forgexa-cli 1.14.8__tar.gz → 1.14.10__tar.gz

{forgexa_cli-1.14.8 → forgexa_cli-1.14.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.14.8
+Version: 1.14.10
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT

{forgexa_cli-1.14.8 → forgexa_cli-1.14.10}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.14.8"
+__version__ = "1.14.10"

{forgexa_cli-1.14.8 → forgexa_cli-1.14.10}/forgexa_cli/daemon.py

@@ -523,7 +523,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.14.8"
+DAEMON_VERSION = "1.14.10"
 
 
 def _detect_client_type() -> str:
@@ -1892,8 +1892,16 @@ class WorkspaceManager:
             # the initial analysis.  This ensures a hard error (and workspace
             # re-clone) when the branch sync fails, rather than silently proceeding
             # with a stale workspace that will cause a non-fast-forward push later.
-            expect_branch = bool(task.analysis_branch) or (
-                bool(task.requirement_key) and not is_fresh_start and task.node_type != "analysis"
+            #
+            # IMPORTANT: Fresh analysis tasks MUST NOT set expect_branch even when
+            # task.analysis_branch is populated from workflow metadata.  That value
+            # reflects the branch from a *previous* analysis run (e.g. a prior Copilot
+            # analysis) which may have been deleted as part of the fresh restart.
+            # Only refine/continuation tasks require the branch to already exist.
+            expect_branch = (not is_fresh_start) and (
+                bool(task.analysis_branch) or (
+                    bool(task.requirement_key) and task.node_type != "analysis"
+                )
             )
             ws_path = await self._create_worktree(
                 project_dir, repo_url, default_branch, workspace_key, branch_name,
@@ -2385,25 +2393,66 @@ class WorkspaceManager:
                         cwd=ws_path, timeout=settings.GIT_FETCH_TIMEOUT, project_key=project_key,
                     )
                 except RuntimeError as _pre_fe2:
-                    logger.warning(
-                        "fetch branch %s failed for worktree %s: %s "
-                        "(likely auth/SSH issue — will retry in sync loop)",
-                        branch_name, ws_path, _pre_fe2,
+                    _sync_err_str = str(_pre_fe2)
+                    _sync_err_lower_pre = _sync_err_str.lower()
+                    _is_not_found_pre = (
+                        "couldn't find remote ref" in _sync_err_lower_pre
+                        or "\u65e0\u6cd5\u627e\u5230\u8fdc\u7a0b\u5f15\u7528" in _sync_err_lower_pre
+                        or "remote ref does not exist" in _sync_err_lower_pre
                     )
-                    _last_sync_err = str(_pre_fe2)[:300]
+                    if _is_not_found_pre:
+                        # Branch doesn't exist on remote — expected for fresh analysis.
+                        # Log at INFO, not WARNING, so operators aren't misled.
+                        logger.info(
+                            "fetch branch %s not found on remote for worktree %s "
+                            "(branch was deleted or never created — normal for fresh analysis)",
+                            branch_name, ws_path,
+                        )
+                    else:
+                        logger.warning(
+                            "fetch branch %s failed for worktree %s: %s "
+                            "(likely auth/SSH issue — will retry in sync loop)",
+                            branch_name, ws_path, _pre_fe2,
+                        )
+                    _last_sync_err = _sync_err_str[:300]
                     _branch_fetch_ok = False
 
                 if fresh_start and not _branch_fetch_ok:
-                    # Cannot determine remote branch state — prohibit reset to avoid
-                    # silently destroying implementation commits that exist on the remote
-                    # but could not be fetched (auth/network failure).  Conservative
-                    # stance: treat unverified state as "has implementation work".
-                    logger.warning(
-                        "Fresh start blocked for %s: branch fetch failed (%s) — "
-                        "remote state unknown, refusing to reset to avoid data loss",
-                        branch_name, _last_sync_err[:200],
+                    # Distinguish "branch not found" from "auth/network failure".
+                    # When the branch simply doesn't exist on the remote, that is the
+                    # *expected* state for a fresh analysis restart (the branch was
+                    # deleted by a prior fresh run or was never pushed).  In that case
+                    # keep fresh_start=True so the worktree is correctly reset to the
+                    # default branch.
+                    # Only block fresh_start when the fetch failed for reasons other
+                    # than "not found" (e.g. auth/SSH/network issues) where we genuinely
+                    # cannot determine whether implementation commits exist on the remote.
+                    _err_lower = _last_sync_err.lower()
+                    _branch_not_found = (
+                        "couldn't find remote ref" in _err_lower
+                        or "无法找到远程引用" in _err_lower   # Chinese git output
+                        or "remote ref does not exist" in _err_lower
+                        or "not found" in _err_lower
                     )
-                    fresh_start = False
+                    if _branch_not_found:
+                        # Branch is gone from remote — ideal state for a fresh restart.
+                        logger.info(
+                            "Fresh start for %s: remote branch not found — expected for a "
+                            "fresh analysis restart (branch was deleted or never existed). "
+                            "Proceeding with clean worktree reset to origin/%s",
+                            branch_name, default_branch,
+                        )
+                        # fresh_start remains True
+                    else:
+                        # Cannot determine remote branch state (auth/network failure) —
+                        # prohibit reset to avoid silently destroying implementation commits
+                        # that may exist on the remote but could not be fetched.
+                        logger.warning(
+                            "Fresh start blocked for %s: branch fetch failed (%s) — "
+                            "remote state unknown, refusing to reset to avoid data loss",
+                            branch_name, _last_sync_err[:200],
+                        )
+                        fresh_start = False
 
                 if fresh_start:
                     # Safety check: if the branch already has IMPLEMENTATION commits
@@ -4476,23 +4525,35 @@ class ProcessManager:
         The daemon service runs with ProtectSystem=strict and only allows
         writes under ~/.forgexa plus the workspace root. Claude Code writes
         config, debug logs, cache, and session state under XDG paths and
-        ~/.claude by default, which can fail with EROFS inside the daemon.
+        ~/.claude by default, and newer builds may still touch $HOME/.claude.json
+        even when XDG paths are set. That can fail with EROFS inside the daemon.
 
-        Point Claude at writable daemon-owned directories and mirror only the
-        small set of user config files it needs for headless execution.
+        Point Claude at writable daemon-owned directories, redirect HOME to
+        the same writable sandbox, and mirror only the small set of user
+        config files it needs for headless execution.
         """
         sandbox_root = Path.home() / ".forgexa" / "claude-home"
         config_root = sandbox_root / "config"
         data_root = sandbox_root / "data"
         cache_root = sandbox_root / "cache"
         state_root = sandbox_root / "state"
+        home_claude_dir = sandbox_root / ".claude"
         claude_config_dir = config_root / "claude"
 
-        for path in (config_root, data_root, cache_root, state_root, claude_config_dir):
+        for path in (
+            config_root,
+            data_root,
+            cache_root,
+            state_root,
+            home_claude_dir,
+            claude_config_dir,
+        ):
             path.mkdir(parents=True, exist_ok=True)
 
         source_files = [
+            (Path.home() / ".claude.json", sandbox_root / ".claude.json"),
             (Path.home() / ".claude.json", claude_config_dir / ".claude.json"),
+            (Path.home() / ".claude" / "settings.json", home_claude_dir / "settings.json"),
             (Path.home() / ".claude" / "settings.json", claude_config_dir / "settings.json"),
         ]
         for source, dest in source_files:
@@ -4506,6 +4567,7 @@ class ProcessManager:
                 )
 
         env = {
+            "HOME": str(sandbox_root),
             "XDG_CONFIG_HOME": str(config_root),
             "XDG_DATA_HOME": str(data_root),
             "XDG_CACHE_HOME": str(cache_root),
@@ -4533,6 +4595,17 @@ class ProcessManager:
 
         Mirror the user-facing ~/.copilot state into a writable daemon-owned
         directory, then point COPILOT_HOME there for non-interactive runs.
+
+        Stale-auth cleanup: Before the per-task isolation fix, the daemon
+        pointed COPILOT_HOME directly at this master directory, so Copilot
+        wrote its own OAuth token (plain-text on Linux systems without a
+        credential store) here. Those files are NOT present in ~/.copilot/
+        (the user's interactive home), so the normal mirror loop never
+        overwrites them — they persist across restarts and poison isolated
+        temp dirs.  We clean up any file/dir in the master home that has no
+        counterpart in ~/.copilot/ (excluding session-state and logs which
+        are deliberately retained) to ensure the master home stays a clean
+        mirror of the user-facing directory.
         """
         source_root = Path.home() / ".copilot"
         target_root = Path.home() / ".forgexa" / "copilot-home"
@@ -4541,6 +4614,26 @@ class ProcessManager:
         if not source_root.exists():
             return str(target_root)
 
+        # Collect names present in source for stale-file detection.
+        source_names: set[str] = {child.name for child in source_root.iterdir()}
+
+        # Remove master-home entries that are absent from ~/.copilot/.
+        # These are typically old Copilot OAuth token files written when
+        # COPILOT_HOME pointed here directly (pre-isolation-fix era).
+        _keep_always = {"session-state", "logs"}
+        for target_child in list(target_root.iterdir()):
+            if target_child.name in _keep_always:
+                continue
+            if target_child.name not in source_names:
+                try:
+                    if target_child.is_dir():
+                        shutil.rmtree(str(target_child), ignore_errors=True)
+                    else:
+                        target_child.unlink(missing_ok=True)
+                    logger.debug("Copilot home: removed stale %s", target_child.name)
+                except Exception as exc:
+                    logger.debug("Copilot home: could not remove stale %s: %s", target_child.name, exc)
+
         for child in source_root.iterdir():
             if child.name in {"logs", "session-state"}:
                 continue
@@ -4628,6 +4721,37 @@ class ProcessManager:
         env["TERM"] = "dumb"  # suppress TTY-detection that suspends the process
         env["COPILOT_HOME"] = _isolated_copilot_home
 
+        # Inject GH_TOKEN from the gh CLI for headless/automation auth.
+        # Per `copilot login --help`, env-var auth is the recommended method
+        # for automation: COPILOT_GITHUB_TOKEN > GH_TOKEN > GITHUB_TOKEN.
+        # GH_TOKEN accepts OAuth tokens from the GitHub CLI (gh) app, which
+        # is exactly what `gh auth token` returns.
+        #
+        # This bypasses any stale Copilot-specific OAuth token file that may
+        # be cached in COPILOT_HOME from an earlier run (e.g., after a
+        # password change when `gh auth login` refreshes gh's token but does
+        # NOT update Copilot's own stored token).  After `gh auth login` the
+        # daemon works again without requiring `copilot login` or manual
+        # deletion of ~/.forgexa/copilot-home/.
+        if not any(env.get(k) for k in ("COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN")):
+            try:
+                _gh_proc = await asyncio.create_subprocess_exec(
+                    "gh", "auth", "token",
+                    stdout=asyncio.subprocess.PIPE,
+                    stderr=asyncio.subprocess.DEVNULL,
+                    stdin=asyncio.subprocess.DEVNULL,
+                )
+                _gh_token_out, _ = await asyncio.wait_for(_gh_proc.communicate(), timeout=10.0)
+                _gh_token = (_gh_token_out or b"").decode().strip()
+                if _gh_token:
+                    env["GH_TOKEN"] = _gh_token
+                    logger.debug("Copilot task %s: injected GH_TOKEN from gh CLI", task_id)
+            except Exception as _gh_exc:
+                logger.debug(
+                    "Copilot task %s: could not inject GH_TOKEN (%s); falling back to stored auth",
+                    task_id, _gh_exc,
+                )
+
         model_override = os.environ.get("FACTORY_COPILOT_MODEL")
         # FACTORY_COPILOT_REASONING is opt-in: only pass --effort when the env
         # var is explicitly set to a non-empty string.  The default (unset / "")
@@ -4768,12 +4892,27 @@ class ProcessManager:
                 if effective_rc == 1 and _no_tools and not copilot_specific_error:
                     logger.error(
                         "Copilot exitCode=1 with no tool calls for task %s after retries. "
-                        "Likely causes: (1) GitHub auth expired — run `gh auth status` and "
-                        "`gh auth login --scopes copilot`; (2) Copilot subscription inactive; "
+                        "Likely causes: (1) GitHub auth expired — run `gh auth status`; if "
+                        "expired, run `copilot login` (Copilot's own auth) and `gh auth login`; "
+                        "(2) Copilot subscription inactive; "
                         "(3) --allow-all flag not supported by this CLI version (%s). "
                         "To reproduce manually: %s",
                         task_id, agent.version, _cmd_display,
                     )
+                # Detect auth-specific error for targeted diagnostics.
+                _is_auth_error = any(
+                    "gh auth login" in str(msg) or "authenticate with the GitHub" in str(msg)
+                    for msg in structured_errors
+                )
+                if _is_auth_error:
+                    logger.error(
+                        "Copilot auth error for task %s: %s. "
+                        "Fix: (1) run 'gh auth login' to refresh gh credentials; "
+                        "(2) run 'copilot login' to refresh Copilot's own OAuth token; "
+                        "(3) if the issue persists, delete ~/.forgexa/copilot-home/ and retry.",
+                        task_id,
+                        structured_errors[-1] if structured_errors else "auth failure",
+                    )
                 if copilot_specific_error:
                     failure_error = copilot_specific_error[:1500]
                 elif stderr.strip():

{forgexa_cli-1.14.8 → forgexa_cli-1.14.10}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.14.8
+Version: 1.14.10
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT

{forgexa_cli-1.14.8 → forgexa_cli-1.14.10}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.14.8"
+version = "1.14.10"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = { text = "MIT" }