@capagents/forgeqe 2.2.3 → 2.2.5

package/docs/user-guide.html

@@ -470,7 +470,7 @@ forgeqe suite cases.yaml --parallel 3        # what pipelines call
 pip install forgeqe-cli
 forgeqe --help
 </code></pre>
-<p>That is the only install step on Windows, macOS and Linux. The first run downloads Bun into <code>~/.forgeqe/tools</code> (unless a Bun 1.3+ is already installed), and <code>forgeqe setup</code> downloads the agent runtime and uv, which fetches Python. Nothing is added to PATH or shell profiles; deleting <code>~/.forgeqe</code> removes it all.</p>
+<p>That is the only install step on Windows, macOS and Linux. npm installs Bun with ForgeQE (through your npm registry, so a company mirror works); with pip, or when npm skipped it, the first run downloads Bun into <code>~/.forgeqe/tools</code> (unless a Bun 1.3+ is already installed), and <code>forgeqe setup</code> downloads the agent runtime and uv, which fetches Python. Nothing is added to PATH or shell profiles; deleting <code>~/.forgeqe</code> removes it all.</p>
 <p>Set up the ForgeQE engine once (the first live run does it automatically if you skip this):</p>
 <pre><code class="language-bash">forgeqe setup
 </code></pre>
@@ -488,6 +488,38 @@ bun install
 bun src/index.ts --help
 </code></pre>
 </div></section>
+<section class="doc sub" id="doc-how_to_use-company-networks"><h4>Company networks</h4><div class="prose"><p>On a company laptop, ForgeQE sets itself up for the network without anyone changing settings:</p>
+<div class="tbl"><table>
+<thead>
+<tr><th>What the network does</th><th>What ForgeQE does</th></tr>
+</thead>
+<tbody>
+<tr><td>Inspects HTTPS (Zscaler, Netskope, a firewall), with the company's own certificate</td><td>Uses the certificates this computer trusts: Windows' Trusted Root store, or the macOS System keychain. ForgeQE, the agent runtime, Playwright and Copilot's runtime get them through <code>NODE_EXTRA_CA_CERTS</code> (a copy in <code>~/.forgeqe/cache/system-ca.pem</code>, refreshed weekly); the Python engines check with the system through truststore; uv with <code>UV_SYSTEM_CERTS</code>. Certificates are still verified.</td></tr>
+<tr><td>Sends traffic through a proxy set in Windows</td><td>Reads Windows' proxy setting (or the one proxy its automatic configuration script names) and passes it on as <code>HTTPS_PROXY</code>. ForgeQE's own servers on <code>127.0.0.1</code> always bypass it.</td></tr>
+<tr><td>Blocks downloads from GitHub or the Playwright CDN</td><td>npm brings Bun through your registry; Microsoft Edge is used when Google Chrome is not installed, so no Chromium is downloaded; mirrors can stand in for the rest (below).</td></tr>
+</tbody>
+</table></div>
+<p>To see where the network stops ForgeQE, run:</p>
+<pre><code class="language-bash">forgeqe doctor
+</code></pre>
+<p>It shows the proxy and certificates in use, checks each address ForgeQE needs (GitHub downloads, Python packages, the npm registry, your models, Azure DevOps or Jira), and for anything blocked prints what to ask IT for, ready to forward.</p>
+<p><strong>For IT: mirrors and settings.</strong> Set these as environment variables (for example by Group Policy):</p>
+<div class="tbl"><table>
+<thead>
+<tr><th>Variable</th><th>What it does</th></tr>
+</thead>
+<tbody>
+<tr><td><code>FORGEQE_GITHUB_MIRROR</code></td><td>A mirror of GitHub release downloads (<code>https://artifacts.example.com/github</code>, laid out as <code>&lt;owner&gt;/&lt;repo&gt;/releases/download/&lt;tag&gt;/&lt;file&gt;</code>): Bun, uv, the agent runtime, Python builds and Copilot's runtime come from it. Checksums are still checked.</td></tr>
+<tr><td><code>UV_DEFAULT_INDEX</code> (or <code>PIP_INDEX_URL</code>)</td><td>A mirror of PyPI for the engine's Python packages.</td></tr>
+<tr><td><code>PLAYWRIGHT_DOWNLOAD_HOST</code></td><td>A mirror for Chromium, needed only without Chrome or Edge.</td></tr>
+<tr><td><code>HTTPS_PROXY</code>, <code>NO_PROXY</code></td><td>A proxy other than Windows' setting. A proxy that needs a sign-in takes <code>http://user:password@host:port</code>.</td></tr>
+<tr><td><code>NODE_EXTRA_CA_CERTS</code></td><td>Your own certificate file instead of the system's roots.</td></tr>
+<tr><td><code>FORGEQE_SYSTEM_CERTS=off</code></td><td>Leaves certificates to each tool's built-in list.</td></tr>
+<tr><td><code>FORGEQE_HOME</code></td><td>Where ForgeQE keeps its tools (default <code>~/.forgeqe</code>), for machines where programs may run only from certain folders.</td></tr>
+</tbody>
+</table></div>
+<p>What still needs IT: a proxy that signs in with your Windows account only (NTLM or Kerberos), and policies that block programs in the user folder (set <code>FORGEQE_HOME</code> to an allowed folder). On macOS, the company's certificate must be in the System keychain, where device management puts it.</p>
+</div></section>
 </section>
 <section class="doc" id="doc-how_to_use-2-scaffold-config">
 <h3>Scaffold config</h3>
@@ -577,6 +609,7 @@ bun src/index.ts init --global --profile azure-gpt4o
 <tr><td><code>ForgeQE's agent and Scribe cannot run on a github_copilot profile yet</code></td><td>Pick another profile for them (<code>--profile</code>, or Tab in the shell), or set <code>code.model</code>.</td></tr>
 <tr><td>The model is refused, or not found</td><td>The seat's plan or your organization's Copilot policies do not allow that model: pick one the sign-in listed, or ask a Copilot admin to enable it.</td></tr>
 <tr><td><code>GitHub Copilot runs through the ForgeQE engine, which is not set up</code></td><td>Run <code>forgeqe setup</code>.</td></tr>
+<tr><td><code>CERTIFICATE_VERIFY_FAILED</code> while downloading Copilot's runtime</td><td>Your network inspects HTTPS. Update ForgeQE and run <code>forgeqe setup</code>, then sign in again: it uses the certificates your computer trusts (see <a href="../HOW_TO_USE.md#company-networks">Company networks</a>). If it still fails, run <code>forgeqe doctor</code> and send its output to IT.</td></tr>
 </tbody>
 </table></div>
 </div></section>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capagents/forgeqe",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "description": "ForgeQE: a browser agent CLI that runs goals and test cases in local Chrome or Chromium, or BrowserStack and TestMu AI/LambdaTest when configured, and turns passing runs into tests in your repo",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -60,6 +60,16 @@
   "dependencies": {
     "@opentui/core": "^0.5.12"
   },
+  "optionalDependencies": {
+    "@oven/bun-darwin-aarch64": "1.4.2",
+    "@oven/bun-darwin-x64-baseline": "1.4.2",
+    "@oven/bun-linux-aarch64": "1.4.2",
+    "@oven/bun-linux-aarch64-musl": "1.4.2",
+    "@oven/bun-linux-x64-baseline": "1.4.2",
+    "@oven/bun-linux-x64-musl-baseline": "1.4.2",
+    "@oven/bun-windows-aarch64": "1.4.2",
+    "@oven/bun-windows-x64-baseline": "1.4.2"
+  },
   "devDependencies": {
     "@opencode-ai/sdk": "1.18.33",
     "@opentui/react": "^0.5.12",

package/py/forgeqe_desktop/__main__.py

@@ -1,3 +1,7 @@
+from forgeqe_engine.systemcerts import use_system_certificates
+
 from .cli import main
 
+use_system_certificates()
+
 raise SystemExit(main())

package/py/forgeqe_engine/__main__.py

@@ -1,3 +1,7 @@
+from forgeqe_engine.systemcerts import use_system_certificates
+
 from .cli import main
 
+use_system_certificates()
+
 raise SystemExit(main())

package/py/forgeqe_engine/browser.py

@@ -7,9 +7,10 @@ import contextlib
 import json
 import logging
 import os
+import sys
 import time
 from pathlib import Path
-from typing import Any, Dict, Optional
+from typing import Any, Dict, List, Optional
 from urllib.parse import quote, urlparse
 
 logger = logging.getLogger("forgeqe_engine.service")
@@ -84,6 +85,24 @@ _UNSUPPORTED_BROWSER_USE_ARGS = (
 _MAC_CHROME_EXECUTABLE = "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
 
 
+def find_edge_executable() -> Optional[str]:
+    """
+    Microsoft Edge, which every Windows PC has: used when Google Chrome is not installed, so that no Chromium has to be
+    downloaded (company networks often block where it comes from).
+    """
+    candidates: List[str] = []
+    if sys.platform == "win32":
+        for var in ("PROGRAMFILES(X86)", "PROGRAMFILES", "LOCALAPPDATA"):
+            base = os.environ.get(var)
+            if base:
+                candidates.append(os.path.join(base, "Microsoft", "Edge", "Application", "msedge.exe"))
+    elif sys.platform == "darwin":
+        candidates.append("/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge")
+    else:
+        candidates += ["/usr/bin/microsoft-edge", "/usr/bin/microsoft-edge-stable", "/opt/microsoft/msedge/msedge"]
+    return next((c for c in candidates if Path(c).is_file()), None)
+
+
 def resolve_browser_channel() -> str:
     """Default is installed Google Chrome (`chrome`). Override with BROWSER_USE_CHANNEL (e.g. `chromium`)."""
     raw = (os.getenv("BROWSER_USE_CHANNEL") or "chrome").strip().lower()
@@ -125,8 +144,12 @@ def local_browser_launch_kwargs(*, headless: bool) -> Dict[str, Any]:
         "ignore_default_args": list(_UNSUPPORTED_BROWSER_USE_ARGS),
     }
     exe = resolve_chrome_executable_path(channel)
+    edge = None if exe or channel not in ("chrome", "msedge") else find_edge_executable()
     if exe:
         kw["executable_path"] = exe
+    elif edge:
+        kw["executable_path"] = edge
+        kw["channel"] = "msedge"
     elif channel == "chrome":
         # No Google Chrome here: let the library use its own Chromium instead of failing on the channel.
         kw["channel"] = "chromium"

package/py/forgeqe_engine/cli.py

@@ -78,6 +78,10 @@ def _doctor(out: TextIO) -> int:
         info["copilot_sdk"] = version("github-copilot-sdk")
     except Exception:
         pass
+    try:
+        info["truststore"] = version("truststore")
+    except Exception:
+        pass
     try:
         info["video"] = version("imageio")
     except Exception:

package/py/forgeqe_engine/copilot_gateway.py

@@ -26,6 +26,8 @@ import time
 import uuid
 from typing import Any, Dict, List, Optional, TextIO, Tuple
 
+from .systemcerts import use_system_certificates
+
 TOKEN_ENV = "COPILOT_GITHUB_TOKEN"
 KEY_ENV = "FORGEQE_COPILOT_GATEWAY_KEY"
 
@@ -366,4 +368,5 @@ async def serve(out: TextIO, copilot: Any = None) -> int:
 
 
 def main(out: TextIO) -> int:
+    use_system_certificates()
     return asyncio.run(serve(out))

package/py/forgeqe_engine/systemcerts.py

@@ -0,0 +1,23 @@
+"""
+HTTPS certificates checked with the operating system's store (truststore), as pip and uv do. On a company network that
+inspects HTTPS, the company's certificate authority is trusted by Windows or macOS but not by Python's own bundle
+(certifi), and Python 3.13+ refuses such a CA whose Basic Constraints are not marked critical. With this, the engines'
+calls to the model, the Copilot SDK's runtime download and any other HTTPS request work there.
+
+Certificates are still verified, hostnames included; only who verifies them changes. FORGEQE_SYSTEM_CERTS=off leaves
+Python's own checks in place (src/network.ts).
+"""
+from __future__ import annotations
+
+import os
+
+
+def use_system_certificates() -> bool:
+    if os.environ.get("FORGEQE_SYSTEM_CERTS", "").strip().lower() in ("0", "off", "false", "no"):
+        return False
+    try:
+        import truststore
+    except ImportError:
+        return False
+    truststore.inject_into_ssl()
+    return True

package/py/forgeqe_mobile/__main__.py

@@ -1,3 +1,7 @@
+from forgeqe_engine.systemcerts import use_system_certificates
+
 from .cli import main
 
+use_system_certificates()
+
 raise SystemExit(main())