forgeqe-cli 2.2.3__tar.gz → 2.2.5__tar.gz

{forgeqe_cli-2.2.3 → forgeqe_cli-2.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgeqe-cli
-Version: 2.2.3
+Version: 2.2.5
 Summary: pip launcher for the ForgeQE browser agent (npm package: @capagents/forgeqe)
 Author: CLI-Agents
 License: MIT
@@ -8,6 +8,7 @@ Keywords: forgeqe,browser,agent,cli,opentui
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: truststore==0.10.4; python_version >= "3.10"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Dynamic: license-file

{forgeqe_cli-2.2.3 → forgeqe_cli-2.2.5}/py/forgeqe_cli/__init__.py

@@ -4,4 +4,4 @@ The agent itself is the npm package ``@capagents/forgeqe`` (OpenTUI + Bun).
 This distribution only puts a ``forgeqe`` command on PATH.
 """
 
-__version__ = "2.2.3"
+__version__ = "2.2.5"

{forgeqe_cli-2.2.3 → forgeqe_cli-2.2.5}/py/forgeqe_cli/launcher.py

@@ -5,6 +5,7 @@ import io
 import os
 import platform
 import shutil
+import ssl
 import stat
 import subprocess
 import sys
@@ -93,11 +94,77 @@ def bun_asset(system: str | None = None, machine: str | None = None, musl: bool
     return f"bun-{os_name}-{cpu}{'-musl' if musl else ''}{'-baseline' if cpu == 'x64' else ''}.zip"
 
 
+def _ssl_context() -> ssl.SSLContext | None:
+    """The system's certificate store (truststore), so downloads work on networks that inspect HTTPS."""
+    try:
+        import truststore
+
+        return truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    except Exception:
+        return None
+
+
 def _download(url: str) -> bytes:
-    with urllib.request.urlopen(url, timeout=120) as res:
+    with urllib.request.urlopen(url, timeout=120, context=_ssl_context()) as res:
         return res.read()
 
 
+def github_release(repo: str, tag: str, asset: str) -> str:
+    """A GitHub release download, from FORGEQE_GITHUB_MIRROR when one is set (src/network.ts)."""
+    mirror = os.environ.get("FORGEQE_GITHUB_MIRROR", "").strip().rstrip("/")
+    base = mirror if mirror.lower().startswith("https://") else "https://github.com"
+    return f"{base}/{repo}/releases/download/{tag}/{asset}"
+
+
+def certs_off() -> bool:
+    return os.environ.get("FORGEQE_SYSTEM_CERTS", "").strip().lower() in ("0", "off", "false", "no")
+
+
+def system_ca_path() -> Path:
+    return forgeqe_home() / "cache" / "system-ca.pem"
+
+
+def _system_roots() -> list[str]:
+    """PEM roots the system trusts: Windows' ROOT store, macOS' System keychains, or Linux's bundle."""
+    if WINDOWS:
+        return [ssl.DER_cert_to_PEM_cert(der) for der, enc, _ in ssl.enum_certificates("ROOT") if enc == "x509_asn"]
+    if sys.platform == "darwin":
+        keychains = [k for k in ("/Library/Keychains/System.keychain", "/System/Library/Keychains/SystemRootCertificates.keychain") if Path(k).is_file()]
+        try:
+            out = subprocess.run(["/usr/bin/security", "find-certificate", "-a", "-p", *keychains], capture_output=True, text=True, timeout=30)
+        except (OSError, subprocess.SubprocessError):
+            return []
+        return [b + "-----END CERTIFICATE-----\n" for b in out.stdout.split("-----END CERTIFICATE-----") if "BEGIN CERTIFICATE" in b] if out.returncode == 0 else []
+    for bundle in ("/etc/ssl/certs/ca-certificates.crt", "/etc/pki/tls/certs/ca-bundle.crt", "/etc/ssl/ca-bundle.pem", "/etc/ssl/cert.pem"):
+        if Path(bundle).is_file():
+            return [Path(bundle).read_text(encoding="utf-8", errors="replace")]
+    return []
+
+
+def bun_env(env: dict[str, str] | None = None) -> dict[str, str]:
+    """
+    Bun reads NODE_EXTRA_CA_CERTS only at start: give it the system's trusted roots, written here the first time
+    (bun x fetches ForgeQE before ForgeQE runs) and kept up to date by ForgeQE (src/network.ts).
+    """
+    env = dict(os.environ if env is None else env)
+    if env.get("NODE_EXTRA_CA_CERTS") or certs_off():
+        return env
+    ca = system_ca_path()
+    if not ca.is_file():
+        try:
+            roots = _system_roots()
+            if roots:
+                ca.parent.mkdir(parents=True, exist_ok=True)
+                tmp = ca.with_name(f"{ca.name}.{os.getpid()}.tmp")
+                tmp.write_text("".join(r if r.endswith("\n") else r + "\n" for r in roots), encoding="utf-8")
+                os.replace(tmp, ca)
+        except OSError:
+            pass
+    if ca.is_file():
+        env["NODE_EXTRA_CA_CERTS"] = str(ca)
+    return env
+
+
 def expected_sha256(sums: str, asset: str) -> str | None:
     for line in sums.splitlines():
         parts = line.split()
@@ -110,7 +177,7 @@ def install_bun() -> str:
     asset = bun_asset()
     if not asset:
         raise LaunchError(f"no Bun build for {platform.system()}/{platform.machine()}")
-    base = f"https://github.com/oven-sh/bun/releases/download/bun-v{BUN_VERSION}"
+    base = github_release("oven-sh/bun", f"bun-v{BUN_VERSION}", "").rstrip("/")
     print(f"forgeqe: downloading Bun {BUN_VERSION} ({asset}) into {tools_dir()} (one time)...", file=sys.stderr)
     data = _download(f"{base}/{asset}")
     expected = expected_sha256(_download(f"{base}/SHASUMS256.txt").decode("utf-8"), asset)
@@ -139,7 +206,8 @@ def manual_hint() -> str:
     install = 'powershell -c "irm bun.sh/install.ps1 | iex"' if WINDOWS else "curl -fsSL https://bun.sh/install | bash"
     return (
         f"Install Bun {'.'.join(map(str, MIN_BUN))}+ yourself ({install}) and re-run forgeqe,\n"
-        f"or set FORGEQE_BUN to the full path of {BUN_EXE}."
+        f"or set FORGEQE_BUN to the full path of {BUN_EXE}.\n"
+        "Behind a company mirror of GitHub downloads, set FORGEQE_GITHUB_MIRROR to it."
     )
 
 
@@ -179,7 +247,7 @@ def main() -> None:
     os.environ["PATH"] = bindir + os.pathsep + os.environ.get("PATH", "")
     if WINDOWS:
         try:
-            raise SystemExit(subprocess.call(cmd))
+            raise SystemExit(subprocess.call(cmd, env=bun_env()))
         except KeyboardInterrupt:
             raise SystemExit(130)
-    os.execv(cmd[0], cmd)
+    os.execve(cmd[0], cmd, bun_env())

{forgeqe_cli-2.2.3 → forgeqe_cli-2.2.5}/py/forgeqe_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgeqe-cli
-Version: 2.2.3
+Version: 2.2.5
 Summary: pip launcher for the ForgeQE browser agent (npm package: @capagents/forgeqe)
 Author: CLI-Agents
 License: MIT
@@ -8,6 +8,7 @@ Keywords: forgeqe,browser,agent,cli,opentui
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: truststore==0.10.4; python_version >= "3.10"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Dynamic: license-file

forgeqe_cli-2.2.5/py/forgeqe_cli.egg-info/requires.txt

@@ -0,0 +1,6 @@
+
+[:python_version >= "3.10"]
+truststore==0.10.4
+
+[dev]
+pytest>=8.0

{forgeqe_cli-2.2.3 → forgeqe_cli-2.2.5}/pyproject.toml

@@ -4,14 +4,15 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "forgeqe-cli"
-version = "2.2.3"
+version = "2.2.5"
 description = "pip launcher for the ForgeQE browser agent (npm package: @capagents/forgeqe)"
 readme = "README.md"
 requires-python = ">=3.9"
 license = { text = "MIT" }
 authors = [{ name = "CLI-Agents" }]
 keywords = ["forgeqe", "browser", "agent", "cli", "opentui"]
-dependencies = []
+# truststore: downloads check HTTPS certificates with the system's store, for networks that inspect HTTPS.
+dependencies = ["truststore==0.10.4; python_version >= '3.10'"]
 
 [project.optional-dependencies]
 dev = ["pytest>=8.0"]

forgeqe_cli-2.2.3/py/forgeqe_cli.egg-info/requires.txt

@@ -1,3 +0,0 @@
-
-[dev]
-pytest>=8.0