forgexa-cli 1.1.6__tar.gz → 1.2.2__tar.gz

{forgexa_cli-1.1.6 → forgexa_cli-1.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.1.6
+Version: 1.2.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT

{forgexa_cli-1.1.6 → forgexa_cli-1.2.2}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.1.6"
+__version__ = "1.2.2"

{forgexa_cli-1.1.6 → forgexa_cli-1.2.2}/forgexa_cli/daemon.py

@@ -11,6 +11,7 @@ Usage:
 from __future__ import annotations
 
 import asyncio
+import base64
 import hashlib
 import json
 import logging
@@ -27,8 +28,15 @@ from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
+from urllib.parse import urlparse
 from uuid import UUID
 
+# fcntl is Unix-only; on Windows we skip file locking
+try:
+    import fcntl
+except ImportError:
+    fcntl = None  # type: ignore[assignment]
+
 try:
     import httpx
 except ImportError:
@@ -104,8 +112,8 @@ except (ImportError, ModuleNotFoundError):
 
         def get_daemon_server_urls(self) -> list:
             if self.DAEMON_SERVER_URLS:
-                return [u.strip() for u in self.DAEMON_SERVER_URLS.split(",") if u.strip()]
-            return [self.DAEMON_SERVER_URL] if self.DAEMON_SERVER_URL else []
+                return list(dict.fromkeys(u.strip().rstrip("/") for u in self.DAEMON_SERVER_URLS.split(",") if u.strip()))
+            return [self.DAEMON_SERVER_URL.rstrip("/")] if self.DAEMON_SERVER_URL else []
 
     settings = _StandaloneSettings()  # type: ignore[assignment]
 
@@ -444,12 +452,89 @@ class WorkspaceManager:
     def __init__(self, root: str):
         self.root = Path(root).expanduser()
         self.root.mkdir(parents=True, exist_ok=True)
+        # Project repos live under projects/ to avoid mixing with other daemon files
+        self.projects_root = self.root / "projects"
+        self.projects_root.mkdir(parents=True, exist_ok=True)
         self._ssh_keys: dict[str, str] = {}  # project_key -> PEM key content
+        self._http_auth: dict[str, dict[str, str]] = {}  # project_key -> provider/token/username
+
+        # One-time migration: move legacy project dirs from root/ to projects/
+        self._migrate_legacy_project_dirs()
 
     def set_ssh_key(self, project_key: str, ssh_private_key: str) -> None:
         """Register an SSH private key for a project."""
         self._ssh_keys[project_key] = ssh_private_key
 
+    def _migrate_legacy_project_dirs(self) -> None:
+        """Move project directories from root/ to root/projects/ (one-time migration).
+
+        Previously project workspaces lived at e.g. ~/.forgexa/daemon/AILP/
+        Now they live at ~/.forgexa/daemon/projects/AILP/
+        Skip known non-project entries (projects/, daemon.log, daemon.lock, etc.).
+        """
+        _skip = {"projects", "daemon.log", "daemon.lock", ".DS_Store"}
+        try:
+            for child in self.root.iterdir():
+                if child.name in _skip or child.name.startswith("."):
+                    continue
+                if child.is_dir() and child != self.projects_root:
+                    dest = self.projects_root / child.name
+                    if not dest.exists():
+                        try:
+                            child.rename(dest)
+                            logger.info("Migrated workspace %s → projects/%s", child.name, child.name)
+                        except OSError as e:
+                            logger.warning("Failed to migrate workspace %s: %s", child.name, e)
+        except Exception:
+            pass  # Non-critical migration
+
+    def set_http_auth(
+        self,
+        project_key: str,
+        provider: str,
+        api_token: str,
+        username: str | None = None,
+    ) -> None:
+        """Register HTTPS git auth for a project.
+
+        This is used when repos are configured via HTTPS and no SSH key is provided.
+        """
+        if not api_token:
+            return
+        self._http_auth[project_key] = {
+            "provider": provider,
+            "api_token": api_token,
+            "username": username or "",
+        }
+
+    def _build_http_git_config_args(self, project_key: str) -> list[str]:
+        """Build git -c args for HTTP Authorization header."""
+        auth = self._http_auth.get(project_key)
+        if not auth:
+            return []
+
+        provider = (auth.get("provider") or "").strip().lower()
+        token = auth.get("api_token") or ""
+        if not token:
+            return []
+
+        username = (auth.get("username") or "").strip()
+        if not username:
+            if provider == "github":
+                username = "x-access-token"
+            elif provider == "gitlab":
+                username = "oauth2"
+            else:
+                # Works for Bitbucket Server/Data Center PAT in HTTPS git auth.
+                username = "x-token-auth"
+
+        basic = base64.b64encode(f"{username}:{token}".encode("utf-8")).decode("ascii")
+        args = ["-c", f"http.extraHeader=Authorization: Basic {basic}"]
+        # Disable SSL verification for self-signed certs (common in on-prem Bitbucket Server)
+        if provider in ("bitbucket-server", "gitlab", "gitea"):
+            args.extend(["-c", "http.sslVerify=false"])
+        return args
+
     def _build_ssh_env(self, project_key: str) -> dict | None:
         """Build env dict with GIT_SSH_COMMAND if an SSH key is available."""
         key_content = self._ssh_keys.get(project_key)
@@ -473,7 +558,15 @@ class WorkspaceManager:
         if ssh_key:
             self.set_ssh_key(project_key, ssh_key)
 
-        project_dir = self.root / project_key
+        # Register HTTPS token auth for non-SSH repos.
+        # Token/provider are resolved by API server from integration config fallback chain.
+        git_provider = str(project.get("git_provider") or "")
+        git_api_token = str(project.get("git_api_token") or "")
+        git_username = str(project.get("git_username") or "")
+        if git_api_token:
+            self.set_http_auth(project_key, git_provider, git_api_token, git_username or None)
+
+        project_dir = self.projects_root / project_key
         project_dir.mkdir(parents=True, exist_ok=True)
 
         # Use requirement_workflow_id as workspace key when available so that
@@ -485,12 +578,12 @@ class WorkspaceManager:
         else:
             workspace_key = re.sub(r"[^a-zA-Z0-9_-]", "_", str(task.graph_id))
 
-        # V5.4: Use human-readable branch name ai/{project_key}/{requirement_key}
-        # when requirement_key is available; fallback to ai/{workspace_key}
+        # Use human-readable branch name feature/{requirement_key}
+        # when requirement_key is available; fallback to feature/{workspace_key}
         if task.requirement_key:
-            branch_name = f"ai/{project_key}/{task.requirement_key}"
+            branch_name = f"feature/{task.requirement_key}"
         else:
-            branch_name = f"ai/{workspace_key}"
+            branch_name = f"feature/{workspace_key}"
 
         # Determine whether this node is the "first" in a new graph that needs
         # a fresh base from the default branch.  Analysis nodes always start
@@ -551,6 +644,40 @@ class WorkspaceManager:
                 await self._git("checkout", "-b", branch_name, cwd=ws_path)
             return ws_path
 
+    async def _is_healthy_worktree(self, ws_path: Path) -> bool:
+        """Check if a git worktree directory is valid and functional."""
+        git_file = ws_path / ".git"
+        if not git_file.exists():
+            return False
+        if git_file.is_dir():
+            # It's a real .git directory (init'd repo), not a worktree
+            return True
+        # Worktree: .git is a file containing "gitdir: /path/to/main/.git/worktrees/..."
+        try:
+            content = git_file.read_text().strip()
+            if content.startswith("gitdir: "):
+                gitdir = Path(content.split("gitdir: ", 1)[1].strip())
+                return gitdir.exists()
+        except OSError:
+            pass
+        return False
+
+    async def _remove_broken_worktree(self, main_repo: Path, ws_path: Path, workspace_key: str):
+        """Remove a broken worktree directory and clean up stale worktree refs."""
+        import shutil
+        # Try to prune from main repo first
+        if main_repo.exists():
+            try:
+                await self._git("worktree", "prune", cwd=main_repo)
+            except RuntimeError:
+                pass
+            # Also remove the worktree ref if it still exists
+            wt_ref = main_repo / ".git" / "worktrees" / workspace_key
+            if wt_ref.exists():
+                shutil.rmtree(wt_ref, ignore_errors=True)
+        # Remove the broken worktree directory
+        shutil.rmtree(ws_path, ignore_errors=True)
+
     async def _create_worktree(
         self, project_dir: Path, repo_url: str, default_branch: str,
         workspace_key: str, branch_name: str, *, fresh_start: bool = False,
@@ -560,31 +687,46 @@ class WorkspaceManager:
         ws_path = project_dir / workspace_key
 
         if ws_path.exists():
-            # Always fetch latest remote refs.
-            try:
-                await self._git("fetch", "origin", cwd=ws_path, project_key=project_key)
-            except RuntimeError:
-                pass
-
-            if fresh_start:
-                # This is the first node of a new graph (e.g. analysis).
-                # Reset the worktree to the latest origin/default_branch so
-                # that the AI works on up-to-date code.  Any previous AI
-                # commits have already been pushed, so they are safe.
-                logger.info("Fresh start: resetting %s to origin/%s", ws_path, default_branch)
+            # Validate that this worktree is healthy (its .git file points to a
+            # valid main repo).  Worktrees break when directories are moved.
+            if not await self._is_healthy_worktree(ws_path):
+                logger.warning("Broken worktree detected at %s — removing and recreating", ws_path)
+                await self._remove_broken_worktree(main_repo, ws_path, workspace_key)
+            else:
+                # Healthy worktree — fetch and optionally reset
                 try:
-                    await self._git("checkout", branch_name, cwd=ws_path)
+                    await self._git("fetch", "origin", cwd=ws_path, project_key=project_key)
                 except RuntimeError:
-                    pass  # Already on this branch
-                try:
-                    await self._git(
-                        "reset", "--hard", f"origin/{default_branch}", cwd=ws_path,
-                    )
-                except RuntimeError as exc:
-                    logger.warning("Failed to reset to origin/%s: %s", default_branch, exc)
-            # For non-fresh-start (continuation nodes like coding→testing),
-            # keep the working branch as-is so changes accumulate.
-            return ws_path
+                    pass
+
+                if fresh_start:
+                    logger.info("Fresh start: resetting %s to origin/%s", ws_path, default_branch)
+                    # Use checkout -B to create or reset the branch to origin/default_branch.
+                    # Plain `checkout branch_name` fails when the branch doesn't exist locally.
+                    try:
+                        await self._git(
+                            "checkout", "-B", branch_name, f"origin/{default_branch}",
+                            cwd=ws_path,
+                        )
+                    except RuntimeError as exc:
+                        logger.warning(
+                            "checkout -B %s failed: %s — falling back to reset", branch_name, exc,
+                        )
+                        try:
+                            await self._git("checkout", branch_name, cwd=ws_path)
+                        except RuntimeError:
+                            # Last resort: create branch from HEAD
+                            try:
+                                await self._git("checkout", "-b", branch_name, cwd=ws_path)
+                            except RuntimeError:
+                                pass
+                        try:
+                            await self._git(
+                                "reset", "--hard", f"origin/{default_branch}", cwd=ws_path,
+                            )
+                        except RuntimeError as exc2:
+                            logger.warning("Failed to reset to origin/%s: %s", default_branch, exc2)
+                return ws_path
 
         # Ensure _main repo is present and up-to-date
         if not main_repo.exists():
@@ -605,7 +747,7 @@ class WorkspaceManager:
         except RuntimeError as exc:
             logger.warning("Could not fast-forward _main/%s: %s", default_branch, exc)
 
-        # V5.4: branch_name is passed in (ai/{project_key}/{requirement_key} or ai/{workspace_key})
+        # branch_name is passed in (feature/{requirement_key} or feature/{workspace_key})
         # First check if the branch already exists on remote (for refine/continuation)
         branch_exists_remote = False
         try:
@@ -644,6 +786,11 @@ class WorkspaceManager:
                     except Exception:
                         ws_path.mkdir(parents=True, exist_ok=True)
                         await self._git("clone", repo_url, str(ws_path), project_key=project_key)
+                        # Ensure we're on the correct branch after clone
+                        try:
+                            await self._git("checkout", "-B", branch_name, cwd=ws_path)
+                        except RuntimeError:
+                            pass
         else:
             try:
                 await self._git(
@@ -661,6 +808,11 @@ class WorkspaceManager:
                     # Fallback to simple clone
                     ws_path.mkdir(parents=True, exist_ok=True)
                     await self._git("clone", repo_url, str(ws_path), project_key=project_key)
+                    # Ensure we're on the correct branch after clone
+                    try:
+                        await self._git("checkout", "-B", branch_name, cwd=ws_path)
+                    except RuntimeError:
+                        pass
 
         return ws_path
 
@@ -676,6 +828,7 @@ class WorkspaceManager:
         (clone, fetch, pull, push) will use GIT_SSH_COMMAND.
         """
         env = None
+        git_prefix_args: list[str] = []
         # Inject SSH key for commands that touch the remote
         remote_commands = {"clone", "fetch", "pull", "push"}
         if project_key and args and args[0] in remote_commands:
@@ -698,9 +851,20 @@ class WorkspaceManager:
                         os.close(fd)
                     except OSError:
                         pass
+            elif args[0] == "clone" and len(args) >= 2:
+                # Only use HTTP auth for HTTPS repos when no SSH key is configured.
+                repo_candidate = args[-2] if len(args) >= 3 else args[-1]
+                if isinstance(repo_candidate, str):
+                    parsed = urlparse(repo_candidate)
+                    if parsed.scheme in ("http", "https"):
+                        git_prefix_args = self._build_http_git_config_args(project_key)
+            elif args[0] in {"fetch", "pull", "push"}:
+                git_prefix_args = self._build_http_git_config_args(project_key)
+                if git_prefix_args:
+                    env = {**(env or os.environ), "GIT_TERMINAL_PROMPT": "0"}
 
         proc = await asyncio.create_subprocess_exec(
-            "git", *args,
+            "git", *git_prefix_args, *args,
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
             cwd=str(cwd) if cwd else None,
@@ -1553,6 +1717,8 @@ class HeartbeatService:
         self._task: asyncio.Task | None = None
         self._active_tasks = 0
         self._agents: list[dict] = []
+        self._on_success = lambda: None  # Callbacks set by ServerConnection
+        self._on_auth_failure = lambda: None
 
     def update(self, active_tasks: int, agents: list[dict]):
         self._active_tasks = active_tasks
@@ -1582,7 +1748,12 @@ class HeartbeatService:
                     },
                     timeout=10,
                 )
-                if resp.status_code != 200:
+                if resp.status_code == 200:
+                    self._on_success()
+                elif resp.status_code in (401, 403):
+                    logger.warning("Heartbeat auth failed: %s %s", resp.status_code, resp.text)
+                    self._on_auth_failure()
+                else:
                     logger.warning("Heartbeat failed: %s %s", resp.status_code, resp.text)
             except Exception as e:
                 logger.warning("Heartbeat error: %s", e)
@@ -1619,6 +1790,8 @@ class TaskPoller:
         self.server_url = server_url.rstrip("/")
         self.runtime_id = runtime_id
         self.interval = interval
+        self._on_success = lambda: None  # Callbacks set by ServerConnection
+        self._on_auth_failure = lambda: None
 
     async def poll(self) -> list[TaskInfo]:
         """Poll for tasks assigned to this daemon."""
@@ -1627,7 +1800,12 @@ class TaskPoller:
                 f"{self.server_url}/api/v1/runtimes/{self.runtime_id}/tasks/poll",
                 timeout=10,
             )
-            if resp.status_code != 200:
+            if resp.status_code == 200:
+                self._on_success()
+            elif resp.status_code in (401, 403):
+                self._on_auth_failure()
+                return []
+            else:
                 return []
 
             data = resp.json()
@@ -1680,13 +1858,57 @@ class ServerConnection:
         self.heartbeat: HeartbeatService | None = None
         self.poller: TaskPoller | None = None
         self.reporter: ProgressReporter | None = None
+        self._auth_failures = 0  # Consecutive auth failure count
+        self._max_auth_failures = 3  # Trigger re-registration after this many
         # Short label for logging
         from urllib.parse import urlparse
         parsed = urlparse(server_url)
         self.label = parsed.hostname or server_url
 
+    def refresh_token(self) -> bool:
+        """Re-read the user JWT from ~/.forgexa/token and update client headers.
+
+        Returns True if a new token was loaded (different from current).
+        """
+        token_path = Path.home() / ".forgexa" / "token"
+        try:
+            new_token = token_path.read_text().strip() if token_path.exists() else ""
+        except OSError:
+            new_token = ""
+
+        if new_token and new_token != self.api_token:
+            self.api_token = new_token
+            self.client.headers["Authorization"] = f"Bearer {new_token}"
+            logger.info("[%s] Refreshed daemon token from ~/.forgexa/token", self.label)
+            return True
+        return False
+
+    async def re_register(self, agents: list[DiscoveredAgent], max_concurrent: int):
+        """Refresh token and re-register with the server.
+
+        Called when persistent auth failures indicate stale token/hash.
+        After re-registration, update the runtime_id on heartbeat/poller/reporter
+        in case the server assigned a different one.
+        """
+        self.refresh_token()
+        try:
+            await self.register(agents, max_concurrent)
+            # Sync runtime_id to all services (may change after re-registration)
+            if self.heartbeat and self.runtime_id:
+                self.heartbeat.runtime_id = self.runtime_id
+            if self.poller and self.runtime_id:
+                self.poller.runtime_id = self.runtime_id
+            if self.reporter and self.runtime_id:
+                self.reporter.runtime_id = self.runtime_id
+            self._auth_failures = 0
+            logger.info("[%s] Re-registered successfully after token refresh", self.label)
+        except Exception as e:
+            logger.warning("[%s] Re-registration failed: %s", self.label, e)
+
     async def register(self, agents: list[DiscoveredAgent], max_concurrent: int):
         """Register this daemon with the server."""
+        self._agents = agents
+        self._max_concurrent_cache = max_concurrent
         agent_dicts = [
             {
                 "agent_id": a.agent_id,
@@ -1729,10 +1951,33 @@ class ServerConnection:
         agents: list[DiscoveredAgent],
     ):
         """Initialize heartbeat, poller, and reporter services."""
+        self._agents = agents
+        self._max_concurrent = getattr(self, '_max_concurrent_cache', 5)
+
+        def _on_auth_success():
+            self._auth_failures = 0
+
+        def _on_auth_failure():
+            self._auth_failures += 1
+            if self._auth_failures >= self._max_auth_failures:
+                logger.warning(
+                    "[%s] %d consecutive auth failures — scheduling re-registration",
+                    self.label, self._auth_failures,
+                )
+                # Schedule re-registration in the event loop (non-blocking)
+                try:
+                    loop = asyncio.get_event_loop()
+                    if loop.is_running():
+                        loop.create_task(self.re_register(self._agents, self._max_concurrent))
+                except Exception:
+                    pass
+
         self.heartbeat = HeartbeatService(
             self.client, self.server_url, self.runtime_id, self.daemon_id,
             heartbeat_interval,
         )
+        self.heartbeat._on_success = _on_auth_success
+        self.heartbeat._on_auth_failure = _on_auth_failure
         self.heartbeat.update(0, [
             {
                 "agent_id": a.agent_id,
@@ -1745,6 +1990,8 @@ class ServerConnection:
         self.poller = TaskPoller(
             self.client, self.server_url, self.runtime_id, poll_interval,
         )
+        self.poller._on_success = _on_auth_success
+        self.poller._on_auth_failure = _on_auth_failure
         self.reporter = ProgressReporter(
             self.client, self.server_url, self.runtime_id,
         )
@@ -1759,8 +2006,9 @@ class ServerConnection:
             await self.heartbeat.stop()
         if self.runtime_id:
             try:
-                await self.client.delete(
-                    f"{self.server_url}/api/v1/runtimes/{self.runtime_id}",
+                # Use deregister endpoint (no admin required) instead of DELETE
+                await self.client.post(
+                    f"{self.server_url}/api/v1/runtimes/{self.runtime_id}/deregister",
                     timeout=5,
                 )
             except Exception:
@@ -1791,6 +2039,14 @@ class RuntimeDaemon:
         self.daemon_id = settings.DAEMON_ID or self.hardware_id or platform.node()
         self.server_urls = settings.get_daemon_server_urls()
         self.api_token = settings.DAEMON_API_TOKEN
+        # If no explicit token, try user JWT from ~/.forgexa/token (written by `forgexa login`)
+        if not self.api_token:
+            token_path = Path.home() / ".forgexa" / "token"
+            try:
+                self.api_token = token_path.read_text().strip() if token_path.exists() else ""
+            except OSError:
+                self.api_token = ""
+        # _mint_local_dev_token() is called in start() if still empty
         self.max_concurrent = settings.DAEMON_MAX_CONCURRENT
         self.poll_interval = settings.DAEMON_POLL_INTERVAL
         self.heartbeat_interval = settings.DAEMON_HEARTBEAT_INTERVAL
@@ -1806,9 +2062,120 @@ class RuntimeDaemon:
         self.agent_discovery = AgentDiscovery()
         self.workspace_manager = WorkspaceManager(self.workspaces_root)
         self.process_manager = ProcessManager()
+        self._lock_file = None  # File lock to prevent multiple daemon instances
+
+    @staticmethod
+    async def _mint_local_dev_token() -> str:
+        """Mint a JWT for local development when no explicit token is configured.
+
+        Only works when running in-process with the backend package (``make daemon``).
+        Queries the first active user and creates a long-lived access token so the
+        runtime gets proper owner_id + organization_id assignment.
+        """
+        try:
+            from app.core.security import create_access_token
+            from app.database import engine
+            from datetime import timedelta
+            from sqlalchemy import text
+
+            async with engine.connect() as conn:
+                row = await conn.execute(
+                    text("SELECT id FROM users WHERE is_active = true ORDER BY created_at LIMIT 1")
+                )
+                r = row.first()
+                uid = str(r[0]) if r else None
+
+            if uid:
+                token = create_access_token({"sub": uid}, expires_delta=timedelta(days=30))
+                logger.info("Minted local-dev JWT for user %s (no DAEMON_API_TOKEN configured)", uid)
+                return token
+            logger.warning("No active users in database; cannot mint local-dev token")
+            return ""
+        except Exception as e:
+            logger.debug("Cannot mint local-dev token (standalone mode?): %s", e)
+            return ""
+
+    def _acquire_lock(self):
+        """Acquire an exclusive file lock to prevent multiple daemon instances.
+
+        If another daemon is already running, try to kill it and take over.
+        This handles orphaned processes from crashed desktop apps, duplicate
+        CLI starts, etc.
+        """
+        if fcntl is None:
+            # Windows: skip file locking (fcntl not available)
+            logger.info("File locking not available on this platform; skipping")
+            return
+
+        lock_path = Path.home() / ".forgexa" / "daemon" / "daemon.lock"
+        lock_path.parent.mkdir(parents=True, exist_ok=True)
+
+        self._lock_file = open(lock_path, "w")
+
+        try:
+            fcntl.flock(self._lock_file.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except (IOError, OSError):
+            # Lock held by another process — try to read its PID and kill it
+            try:
+                old_pid = int(lock_path.read_text().strip())
+                logger.warning("Another daemon is running (PID %d). Sending SIGTERM...", old_pid)
+                os.kill(old_pid, signal.SIGTERM)
+                # Wait up to 5 seconds for it to exit
+                for _ in range(50):
+                    try:
+                        os.kill(old_pid, 0)  # Check if still alive
+                        time.sleep(0.1)
+                    except ProcessLookupError:
+                        break
+                else:
+                    # Still alive after 5s — force kill
+                    logger.warning("Daemon PID %d did not exit, sending SIGKILL", old_pid)
+                    try:
+                        os.kill(old_pid, signal.SIGKILL)
+                        time.sleep(0.2)
+                    except ProcessLookupError:
+                        pass
+            except (ValueError, ProcessLookupError, FileNotFoundError, PermissionError):
+                pass
+
+            # Retry the lock
+            try:
+                fcntl.flock(self._lock_file.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except (IOError, OSError):
+                logger.error("Cannot acquire daemon lock — another instance may still be running")
+                raise SystemExit(1)
+
+        # Write our PID to the lock file for reference
+        self._lock_file.seek(0)
+        self._lock_file.truncate()
+        self._lock_file.write(str(os.getpid()))
+        self._lock_file.flush()
+        logger.info("Acquired exclusive daemon lock (pid=%d)", os.getpid())
+
+        # Also clean up CLI daemon PID file if it points to a dead process
+        cli_pid_file = Path.home() / ".forgexa-daemon.pid"
+        if cli_pid_file.exists():
+            try:
+                cli_pid = int(cli_pid_file.read_text().strip())
+                if cli_pid != os.getpid():
+                    os.kill(cli_pid, signal.SIGTERM)
+                    logger.info("Killed stale CLI daemon (PID %d)", cli_pid)
+            except (ValueError, ProcessLookupError):
+                pass
+            try:
+                cli_pid_file.unlink(missing_ok=True)
+            except OSError:
+                pass
 
     async def start(self):
         """Main entry point."""
+        # Prevent multiple daemon instances on the same machine
+        self._acquire_lock()
+
+        # Mint a local-dev token if no token is available yet
+        if not self.api_token:
+            self.api_token = await self._mint_local_dev_token()
+
         logger.info("Starting RuntimeDaemon (id=%s)", self.daemon_id)
         logger.info("Server URLs: %s", ", ".join(self.server_urls))
         logger.info("Workspaces root: %s", self.workspaces_root)
@@ -2097,7 +2464,10 @@ class RuntimeDaemon:
 
             # 5. Auto-commit and push if changes exist
             if result.status == "success":
-                await self._auto_commit(workspace_path, task)
+                commit_result = await self._auto_commit(workspace_path, task)
+                if commit_result:
+                    # Propagate push/commit errors in metrics so they're visible
+                    result.metrics.update(commit_result)
                 # Re-collect git info after commit (compare with parent)
                 post_commit_git = await self.process_manager._collect_git_info_vs_parent(workspace_path)
                 # Merge: use the pre-commit file list if post-commit is empty
@@ -2425,7 +2795,7 @@ class RuntimeDaemon:
             except Exception as e:
                 logger.warning("Failed to read analysis artifact %s: %s", fname, e)
 
-    async def _auto_commit(self, workspace_path: Path, task: TaskInfo):
+    async def _auto_commit(self, workspace_path: Path, task: TaskInfo) -> dict:
         """Auto-commit and push agent changes.
 
         Some agents (e.g. claude-code) commit changes internally, so we must
@@ -2436,6 +2806,8 @@ class RuntimeDaemon:
         merge conflicts.  If rebase fails (true conflict), we fall back to a
         merge.  If the merge also fails, we invoke the same AI agent to
         resolve the remaining conflicts automatically.
+
+        Returns a dict with commit/push status info (empty on success).
         """
         git = self.workspace_manager._git
         default_branch = task.project.get("default_branch", "main")
@@ -2506,11 +2878,35 @@ class RuntimeDaemon:
             # changes, dramatically reducing PR merge conflicts.
             await self._rebase_onto_latest(workspace_path, default_branch, task, project_key)
 
+            # ── Verify we're on the correct branch before pushing ──
+            current_branch = ""
+            try:
+                current_branch = (await git(
+                    "rev-parse", "--abbrev-ref", "HEAD", cwd=workspace_path,
+                )).strip()
+            except RuntimeError:
+                pass
+
+            expected_branch = ""
+            if task.requirement_key:
+                expected_branch = f"feature/{task.requirement_key}"
+            if current_branch == default_branch:
+                logger.error(
+                    "CRITICAL: About to push to default branch '%s' instead of "
+                    "feature branch '%s' — aborting push to prevent pollution",
+                    current_branch, expected_branch or "(unknown)",
+                )
+                return {"push_error": f"Would push to default branch {current_branch}"}
+
             # ── Push ──
-            await self._push_branch(workspace_path, project_key)
+            push_error = await self._push_branch(workspace_path, project_key)
+            if push_error:
+                return {"push_error": push_error}
+            return {}
 
         except Exception as e:
             logger.warning("Auto-commit failed: %s", e)
+            return {"commit_error": str(e)}
 
     async def _collect_staged_diff_stats(self, cwd: Path) -> dict:
         """Collect staged diff stats for building a rich commit message."""
@@ -2973,8 +3369,8 @@ class RuntimeDaemon:
             except RuntimeError:
                 await git("reset", "--hard", "HEAD", cwd=workspace_path)
 
-    async def _push_branch(self, workspace_path: Path, project_key: str = "default"):
-        """Push the current branch to origin."""
+    async def _push_branch(self, workspace_path: Path, project_key: str = "default") -> str | None:
+        """Push the current branch to origin. Returns error message on failure, None on success."""
         git = self.workspace_manager._git
         try:
             # Get current branch name
@@ -2999,11 +3395,14 @@ class RuntimeDaemon:
                         )
                         logger.info("Pushed branch %s to origin", branch)
                     except RuntimeError as exc:
-                        logger.warning("Push failed: %s", exc)
+                        logger.error("Push failed for branch %s: %s", branch, exc)
+                        return f"Push failed: {exc}"
                 else:
                     logger.info("No unpushed commits on %s", branch)
+            return None
         except Exception as e:
-            logger.warning("Push failed: %s", e)
+            logger.error("Push failed: %s", e)
+            return f"Push failed: {e}"
 
     def _agents_as_dicts(self) -> list[dict]:
         return [

{forgexa_cli-1.1.6 → forgexa_cli-1.2.2}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.1.6
+Version: 1.2.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT

{forgexa_cli-1.1.6 → forgexa_cli-1.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.1.6"
+version = "1.2.2"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = { text = "MIT" }