}

package/runtime/sandbox/package.json

@@ -9,6 +9,7 @@
     "cli": "bun run scripts/pushpals-cli.ts",
     "cli:integration": "bun run scripts/cli-integration.ts",
     "cli:bundle": "bun run --cwd packages/cli build",
+    "cli:verify-package-payload": "bun run scripts/verify-cli-package-payload.ts",
     "cli:monitor:export": "bun run scripts/sync-cli-monitor-ui.ts",
     "replay:worker-job": "bun run scripts/replay-worker-job.ts",
     "protocol:build": "bun --cwd packages/protocol build",