forgexa-cli 1.18.9__tar.gz → 1.18.11__tar.gz

{forgexa_cli-1.18.9 → forgexa_cli-1.18.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.18.9
+Version: 1.18.11
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.18.9 → forgexa_cli-1.18.11}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.18.9"
+__version__ = "1.18.11"

{forgexa_cli-1.18.9 → forgexa_cli-1.18.11}/forgexa_cli/daemon.py

@@ -555,7 +555,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.18.9"
+DAEMON_VERSION = "1.18.11"
 
 
 def _detect_client_type() -> str:
@@ -1716,6 +1716,13 @@ class WorkspaceManager:
         """Register an SSH private key for a project."""
         self._ssh_keys[project_key] = ssh_private_key
 
+    @staticmethod
+    def _summarize_git_error(error: Exception) -> str:
+        """Return a compact Git error without exposing embedded HTTPS credentials."""
+        detail = " ".join(str(error).split())
+        detail = re.sub(r"(https?://)[^/@\s]+@", r"\1***@", detail)
+        return detail[:500]
+
     def _migrate_legacy_project_dirs(self) -> None:
         """Move project directories from root/ to root/projects/ (one-time migration).
 
@@ -3042,6 +3049,7 @@ class WorkspaceManager:
         # Retry up to 2 times with short delay for cross-runtime timing issues
         # (analysis daemon may have just pushed the branch).
         branch_exists_remote = False
+        last_branch_fetch_error: str | None = None
         for _check_attempt in range(3 if not fresh_start else 1):
             try:
                 check_proc = await asyncio.create_subprocess_exec(
@@ -3070,8 +3078,8 @@ class WorkspaceManager:
                         timeout=settings.GIT_FETCH_TIMEOUT,
                         project_key=project_key,
                     )
-                except RuntimeError:
-                    pass
+                except RuntimeError as exc:
+                    last_branch_fetch_error = self._summarize_git_error(exc)
 
         # Fresh analysis with an existing remote branch that has implementation commits:
         # delete the remote branch so the agent starts from a clean slate.
@@ -3138,10 +3146,16 @@ class WorkspaceManager:
 
         if expect_branch and not fresh_start and not branch_exists_remote:
             self._safe_rmtree(ws_path)
+            fetch_detail = (
+                f" Last branch fetch error: {last_branch_fetch_error}"
+                if last_branch_fetch_error
+                else ""
+            )
             raise RuntimeError(
                 f"Expected remote branch '{branch_name}' to exist, but it could not be "
                 "fetched or resolved. Refusing to create a continuation workspace from "
                 f"origin/{default_branch} because that risks overwriting requirement-scoped history."
+                f"{fetch_detail}"
             )
 
         if branch_exists_remote and not fresh_start:
@@ -7292,6 +7306,43 @@ class RuntimeDaemon:
         result.metrics["recovered_from_timeout_uncommitted_changes"] = True
         return True
 
+    async def _discard_verification_scope_changes(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        result: TaskResult,
+        before_sha: str,
+    ) -> None:
+        """Discard protected analysis changes from a failed verification task."""
+        if not bool((task.input_data or {}).get("verification_work_item")):
+            return
+
+        forbidden_paths = sorted(
+            path
+            for path in ProcessManager._normalize_repo_paths(result.files_changed)
+            if _is_requirement_analysis_path(path)
+        )
+        if not forbidden_paths:
+            return
+
+        try:
+            await self.workspace_manager._git(
+                "reset", "--hard", before_sha or "HEAD", cwd=workspace_path,
+            )
+            await self.workspace_manager._git(
+                "clean", "-f", "--", *forbidden_paths, cwd=workspace_path,
+            )
+            logger.warning(
+                "Discarded verification scope-violation changes for task %s: %s",
+                task.task_id,
+                forbidden_paths,
+            )
+        except Exception:
+            logger.exception(
+                "Failed to discard verification scope-violation changes for task %s",
+                task.task_id,
+            )
+
     async def _execute_task(self, task: TaskInfo, conn: ServerConnection):
         """Execute a single task, reporting to the originating server connection."""
         reporter = conn.reporter
@@ -7769,6 +7820,7 @@ class RuntimeDaemon:
                     result = await self._validate_and_retry(
                         agent, task, workspace_path, result,
                         reporter, on_output_chunk, max_retries=2,
+                        default_branch=default_branch, before_sha=node_before_sha,
                     )
                     # Re-collect git info if validation triggered retries
                     if result.metrics.get("validation_issues") is not None or True:
@@ -7776,6 +7828,11 @@ class RuntimeDaemon:
                 except Exception:
                     logger.exception("Validation gate error for task %s (proceeding anyway)", task.task_id)
 
+            if result.failure_code == "verification_work_item_scope_violation":
+                await self._discard_verification_scope_changes(
+                    workspace_path, task, result, node_before_sha,
+                )
+
             # 4.6 Post-validation rate-limit fallback.
             # _validate_and_retry returns early (preserving the rate-limit error)
             # when the agent hits a quota wall mid-retry.  The initial-run fallback
@@ -7817,6 +7874,7 @@ class RuntimeDaemon:
                                 result = await self._validate_and_retry(
                                     agent, task, workspace_path, result,
                                     reporter, on_output_chunk, max_retries=2,
+                                    default_branch=default_branch, before_sha=node_before_sha,
                                 )
                                 pre_commit_git = await self.process_manager._collect_git_info(workspace_path)
                             except Exception:
@@ -8779,6 +8837,8 @@ class RuntimeDaemon:
         reporter: "ProgressReporter",
         on_chunk: Any,
         max_retries: int = 2,
+        default_branch: str = "",
+        before_sha: str = "",
     ) -> TaskResult:
         """Validate agent output and retry with fix prompt if issues found.
 
@@ -8790,6 +8850,16 @@ class RuntimeDaemon:
         Returns the (possibly updated) TaskResult.
         """
         for attempt in range(max_retries):
+            if before_sha and bool((task.input_data or {}).get("verification_work_item")):
+                committed_git = await self.process_manager._collect_git_info_vs_parent(
+                    workspace_path,
+                    default_branch=default_branch,
+                    before_sha=before_sha,
+                )
+                result.files_changed = sorted(
+                    set(result.files_changed)
+                    | set(committed_git.get("files_changed") or [])
+                )
             issues = self._validate_outputs(workspace_path, task, result)
             if not issues:
                 return result  # All validations passed
@@ -8878,27 +8948,46 @@ class RuntimeDaemon:
                 return result
 
         # Final check after all retries
+        if before_sha and bool((task.input_data or {}).get("verification_work_item")):
+            committed_git = await self.process_manager._collect_git_info_vs_parent(
+                workspace_path,
+                default_branch=default_branch,
+                before_sha=before_sha,
+            )
+            result.files_changed = sorted(
+                set(result.files_changed)
+                | set(committed_git.get("files_changed") or [])
+            )
         remaining = self._validate_outputs(workspace_path, task, result)
         if remaining:
             # Distinguish critical issues (no output produced) from minor ones (syntax)
+            scope_violations = [
+                issue
+                for issue in remaining
+                if issue.startswith("Verification work item modified requirement analysis assets:")
+            ]
             critical_patterns = ("missing", "not found", "is empty")
             critical_issues = [
                 iss for iss in remaining
                 if any(p in iss.lower() for p in critical_patterns)
             ]
-            if critical_issues:
+            if critical_issues or scope_violations:
                 # Agent didn't produce required output — mark as failed
                 logger.warning(
                     "Validation gate: %d critical issues remain after %d retries for task %s — "
                     "marking as failed:\n%s",
-                    len(critical_issues), max_retries, task.task_id,
-                    "\n".join(f"  - {iss}" for iss in critical_issues),
+                    len(critical_issues) + len(scope_violations), max_retries, task.task_id,
+                    "\n".join(f"  - {iss}" for iss in critical_issues + scope_violations),
                 )
                 result.status = "failed"
-                result.error = (
-                    f"Agent failed to produce required output after {max_retries} retries: "
-                    + "; ".join(critical_issues[:3])
-                )
+                if scope_violations:
+                    result.failure_code = "verification_work_item_scope_violation"
+                    result.error = "; ".join(scope_violations[:3])
+                else:
+                    result.error = (
+                        f"Agent failed to produce required output after {max_retries} retries: "
+                        + "; ".join(critical_issues[:3])
+                    )
             else:
                 # Non-critical issues (syntax warnings) — proceed with warning
                 logger.warning(

{forgexa_cli-1.18.9 → forgexa_cli-1.18.11}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.18.9
+Version: 1.18.11
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.18.9 → forgexa_cli-1.18.11}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.18.9"
+version = "1.18.11"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"

{forgexa_cli-1.18.9 → forgexa_cli-1.18.11}/tests/test_auth_and_runtime_commands.py

@@ -5,7 +5,7 @@ import io
 import json
 from pathlib import Path
 from types import SimpleNamespace
-from unittest.mock import MagicMock
+from unittest.mock import AsyncMock, MagicMock
 
 import httpx
 import pytest
@@ -196,6 +196,49 @@ def test_httpx_recovery_hints_use_platform_specific_upgrade_commands() -> None:
     assert linux_hints[0] == "python3 -m pip install --upgrade forgexa-cli"
 
 
+@pytest.mark.asyncio
+async def test_workspace_reports_last_expected_branch_fetch_error(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    manager = daemon.WorkspaceManager(str(tmp_path / "daemon-root"))
+    project_dir = tmp_path / "project"
+    (project_dir / "_main").mkdir(parents=True)
+
+    class DummyProc:
+        returncode = 1
+
+        async def communicate(self):
+            return b"", b""
+
+    async def fake_git(*args, **kwargs):
+        if args[:2] == ("fetch", "origin") and args[2].startswith("feature/SI-647:"):
+            raise RuntimeError("Permission denied (publickey).")
+        return ""
+
+    manager._git = AsyncMock(side_effect=fake_git)
+    monkeypatch.setattr(
+        daemon.asyncio,
+        "create_subprocess_exec",
+        AsyncMock(return_value=DummyProc()),
+    )
+    monkeypatch.setattr(daemon.asyncio, "sleep", AsyncMock())
+
+    with pytest.raises(
+        RuntimeError,
+        match="Last branch fetch error: Permission denied \\(publickey\\)\\.",
+    ):
+        await manager._create_worktree_impl(
+            project_dir,
+            "ssh://git@example.com/repo.git",
+            "develop",
+            "workflow-keep-branch",
+            "feature/SI-647",
+            project_key="SI",
+            expect_branch=True,
+        )
+
+
 def test_normalize_target_version_accepts_plain_and_v_prefixed_tags() -> None:
     assert main._normalize_target_version("1.12.3") == "1.12.3"
     assert main._normalize_target_version("v1.12.3") == "1.12.3"