forgexa-cli 1.21.8__tar.gz → 1.22.0__tar.gz

{forgexa_cli-1.21.8 → forgexa_cli-1.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.21.8
+Version: 1.22.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.21.8 → forgexa_cli-1.22.0}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.21.8"
+__version__ = "1.22.0"

{forgexa_cli-1.21.8 → forgexa_cli-1.22.0}/forgexa_cli/daemon.py

@@ -555,7 +555,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.21.8"
+DAEMON_VERSION = "1.22.0"
 
 
 def _detect_client_type() -> str:
@@ -990,6 +990,12 @@ class TaskInfo:
     requirement_key: str | None = None
     graph_type: str = "execution"
     analysis_branch: str | None = None
+    # Explicit workspace baseline resolved server-side (SI-887).  When set,
+    # these override the legacy requirement_key-based branch derivation:
+    #   "requirement_branch" -> checkout workspace_branch, fail closed
+    #   "default_branch"     -> detached HEAD at origin/workspace_branch, never push
+    workspace_source_mode: str | None = None
+    workspace_branch: str | None = None
 
 
 @dataclass
@@ -2375,7 +2381,22 @@ class WorkspaceManager:
 
         # Use human-readable branch name feature/{requirement_key}
         # when requirement_key is available; fallback to feature/{workspace_key}
-        if task.requirement_key:
+        #
+        # Explicit server-resolved baseline (SI-887) takes precedence over the
+        # legacy requirement_key derivation:
+        #   - "requirement_branch": checkout the given branch, fail closed.
+        #   - "default_branch": detached HEAD at origin/<branch> (QA read-only
+        #     context) — never probe feature/{key}, never push.
+        ws_source_mode = task.workspace_source_mode
+        detach_head = ws_source_mode == "default_branch"
+        if ws_source_mode == "requirement_branch":
+            branch_name = task.workspace_branch or (
+                f"feature/{task.requirement_key}" if task.requirement_key
+                else f"feature/{workspace_key}"
+            )
+        elif detach_head:
+            branch_name = task.workspace_branch or default_branch
+        elif task.requirement_key:
             branch_name = f"feature/{task.requirement_key}"
         else:
             branch_name = f"feature/{workspace_key}"
@@ -2408,16 +2429,25 @@ class WorkspaceManager:
             # reflects the branch from a *previous* analysis run (e.g. a prior Copilot
             # analysis) which may have been deleted as part of the fresh restart.
             # Only refine/continuation tasks require the branch to already exist.
-            expect_branch = (not is_fresh_start) and (
-                bool(task.analysis_branch) or (
-                    bool(task.requirement_key) and task.node_type != "analysis"
+            if ws_source_mode == "requirement_branch":
+                # Server-resolved requirement baseline: the branch must exist.
+                expect_branch = True
+            elif detach_head:
+                # Server-resolved default-branch baseline: read-only QA context,
+                # never fail closed on the delivery branch protection.
+                expect_branch = False
+            else:
+                expect_branch = (not is_fresh_start) and (
+                    bool(task.analysis_branch) or (
+                        bool(task.requirement_key) and task.node_type != "analysis"
+                    )
                 )
-            )
             ws_path = await self._create_worktree(
                 project_dir, repo_url, default_branch, workspace_key, branch_name,
                 fresh_start=is_fresh_start,
                 project_key=project_key,
                 expect_branch=expect_branch,
+                detach_head=detach_head,
             )
             # After workspace creation, perform a final branch-specific fetch + reset
             # to ensure the working tree is at the absolute latest remote state.
@@ -2427,7 +2457,9 @@ class WorkspaceManager:
             #      may have pushed commits while this runtime's agent was executing.
             #      A final sync here keeps the workspace current so the agent works
             #      on the latest codebase and avoids non-fast-forward push failures.
-            if not is_fresh_start:
+            # Skipped for detach_head (default-branch QA baseline): the detached
+            # worktree path already fetched and pinned HEAD to origin/<branch>.
+            if not is_fresh_start and not detach_head:
                 sync_success = False
                 sync_error = ""
                 try:
@@ -2893,10 +2925,163 @@ class WorkspaceManager:
                 self._worktree_locks[key] = asyncio.Lock()
             return self._worktree_locks[key]
 
+    async def _refresh_or_invalidate_detached_worktree(
+        self, main_repo: Path, ws_path: Path, branch_name: str, *, project_key: str,
+    ) -> bool:
+        """Refresh an existing healthy detached-mode worktree onto origin/<branch_name>.
+
+        Returns True when the worktree was successfully refreshed/re-pinned and
+        the caller should reuse it as-is. Returns False when it was removed and
+        the caller must fall through to full recreation.
+
+        SI-887 review fix: a worktree still checked out on a real local branch
+        (not yet detached) is a leftover requirement_branch-mode checkout from
+        before a baseline switch. That content must never be silently reused
+        just because the refresh fetch below happens to fail — doing so would
+        run the job against the wrong baseline entirely, not merely stale
+        content. Only an already-detached worktree (same-mode refresh) may
+        tolerate a fetch failure, matching the daemon's existing tolerance of
+        transient fetch errors elsewhere when there is no baseline-identity
+        risk.
+        """
+        stale_branch_checkout = False
+        try:
+            await self._git("symbolic-ref", "-q", "HEAD", cwd=ws_path)
+            stale_branch_checkout = True
+        except RuntimeError:
+            pass  # already detached
+
+        try:
+            await self._git(
+                "fetch", "origin",
+                f"{branch_name}:refs/remotes/origin/{branch_name}",
+                cwd=ws_path, timeout=settings.GIT_FETCH_TIMEOUT,
+                project_key=project_key,
+            )
+        except RuntimeError as exc:
+            if not stale_branch_checkout:
+                logger.warning(
+                    "fetch origin/%s failed for QA workspace %s: %s — reusing current checkout",
+                    branch_name, ws_path, exc,
+                )
+                return True
+            logger.warning(
+                "fetch origin/%s failed for QA workspace %s while switching off a "
+                "requirement-branch baseline: %s — discarding the stale checkout "
+                "instead of running this job against the wrong baseline",
+                branch_name, ws_path, exc,
+            )
+            await self._remove_broken_worktree(main_repo, ws_path, ws_path.name)
+            return False
+
+        try:
+            await self._git(
+                "checkout", "-f", "--detach", f"origin/{branch_name}",
+                cwd=ws_path,
+            )
+        except RuntimeError as exc:
+            logger.warning(
+                "Failed to detach QA workspace %s onto origin/%s: %s — recreating",
+                ws_path, branch_name, exc,
+            )
+            await self._remove_broken_worktree(main_repo, ws_path, ws_path.name)
+            return False
+        return True
+
+    async def _create_detached_worktree(
+        self, repo_url: str, main_repo: Path, ws_path: Path, branch_name: str,
+        *, default_branch: str, project_key: str = "default",
+    ) -> Path:
+        """Create or refresh a read-only worktree pinned to origin/<branch_name>.
+
+        Used for server-resolved default-branch QA baselines (SI-887): the
+        worktree is checked out at a DETACHED HEAD so it never collides with
+        the default branch held by _main, never creates/tracks a local branch,
+        and is never pushed.  AI job results flow back via the API only.
+        """
+        if ws_path.exists():
+            if not await self._is_healthy_worktree(ws_path, main_repo=main_repo):
+                logger.warning("Broken worktree detected at %s — removing and recreating", ws_path)
+                await self._remove_broken_worktree(main_repo, ws_path, ws_path.name)
+            else:
+                # Reuse: refresh origin/<branch_name> and re-pin HEAD onto it (or
+                # discard and fall through to full recreation below) — see
+                # _refresh_or_invalidate_detached_worktree for the baseline-switch
+                # safety rationale.
+                if await self._refresh_or_invalidate_detached_worktree(
+                    main_repo, ws_path, branch_name, project_key=project_key,
+                ):
+                    return ws_path
+
+        # Ensure _main exists (single-branch clone of the default branch).
+        if not main_repo.exists():
+            await self._clone_repo(
+                repo_url, main_repo, branch=default_branch, project_key=project_key,
+            )
+        else:
+            # Same interrupted-clone guard as the feature-branch path: without a
+            # valid HEAD / readable tree, worktree add would always fail.
+            try:
+                await self._git("rev-parse", "HEAD", cwd=main_repo)
+                await self._git("rev-parse", "HEAD^{tree}", cwd=main_repo)
+            except RuntimeError:
+                logger.warning(
+                    "_main repo at %s has no valid HEAD (likely interrupted initial clone) "
+                    "— deleting and re-cloning from scratch",
+                    main_repo,
+                )
+                await self._safe_rmtree_main(main_repo)
+                if main_repo.exists():
+                    raise RuntimeError(
+                        f"Cannot re-clone: {main_repo} could not be fully removed "
+                        "(files may be locked by another process). "
+                        "Please stop the daemon, manually delete it, then restart."
+                    )
+                await self._clone_repo(
+                    repo_url, main_repo, branch=default_branch, project_key=project_key,
+                )
+
+        # Refresh origin/<branch_name>.  _main is a single-branch clone of the
+        # default branch and branch_name is the server-resolved baseline
+        # (normally that same default branch); fetch the explicit refspec so
+        # the pin below always has a fresh ref.
+        try:
+            await self._git(
+                "fetch", "origin",
+                f"{branch_name}:refs/remotes/origin/{branch_name}",
+                cwd=main_repo, timeout=settings.GIT_FETCH_TIMEOUT,
+                project_key=project_key,
+            )
+        except RuntimeError as exc:
+            raise RuntimeError(
+                f"Failed to fetch QA baseline branch '{branch_name}' from remote: {exc}"
+            ) from exc
+
+        try:
+            await self._git(
+                "worktree", "add", "--detach", str(ws_path), f"origin/{branch_name}",
+                cwd=main_repo,
+            )
+        except RuntimeError:
+            # A stale worktree registration may linger after a manual delete.
+            await self._git("worktree", "prune", cwd=main_repo)
+            try:
+                await self._git(
+                    "worktree", "add", "--detach", str(ws_path), f"origin/{branch_name}",
+                    cwd=main_repo,
+                )
+            except RuntimeError as exc:
+                self._safe_rmtree(ws_path)
+                raise RuntimeError(
+                    f"Failed to create detached QA workspace at origin/{branch_name}: {exc}"
+                ) from exc
+        return ws_path
+
     async def _create_worktree(
         self, project_dir: Path, repo_url: str, default_branch: str,
         workspace_key: str, branch_name: str, *, fresh_start: bool = False,
         project_key: str = "default", expect_branch: bool = False,
+        detach_head: bool = False,
     ) -> Path:
         # Serialize all _create_worktree calls for the same project to prevent
         # concurrent tasks from racing on _main (shutil.rmtree / git clone / worktree add).
@@ -2908,16 +3093,27 @@ class WorkspaceManager:
                 fresh_start=fresh_start,
                 project_key=project_key,
                 expect_branch=expect_branch,
+                detach_head=detach_head,
             )
 
     async def _create_worktree_impl(
         self, project_dir: Path, repo_url: str, default_branch: str,
         workspace_key: str, branch_name: str, *, fresh_start: bool = False,
         project_key: str = "default", expect_branch: bool = False,
+        detach_head: bool = False,
     ) -> Path:
         main_repo = project_dir / "_main"
         ws_path = project_dir / workspace_key
 
+        if detach_head:
+            # Server-resolved default-branch baseline (SI-887 QA context):
+            # dedicated path that never touches feature/* refs and pins the
+            # worktree to a detached HEAD at origin/<branch_name>.
+            return await self._create_detached_worktree(
+                repo_url, main_repo, ws_path, branch_name,
+                default_branch=default_branch, project_key=project_key,
+            )
+
         if ws_path.exists():
             # Validate that this worktree is healthy (its .git file points to a
             # valid main repo).  Worktrees break when directories are moved.
@@ -9540,6 +9736,13 @@ class RuntimeDaemon:
         user_prompt = aj.get("user_prompt", "")
         input_ctx = aj.get("input_context", {})
         ai_workspace_scope = _resolve_ai_job_workspace_scope(aj)
+        # Server-resolved QA workspace baseline (SI-887).  Top-level field wins;
+        # the input_context copy is the fallback for older payload shapes.
+        # When absent, prepare_workspace keeps its legacy requirement_key
+        # derivation so this daemon stays compatible with older servers.
+        qa_ws_source = aj.get("qa_workspace_source") or (
+            input_ctx.get("qa_workspace_source") if isinstance(input_ctx, dict) else None
+        ) or {}
 
         reporter_url = f"{conn.server_url.rstrip('/')}/api/v1/runtimes/{conn.runtime_id}/ai-jobs/{job_id}"
         # Use workspace-level key (project:requirement or project:job_id) so AI jobs
@@ -9615,6 +9818,8 @@ class RuntimeDaemon:
                 requirement_workflow_id=None,
                 requirement_key=requirement_key,
                 graph_type="ai_job",
+                workspace_source_mode=qa_ws_source.get("mode"),
+                workspace_branch=qa_ws_source.get("branch"),
             )
             workspace_path = await self.workspace_manager.prepare_workspace(
                 project_info, fake_task,

{forgexa_cli-1.21.8 → forgexa_cli-1.22.0}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.21.8
+Version: 1.22.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.21.8 → forgexa_cli-1.22.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.21.8"
+version = "1.22.0"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"