fix(cli-server): parse string args without shlex

[radu-mocanu]

Summary

• replace shlex-based parsing of the args request field with a linear parser for the '<entrypoint>' '<json>' wire format
• still accept args as a list of strings (passthrough)
• return 400 for malformed strings

Why

shlex.split runs a character-by-character shell-lexer (https://docs.python.org/3/library/shlex.html#shlex.split). when clients inlined a large json blob into args as 'agent.json' '{...json...}', the server stalled on the request thread before the command could start. the new parser finds the ' ' boundary, so latency is linear in payload size and large inputs no longer block the loop.

Development Packages

uipath

[project]
dependencies = [
  # Exact version:
  "uipath==2.10.73.dev1016886592",

  # Any version from PR
  "uipath>=2.10.73.dev1016880000,<2.10.73.dev1016890000"
]

[[tool.uv.index]]
name = "testpypi"
url = "https://test.pypi.org/simple/"
publish-url = "https://test.pypi.org/legacy/"
explicit = true

[tool.uv.sources]
uipath = { index = "testpypi" }

[Copilot]

Pull request overview

Tightens validation on POST /jobs/{job_key}/start so that args must be a JSON array of strings. The previous string branch that called shlex.split on the request payload is removed, eliminating shell tokenization on the request thread and reducing latency for large payloads.

Changes:

• Replace parse_args() with ensure_args_list() that accepts only None/list[str] and returns None for invalid values.
• handle_start() returns a 400 JSON error when args is not a JSON array of strings; shlex import dropped.
• Bump package version to 2.10.72 and refresh the lockfile.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
packages/uipath/src/uipath/_cli/cli_server.py	New args validator and 400 response; remove shlex-based string parsing.
packages/uipath/pyproject.toml	Version bump to 2.10.72.
packages/uipath/uv.lock	Lockfile updated for new version and exclude-newer.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🚨 Heads up: uipath-langchain cross-tests are FAILING 🚨

Your changes may break the uipath-langchain-python integration.

⚠️ These checks are NOT enforced by branch protection rules. Please review the failures before merging.

🔍 Inspect the failed run →