forgexa-cli 1.11.1__tar.gz → 1.11.3__tar.gz

{forgexa_cli-1.11.1 → forgexa_cli-1.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.11.1
+Version: 1.11.3
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT

{forgexa_cli-1.11.1 → forgexa_cli-1.11.3}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.11.1"
+__version__ = "1.11.3"

{forgexa_cli-1.11.1 → forgexa_cli-1.11.3}/forgexa_cli/daemon.py

@@ -360,7 +360,41 @@ except (ImportError, ModuleNotFoundError):
 
         @property
         def GIT_CLONE_TIMEOUT(self) -> int:
-            return int(os.environ.get("GIT_CLONE_TIMEOUT", "600"))
+            return int(os.environ.get("GIT_CLONE_TIMEOUT", "1800"))
+
+        @property
+        def GIT_FETCH_TIMEOUT(self) -> int:
+            """Timeout (seconds) for incremental git fetch operations.
+
+            Separate from GIT_CLONE_TIMEOUT because fetch on an existing repo must
+            download all accumulated delta objects since the last sync — this can
+            easily exceed 600 s for large active repos (e.g. HP SI develop branch).
+
+            Precedence:
+              1. GIT_FETCH_TIMEOUT env var (explicit override)
+              2. GIT_CLONE_TIMEOUT env var (backwards compat — if operator raised
+                 the clone timeout they likely want fetches to match)
+              3. 1800 s default (30 min — safe ceiling for large enterprise repos)
+            """
+            env_fetch = os.environ.get("GIT_FETCH_TIMEOUT")
+            if env_fetch:
+                return int(env_fetch)
+            env_clone = os.environ.get("GIT_CLONE_TIMEOUT")
+            if env_clone:
+                return int(env_clone)
+            return 1800
+
+        @property
+        def GIT_CLONE_FILTER(self) -> str:
+            """Optional partial-clone filter, e.g. 'blob:none' for blobless clones.
+
+            When set, git clone/fetch only downloads commits and trees — blobs are
+            fetched on demand during checkout.  This dramatically reduces clone and
+            incremental-fetch time on large repos.  Requires Git 2.22+ and a
+            compatible server (GitHub, GitLab, Bitbucket Server 7+).
+            Leave empty (default) to use a full clone.
+            """
+            return os.environ.get("GIT_CLONE_FILTER", "").strip()
 
         @property
         def AGENT_MAX_OUTPUT_SIZE(self) -> int:
@@ -404,7 +438,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.11.1"
+DAEMON_VERSION = "1.11.3"
 
 
 def _detect_client_type() -> str:
@@ -1047,6 +1081,12 @@ class WorkspaceManager:
         self._ssh_keys: dict[str, str] = {}  # project_key -> PEM key content
         self._http_auth: dict[str, dict[str, str]] = {}  # project_key -> provider/token/username
 
+        # Per-project asyncio locks: prevent concurrent _create_worktree calls for the
+        # same project from racing on _main (shutil.rmtree / git clone / worktree add).
+        # _worktree_locks_mu guards mutations of the dict itself.
+        self._worktree_locks: dict[str, asyncio.Lock] = {}
+        self._worktree_locks_mu: asyncio.Lock = asyncio.Lock()
+
         # One-time migration: move legacy project dirs from root/ to projects/
         self._migrate_legacy_project_dirs()
 
@@ -1273,20 +1313,63 @@ class WorkspaceManager:
                 await self._git("checkout", "-b", branch_name, cwd=ws_path)
             return ws_path
 
-    async def _is_healthy_worktree(self, ws_path: Path) -> bool:
-        """Check if a git worktree directory is valid and functional."""
+    async def _is_healthy_worktree(self, ws_path: Path, main_repo: Path | None = None) -> bool:
+        """Check if a git worktree directory is a valid *linked* worktree.
+
+        A linked git worktree has .git as a FILE containing a gitdir pointer to
+        main_repo/.git/worktrees/<name>.  A standalone clone has .git as a
+        DIRECTORY (the full object store) — that is NOT a linked worktree and
+        must not be treated as one, because:
+          • it may point to a different remote (e.g. Bitbucket fallback clone
+            while _main points to GitHub)
+          • the default_branch may differ between remotes (develop vs master)
+          • force-resetting it would leave the tree in a state where the entire
+            codebase appears as "changed" in the analysis commit diff
+        Returning False triggers removal + fresh worktree creation from _main.
+
+        When main_repo is provided, also verifies that the gitdir pointer is
+        inside main_repo/.git/worktrees/, rejecting foreign-repo worktrees
+        whose gitdir happens to exist but belongs to a different clone (L4 fix).
+        """
         git_file = ws_path / ".git"
         if not git_file.exists():
             return False
         if git_file.is_dir():
-            # It's a real .git directory (init'd repo), not a worktree
-            return True
+            # .git is a directory → standalone clone, NOT a linked worktree.
+            # Warn if the clone has uncommitted changes so the operator knows
+            # what will be lost when it is removed (L3 fix).
+            try:
+                st_proc = await asyncio.create_subprocess_exec(
+                    "git", "status", "--porcelain",
+                    cwd=str(ws_path),
+                    stdout=asyncio.subprocess.PIPE,
+                    stderr=asyncio.subprocess.PIPE,
+                )
+                st_out, _ = await asyncio.wait_for(st_proc.communicate(), timeout=10)
+                if st_proc.returncode == 0 and st_out.decode().strip():
+                    logger.warning(
+                        "Standalone clone at %s has uncommitted changes that WILL BE LOST "
+                        "when it is replaced by a linked worktree: %s",
+                        ws_path, st_out.decode().strip()[:300],
+                    )
+            except Exception:
+                pass
+            return False
         # Worktree: .git is a file containing "gitdir: /path/to/main/.git/worktrees/..."
         try:
             content = git_file.read_text().strip()
             if content.startswith("gitdir: "):
                 gitdir = Path(content.split("gitdir: ", 1)[1].strip())
-                return gitdir.exists()
+                if not gitdir.exists():
+                    return False
+                if main_repo is not None:
+                    # Reject gitdirs that point into a different repo's worktrees dir
+                    expected_wt_root = (main_repo / ".git" / "worktrees").resolve()
+                    try:
+                        gitdir.resolve().relative_to(expected_wt_root)
+                    except ValueError:
+                        return False
+                return True
         except OSError:
             pass
         return False
@@ -1307,6 +1390,47 @@ class WorkspaceManager:
         # Remove the broken worktree directory
         shutil.rmtree(ws_path, ignore_errors=True)
 
+    async def _safe_rmtree_main(self, main_repo: Path) -> None:
+        """Remove _main repo, first evicting all linked worktrees to prevent orphans.
+
+        A linked worktree's .git file contains «gitdir: <main>/.git/worktrees/<n>».
+        Deleting _main without first removing linked worktrees leaves those
+        directories with a dangling .git pointer — `_is_healthy_worktree` then
+        flags them broken and `_remove_broken_worktree` calls shutil.rmtree on
+        any active workspace, silently discarding uncommitted work.
+
+        Strategy:
+          1. Use git worktree list --porcelain to enumerate linked worktrees.
+          2. shutil.rmtree each linked worktree directory (excluding _main itself).
+          3. shutil.rmtree _main.
+        If git is unavailable (already corrupted), fall back to a directory scan.
+        """
+        import shutil as _shutil
+        if not main_repo.exists():
+            return
+        linked: list[Path] = []
+        try:
+            raw = await self._git("worktree", "list", "--porcelain", cwd=main_repo)
+            for line in raw.splitlines():
+                if line.startswith("worktree "):
+                    wt_path = Path(line.split(" ", 1)[1].strip())
+                    if wt_path != main_repo and wt_path.exists():
+                        linked.append(wt_path)
+        except Exception:
+            # Fallback: scan project_dir for sibling directories that look like
+            # linked worktrees (contain a .git file, not a .git directory).
+            project_dir = main_repo.parent
+            for child in project_dir.iterdir():
+                if child == main_repo or not child.is_dir():
+                    continue
+                git_file = child / ".git"
+                if git_file.is_file():  # linked worktree marker
+                    linked.append(child)
+        for wt in linked:
+            logger.info("Evicting linked worktree %s before deleting _main", wt)
+            _shutil.rmtree(wt, ignore_errors=True)
+        _shutil.rmtree(main_repo, ignore_errors=True)
+
     async def _detect_unrelated_histories(self, repo_path: Path, project_key: str) -> bool:
         """Detect whether local clone has diverged from remote due to history rewrite.
 
@@ -1315,14 +1439,20 @@ class WorkspaceManager:
         the old SHAs in its object store, making fetch/reset/merge fail in
         cryptic ways.
 
-        Strategy: ask git whether the local HEAD commit object is reachable in
-        the remote graph.  We use `git ls-remote` to get the remote HEAD SHA,
-        then check if that SHA exists locally.  If the remote HEAD does NOT
-        exist locally, histories are definitely unrelated.
-
-        Additionally, if the repo has a shallow marker but the remote default
-        branch has diverged past the shallow grafts, `git fetch` itself will
-        indicate problems.
+        Strategy:
+        1. Get the local HEAD SHA via ``git rev-parse HEAD``.
+        2. Guard against false positives: run ``git rev-list --count
+           --right-only origin...HEAD`` to count local-only (unpushed) commits.
+           If there are any local-only commits, the HEAD won't appear in remote
+           tracking branches — this is expected and NOT a history rewrite.
+        3. Run ``git branch -r --contains <local_head>`` to check whether the
+           local HEAD is reachable from any remote tracking branch.  If no
+           branch contains it (and there are no local-only commits), the
+           histories have diverged and this method returns True.
+
+        Note: ``git ls-remote`` is intentionally NOT used here because it
+        requires a network round-trip and we can determine divergence entirely
+        from the locally-cached remote-tracking refs.
         """
         try:
             # Get the local HEAD SHA
@@ -1339,26 +1469,69 @@ class WorkspaceManager:
             if not local_head:
                 return False
 
-            # Get the remote HEAD SHA via ls-remote (no network for local check)
-            # Try to see if the remote HEAD is in local object store
-            # If git cat-file -e <remote_sha> succeeds, remote HEAD is known locally
-            # (histories still share commits). Otherwise, fully diverged.
+            # Determine whether the local HEAD is reachable from any remote
+            # tracking branch.  We use `git branch -r --contains <local_head>`
+            # which lists remote tracking branches that contain that commit.
+            # If none, it's unrelated.
             #
-            # However, after a history rewrite the remote HEAD is a brand-new SHA,
-            # and the local object store only has old SHAs.  So we check the other
-            # direction: does the local HEAD exist on the remote at all?
-            # We use `git branch -r --contains <local_head>` which lists remote
-            # tracking branches that contain that commit.  If none, it's unrelated.
+            # IMPORTANT: before calling this check we first verify that the local HEAD
+            # is not a purely local (unpushed) commit.  A fresh feature-branch commit
+            # that has never been pushed will not appear in any remote tracking branch,
+            # which would produce a false "unrelated histories" verdict.  We detect
+            # local-only commits by comparing HEAD against the merge-base with the
+            # remote default branch; if HEAD itself IS the merge-base (or an ancestor),
+            # we are on the default branch tip and there are no local-only commits.
+            # If HEAD is ahead of the merge-base, we count local-only commits — any
+            # count > 0 means we should NOT call the branch-r check.
+            try:
+                ahead_proc = await asyncio.create_subprocess_exec(
+                    "git", "rev-list", "--count", "--right-only", "origin...HEAD",
+                    cwd=str(repo_path),
+                    stdout=asyncio.subprocess.PIPE,
+                    stderr=asyncio.subprocess.PIPE,
+                )
+                ahead_out, _ = await asyncio.wait_for(ahead_proc.communicate(), timeout=10)
+                if ahead_proc.returncode == 0:
+                    local_ahead = int(ahead_out.decode().strip() or "0")
+                    if local_ahead > 0:
+                        # There are commits in local HEAD that are not yet on any remote
+                        # tracking branch.  This is NOT a history-rewrite scenario.
+                        logger.debug(
+                            "_detect_unrelated_histories: %s has %d local-only commit(s) — "
+                            "skipping unrelated-history check to avoid false positive",
+                            repo_path, local_ahead,
+                        )
+                        return False
+            except Exception:
+                pass  # If the ahead count fails, proceed with the branch-r check
+
             check_proc = await asyncio.create_subprocess_exec(
                 "git", "branch", "-r", "--contains", local_head,
                 cwd=str(repo_path),
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
             )
-            out, _ = await asyncio.wait_for(check_proc.communicate(), timeout=10)
+            out, err = await asyncio.wait_for(check_proc.communicate(), timeout=10)
             if check_proc.returncode != 0:
-                # Command failed (e.g. invalid object) — history is broken
-                return True
+                # Distinguish genuine object-store corruption from transient
+                # command errors (permission denied, IO, etc.).
+                # Only treat the repo as broken if git explicitly reports a
+                # bad/unknown object; other errors are not diagnostic (L6 fix).
+                err_text = err.decode().lower()
+                if any(kw in err_text for kw in ("bad object", "unknown object", "not a valid object", "malformed")):
+                    logger.warning(
+                        "_detect_unrelated_histories: 'git branch -r --contains' reports broken "
+                        "object at %s: %s",
+                        repo_path, err.decode().strip()[:200],
+                    )
+                    return True
+                # Non-diagnostic error (IO, permissions, etc.) — safe to assume related
+                logger.warning(
+                    "_detect_unrelated_histories: 'git branch -r --contains' failed at %s "
+                    "(non-diagnostic, assuming related histories): %s",
+                    repo_path, err.decode().strip()[:200],
+                )
+                return False
             remote_branches = out.decode().strip()
             if not remote_branches:
                 # Local HEAD is not reachable from any remote branch — unrelated
@@ -1372,10 +1545,118 @@ class WorkspaceManager:
             pass
         return False
 
+    async def _branch_has_impl_commits(
+        self, ws_path: Path, branch_name: str, default_branch: str,
+    ) -> bool:
+        """Return True if the remote feature branch contains implementation commits.
+
+        An "implementation commit" is any commit whose message does NOT start with
+        a known analysis-phase prefix.  This distinguishes branches that only have
+        analysis documents (safe to reset on fresh re-analysis) from branches that
+        also carry design/coding/testing work (must never be reset).
+
+        Known analysis-only prefixes (case-insensitive):
+          • "analysis("  — auto-commit from analysis node
+          • "docs(analysis"  — conventional-commit form (docs(analysis): …)
+          • "cleanup: wipe analysis"  — pre-analysis directory wipe
+          • "chore(analysis)"  — normalised cleanup variant
+          • "initial commit"  — repo bootstrap commit (not implementation)
+
+        Any commit whose subject does not match one of these prefixes is treated as
+        an implementation commit (fail-safe: assume the worst to protect code).
+        """
+        _ANALYSIS_ONLY_PREFIXES = (
+            "analysis(",
+            "docs(analysis",
+            "cleanup: wipe analysis",
+            "chore(analysis)",
+            "refactor(analysis",
+            "style(analysis",
+            "test(analysis",
+            "ci(analysis",
+            "build(analysis",
+            "revert(analysis",
+            "initial commit",
+        )
+        try:
+            raw = await self._git(
+                "log", "--format=%s",
+                f"origin/{default_branch}..origin/{branch_name}",
+                cwd=ws_path,
+            )
+        except RuntimeError:
+            # Cannot determine — assume implementation commits exist (fail-safe).
+            return True
+
+        subjects = [line.strip() for line in raw.splitlines() if line.strip()]
+        if not subjects:
+            return False  # No commits ahead of default branch
+
+        for subject in subjects:
+            lower = subject.lower()
+            if not any(lower.startswith(p) for p in _ANALYSIS_ONLY_PREFIXES):
+                return True  # Found at least one implementation commit
+
+        # All subjects look analysis-only.  Do a secondary full-body scan as a
+        # safety net: some agents write the analysis subject but add implementation
+        # markers (feat:, fix:, etc.) in the commit body paragraphs (L2 fix).
+        _IMPL_BODY_PREFIXES = (
+            "feat(", "feat:",
+            "fix(", "fix:",
+            "refactor(", "perf(", "perf:",
+        )
+        try:
+            raw_body = await self._git(
+                "log", "--format=---GITCOMMIT---%n%B",
+                f"origin/{default_branch}..origin/{branch_name}",
+                cwd=ws_path,
+            )
+            for commit_block in raw_body.split("---GITCOMMIT---"):
+                lines = [l.strip() for l in commit_block.splitlines() if l.strip()]
+                # Skip first non-empty line (subject — already checked above)
+                for line in lines[1:]:
+                    lower_line = line.lower()
+                    for pfx in _IMPL_BODY_PREFIXES:
+                        if lower_line.startswith(pfx) and "(analysis" not in lower_line:
+                            logger.debug(
+                                "_branch_has_impl_commits: impl marker '%s' found in commit "
+                                "body of %s/%s", pfx, ws_path, branch_name,
+                            )
+                            return True
+        except RuntimeError:
+            pass  # Body scan failed; trust subject-only result
+
+        return False  # All commits are analysis-only
+
+    async def _get_project_lock(self, project_dir: Path) -> asyncio.Lock:
+        """Return (creating if needed) the per-project asyncio.Lock for _create_worktree."""
+        key = str(project_dir)
+        async with self._worktree_locks_mu:
+            if key not in self._worktree_locks:
+                self._worktree_locks[key] = asyncio.Lock()
+            return self._worktree_locks[key]
+
     async def _create_worktree(
         self, project_dir: Path, repo_url: str, default_branch: str,
         workspace_key: str, branch_name: str, *, fresh_start: bool = False,
         project_key: str = "default", expect_branch: bool = False,
+    ) -> Path:
+        # Serialize all _create_worktree calls for the same project to prevent
+        # concurrent tasks from racing on _main (shutil.rmtree / git clone / worktree add).
+        project_lock = await self._get_project_lock(project_dir)
+        async with project_lock:
+            return await self._create_worktree_impl(
+                project_dir, repo_url, default_branch,
+                workspace_key, branch_name,
+                fresh_start=fresh_start,
+                project_key=project_key,
+                expect_branch=expect_branch,
+            )
+
+    async def _create_worktree_impl(
+        self, project_dir: Path, repo_url: str, default_branch: str,
+        workspace_key: str, branch_name: str, *, fresh_start: bool = False,
+        project_key: str = "default", expect_branch: bool = False,
     ) -> Path:
         main_repo = project_dir / "_main"
         ws_path = project_dir / workspace_key
@@ -1383,7 +1664,7 @@ class WorkspaceManager:
         if ws_path.exists():
             # Validate that this worktree is healthy (its .git file points to a
             # valid main repo).  Worktrees break when directories are moved.
-            if not await self._is_healthy_worktree(ws_path):
+            if not await self._is_healthy_worktree(ws_path, main_repo=main_repo):
                 logger.warning("Broken worktree detected at %s — removing and recreating", ws_path)
                 await self._remove_broken_worktree(main_repo, ws_path, workspace_key)
             else:
@@ -1394,7 +1675,8 @@ class WorkspaceManager:
                 # origin/{branch_name} is available for checkout/reset.
                 _last_sync_err: str = ""
                 try:
-                    await self._git("fetch", "origin", cwd=ws_path, project_key=project_key)
+                    await self._git("fetch", "origin", cwd=ws_path,
+                                    timeout=settings.GIT_FETCH_TIMEOUT, project_key=project_key)
                 except RuntimeError as _pre_fe:
                     logger.warning(
                         "fetch origin failed for worktree %s: %s "
@@ -1402,11 +1684,12 @@ class WorkspaceManager:
                         ws_path, _pre_fe,
                     )
                     _last_sync_err = str(_pre_fe)[:300]
+                _branch_fetch_ok = True
                 try:
                     await self._git(
                         "fetch", "origin",
                         f"{branch_name}:refs/remotes/origin/{branch_name}",
-                        cwd=ws_path, project_key=project_key,
+                        cwd=ws_path, timeout=settings.GIT_FETCH_TIMEOUT, project_key=project_key,
                     )
                 except RuntimeError as _pre_fe2:
                     logger.warning(
@@ -1415,15 +1698,36 @@ class WorkspaceManager:
                         branch_name, ws_path, _pre_fe2,
                     )
                     _last_sync_err = str(_pre_fe2)[:300]
+                    _branch_fetch_ok = False
+
+                if fresh_start and not _branch_fetch_ok:
+                    # Cannot determine remote branch state — prohibit reset to avoid
+                    # silently destroying implementation commits that exist on the remote
+                    # but could not be fetched (auth/network failure).  Conservative
+                    # stance: treat unverified state as "has implementation work".
+                    logger.warning(
+                        "Fresh start blocked for %s: branch fetch failed (%s) — "
+                        "remote state unknown, refusing to reset to avoid data loss",
+                        branch_name, _last_sync_err[:200],
+                    )
+                    fresh_start = False
 
                 if fresh_start:
-                    # Safety check: if the branch already exists on remote with
-                    # commits beyond the default branch, do NOT reset to
-                    # origin/default_branch — that would destroy prior work.
-                    # This guards against accidental branch destruction when
-                    # analysis_mode is incorrectly set to "fresh" for
-                    # verification or iterative nodes.
-                    branch_has_remote_commits = False
+                    # Safety check: if the branch already has IMPLEMENTATION commits
+                    # beyond the default branch, do NOT reset to origin/default_branch
+                    # — that would destroy prior design/coding/testing work.
+                    #
+                    # Previous behaviour blocked the reset whenever *any* remote commit
+                    # existed, including analysis-only commits (PRD.md, cleanup wipes).
+                    # That was overly conservative: a branch whose only commits are
+                    # analysis documents is safe to reset for a fresh re-analysis
+                    # because no code has been written yet.
+                    #
+                    # The new check distinguishes:
+                    #   • analysis-only commits → safe to reset → allow fresh start
+                    #   • implementation commits (design/coding/testing) → block reset
+                    branch_has_impl = False
+                    ahead_count = 0
                     try:
                         result = await self._git(
                             "rev-list", "--count",
@@ -1431,19 +1735,30 @@ class WorkspaceManager:
                             cwd=ws_path,
                         )
                         ahead_count = int(result.strip()) if result.strip() else 0
-                        branch_has_remote_commits = ahead_count > 0
                     except (RuntimeError, ValueError):
                         pass  # Branch may not exist on remote yet
 
-                    if branch_has_remote_commits:
+                    if ahead_count > 0:
+                        branch_has_impl = await self._branch_has_impl_commits(
+                            ws_path, branch_name, default_branch,
+                        )
+
+                    if branch_has_impl:
                         logger.warning(
-                            "Fresh start requested for %s but remote branch has %d commit(s) "
-                            "ahead of %s — switching to safe sync instead of resetting to "
-                            "avoid destroying prior work",
-                            branch_name, ahead_count, default_branch,
+                            "Fresh start requested for %s but remote branch has implementation "
+                            "commit(s) ahead of %s — switching to safe sync to avoid "
+                            "destroying prior implementation work",
+                            branch_name, default_branch,
                         )
                         # Override: fall through to the non-fresh sync path
                         fresh_start = False
+                    elif ahead_count > 0:
+                        # Branch has commits but they are all analysis-only (safe to reset).
+                        logger.info(
+                            "Fresh start for %s: remote branch has %d analysis-only commit(s) "
+                            "ahead of %s — resetting is safe (no implementation work present)",
+                            branch_name, ahead_count, default_branch,
+                        )
 
                 if fresh_start:
                     logger.info("Fresh start: resetting %s to origin/%s", ws_path, default_branch)
@@ -1561,7 +1876,7 @@ class WorkspaceManager:
                                     ws_path,
                                 )
                                 await self._remove_broken_worktree(main_repo, ws_path, workspace_key)
-                                shutil.rmtree(main_repo, ignore_errors=True)
+                                await self._safe_rmtree_main(main_repo)
                                 raise RuntimeError(
                                     f"Repository history was rewritten (e.g. large-file cleanup). "
                                     f"Stale local clone discarded. "
@@ -1602,39 +1917,79 @@ class WorkspaceManager:
         if not main_repo.exists():
             await self._git(
                 "clone", "--single-branch", "--no-tags",
+                "--branch", default_branch,
                 repo_url, str(main_repo), timeout=settings.GIT_CLONE_TIMEOUT, project_key=project_key,
             )
         else:
-            # Use targeted fetch instead of --all to avoid pulling every branch/tag
-            # from potentially large repos (avoids 300s timeout on big repos).
-            # Fetch default branch only; the feature branch is explicitly fetched below.
+            # Before fetching, verify _main has a valid HEAD and at least one ref.
+            # An interrupted initial clone (killed by the old 600 s timeout or
+            # SIGKILL) leaves HEAD pointing to refs/heads/.invalid with no
+            # packed-refs.  In that state `git fetch` adds objects to the pack
+            # but never sets up branch refs, so `git worktree add` always fails.
+            # Detect this by running `git rev-parse HEAD`; failure means the
+            # repo is unusable and must be deleted and re-cloned from scratch.
+            _main_broken = False
             try:
-                await self._git(
-                    "fetch", "origin", default_branch,
-                    cwd=main_repo, timeout=settings.GIT_CLONE_TIMEOUT, project_key=project_key,
+                await self._git("rev-parse", "HEAD", cwd=main_repo)
+                # Also verify the commit object itself is readable (not just the ref).
+                # An interrupted clone can write a valid HEAD ref but leave pack files
+                # truncated — rev-parse HEAD succeeds (reads the ref) but HEAD^{tree}
+                # fails (requires the commit object to be intact).
+                await self._git("rev-parse", "HEAD^{tree}", cwd=main_repo)
+            except RuntimeError:
+                _main_broken = True
+            if _main_broken:
+                logger.warning(
+                    "_main repo at %s has no valid HEAD (likely interrupted initial clone) "
+                    "— deleting and re-cloning from scratch",
+                    main_repo,
                 )
-            except RuntimeError as _fetch_err:
-                err_str = str(_fetch_err)
-                # Detect "unrelated histories" / history-rewrite scenarios:
-                # If the remote history was rewritten (e.g. BFG large-file removal),
-                # all commit SHAs change. The local clone becomes incompatible —
-                # fetch may succeed but the local refs are orphaned and unusable.
-                # Detection: check whether local HEAD exists in the remote graph.
-                is_unrelated = await self._detect_unrelated_histories(main_repo, project_key)
-                if is_unrelated or "not our ref" in err_str or "shallow" in err_str:
-                    logger.warning(
-                        "Detected repository history mismatch for %s (remote history likely "
-                        "rewritten). Discarding stale local clone and re-cloning from scratch.",
-                        main_repo,
-                    )
-                    shutil.rmtree(main_repo, ignore_errors=True)
+                await self._safe_rmtree_main(main_repo)
+                try:
                     await self._git(
                         "clone", "--single-branch", "--no-tags",
-                        repo_url, str(main_repo), timeout=settings.GIT_CLONE_TIMEOUT,
-                        project_key=project_key,
+                        "--branch", default_branch,
+                        repo_url, str(main_repo), timeout=settings.GIT_CLONE_TIMEOUT, project_key=project_key,
                     )
-                else:
+                except Exception:
+                    shutil.rmtree(main_repo, ignore_errors=True)
                     raise
+                # Use targeted fetch instead of --all to avoid pulling every branch/tag
+                # from potentially large repos.  Use GIT_FETCH_TIMEOUT (default 1800 s)
+                # rather than GIT_CLONE_TIMEOUT: accumulated delta objects on an active
+                # large repo (e.g. HP SI develop) easily exceed the 600 s clone timeout.
+                try:
+                    await self._git(
+                        "fetch", "origin", default_branch,
+                        cwd=main_repo, timeout=settings.GIT_FETCH_TIMEOUT, project_key=project_key,
+                    )
+                except RuntimeError as _fetch_err:
+                    err_str = str(_fetch_err)
+                    # Detect "unrelated histories" / history-rewrite scenarios:
+                    # If the remote history was rewritten (e.g. BFG large-file removal),
+                    # all commit SHAs change. The local clone becomes incompatible —
+                    # fetch may succeed but the local refs are orphaned and unusable.
+                    # Detection: check whether local HEAD exists in the remote graph.
+                    is_unrelated = await self._detect_unrelated_histories(main_repo, project_key)
+                    if is_unrelated or "not our ref" in err_str or "shallow" in err_str:
+                        logger.warning(
+                            "Detected repository history mismatch for %s (remote history likely "
+                            "rewritten). Discarding stale local clone and re-cloning from scratch.",
+                            main_repo,
+                        )
+                        await self._safe_rmtree_main(main_repo)
+                        try:
+                            await self._git(
+                                "clone", "--single-branch", "--no-tags",
+                                "--branch", default_branch,
+                                repo_url, str(main_repo), timeout=settings.GIT_CLONE_TIMEOUT,
+                                project_key=project_key,
+                            )
+                        except Exception:
+                            shutil.rmtree(main_repo, ignore_errors=True)
+                            raise
+                    else:
+                        raise
 
         # --single-branch clone only fetches the default branch.
         # Explicitly fetch the feature branch so origin/{branch_name}
@@ -1881,6 +2236,16 @@ class WorkspaceManager:
                 if git_prefix_args:
                     env = {**(env or os.environ), "GIT_TERMINAL_PROMPT": "0"}
 
+        # Apply optional partial-clone filter for large-repo support.
+        # Injecting here centralises the setting across all call sites: callers
+        # only need "clone" in args; the filter (e.g. "blob:none") is appended
+        # automatically when GIT_CLONE_FILTER is configured.
+        _clone_filter = getattr(settings, "GIT_CLONE_FILTER", "")
+        if args and args[0] == "clone" and _clone_filter:
+            # Insert --filter=<filter> immediately after "clone" so that
+            # remaining args (--single-branch, URL, dir) stay in their expected order.
+            args = (args[0], f"--filter={_clone_filter}") + args[1:]
+
         # Always enable long-path support.  On Windows this removes git's own
         # 260-char path limit (Windows also needs HKLM LongPathsEnabled=1 or
         # the Win10 1607+ Group Policy, but at a minimum we ensure git won't
@@ -2077,6 +2442,19 @@ class ProcessManager:
         "apiexception:",
         "api error: 5",   # 5xx errors like "API error: 503", "API error: 502"
         "api error: connection",
+        # Kimi Code 0.18.0 auth/model errors.
+        # Kimi Code 0.18.0 streams error text character-by-character with the
+        # model name "kimi-for-coding" prepended to each char, producing a
+        # garbled string.  After stripping those tokens the real message is
+        # "Not found the model  or Permission denied".  We match:
+        # a) the raw garbled prefix pattern (first few chars: "kimi-for-codingN")
+        # b) the decoded phrases (produced by our degarble helper in _run_kimi_code)
+        # c) the Kimi SDK error prefix "provider.api_error"
+        # d) our own pre-flight "kimi authentication required" sentinel
+        "kimi-for-codingnkimi-for-coding",  # garbled "Not" in 404 response
+        "not found the model",              # decoded Kimi 404 body
+        "provider.api_error",               # Kimi SDK error prefix
+        "kimi authentication required",     # pre-flight oauth check sentinel
     ]
 
     def __init__(self):
@@ -3046,11 +3424,50 @@ class ProcessManager:
         We therefore stream stderr through ``on_chunk`` so the user sees
         output in real time instead of a blank panel until process exit.
         """
+        # ── Pre-flight: verify Kimi Code auth is configured ──────────────────
+        # Kimi Code changed its on-disk auth storage in 0.18.0:
+        #   - legacy:  $KIMI_CODE_HOME/oauth/kimi-code
+        #   - current: $KIMI_CODE_HOME/credentials/kimi-code.json
+        # The legacy oauth file can now legitimately remain empty while the
+        # credentials JSON contains valid bearer/refresh tokens.  Be
+        # conservative: only fail fast when BOTH known stores are missing or
+        # empty.  Otherwise let the CLI decide, and rely on the decoded
+        # provider.api_error handling below if the server still rejects the
+        # credentials.
+        kimi_home = Path(os.environ.get("KIMI_CODE_HOME", Path.home() / ".kimi-code"))
+        auth_ok, auth_detail = self._get_kimi_auth_state(kimi_home)
+        if not auth_ok:
+            credentials_file = kimi_home / "credentials" / "kimi-code.json"
+            oauth_file = kimi_home / "oauth" / "kimi-code"
+            logger.warning(
+                "Kimi Code auth not configured (%s); skipping Kimi Code and "
+                "triggering agent fallback. Run 'kimi' in a terminal to log in.",
+                auth_detail,
+            )
+            return TaskResult(
+                status="failed", exit_code=-1, stdout="", stderr="",
+                error=(
+                    "Kimi authentication required: no usable auth state was found under "
+                    f"{credentials_file} or {oauth_file} ({auth_detail}). Please run "
+                    "'kimi' in a terminal and log in, then retry the task."
+                ),
+            )
+
         cmd = [agent.command, "-p", prompt]
         result = await self._run_cli(
             cmd, cwd, timeout, task_id, on_chunk=on_chunk,
             stream_stderr=True,
         )
+
+        # ── Post-run: degarble Kimi Code 0.18.0 error messages ───────────────
+        # Kimi Code 0.18.0 has a bug where it streams 404/auth error text
+        # character-by-character, prepending the model name "kimi-for-coding"
+        # before every character.  The resulting output is unreadable.
+        # Strip those tokens to expose the real error message so that:
+        #   (a) humans can read it in the UI
+        #   (b) AGENT_UNAVAILABLE_PATTERNS can match "not found the model"
+        result = self._degarble_kimi_error(result)
+
         parsed_metrics = self._parse_agent_jsonl_output(result.stdout)
         result.metrics.update(parsed_metrics)
         # Kimi 0.18.0+ stores token usage in the session wire.jsonl file,
@@ -3062,6 +3479,91 @@ class ProcessManager:
                 result.metrics.update(wire_metrics)
         return result
 
+    @staticmethod
+    def _get_kimi_auth_state(kimi_home: Path) -> tuple[bool, str]:
+        """Return whether Kimi Code appears authenticated on disk.
+
+        Kimi Code has used two storage layouts:
+        - legacy oauth token file: ``oauth/kimi-code``
+        - current credential cache: ``credentials/kimi-code.json``
+
+        The 0.18.0 release may leave the legacy oauth file empty even when the
+        CLI is fully authenticated, so checking only that file creates false
+        negatives.  This pre-flight helper therefore errs on the side of not
+        blocking execution:
+
+        - any non-empty legacy oauth file counts as configured
+        - any non-empty credentials JSON counts as configured
+        - if the JSON is parseable and exposes ``access_token`` or
+          ``refresh_token``, include that in the detail for debugging
+        - only return ``False`` when both known stores are absent or empty
+        """
+        credentials_file = kimi_home / "credentials" / "kimi-code.json"
+        oauth_file = kimi_home / "oauth" / "kimi-code"
+
+        if credentials_file.exists() and credentials_file.stat().st_size > 0:
+            try:
+                payload = json.loads(credentials_file.read_text())
+            except Exception:
+                return True, f"non-empty credentials file {credentials_file}"
+
+            if any(str(payload.get(key, "")).strip() for key in ("access_token", "refresh_token")):
+                return True, f"token fields present in {credentials_file}"
+            return True, f"non-empty credentials file {credentials_file}"
+
+        if oauth_file.exists() and oauth_file.stat().st_size > 0:
+            return True, f"legacy oauth token present in {oauth_file}"
+
+        problems: list[str] = []
+        if not credentials_file.exists():
+            problems.append(f"missing {credentials_file}")
+        elif credentials_file.stat().st_size == 0:
+            problems.append(f"empty {credentials_file}")
+        if not oauth_file.exists():
+            problems.append(f"missing {oauth_file}")
+        elif oauth_file.stat().st_size == 0:
+            problems.append(f"empty {oauth_file}")
+        return False, "; ".join(problems)
+
+    @staticmethod
+    def _degarble_kimi_error(result: "TaskResult") -> "TaskResult":
+        """Strip Kimi Code 0.18.0 character-level model-name interleaving from errors.
+
+        Kimi Code 0.18.0 has a bug where API error response text is emitted as
+        a character-by-character SSE stream, with the model identifier
+        ("kimi-for-coding") prepended to every character.  The result looks
+        like::
+
+            provider.api_error: 404 kimi-for-codingNkimi-for-codingokimi-for-coding…
+
+        Stripping "kimi-for-coding" from that string yields the readable message::
+
+            provider.api_error: 404 Not found the model  or Permission denied
+
+        We apply this only when the garble signature is present in stderr or
+        error to avoid mutating normal successful output.
+        """
+        def _clean(text: str | None) -> str | None:
+            # Real 0.18.0 failures interleave the model name before nearly
+            # every character, e.g. ``kimi-for-codingN`` ``kimi-for-codingo``.
+            # Counting repeated model-name tokens is more robust than a strict
+            # regex because the stream can contain spaces/newlines between
+            # individual characters.
+            if not text or text.count("kimi-for-coding") < 2:
+                return text
+            cleaned = text.replace("kimi-for-coding", "")
+            logger.debug("Degarbled Kimi error output: %r → %r", text[:120], cleaned[:120])
+            return cleaned
+
+        stderr_clean = _clean(result.stderr)
+        error_clean = _clean(result.error)
+        if stderr_clean is result.stderr and error_clean is result.error:
+            return result  # nothing changed
+        # TaskResult is a non-frozen dataclass — mutate fields in place
+        result.stderr = stderr_clean or result.stderr
+        result.error = error_clean or result.error
+        return result
+
     async def _run_copilot(
         self, agent: DiscoveredAgent, prompt: str, cwd: Path, timeout: int, task_id: str,
         on_chunk: Any = None,
@@ -4819,12 +5321,23 @@ class RuntimeDaemon:
                 output_dir_norm = str(output_dir_raw).replace("\\", "/").lstrip("./").rstrip("/")
                 if output_dir_norm:
                     dir_to_wipe = workspace_path / output_dir_norm
-                    if dir_to_wipe.is_dir():
+                    # Guard against path-traversal: resolved path must remain
+                    # inside the workspace (e.g. "docs/../../.." would escape).
+                    try:
+                        if not dir_to_wipe.resolve().is_relative_to(workspace_path.resolve()):
+                            logger.warning(
+                                "wipe_analysis_dir path %r resolves outside workspace %s — skipping",
+                                output_dir_norm, workspace_path,
+                            )
+                            dir_to_wipe = None
+                    except Exception:
+                        dir_to_wipe = None
+                    if dir_to_wipe and dir_to_wipe.is_dir():
                         existing_files = [f for f in dir_to_wipe.iterdir() if f.is_file()]
                         if existing_files:
                             try:
                                 # Stage all deletions with git rm
-                                await self._git(
+                                await self.workspace_manager._git(
                                     "rm", "-r", "--cached", "--ignore-unmatch",
                                     output_dir_norm,
                                     cwd=workspace_path,
@@ -4833,7 +5346,7 @@ class RuntimeDaemon:
                                 shutil.rmtree(str(dir_to_wipe), ignore_errors=True)
                                 # Commit the wipe so the branch diff is clean
                                 _git_name, _git_email = _resolve_git_author(task.project)
-                                await self._git(
+                                await self.workspace_manager._git(
                                     "-c", f"user.name={_git_name}",
                                     "-c", f"user.email={_git_email}",
                                     "commit", "-m",
@@ -4844,12 +5357,20 @@ class RuntimeDaemon:
                                     "Wiped %d analysis doc(s) from %s for task %s (fresh analysis)",
                                     len(existing_files), output_dir_norm, task.task_id,
                                 )
-                            except Exception:
-                                logger.warning(
-                                    "Could not wipe analysis dir %s for task %s "
-                                    "(proceeding anyway — agent will overwrite)",
-                                    output_dir_norm, task.task_id, exc_info=True,
+                            except Exception as _wipe_err:
+                                # Wipe failure on a fresh analysis is not safe to ignore:
+                                # stale analysis docs could contaminate the new analysis
+                                # (agent may treat them as context and refine instead of
+                                # regenerating from scratch).  Abort this task so the
+                                # orchestrator can retry on a clean workspace.
+                                logger.error(
+                                    "Failed to wipe analysis dir %s for task %s — "
+                                    "aborting to avoid stale-file contamination: %s",
+                                    output_dir_norm, task.task_id, _wipe_err, exc_info=True,
                                 )
+                                raise RuntimeError(
+                                    f"wipe_analysis_dir failed for {output_dir_norm}: {_wipe_err}"
+                                ) from _wipe_err
                         else:
                             logger.debug(
                                 "Analysis dir %s is already empty for task %s",
@@ -5441,8 +5962,8 @@ class RuntimeDaemon:
                         if not intents:
                             issues.append("test-intent.json contains no test intents")
                         for ti in intents[:20]:
-                            if not ti.get("id") or not ti.get("title"):
-                                issues.append(f"Test intent missing 'id' or 'title': {ti.get('id', '?')}")
+                            if not ti.get("id") or not (ti.get("title") or ti.get("description")):
+                                issues.append(f"Test intent missing 'id' or 'title'/'description': {ti.get('id', '?')}")
                                 break
                     except _json.JSONDecodeError as e:
                         issues.append(f"test-intent.json is not valid JSON: {e}")
@@ -6511,14 +7032,19 @@ class RuntimeDaemon:
         branch: str,
         project_key: str = "default",
         *,
-        timeout: int = 120,
+        timeout: int | None = None,
     ) -> None:
-        """Refresh origin/<branch> explicitly, even inside single-branch clones."""
+        """Refresh origin/<branch> explicitly, even inside single-branch clones.
+
+        Defaults to GIT_FETCH_TIMEOUT so that large active repos (e.g. HP SI)
+        don't hit a hard 120 s ceiling on per-branch incremental fetches.
+        """
+        _timeout = timeout if timeout is not None else settings.GIT_FETCH_TIMEOUT
         await self.workspace_manager._git(
             "fetch", "origin",
             f"{branch}:refs/remotes/origin/{branch}",
             cwd=workspace_path,
-            timeout=timeout,
+            timeout=_timeout,
             project_key=project_key,
         )
 
@@ -7076,7 +7602,8 @@ class RuntimeDaemon:
 
         # Fetch latest remote state
         try:
-            await git("fetch", "origin", cwd=workspace_path, timeout=300, project_key=project_key)
+            await git("fetch", "origin", cwd=workspace_path,
+                      timeout=settings.GIT_FETCH_TIMEOUT, project_key=project_key)
         except RuntimeError as exc:
             logger.warning("Pre-push fetch failed: %s — skipping integration", exc)
             return
@@ -7346,7 +7873,7 @@ class RuntimeDaemon:
                         workspace_path,
                         branch,
                         project_key,
-                        timeout=300,
+                        # timeout omitted — defaults to GIT_FETCH_TIMEOUT
                     )
                 except RuntimeError as _pre_push_fetch_exc:
                     logger.warning(
@@ -7415,6 +7942,7 @@ class RuntimeDaemon:
                                 await git(
                                     "push", "--force-with-lease", "-u", "origin", branch,
                                     cwd=workspace_path, project_key=project_key,
+                                    timeout=settings.GIT_PUSH_TIMEOUT,
                                 )
                                 logger.info("Force-pushed (with lease) branch %s to origin", branch)
                                 return None
@@ -7477,6 +8005,7 @@ class RuntimeDaemon:
                                         await git(
                                             "push", "-u", "origin", branch,
                                             cwd=workspace_path, project_key=project_key,
+                                            timeout=settings.GIT_PUSH_TIMEOUT,
                                         )
                                         logger.info(
                                             "Recovery push succeeded for branch %s "
@@ -7527,6 +8056,7 @@ class RuntimeDaemon:
                                 await git(
                                     "push", "-u", "origin", branch,
                                     cwd=workspace_path, project_key=project_key,
+                                    timeout=settings.GIT_PUSH_TIMEOUT,
                                 )
                                 logger.info(
                                     "Fetch+rebase recovery succeeded for branch %s "
@@ -7554,6 +8084,7 @@ class RuntimeDaemon:
                                     await git(
                                         "push", "--force-with-lease", "-u", "origin", branch,
                                         cwd=workspace_path, project_key=project_key,
+                                        timeout=settings.GIT_PUSH_TIMEOUT,
                                     )
                                     logger.info(
                                         "Force-with-lease fallback push succeeded for branch %s",
@@ -7581,6 +8112,7 @@ class RuntimeDaemon:
                             await git(
                                 "push", "-u", "origin", branch,
                                 cwd=workspace_path, project_key=project_key,
+                                timeout=settings.GIT_PUSH_TIMEOUT,
                             )
                             logger.info("Pushed branch %s to origin (attempt %d)", branch, attempt)
                             last_push_exc = None

{forgexa_cli-1.11.1 → forgexa_cli-1.11.3}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.11.1
+Version: 1.11.3
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT

{forgexa_cli-1.11.1 → forgexa_cli-1.11.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.11.1"
+version = "1.11.3"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = { text = "MIT" }