forgexa-cli 1.14.10__tar.gz → 1.15.0__tar.gz

{forgexa_cli-1.14.10 → forgexa_cli-1.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.14.10
+Version: 1.15.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT

{forgexa_cli-1.14.10 → forgexa_cli-1.15.0}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.14.10"
+__version__ = "1.15.0"

{forgexa_cli-1.14.10 → forgexa_cli-1.15.0}/forgexa_cli/daemon.py

@@ -523,7 +523,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.14.10"
+DAEMON_VERSION = "1.15.0"
 
 
 def _detect_client_type() -> str:
@@ -939,6 +939,27 @@ def _daemon_extract_claude_output(raw: str) -> str:
     return raw
 
 
+# OpenCode requires v1.4.0+ for --dangerously-skip-permissions (added 2026-04-08).
+# Without it, headless opencode run blocks on permission prompts and exits with code 1.
+_OPENCODE_MIN_VERSION = (1, 4, 0)
+
+
+def _parse_semver(v: str) -> "tuple[int, int, int] | None":
+    """Parse a semver string into a comparable (major, minor, patch) tuple.
+
+    Strips a leading 'v' and ignores pre-release/build suffixes so that
+    '1.4.0-beta.1' and 'v1.4.0' both return (1, 4, 0).
+    Returns None when the string cannot be parsed (e.g. 'unknown', 'latest'),
+    so callers can skip the version check rather than erroneously rejecting
+    a valid agent whose version string is non-standard.
+    """
+    import re as _re
+    m = _re.match(r"^v?(\d+)\.(\d+)\.(\d+)", v.strip())
+    if m:
+        return (int(m.group(1)), int(m.group(2)), int(m.group(3)))
+    return None
+
+
 def _daemon_extract_opencode_output(raw: str) -> str:
     """Extract text content from OpenCode JSONL output."""
     parts: list[str] = []
@@ -1239,18 +1260,18 @@ def _get_design_output_for_type(req_type: str) -> str:
     Used by _validate_outputs and _required_deliverable_paths to avoid
     hardcoding 'design.md' for all node_type='design' nodes — spike produces
     'research.md' instead.
+
+    Reads the explicit `output_filename` field on the PhaseConfig dataclass
+    (set in type_workflow_profiles.py) rather than using a fragile regex over
+    the prompt template text.
     """
     try:
         from app.services.type_workflow_profiles import get_profile
         profile = get_profile(req_type)
         for phase in profile.execution_phases:
             if phase.node_type == "design":
-                from app.services.type_prompts import TYPE_PROMPT_TEMPLATES
-                tmpl = TYPE_PROMPT_TEMPLATES.get(phase.prompt_key, "")
-                import re as _re
-                m = _re.search(r"{doc_dir}/([\w.-]+)", tmpl)
-                if m:
-                    return m.group(1)
+                if phase.output_filename:
+                    return phase.output_filename
                 break
     except Exception:
         pass
@@ -1735,18 +1756,30 @@ class WorkspaceManager:
         """
         import shutil
         import stat as _stat
+        import sys as _sys
 
         if not path.exists():
             return
 
         def _handle_readonly(func, entry_path, excinfo):
             try:
-                os.chmod(entry_path, _stat.S_IWRITE | _stat.S_IREAD | _stat.S_IRWXU)
+                os.chmod(entry_path, _stat.S_IWRITE | _stat.S_IREAD | _stat.S_IEXEC)
                 func(entry_path)
-            except Exception:
-                pass  # Best-effort: if even chmod fails, ignore
+            except Exception as _chmod_err:
+                logger.debug(
+                    "_safe_rmtree: failed to force-remove %s: %s",
+                    entry_path, _chmod_err,
+                )
 
-        shutil.rmtree(path, onerror=_handle_readonly)
+        # Python 3.12 deprecated onerror= in favour of onexc=.
+        # The signatures differ: onerror gets (exc_type, exc_val, tb),
+        # onexc gets (func, path, exc_instance).
+        if _sys.version_info >= (3, 12):
+            def _onexc(func, p, exc):
+                _handle_readonly(func, p, (type(exc), exc, exc.__traceback__))
+            shutil.rmtree(path, onexc=_onexc)
+        else:
+            shutil.rmtree(path, onerror=_handle_readonly)
 
         # Windows fallback: reserved device names survive shutil.rmtree.
         # cmd /c rmdir /s /q with the \\?\ extended-length prefix bypasses
@@ -1755,16 +1788,19 @@ class WorkspaceManager:
             try:
                 import subprocess
                 resolved = str(path.resolve())
-                # Prepend \\?\ extended-length prefix if not already present.
-                # In Python source "\\\\?\\" represents the 4-char string \\?\
-                # which is the Win32 flag to bypass reserved-name interception.
-                if not resolved.startswith("\\\\?\\"):
+                # Build the correct extended-length prefix:
+                #   UNC paths (\\server\share) → \\?\UNC\server\share
+                #   Regular paths              → \\?\C:\path
+                if resolved.startswith("\\\\"):
+                    unc = "\\\\?\\UNC\\" + resolved[2:]
+                elif not resolved.startswith("\\\\?\\"):
                     unc = "\\\\?\\" + resolved
                 else:
                     unc = resolved
                 result = subprocess.run(
                     ["cmd", "/c", "rmdir", "/s", "/q", unc],
                     capture_output=True,
+                    stdin=subprocess.DEVNULL,
                     timeout=60,
                 )
                 if result.returncode != 0 and path.exists():
@@ -2279,6 +2315,14 @@ class WorkspaceManager:
             "revert(analysis",
             "initial commit",
         )
+        # These look like docs/* but contain actual design/architecture work —
+        # treat them as implementation commits so fresh-start never discards them.
+        _IMPL_DOCS_PREFIXES = (
+            "docs(design",
+            "docs(rfc",
+            "docs(architecture",
+            "docs(spec",
+        )
         try:
             raw = await self._git(
                 "log", "--format=%s",
@@ -2295,6 +2339,11 @@ class WorkspaceManager:
 
         for subject in subjects:
             lower = subject.lower()
+            # First check: is it an explicit design/rfc/architecture doc commit?
+            # These look like "docs(design)" but carry real design artifacts and
+            # must never be discarded on a fresh-start reset.
+            if any(lower.startswith(p) for p in _IMPL_DOCS_PREFIXES):
+                return True  # Design/architecture commit — treat as implementation
             if not any(lower.startswith(p) for p in _ANALYSIS_ONLY_PREFIXES):
                 return True  # Found at least one implementation commit
 
@@ -2543,6 +2592,22 @@ class WorkspaceManager:
 
                 if fresh_start:
                     logger.info("Fresh start: resetting %s to origin/%s", ws_path, default_branch)
+                    # Safety: create a backup tag before resetting, so commits can
+                    # be recovered even if the remote branch was deleted and the
+                    # _branch_has_impl_commits heuristic misfired.
+                    import time as _time
+                    _backup_tag = f"backup/pre-fresh-start-{int(_time.time())}"
+                    try:
+                        await self._git("tag", _backup_tag, "HEAD", cwd=ws_path)
+                        logger.info(
+                            "Created safety tag %s before fresh re-analysis reset on %s",
+                            _backup_tag, branch_name,
+                        )
+                    except RuntimeError as _tag_err:
+                        logger.warning(
+                            "Could not create backup tag %s before fresh-start reset: %s",
+                            _backup_tag, _tag_err,
+                        )
                     # Use checkout -B to create or reset the branch to origin/default_branch.
                     # Plain `checkout branch_name` fails when the branch doesn't exist locally.
                     try:
@@ -3109,7 +3174,17 @@ class WorkspaceManager:
                         except Exception:
                             pass
                     else:
-                        _known_hosts_null = "/dev/null"
+                        # Use a persistent per-daemon known_hosts file under ~/.forgexa.
+                        # This provides TOFU (Trust On First Use) protection: the first
+                        # connection stores the host key; subsequent connections verify it.
+                        # Using /dev/null discards all host keys on every git operation,
+                        # leaving every connection open to MITM attacks.
+                        _kh_dir = Path.home() / ".forgexa"
+                        try:
+                            _kh_dir.mkdir(parents=True, exist_ok=True)
+                        except OSError:
+                            pass
+                        _known_hosts_null = str(_kh_dir / "known_hosts")
                     env = {
                         **os.environ,
                         "GIT_SSH_COMMAND": (
@@ -3169,6 +3244,7 @@ class WorkspaceManager:
         # we use taskkill /T there instead of killpg.
         proc = await asyncio.create_subprocess_exec(
             "git", *longpath_args, *git_prefix_args, *args,
+            stdin=asyncio.subprocess.DEVNULL,
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
             cwd=str(cwd) if cwd else None,
@@ -4155,7 +4231,12 @@ class ProcessManager:
         model_override = os.environ.get("FACTORY_CLAUDE_MODEL")
         if model_override:
             env["ANTHROPIC_MODEL"] = model_override
-        env.update(self._prepare_claude_environment())
+
+        # Per-task isolated Claude home prevents cross-task state leakage
+        # (cache/XDG data, session state) between concurrent task executions.
+        import tempfile
+        _claude_home = tempfile.mkdtemp(prefix=f"claude-{task_id[:8]}-")
+        env.update(self._prepare_claude_environment(sandbox_root=Path(_claude_home)))
 
         try:
             proc = await asyncio.create_subprocess_exec(
@@ -4243,6 +4324,8 @@ class ProcessManager:
             )
         finally:
             self.active_processes.pop(task_id, None)
+            # Clean up per-task isolated Claude home (suppress errors — best-effort)
+            WorkspaceManager._safe_rmtree(Path(_claude_home))
 
     async def _run_codex(
         self, agent: DiscoveredAgent, prompt: str, cwd: Path, timeout: int, task_id: str,
@@ -4318,6 +4401,35 @@ class ProcessManager:
         'Failed to run the query PRAGMA wal_checkpoint(PASSIVE)' errors and
         exit code 1 when multiple tasks run simultaneously.
         """
+        # --dangerously-skip-permissions was introduced in opencode v1.4.0 (2026-04-08).
+        # Older versions silently ignore the flag but then block on permission prompts
+        # in headless mode (no TTY), eventually exiting with code 1 after a long wait.
+        # Fail fast here so the error is immediately actionable.
+        _oc_ver = _parse_semver(agent.version)
+        if _oc_ver is None:
+            # Non-standard version string (e.g. 'unknown', 'latest') — skip version
+            # check rather than incorrectly rejecting a potentially valid agent.
+            logger.warning(
+                "Could not parse opencode version %r; skipping version check",
+                agent.version,
+            )
+        elif _oc_ver < _OPENCODE_MIN_VERSION:
+            _min_str = ".".join(str(x) for x in _OPENCODE_MIN_VERSION)
+            return TaskResult(
+                status="failed",
+                exit_code=-1,
+                stdout="",
+                stderr="",
+                error=(
+                    f"OpenCode {agent.version} is too old for headless execution. "
+                    f"Version {_min_str}+ is required: --dangerously-skip-permissions "
+                    f"(which auto-approves permission prompts in non-interactive mode) "
+                    f"was added in v{_min_str} on 2026-04-08. "
+                    f"Upgrade with: opencode upgrade"
+                ),
+                failure_code="agent_version_incompatible",
+            )
+
         cmd = [
             agent.command, "run",
             "--format", "json",
@@ -4519,8 +4631,13 @@ class ProcessManager:
         return result
 
     @staticmethod
-    def _prepare_claude_environment() -> dict[str, str]:
-        """Prepare writable Claude config/data/cache dirs under ~/.forgexa.
+    def _prepare_claude_environment(
+        sandbox_root: "Path | None" = None,
+    ) -> dict[str, str]:
+        """Prepare writable Claude config/data/cache dirs for isolated execution.
+
+        When *sandbox_root* is given (per-task isolation via mkdtemp), uses that
+        directory.  When None, falls back to the shared legacy path under ~/.forgexa.
 
         The daemon service runs with ProtectSystem=strict and only allows
         writes under ~/.forgexa plus the workspace root. Claude Code writes
@@ -4532,7 +4649,8 @@ class ProcessManager:
         the same writable sandbox, and mirror only the small set of user
         config files it needs for headless execution.
         """
-        sandbox_root = Path.home() / ".forgexa" / "claude-home"
+        if sandbox_root is None:
+            sandbox_root = Path.home() / ".forgexa" / "claude-home"
         config_root = sandbox_root / "config"
         data_root = sandbox_root / "data"
         cache_root = sandbox_root / "cache"
@@ -4614,6 +4732,22 @@ class ProcessManager:
         if not source_root.exists():
             return str(target_root)
 
+        # P3-3.5: Prune old session-state WAL/SHM files and log files > 7 days.
+        # These accumulate indefinitely without cleanup.
+        import time as _time
+        _prune_cutoff = _time.time() - 7 * 86400  # 7 days
+        for _prune_dir_name in ("session-state", "logs"):
+            _prune_dir = target_root / _prune_dir_name
+            if not _prune_dir.is_dir():
+                continue
+            for _old_file in _prune_dir.iterdir():
+                try:
+                    if _old_file.is_file() and _old_file.stat().st_mtime < _prune_cutoff:
+                        _old_file.unlink(missing_ok=True)
+                        logger.debug("Pruned old Copilot home file: %s", _old_file)
+                except Exception as _prune_err:
+                    logger.debug("Could not prune %s: %s", _old_file, _prune_err)
+
         # Collect names present in source for stale-file detection.
         source_names: set[str] = {child.name for child in source_root.iterdir()}
 
@@ -4778,6 +4912,19 @@ class ProcessManager:
         ) + ' -p "<prompt>"'
         logger.debug("Copilot invocation for task %s: %s", task_id, _cmd_display)
 
+        # On Windows, CREATE_NO_WINDOW ensures GetConsoleWindow() returns NULL for
+        # the child process, even when the parent (daemon or Tauri app) has a console
+        # window attached.  Copilot CLI 1.0.68+ added a secondary interactive-mode
+        # check via GetConsoleWindow(): if a console window is visible, it uses only
+        # the first line of -p as a brief context note and reports "No task was
+        # provided" for the rest of the prompt — silently discarding the full task.
+        # stdin=DEVNULL (below) covers the primary check (GetConsoleMode on stdin);
+        # CREATE_NO_WINDOW covers this secondary check so Copilot always sees a fully
+        # headless environment and processes -p as the complete task specification.
+        _win_flags: dict = {}
+        if sys.platform == "win32":
+            _win_flags["creationflags"] = subprocess.CREATE_NO_WINDOW
+
         try:
             proc = await asyncio.create_subprocess_exec(
                 *cmd,
@@ -4799,6 +4946,7 @@ class ProcessManager:
                 env=env,
                 limit=100 * 1024 * 1024,
                 start_new_session=True,
+                **_win_flags,
             )
             self.active_processes[task_id] = proc
             stdout, stderr, returncode = await self._stream_process(
@@ -4947,8 +5095,8 @@ class ProcessManager:
             )
         finally:
             self.active_processes.pop(task_id, None)
-            if _is_outer_call:
-                shutil.rmtree(_isolated_copilot_home, ignore_errors=True)
+            if _is_outer_call and _isolated_copilot_home:
+                WorkspaceManager._safe_rmtree(Path(_isolated_copilot_home))
 
     async def _run_generic(
         self, agent: DiscoveredAgent, prompt: str, cwd: Path, timeout: int, task_id: str,
@@ -4970,7 +5118,7 @@ class ProcessManager:
                 *cmd,
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
-                stdin=asyncio.subprocess.PIPE if stdin_input else None,
+                stdin=asyncio.subprocess.PIPE if stdin_input else asyncio.subprocess.DEVNULL,
                 cwd=str(cwd),
                 env=env,
                 limit=100 * 1024 * 1024,  # 100MB line buffer for large agent output
@@ -6648,6 +6796,10 @@ class RuntimeDaemon:
         logger.info("Daemon ready. Connected to %d server(s). Polling for tasks...",
                     len(self.connections))
 
+        # Clean up stale Copilot/Claude temp directories left by prior OOM-killed
+        # daemon processes.  This runs once at startup so /tmp doesn't fill up.
+        await self._cleanup_stale_tmp_dirs()
+
         # 3. Main loop
         try:
             while not self._shutdown:
@@ -6992,7 +7144,6 @@ class RuntimeDaemon:
                 Using 1-second ticks keeps the UI responsive without flooding
                 the backend. Empty ticks are skipped to reduce HTTP traffic.
                 """
-                import math as _math
                 tick = 0
                 while not progress_stop.is_set():
                     await asyncio.sleep(1)
@@ -7426,9 +7577,22 @@ class RuntimeDaemon:
                 if commit_result:
                     # Propagate push/commit errors in metrics so they're visible
                     result.metrics.update(commit_result)
+                    # Commit failure means changes were never committed — the task
+                    # produced no persisted output.  Mark as failed so the
+                    # orchestrator does not treat this as a successful node and
+                    # propagate stale state to downstream nodes.
+                    if commit_result.get("commit_error"):
+                        commit_err = commit_result["commit_error"]
+                        result.status = "failed"
+                        result.failure_code = result.failure_code or "auto_commit_failed"
+                        result.error = f"Auto-commit failed: {commit_err}"
+                        logger.error(
+                            "Task %s: auto-commit failed — changes not persisted: %s",
+                            task.task_id, commit_err,
+                        )
                     # Push failure is a real problem for downstream nodes — mark
                     # as failed so the orchestrator can retry (transient network).
-                    if commit_result.get("push_error"):
+                    elif commit_result.get("push_error"):
                         push_err = commit_result["push_error"]
                         result.status = "failed"
                         if commit_result.get("push_error_code") == "forbidden_branch_merge":
@@ -9511,15 +9675,21 @@ class RuntimeDaemon:
         current_branch: str,
         default_branch: str,
     ) -> list[str]:
-        """Return merge commits introduced locally and not yet on the remote branch.
+        """Return merge commits that pull default-branch changes into the requirement branch.
+
+        Requirement branches must stay linear and requirement-scoped.  Only
+        merges whose parent chain includes a commit from ``origin/{default_branch}``
+        are rejected — these indicate an explicit merge/rebase that imported
+        default-branch changes (and potentially other requirements' changes).
 
-        Requirement branches must stay linear and requirement-scoped. Any new
-        merge commit pending push indicates an explicit merge/rebase workflow that
-        can import unrelated changes (for example, merging origin/develop into a
-        fix branch). Those pushes are rejected by the caller.
+        Legitimate merges (e.g. AI-assisted conflict resolution that merges
+        two sub-feature branches) are allowed through because neither parent
+        is an ancestor of the default branch.
         """
         git = self.workspace_manager._git
 
+        # Collect all unpushed merge commits first
+        all_merge_shas: list[str] = []
         try:
             await git("rev-parse", "--verify", f"origin/{current_branch}", cwd=workspace_path)
             out = await git(
@@ -9534,8 +9704,42 @@ class RuntimeDaemon:
                 )
             except RuntimeError:
                 return []
+        all_merge_shas = [line.strip() for line in out.splitlines() if line.strip()]
+        if not all_merge_shas:
+            return []
 
-        return [line.strip() for line in out.splitlines() if line.strip()]
+        # Filter: only flag merges where at least one parent is an ancestor of
+        # origin/{default_branch}. This distinguishes "merged default branch in"
+        # (forbidden) from "merged two local sub-branches" (legitimate).
+        forbidden: list[str] = []
+        for sha in all_merge_shas:
+            try:
+                parents_out = await git(
+                    "show", "-s", "--format=%P", sha, cwd=workspace_path,
+                )
+                parents = parents_out.strip().split()
+            except RuntimeError:
+                # Cannot determine parents — treat as forbidden (fail-safe)
+                forbidden.append(sha)
+                continue
+
+            is_default_merge = False
+            for parent in parents:
+                try:
+                    await git(
+                        "merge-base", "--is-ancestor", parent,
+                        f"origin/{default_branch}", cwd=workspace_path,
+                    )
+                    # This parent is an ancestor of the default branch — the
+                    # merge imported default-branch changes → forbidden
+                    is_default_merge = True
+                    break
+                except RuntimeError:
+                    continue  # Parent is not on the default branch — OK
+            if is_default_merge:
+                forbidden.append(sha)
+
+        return forbidden
 
     async def _ai_resolve_conflicts(
         self, workspace_path: Path, default_branch: str, task: TaskInfo,
@@ -10010,6 +10214,37 @@ class RuntimeDaemon:
             for a in self.agents
         ]
 
+    async def _cleanup_stale_tmp_dirs(self) -> None:
+        """Remove stale Copilot/Claude temp dirs from prior OOM-killed daemon runs.
+
+        Both GitHub Copilot and Claude agents use mkdtemp(prefix="copilot-…") /
+        mkdtemp(prefix="claude-…") directories.  When the daemon is killed before
+        cleanup these directories accumulate in /tmp.  We clean anything older
+        than 1 hour at startup.
+        """
+        import glob
+        import tempfile
+        import time as _time
+
+        tmp_dir = tempfile.gettempdir()
+        patterns = [
+            "copilot-*",
+            "claude-*",
+        ]
+        cutoff = _time.time() - 3600  # 1 hour
+
+        for pattern in patterns:
+            for d in glob.glob(os.path.join(tmp_dir, pattern)):
+                try:
+                    if not os.path.isdir(d):
+                        continue
+                    mtime = os.path.getmtime(d)
+                    if mtime < cutoff:
+                        self.workspace_manager._safe_rmtree(Path(d))
+                        logger.info("Cleaned up stale agent temp dir: %s", d)
+                except Exception as e:
+                    logger.debug("Could not clean temp dir %s: %s", d, e)
+
     async def _shutdown_gracefully(self):
         """Graceful shutdown."""
         logger.info("Shutting down daemon...")

{forgexa_cli-1.14.10 → forgexa_cli-1.15.0}/forgexa_cli/main.py

@@ -73,6 +73,75 @@ except ImportError:
 _SERVER_URL_OVERRIDE: str | None = None
 
 
+# ── Banner ────────────────────────────────────────────────────────────────────
+
+_LOGO_ART = """\
+  ███████╗ ██████╗ ██████╗  ██████╗ ███████╗██╗  ██╗ █████╗ 
+  ██╔════╝██╔═══██╗██╔══██╗██╔════╝ ██╔════╝╚██╗██╔╝██╔══██╗
+  █████╗  ██║   ██║██████╔╝██║  ███╗█████╗   ╚███╔╝ ███████║
+  ██╔══╝  ██║   ██║██╔══██╗██║   ██║██╔══╝   ██╔██╗ ██╔══██║
+  ██║     ╚██████╔╝██║  ██║╚██████╔╝███████╗██╔╝ ██╗██║  ██║
+  ╚═╝      ╚═════╝ ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝"""
+
+
+def _supports_color() -> bool:
+    """Return True when stdout can render ANSI colors."""
+    if not sys.stdout.isatty():
+        return False
+    if os.environ.get("NO_COLOR"):
+        return False
+    if os.environ.get("TERM") in ("dumb", ""):
+        return False
+    # Windows: older cmd.exe and PowerShell don't support ANSI escape sequences.
+    # Only enable color when running in a known ANSI-capable environment.
+    if sys.platform == "win32":
+        # Windows Terminal sets WT_SESSION; ConEmu/ANSICON set ANSICON;
+        # VS Code terminal sets TERM_PROGRAM=vscode.
+        if not (
+            os.environ.get("WT_SESSION")
+            or os.environ.get("ANSICON")
+            or os.environ.get("TERM_PROGRAM") == "vscode"
+            or os.environ.get("COLORTERM") in ("truecolor", "24bit", "256color")
+        ):
+            return False
+    return True
+
+
+def _brand_color() -> str:
+    """Return the best available ANSI escape for Forgexa brand blue (#096dd9).
+
+    Priority:
+      1. 24-bit truecolor — exact match  (COLORTERM=truecolor|24bit)
+      2. Bold blue        — 16-color fallback
+    """
+    colorterm = os.environ.get("COLORTERM", "").lower()
+    if colorterm in ("truecolor", "24bit"):
+        return "\033[38;2;9;109;217m"    # #096dd9 exact
+    return "\033[1;34m"                  # bold blue — 16-color fallback
+
+
+def _print_banner() -> None:
+    """Print the Forgexa logo + tagline.
+
+    Shown only on bare invocation and top-level --help/-h.
+    Respects NO_COLOR, TERM=dumb, and non-TTY environments.
+    """
+    from forgexa_cli import __version__
+
+    if _supports_color():
+        blue   = _brand_color()
+        reset  = "\033[0m"
+        logo    = f"{blue}{_LOGO_ART}{reset}"
+        tagline = f"  {blue}AI-Driven Software Factory  ·  v{__version__}{reset}"
+    else:
+        logo    = _LOGO_ART
+        tagline = f"  AI-Driven Software Factory  ·  v{__version__}"
+
+    print(logo, file=sys.stderr)
+    print(tagline, file=sys.stderr)
+    print(file=sys.stderr)
+
+
 # ── Config file helpers (~/.forgexa/config) ──
 
 def _config_path() -> Path:
@@ -168,6 +237,7 @@ def _refresh_access_token() -> bool:
     try:
         with httpx.Client(timeout=15) as client:
             resp = client.post(url, json={"refresh_token": refresh_token})
+            resp.raise_for_status()
             payload = resp.json()
     except Exception:
         return False
@@ -445,9 +515,19 @@ def _write_update_cache(latest_version: str) -> None:
 
 
 def _version_is_newer(candidate: str, reference: str) -> bool:
-    """Return True if candidate is strictly newer than reference (numeric tuple comparison)."""
+    """Return True if candidate is strictly newer than reference.
+
+    Strips pre-release/build suffixes (e.g. '1.14.3a1', '1.14.3.post1')
+    before comparison so that release version 1.14.3 is treated as newer
+    than pre-release 1.14.3a1, not equal.
+    """
+    import re as _re
+
     def _parts(v: str) -> tuple[int, ...]:
-        return tuple(int(x) for x in v.split(".")[:4] if x.isdigit())
+        # Strip pre-release/build suffixes: take only the leading numeric segments
+        clean = _re.split(r"[^0-9.]", v)[0].rstrip(".")
+        return tuple(int(x) for x in clean.split(".")[:4] if x.isdigit())
+
     try:
         return _parts(candidate) > _parts(reference)
     except Exception:
@@ -626,12 +706,24 @@ def _request_json(
                 timeout=timeout,
                 allow_refresh=False,
             )
-        body_text = e.response.text
+        body_text = e.response.text[:500]
+        # Mask secrets that may leak from server 5xx responses
+        import re as _re
+        body_text = _re.sub(
+            r'(password|token|secret|key|auth)["\']?\s*[:=]\s*["\']?[^\s&,"\']+',
+            r'\1=***',
+            body_text,
+            flags=_re.IGNORECASE,
+        )
         print(f"Error {e.response.status_code}: {body_text}", file=sys.stderr)
-        sys.exit(1)
+        # Use distinct exit codes so callers / CI scripts can distinguish error types:
+        #   1 → generic / server error (4xx except auth, 5xx)
+        #   2 → authentication failure (401 / 403)
+        status = e.response.status_code
+        sys.exit(2 if status in (401, 403) else 1)
     except httpx.RequestError as e:
         print(f"Connection error: {e}\nServer: {_api_url()}", file=sys.stderr)
-        sys.exit(1)
+        sys.exit(3)  # 3 → network / connection error
 
 
 def _get(path: str) -> dict | list:
@@ -765,7 +857,12 @@ def _get_runtimes(include_all: bool = False) -> list[dict]:
 
 
 def _get_runtimes_silent(include_all: bool = False) -> list[dict]:
-    """Like _get_runtimes() but returns [] instead of sys.exit on any error."""
+    """Like _get_runtimes() but returns [] instead of sys.exit on any error.
+
+    On 401, tries once to refresh the token (same as _request_json) rather
+    than silently returning [] — the original bug was that 401 caused a 12s
+    polling timeout because the stale token was never refreshed.
+    """
     import httpx
 
     path = "/runtimes" if include_all else "/runtimes/me"
@@ -773,6 +870,11 @@ def _get_runtimes_silent(include_all: bool = False) -> list[dict]:
     try:
         with httpx.Client(headers=_headers(), timeout=10) as client:
             resp = client.get(url)
+            if resp.status_code == 401 and _refresh_access_token():
+                # Retry once with the new token
+                with httpx.Client(headers=_headers(), timeout=10) as retry_client:
+                    resp = retry_client.get(url)
+            resp.raise_for_status()
             result = resp.json() if resp.content else []
             return result if isinstance(result, list) else []
     except Exception:
@@ -1396,6 +1498,10 @@ def main() -> None:
 
     active_url = _api_url()  # resolved before parsing (for help text)
 
+    # Show logo on bare invocation or top-level --help / -h
+    if len(sys.argv) == 1 or (len(sys.argv) >= 2 and sys.argv[1] in ("-h", "--help")):
+        _print_banner()
+
     parser = argparse.ArgumentParser(
         prog="forgexa",
         description="Forgexa CLI — communicates with the Forgexa server via REST API.",

{forgexa_cli-1.14.10 → forgexa_cli-1.15.0}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.14.10
+Version: 1.15.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT

{forgexa_cli-1.14.10 → forgexa_cli-1.15.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.14.10"
+version = "1.15.0"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = { text = "MIT" }

{forgexa_cli-1.14.10 → forgexa_cli-1.15.0}/tests/test_auth_and_runtime_commands.py

@@ -1,11 +1,11 @@
 from __future__ import annotations
 
-import io
 import contextlib
+import io
 import json
 from pathlib import Path
 from types import SimpleNamespace
-import urllib.error
+from unittest.mock import MagicMock
 
 import httpx
 import pytest
@@ -13,27 +13,15 @@ import pytest
 from forgexa_cli import daemon, main
 
 
-class UrlopenResponse:
-    def __init__(self, payload):
-        self._payload = payload
-
-    def read(self) -> bytes:
-        return json.dumps(self._payload).encode("utf-8")
-
-    def __enter__(self):
-        return self
-
-    def __exit__(self, exc_type, exc, tb):
-        return False
-
-
 class HttpxResponse:
-    def __init__(self, status_code: int, payload: dict):
+    def __init__(self, status_code: int, payload: dict | list):
         self.status_code = status_code
         self._payload = payload
-        self.request = httpx.Request("POST", "https://api.example.com/api/v1/runtimes/register")
+        self.request = httpx.Request("GET", "https://api.example.com/api/v1/runtimes/me")
+        self.content = json.dumps(payload).encode("utf-8")
+        self.text = json.dumps(payload)
 
-    def json(self) -> dict:
+    def json(self) -> dict | list:
         return self._payload
 
     def raise_for_status(self) -> None:
@@ -45,16 +33,6 @@ class HttpxResponse:
             )
 
 
-def _http_error(url: str, status_code: int, payload: dict) -> urllib.error.HTTPError:
-    return urllib.error.HTTPError(
-        url,
-        status_code,
-        payload.get("detail", "error"),
-        hdrs=None,
-        fp=io.BytesIO(json.dumps(payload).encode("utf-8")),
-    )
-
-
 def test_login_persists_refresh_token(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("HOME", str(tmp_path))
     monkeypatch.setattr(main, "_SERVER_URL_OVERRIDE", None)
@@ -100,40 +78,62 @@ def test_get_retries_once_after_refresh_on_401(
     )
     (config_dir / "token").write_text("old-access")
 
-    import urllib.request
-
-    runtime_called = {"count": 0}
+    # httpx.Client is created once per request call.  Track creation order:
+    #   call #1 — initial GET (with old-access token) → 401
+    #   call #2 — POST to /auth/refresh (no auth header) → returns new tokens
+    #   call #3 — retry GET (with new-access token) → returns runtimes list
+    client_call_count = {"n": 0}
+    runtime_call_count = {"n": 0}
+
+    class FakeClient:
+        def __init__(self, **kwargs):
+            client_call_count["n"] += 1
+            self._call_num = client_call_count["n"]
+            self._headers = kwargs.get("headers", {})
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+        def request(self, method, url, **kw):
+            # GET /runtimes/me — first time 401, second time success
+            assert "/runtimes/me" in url
+            runtime_call_count["n"] += 1
+            if runtime_call_count["n"] == 1:
+                # Verify old token was used
+                assert "old-access" in self._headers.get("Authorization", "")
+                resp = HttpxResponse(401, {"detail": "Invalid token"})
+                resp.request = httpx.Request(method, url)
+                raise httpx.HTTPStatusError(
+                    "HTTP 401",
+                    request=resp.request,
+                    response=resp,
+                )
+            # Second call: verify new token was used
+            assert "new-access" in self._headers.get("Authorization", "")
+            return HttpxResponse(
+                200,
+                [{"id": "12345678", "daemon_id": "demo-daemon", "status": "online"}],
+            )
 
-    def fake_urlopen(req, timeout=0):
-        url = req.full_url
-        if url.endswith("/api/v1/runtimes/me"):
-            runtime_called["count"] += 1
-            if runtime_called["count"] == 1:
-                raise _http_error(url, 401, {"detail": "Invalid token"})
-            assert req.headers.get("Authorization") == "Bearer new-access"
-            return UrlopenResponse([
-                {
-                    "id": "12345678",
-                    "daemon_id": "demo-daemon",
-                    "status": "online",
-                }
-            ])
-        if url.endswith("/api/v1/auth/refresh"):
-            assert json.loads(req.data.decode("utf-8")) == {"refresh_token": "refresh-1"}
-            return UrlopenResponse(
-                {
-                    "access_token": "new-access",
-                    "refresh_token": "refresh-2",
-                }
+        def post(self, url, **kw):
+            # POST /auth/refresh
+            assert "/auth/refresh" in url
+            body = kw.get("json", {})
+            assert body.get("refresh_token") == "refresh-1"
+            return HttpxResponse(
+                200,
+                {"access_token": "new-access", "refresh_token": "refresh-2"},
             )
-        raise AssertionError(f"Unexpected URL: {url}")
 
-    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+    monkeypatch.setattr(httpx, "Client", FakeClient)
 
     result = main._get("/runtimes/me")
 
     assert isinstance(result, list)
-    assert runtime_called["count"] == 2
+    assert runtime_call_count["n"] == 2
     cfg = json.loads((config_dir / "config").read_text())
     assert cfg["token"] == "new-access"
     assert cfg["refresh_token"] == "refresh-2"