forgexa-cli 1.15.7__tar.gz → 1.16.0__tar.gz

{forgexa_cli-1.15.7 → forgexa_cli-1.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.15.7
+Version: 1.16.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.15.7 → forgexa_cli-1.16.0}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.15.7"
+__version__ = "1.16.0"

{forgexa_cli-1.15.7 → forgexa_cli-1.16.0}/forgexa_cli/daemon.py

@@ -523,7 +523,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.15.7"
+DAEMON_VERSION = "1.16.0"
 
 
 def _detect_client_type() -> str:
@@ -558,7 +558,9 @@ _CLIENT_TYPE = _detect_client_type()
 # Set DAEMON_NO_CONSOLE_LOG=1 to suppress the stream handler even on a TTY
 # (used by `forgexa daemon start` foreground mode for clean UX).
 _log_dir = Path.home() / ".forgexa" / "daemon"
-_log_dir.mkdir(parents=True, exist_ok=True)
+_log_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
+# Ensure directory has restricted permissions even if it already existed
+_log_dir.chmod(0o700)
 DAEMON_LOG_PATH = _log_dir / "daemon.log"
 
 _log_handlers: list[logging.Handler] = [
@@ -568,6 +570,9 @@ _log_handlers: list[logging.Handler] = [
         backupCount=5,
     ),
 ]
+# L-4: Restrict log file to owner-read/write only (shared-host protection)
+if DAEMON_LOG_PATH.exists():
+    DAEMON_LOG_PATH.chmod(0o600)
 if sys.stderr.isatty() and not os.environ.get("DAEMON_NO_CONSOLE_LOG"):
     _log_handlers.append(logging.StreamHandler(sys.stderr))
 
@@ -3182,7 +3187,10 @@ class WorkspaceManager:
             key_content = self._ssh_keys.get(project_key)
             if key_content:
                 import stat as stat_mod
-                fd, key_path = tempfile.mkstemp(prefix="forgexa_ssh_", suffix=".key")
+                # F-9: Use a dedicated directory with restricted permissions for SSH keys
+                _ssh_dir = Path.home() / ".forgexa" / "ssh"
+                _ssh_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
+                fd, key_path = tempfile.mkstemp(prefix="forgexa_ssh_", suffix=".key", dir=str(_ssh_dir))
                 try:
                     os.write(fd, key_content.encode() if isinstance(key_content, str) else key_content)
                     if not key_content.rstrip().endswith("\n"):

{forgexa_cli-1.15.7 → forgexa_cli-1.16.0}/forgexa_cli/main.py

@@ -478,8 +478,8 @@ def _build_upgrade_plan(target_version: str | None) -> UpgradePlan:
 # ── Update-check helpers ──────────────────────────────────────────────────────
 #
 # Strategy (borrowed from gh CLI / update-notifier):
-#   1. At the start of main(): launch a daemon thread that calls PyPI and
-#      writes ~/.forgexa/update-check.json (only when the cache is stale).
+#   1. At the start of main(): launch a detached Python worker that calls PyPI
+#      and writes ~/.forgexa/update-check.json (only when the cache is stale).
 #   2. At the end of main(): read the cache (instant) and, if a newer version
 #      is available, print one notice to stderr.
 #
@@ -534,31 +534,44 @@ def _version_is_newer(candidate: str, reference: str) -> bool:
         return False
 
 
-def _launch_update_check_thread() -> None:
-    """Start a fire-and-forget daemon thread that fetches the latest PyPI version.
+def _run_update_check() -> None:
+    """Fetch the latest published CLI version and refresh the local cache."""
+    try:
+        import httpx
+
+        with httpx.Client(timeout=5) as client:
+            resp = client.get("https://pypi.org/pypi/forgexa-cli/json")
+            resp.raise_for_status()
+            latest = str(resp.json()["info"]["version"])
+        _write_update_cache(latest)
+    except Exception:
+        pass  # Network errors are silently ignored
 
-    The thread only runs if the cache is stale (> TTL).  Because it is a daemon
-    thread the OS kills it automatically when the main process exits, so it never
-    delays shutdown.
+
+def _launch_update_check_process() -> None:
+    """Start a detached worker process that refreshes the update cache.
+
+    Short-lived commands like `forgexa version` can exit before a daemon thread
+    finishes its PyPI request. A separate Python process survives long enough to
+    populate the cache without blocking the foreground command.
     """
     _, checked_at = _read_update_cache()
     if time.time() - checked_at <= _UPDATE_CHECK_TTL:
         return  # Cache is fresh — nothing to do
 
-    import threading
-
-    def _worker() -> None:
-        try:
-            import httpx
-            with httpx.Client(timeout=5) as client:
-                resp = client.get("https://pypi.org/pypi/forgexa-cli/json")
-                latest = str(resp.json()["info"]["version"])
-            _write_update_cache(latest)
-        except Exception:
-            pass  # Network errors are silently ignored
-
-    t = threading.Thread(target=_worker, daemon=True, name="forgexa-update-check")
-    t.start()
+    try:
+        subprocess.Popen(
+            [
+                sys.executable,
+                "-c",
+                "from forgexa_cli.main import _run_update_check; _run_update_check()",
+            ],
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+    except Exception:
+        pass
 
 
 def _print_update_notice_if_available() -> None:
@@ -1750,7 +1763,7 @@ def main() -> None:
         and getattr(args, "follow", False)
     )
     if not _skip_update_check:
-        _launch_update_check_thread()
+        _launch_update_check_process()
 
     dispatch: dict = {
         "version": cmd_version,

{forgexa_cli-1.15.7 → forgexa_cli-1.16.0}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.15.7
+Version: 1.16.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.15.7 → forgexa_cli-1.16.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.15.7"
+version = "1.16.0"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"

{forgexa_cli-1.15.7 → forgexa_cli-1.16.0}/tests/test_auth_and_runtime_commands.py

@@ -207,6 +207,65 @@ def test_normalize_target_version_rejects_invalid_input() -> None:
         main._normalize_target_version("../../1.2.3")
 
 
+def test_run_update_check_writes_cache(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(main, "_UPDATE_CACHE_PATH", tmp_path / "update-check.json")
+
+    class FakeResponse:
+        def raise_for_status(self) -> None:
+            return None
+
+        def json(self) -> dict:
+            return {"info": {"version": "1.15.7"}}
+
+    class FakeClient:
+        def __init__(self, **kwargs):
+            assert kwargs["timeout"] == 5
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+        def get(self, url: str) -> FakeResponse:
+            assert url == "https://pypi.org/pypi/forgexa-cli/json"
+            return FakeResponse()
+
+    monkeypatch.setattr(httpx, "Client", FakeClient)
+
+    main._run_update_check()
+
+    payload = json.loads((tmp_path / "update-check.json").read_text())
+    assert payload["latest_version"] == "1.15.7"
+    assert payload["checked_at"] > 0
+
+
+def test_launch_update_check_process_spawns_background_python_when_cache_is_stale(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    calls: list[tuple[list[str], dict]] = []
+
+    monkeypatch.setattr(main, "_read_update_cache", lambda: (None, 0.0))
+    monkeypatch.setattr(main.time, "time", lambda: float(main._UPDATE_CHECK_TTL + 10))
+    monkeypatch.setattr(main.sys, "executable", "/usr/bin/python3")
+
+    def fake_popen(cmd: list[str], **kwargs):
+        calls.append((cmd, kwargs))
+        return SimpleNamespace()
+
+    monkeypatch.setattr(main.subprocess, "Popen", fake_popen)
+
+    main._launch_update_check_process()
+
+    assert len(calls) == 1
+    cmd, kwargs = calls[0]
+    assert cmd[:2] == ["/usr/bin/python3", "-c"]
+    assert cmd[2] == "from forgexa_cli.main import _run_update_check; _run_update_check()"
+    assert kwargs["stdin"] is main.subprocess.DEVNULL
+    assert kwargs["stdout"] is main.subprocess.DEVNULL
+    assert kwargs["stderr"] is main.subprocess.DEVNULL
+
+
 def test_build_upgrade_plan_for_pipx_latest(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(main, "_cli_distribution", lambda: SimpleNamespace(version="1.12.3"))
     monkeypatch.setattr(main, "_distribution_root", lambda dist: Path("/installed/site-packages"))