forgexa-cli 1.22.5__tar.gz → 1.23.0__tar.gz

{forgexa_cli-1.22.5 → forgexa_cli-1.23.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.22.5
+Version: 1.23.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.22.5 → forgexa_cli-1.23.0}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.22.5"
+__version__ = "1.23.0"

{forgexa_cli-1.22.5 → forgexa_cli-1.23.0}/forgexa_cli/daemon.py

@@ -29,6 +29,8 @@ if sys.version_info < (3, 9):
 
 import asyncio
 import base64
+import errno
+import fnmatch
 import hashlib
 import json
 import logging
@@ -555,7 +557,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.22.5"
+DAEMON_VERSION = "1.23.0"
 
 
 def _detect_client_type() -> str:
@@ -1948,6 +1950,66 @@ class AgentDiscovery:
             logger.warning("bwrap probe error: %s", exc)
 
 
+class _WorkspaceFileLock:
+    """Advisory lock shared by daemon processes using one workspace root."""
+
+    def __init__(self, path: Path):
+        self.path = path
+        self._handle: Any | None = None
+
+    async def acquire(self) -> None:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._handle = open(self.path, "a+b")
+        waiting = False
+
+        try:
+            if sys.platform == "win32":
+                self._handle.seek(0)
+                if not self._handle.read(1):
+                    self._handle.write(b"\0")
+                    self._handle.flush()
+
+            while True:
+                try:
+                    self._handle.seek(0)
+                    if sys.platform == "win32":
+                        import msvcrt
+
+                        msvcrt.locking(self._handle.fileno(), msvcrt.LK_NBLCK, 1)
+                    elif fcntl is not None:
+                        fcntl.flock(self._handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+                    else:
+                        raise RuntimeError("Workspace file locking is unavailable on this platform")
+                    return
+                except OSError as exc:
+                    if exc.errno not in (errno.EACCES, errno.EAGAIN):
+                        raise
+                    if not waiting:
+                        logger.info("Waiting for workspace lock at %s", self.path)
+                        waiting = True
+                    await asyncio.sleep(0.1)
+        except BaseException:
+            self.release()
+            raise
+
+    def release(self) -> None:
+        handle, self._handle = self._handle, None
+        if handle is None:
+            return
+        try:
+            handle.seek(0)
+            if sys.platform == "win32":
+                import msvcrt
+
+                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+            elif fcntl is not None:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+        except OSError:
+            pass
+        finally:
+            handle.close()
+
+
 class WorkspaceManager:
     """Manages isolated workspaces per task using git worktrees."""
 
@@ -1966,6 +2028,32 @@ class WorkspaceManager:
 
         self._dirs_ready = False
 
+    @staticmethod
+    def _workspace_key(task: TaskInfo) -> str:
+        if task.requirement_workflow_id:
+            return re.sub(r"[^a-zA-Z0-9_-]", "_", task.requirement_workflow_id)
+        return re.sub(r"[^a-zA-Z0-9_-]", "_", str(task.graph_id))
+
+    async def _acquire_file_lock(self, lock_path: Path) -> _WorkspaceFileLock:
+        lock = _WorkspaceFileLock(lock_path)
+        await lock.acquire()
+        return lock
+
+    async def _acquire_project_worktree_lock(self, project_dir: Path) -> _WorkspaceFileLock:
+        return await self._acquire_file_lock(project_dir / ".forgexa-worktree.lock")
+
+    async def acquire_workspace_execution_lock(
+        self,
+        project: dict,
+        task: TaskInfo,
+    ) -> _WorkspaceFileLock:
+        self._ensure_dirs()
+        project_key = str(project.get("project_key") or "default")
+        project_dir = self.projects_root / project_key
+        return await self._acquire_file_lock(
+            project_dir / ".forgexa-workspace-locks" / f"{self._workspace_key(task)}.lock"
+        )
+
     def _ensure_dirs(self) -> None:
         """Lazy initialization of workspace directories.
 
@@ -2376,10 +2464,7 @@ class WorkspaceManager:
         # analysis, execution, and fix graphs for the same requirement share
         # one directory and git worktree (C-2 / D-1 workspace reuse).
         # Fall back to graph_id for backward compatibility.
-        if task.requirement_workflow_id:
-            workspace_key = re.sub(r"[^a-zA-Z0-9_-]", "_", task.requirement_workflow_id)
-        else:
-            workspace_key = re.sub(r"[^a-zA-Z0-9_-]", "_", str(task.graph_id))
+        workspace_key = self._workspace_key(task)
 
         # Use human-readable branch name feature/{requirement_key}
         # when requirement_key is available; fallback to feature/{workspace_key}
@@ -2554,7 +2639,13 @@ class WorkspaceManager:
             await self._git("config", "core.filemode", "false", cwd=ws_path)
             return ws_path
 
-    async def _is_healthy_worktree(self, ws_path: Path, main_repo: Path | None = None) -> bool:
+    async def _is_healthy_worktree(
+        self,
+        ws_path: Path,
+        main_repo: Path | None = None,
+        *,
+        require_unlocked: bool = False,
+    ) -> bool:
         """Check if a git worktree directory is a valid *linked* worktree.
 
         A linked git worktree has .git as a FILE containing a gitdir pointer to
@@ -2610,6 +2701,8 @@ class WorkspaceManager:
                         gitdir.resolve().relative_to(expected_wt_root)
                     except ValueError:
                         return False
+                if require_unlocked and (gitdir / "index.lock").exists():
+                    return False
                 return True
         except OSError:
             pass
@@ -2686,6 +2779,7 @@ class WorkspaceManager:
         branch_name: str,
         *,
         healthy_only: bool = True,
+        require_unlocked: bool = False,
     ) -> Path | None:
         """Return a linked worktree already on branch_name."""
         try:
@@ -2715,7 +2809,11 @@ class WorkspaceManager:
                 continue
             if not healthy_only:
                 return candidate_path
-            if candidate_path.exists() and await self._is_healthy_worktree(candidate_path, main_repo=main_repo):
+            if candidate_path.exists() and await self._is_healthy_worktree(
+                candidate_path,
+                main_repo=main_repo,
+                require_unlocked=require_unlocked,
+            ):
                 return candidate_path
 
         return None
@@ -3100,14 +3198,18 @@ class WorkspaceManager:
         # concurrent tasks from racing on _main (shutil.rmtree / git clone / worktree add).
         project_lock = await self._get_project_lock(project_dir)
         async with project_lock:
-            return await self._create_worktree_impl(
-                project_dir, repo_url, default_branch,
-                workspace_key, branch_name,
-                fresh_start=fresh_start,
-                project_key=project_key,
-                expect_branch=expect_branch,
-                detach_head=detach_head,
-            )
+            file_lock = await self._acquire_project_worktree_lock(project_dir)
+            try:
+                return await self._create_worktree_impl(
+                    project_dir, repo_url, default_branch,
+                    workspace_key, branch_name,
+                    fresh_start=fresh_start,
+                    project_key=project_key,
+                    expect_branch=expect_branch,
+                    detach_head=detach_head,
+                )
+            finally:
+                file_lock.release()
 
     async def _create_worktree_impl(
         self, project_dir: Path, repo_url: str, default_branch: str,
@@ -3130,7 +3232,11 @@ class WorkspaceManager:
         if ws_path.exists():
             # Validate that this worktree is healthy (its .git file points to a
             # valid main repo).  Worktrees break when directories are moved.
-            if not await self._is_healthy_worktree(ws_path, main_repo=main_repo):
+            if not await self._is_healthy_worktree(
+                ws_path,
+                main_repo=main_repo,
+                require_unlocked=fresh_start,
+            ):
                 logger.warning("Broken worktree detected at %s — removing and recreating", ws_path)
                 await self._remove_broken_worktree(main_repo, ws_path, workspace_key)
             else:
@@ -3605,6 +3711,19 @@ class WorkspaceManager:
         # that `git worktree add ... {default_branch}` uses latest code.
         # We fetch first, then update the local ref directly (avoids
         # needing to checkout default_branch which may conflict with worktrees).
+        try:
+            await self._git(
+                "fetch", "origin",
+                f"{default_branch}:refs/remotes/origin/{default_branch}",
+                cwd=main_repo,
+                timeout=settings.GIT_FETCH_TIMEOUT,
+                project_key=project_key,
+            )
+        except RuntimeError as exc:
+            raise RuntimeError(
+                f"Failed to fetch default branch '{default_branch}' from remote: {exc}"
+            ) from exc
+
         try:
             await self._git(
                 "update-ref", f"refs/heads/{default_branch}",
@@ -3815,7 +3934,7 @@ class WorkspaceManager:
             # feature ref behind. Attaching that ref would resurrect stale
             # requirement history, so reset it explicitly.
             existing_branch_worktree = await self._find_existing_worktree_for_branch(
-                main_repo, branch_name,
+                main_repo, branch_name, require_unlocked=True,
             )
             if existing_branch_worktree is not None:
                 logger.info(
@@ -3839,7 +3958,7 @@ class WorkspaceManager:
                 )
             except Exception as exc:
                 existing_branch_worktree = await self._find_existing_worktree_for_branch(
-                    main_repo, branch_name,
+                    main_repo, branch_name, require_unlocked=True,
                 )
                 if existing_branch_worktree is not None:
                     logger.info(
@@ -4087,6 +4206,13 @@ class WorkspaceManager:
         )
         try:
             stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=timeout)
+        except asyncio.CancelledError:
+            _kill_proc(proc)
+            try:
+                await asyncio.shield(asyncio.wait_for(proc.wait(), timeout=5.0))
+            except Exception:
+                pass
+            raise
         except (TimeoutError, asyncio.TimeoutError):
             # Kill the entire process group so that SSH (and any other
             # child processes git may have spawned) are also terminated.
@@ -7928,6 +8054,10 @@ class RuntimeDaemon:
         self._project_execution_locks_mu: asyncio.Lock = asyncio.Lock()
         self._shutdown = False
 
+        # Deployment merge worktree GC: runs at most every 6 hours.
+        self._last_merge_gc: float = 0.0
+        self._MERGE_GC_INTERVAL = 6 * 3600  # seconds
+
         self.connections: list[ServerConnection] = []
         self.agent_discovery = AgentDiscovery()
         self.workspace_manager = WorkspaceManager(self.workspaces_root)
@@ -8390,6 +8520,14 @@ class RuntimeDaemon:
         """Poll for tasks from all connected servers and execute them."""
         had_work = False
 
+        # Opportunistic GC: remove old deploy-merge worktrees (throttled internally).
+        try:
+            await self._cleanup_old_merge_worktrees(
+                self.connections[0] if self.connections else None
+            )
+        except Exception:
+            pass  # GC failure must never block the poll loop
+
         def _cancel_server_requested_ai_jobs(conn: ServerConnection) -> None:
             for job_id in conn.poller.cancelled_ai_job_ids:
                 ai_task_key = f"aijob_{job_id}"
@@ -8601,6 +8739,7 @@ class RuntimeDaemon:
                 project_lock_key,
             )
         await project_lock.acquire()
+        workspace_execution_lock: _WorkspaceFileLock | None = None
         try:
             # 1. Find the right agent
             agent = self._select_agent(task.agent_type, task.fallback_chain)
@@ -8624,6 +8763,11 @@ class RuntimeDaemon:
                 ))
                 return
 
+            workspace_execution_lock = await self.workspace_manager.acquire_workspace_execution_lock(
+                task.project,
+                task,
+            )
+
             # Track which agents we've already tried (for rate-limit fallback)
             tried_agents: set[str] = set()
 
@@ -9362,6 +9506,8 @@ class RuntimeDaemon:
                 error=str(e),
             ))
         finally:
+            if workspace_execution_lock is not None:
+                workspace_execution_lock.release()
             project_lock.release()
 
     def _select_fallback_agent(
@@ -9840,6 +9986,626 @@ class RuntimeDaemon:
 
         return issues
 
+    def _merge_job_index_path(self) -> Path:
+        return Path(self.workspaces_root) / "deploy-merge-jobs.json"
+
+    def _load_merge_job_index(self) -> dict:
+        """Load the merge_job_id → project_id index recorded by merge jobs."""
+        try:
+            p = self._merge_job_index_path()
+            if p.exists():
+                data = json.loads(p.read_text())
+                if isinstance(data, dict):
+                    return data
+        except Exception:
+            pass
+        return {}
+
+    def _record_merge_job(self, merge_job_id: str, project_id: str) -> None:
+        """Persist merge_job_id → project_id so GC can query eligibility later."""
+        if not merge_job_id or not project_id:
+            return
+        try:
+            index = self._load_merge_job_index()
+            index[merge_job_id] = {"project_id": project_id, "recorded_at": time.time()}
+            # Bound the index size by dropping the oldest entries.
+            if len(index) > 500:
+                oldest = sorted(index, key=lambda k: index[k].get("recorded_at", 0))
+                for k in oldest[: len(index) - 500]:
+                    index.pop(k, None)
+            self._merge_job_index_path().write_text(json.dumps(index))
+        except Exception as exc:
+            logger.debug("deployment_merge: failed to record merge job index: %s", exc)
+
+    async def _cleanup_old_merge_worktrees(self, conn: "ServerConnection | None" = None) -> int:
+        """Remove deploy-merge-* worktrees the server marks as GC-eligible.
+
+        Retention policy (design 5.6): worktrees of terminal jobs (succeeded /
+        failed / cancelled / superseded) become eligible after 7 days, while
+        conflict_needs_human / precheck_failed jobs are retained permanently
+        until a human finishes handling them. The daemon never decides
+        eligibility from mtime alone — it asks the server which job IDs are
+        safe to collect. If the server is unreachable the whole round is
+        skipped and nothing is deleted. A 30-day orphan fallback guards
+        against disk leaks from worktrees the server no longer knows about.
+        """
+        import time as _time
+        now = _time.time()
+        if now - self._last_merge_gc < self._MERGE_GC_INTERVAL:
+            return 0
+        self._last_merge_gc = now
+
+        # Discover candidate worktrees: {workspaces_root}/{project}/deploy-merge-{job_id}
+        candidates: list[tuple[Path, Path, str, float]] = []  # (project_dir, wt_dir, job_id, mtime)
+        try:
+            ws_root = Path(self.workspaces_root)
+            if not ws_root.exists():
+                return 0
+            for project_dir in ws_root.iterdir():
+                if not project_dir.is_dir():
+                    continue
+                for wt_dir in project_dir.iterdir():
+                    if not wt_dir.is_dir():
+                        continue
+                    name = wt_dir.name
+                    # Match deploy-merge-{job_id} pattern
+                    if not name.startswith("deploy-merge-"):
+                        continue
+                    try:
+                        mtime = wt_dir.stat().st_mtime
+                    except Exception:
+                        mtime = now
+                    candidates.append((project_dir, wt_dir, name[len("deploy-merge-"):], mtime))
+        except Exception as exc:
+            logger.warning("deployment_merge GC: scan failed: %s", exc)
+            return 0
+        if not candidates:
+            return 0
+
+        if conn is None:
+            logger.warning("deployment_merge GC: no server connection — skipping this round")
+            return 0
+
+        # Ask the server which jobs are safe to collect. Any request failure
+        # aborts the whole round: never delete while eligibility is unknown.
+        index = self._load_merge_job_index()
+        project_ids = {
+            str(index[jid].get("project_id"))
+            for _, _, jid, _ in candidates
+            if jid in index and index[jid].get("project_id")
+        }
+        eligible: set[str] = set()
+        for pid in sorted(project_ids):
+            try:
+                resp = await conn.client.get(
+                    f"{conn.server_url}/api/v1/projects/{pid}/deployment-trains/jobs/gc-eligible",
+                    timeout=10,
+                )
+                if resp.status_code != 200:
+                    logger.warning(
+                        "deployment_merge GC: gc-eligible query for project %s returned %s — skipping this round",
+                        pid, resp.status_code,
+                    )
+                    return 0
+                eligible.update(str(j) for j in resp.json().get("eligible_job_ids", []))
+            except Exception as exc:
+                logger.warning(
+                    "deployment_merge GC: server unreachable (%s) — skipping this round", exc,
+                )
+                return 0
+
+        orphan_cutoff = now - (30 * 24 * 3600)  # 30 days ago
+        removed = 0
+        for project_dir, wt_dir, job_id, mtime in candidates:
+            is_eligible = job_id in eligible
+            is_orphan = not is_eligible and mtime < orphan_cutoff
+            if not is_eligible and not is_orphan:
+                continue
+            main_repo = project_dir / "_main"
+            try:
+                removed_ok = False
+                if main_repo.exists():
+                    try:
+                        await self.workspace_manager._git(
+                            "worktree", "remove", "--force", str(wt_dir), cwd=main_repo,
+                        )
+                        removed_ok = True
+                    except RuntimeError:
+                        removed_ok = False
+                if not removed_ok:
+                    shutil.rmtree(wt_dir, ignore_errors=True)
+                    if main_repo.exists():
+                        try:
+                            await self.workspace_manager._git("worktree", "prune", cwd=main_repo)
+                        except RuntimeError:
+                            pass
+                removed += 1
+                index.pop(job_id, None)
+                logger.info(
+                    "deployment_merge GC: removed worktree %s (eligible=%s, orphan=%s, age=%.0f days)",
+                    wt_dir, is_eligible, is_orphan, (now - mtime) / 86400,
+                )
+            except Exception as exc:
+                logger.debug("deployment_merge GC: skip %s: %s", wt_dir, exc)
+            # Best-effort remote candidate branch cleanup (non-fatal).
+            if main_repo.exists():
+                try:
+                    await self.workspace_manager._git(
+                        "push", "origin", "--delete", f"merge-candidate/{job_id}", cwd=main_repo,
+                    )
+                except RuntimeError as exc:
+                    logger.debug(
+                        "deployment_merge GC: remote branch delete failed for %s: %s", job_id, exc,
+                    )
+        if removed:
+            try:
+                self._merge_job_index_path().write_text(json.dumps(index))
+            except Exception:
+                pass
+            logger.info("deployment_merge GC: removed %d worktree(s)", removed)
+        return removed
+
+    async def _execute_deployment_merge_job(self, aj: dict, conn: "ServerConnection"):
+        """Execute a deployment_merge AIJob: git merge + conflict resolution.
+
+        Phase 2: merges the requirement's frozen source SHA onto the integration
+        branch candidate ref, detects conflicts, and attempts batched AI
+        conflict resolution (10 files per batch, up to 3 batches). Conflicts
+        touching sensitive paths, or left unresolved after all batches, are
+        aborted and reported as conflict_needs_human. Resolved/clean candidates
+        pass a deterministic precheck (no residual conflict markers, clean
+        working tree), are pushed to origin as merge-candidate/{merge_job_id},
+        and the structured result is reported back.
+        """
+        job_id = aj.get("job_id", "")
+        input_ctx = aj.get("input_context", {}) or {}
+        project_info = aj.get("project", {}) or {}
+        reporter_url = f"{conn.server_url.rstrip('/')}/api/v1/runtimes/{conn.runtime_id}/ai-jobs/{job_id}"
+
+        merge_job_id = input_ctx.get("deployment_merge_job_id", "")
+        integration_branch = input_ctx.get("integration_branch", "")
+        source_commit_sha = input_ctx.get("source_commit_sha", "")
+        source_branch = input_ctx.get("source_branch", "")
+        base_integration_sha = input_ctx.get("base_integration_sha")
+        default_branch = input_ctx.get("default_branch", "main")
+        agent_type = input_ctx.get("agent_type", "claude")
+        fallback_chain = input_ctx.get("fallback_chain", [])
+        timeout_seconds = min(int(input_ctx.get("timeout_seconds", 300)), 300)
+        sensitive_patterns = input_ctx.get("sensitive_path_patterns") or []
+        candidate_ref = f"refs/heads/merge-candidate/{merge_job_id}"
+
+        # Record merge_job_id → project_id so GC can query eligibility later.
+        self._record_merge_job(merge_job_id, str(input_ctx.get("project_id") or ""))
+
+        async def _report(result: dict, status: str = "completed", error: str = ""):
+            payload = {"status": status, "output_result": result}
+            if error:
+                payload["error"] = error[:1000]
+                payload["failure_code"] = result.get("merge_outcome", "merge_failed")
+            try:
+                await conn.client.post(f"{reporter_url}/complete", json=payload, timeout=15)
+            except Exception:
+                logger.warning("deployment_merge: failed to report result for job %s", job_id)
+
+        await conn.client.post(
+            f"{reporter_url}/progress",
+            json={"current_phase": "preparing", "current_step": "Preparing merge workspace...", "progress_pct": 5},
+            timeout=10,
+        )
+
+        fake_task = TaskInfo(
+            task_id=job_id,
+            graph_id=f"deploy-merge-{merge_job_id}",
+            node_type="deployment_merge",
+            agent_type=agent_type,
+            input_prompt="",
+            input_data={},
+            timeout_seconds=timeout_seconds,
+            max_retries=0,
+            retry_count=0,
+            project=project_info,
+            work_item={},
+            fallback_chain=fallback_chain or [],
+        )
+
+        _proj_key = project_info.get("project_key") or str(project_info.get("id") or "default")
+        project_lock = await self._get_project_execution_lock(f"{_proj_key}:deploy-merge-{merge_job_id}")
+        await project_lock.acquire()
+
+        try:
+            workspace_path = await self.workspace_manager.prepare_workspace(project_info, fake_task)
+            git = self.workspace_manager._git
+            _git_name, _git_email = _resolve_git_author(project_info)
+
+            await conn.client.post(
+                f"{reporter_url}/progress",
+                json={"current_phase": "merging", "current_step": f"Merging into {integration_branch}...", "progress_pct": 25},
+                timeout=10,
+            )
+
+            # Fetch latest refs.
+            await git("fetch", "origin", cwd=workspace_path)
+
+            # Determine base SHA: use recorded base, else default branch HEAD.
+            if base_integration_sha:
+                base_ref = base_integration_sha
+            else:
+                try:
+                    base_ref = (await git("rev-parse", f"origin/{default_branch}", cwd=workspace_path)).strip()
+                except RuntimeError:
+                    base_ref = "HEAD"
+
+            # Detach HEAD to the base, creating a clean starting point for the candidate.
+            await git("checkout", "--detach", base_ref, cwd=workspace_path)
+
+            # Resolve source SHA from branch name if not already a SHA.
+            if not source_commit_sha and source_branch:
+                try:
+                    source_commit_sha = (await git("rev-parse", f"origin/{source_branch}", cwd=workspace_path)).strip()
+                except RuntimeError:
+                    pass
+            if not source_commit_sha:
+                await _report({"merge_outcome": "conflict_needs_human"}, status="failed", error="Cannot resolve source commit SHA")
+                return
+
+            # Attempt the merge.
+            try:
+                await git(
+                    "-c", f"user.name={_git_name}",
+                    "-c", f"user.email={_git_email}",
+                    "merge", "--no-ff", "--no-edit", "-m", f"deploy-merge: {source_branch or source_commit_sha[:8]}",
+                    source_commit_sha,
+                    cwd=workspace_path,
+                )
+                merge_conflicted = False
+            except RuntimeError:
+                merge_conflicted = True
+
+            # Check for unresolved conflicts.
+            try:
+                diff_u = await git("diff", "--name-only", "--diff-filter=U", cwd=workspace_path)
+            except RuntimeError:
+                diff_u = ""
+            conflicted_files = [f.strip() for f in diff_u.strip().splitlines() if f.strip()]
+
+            resolved_agent_id: str | None = None
+            if merge_conflicted or conflicted_files:
+                # Sensitive path policy (design 5.5.3): any conflicted file
+                # matching a sensitive path pattern must go to a human — AI
+                # resolution is disallowed by project policy.
+                sensitive_hits = [
+                    (f, p)
+                    for f in conflicted_files
+                    for p in sensitive_patterns
+                    if fnmatch.fnmatchcase(f, p)
+                ]
+                if sensitive_hits:
+                    hit_notes = "; ".join(f"{f} matches '{p}'" for f, p in sensitive_hits[:20])
+                    logger.warning(
+                        "deployment_merge: job %s hit sensitive path(s) — forcing human review: %s",
+                        job_id, hit_notes,
+                    )
+                    try:
+                        await git("merge", "--abort", cwd=workspace_path)
+                    except RuntimeError:
+                        await git("reset", "--hard", "HEAD", cwd=workspace_path)
+                    await _report({
+                        "merge_outcome": "conflict_needs_human",
+                        "conflicted_files": conflicted_files[:30],
+                        "candidate_ref": candidate_ref,
+                        "base_integration_sha": base_ref,
+                        "ai_resolution_notes": (
+                            "sensitive path(s) matched — AI resolution disallowed "
+                            f"by project policy: {hit_notes}"
+                        ),
+                    })
+                    return
+
+                # Conflicts detected — attempt AI resolution before falling back to human.
+                logger.info(
+                    "deployment_merge: job %s has %d conflict(s), attempting AI resolution: %s",
+                    job_id, len(conflicted_files), ", ".join(conflicted_files[:10]),
+                )
+
+                # Requirement context prefix shared by all batch prompts
+                # (design 5.4.2 contract (d)).
+                req_context_lines: list[str] = []
+                req_key = input_ctx.get("requirement_key") or ""
+                req_title = input_ctx.get("requirement_title") or ""
+                req_summary = input_ctx.get("requirement_summary") or ""
+                if req_key or req_title:
+                    req_context_lines.append(
+                        f"Source requirement: {req_key} — {req_title}".rstrip(" —")
+                    )
+                if req_summary:
+                    req_context_lines.append(f"Requirement summary: {req_summary}")
+                req_context_lines.append(
+                    f"Candidate baseline SHA: {base_integration_sha or base_ref}"
+                )
+                member_ledger = input_ctx.get("member_ledger") or []
+                if member_ledger:
+                    req_context_lines.append(
+                        "Independent requirements already on the integration branch:\n"
+                        + "\n".join(f"- {m}" for m in member_ledger)
+                    )
+                req_context = "\n".join(req_context_lines) + "\n\n"
+
+                # Batched AI resolution: up to 3 batches of 10 files each,
+                # re-checking remaining conflicts after every batch.
+                MAX_SNIPPET_CHARS = 3000
+                MAX_BATCH_FILES = 10
+                MAX_BATCHES = 3
+                remaining = list(conflicted_files)
+                for batch_no in range(1, MAX_BATCHES + 1):
+                    if not remaining:
+                        break
+
+                    await conn.client.post(
+                        f"{reporter_url}/progress",
+                        json={
+                            "current_phase": "ai_resolving",
+                            "current_step": (
+                                f"AI resolving conflicts (batch {batch_no}/{MAX_BATCHES}, "
+                                f"{len(remaining)} remaining)..."
+                            ),
+                            "progress_pct": 40,
+                        },
+                        timeout=10,
+                    )
+
+                    # Read conflict file contents for this batch (3000 chars each).
+                    files_to_read = remaining[:MAX_BATCH_FILES]
+                    conflict_snippets: list[str] = []
+                    for fpath in files_to_read:
+                        full_path = workspace_path / fpath
+                        if full_path.exists():
+                            try:
+                                content = full_path.read_text(errors="replace")
+                                if len(content) > MAX_SNIPPET_CHARS:
+                                    content = content[:MAX_SNIPPET_CHARS] + "\n... (truncated)"
+                                conflict_snippets.append(f"### {fpath}\n```\n{content}\n```")
+                            except Exception:
+                                conflict_snippets.append(f"### {fpath}\n(could not read)")
+                        else:
+                            conflict_snippets.append(f"### {fpath}\n(file not found)")
+
+                    # Build the deployment-merge conflict resolution prompt.
+                    # Key difference from the existing _ai_resolve_conflicts prompt:
+                    # this is NOT "your branch behind main" — both sides are equally
+                    # valid independent requirements that must be composed, not chosen.
+                    resolve_prompt = (
+                        req_context
+                        + f"CONTEXT: You are merging a frozen change for an independent "
+                        f"requirement (source: {source_branch or source_commit_sha[:8]}) "
+                        f"into a candidate integration version that already contains "
+                        f"other independent requirements. Both sides are equally valid "
+                        f"product changes.\n\n"
+                        f"GOAL: Preserve and correctly compose both requirements. "
+                        f"Do NOT choose one side merely because it is newer or shorter. "
+                        f"Do not add unrelated features. Remove ALL conflict markers "
+                        f"(<<<<<<< HEAD, =======, >>>>>>>).\n\n"
+                        f"FAILURE CONTRACT: If the intents cannot safely coexist, leave "
+                        f"the Git conflict unresolved. Do not replace a conflict with a "
+                        f"TODO, comment, stub, or guessed behavior.\n\n"
+                        f"Conflicted files (batch {batch_no}, "
+                        f"{len(files_to_read)} of {len(remaining)}):\n"
+                        + "\n".join(f"- {f}" for f in files_to_read)
+                        + "\n\n"
+                        + "\n\n".join(conflict_snippets)
+                    )
+
+                    # Select agent and run conflict resolution for this batch.
+                    cr_agent = self._select_agent(agent_type, fallback_chain)
+                    if not cr_agent:
+                        logger.warning(
+                            "deployment_merge: no agent available for conflict resolution (job %s)",
+                            job_id,
+                        )
+                        break
+                    _cr_tried: set[str] = {cr_agent.agent_id}
+                    _cr_task = TaskInfo(
+                        task_id=f"{job_id}-conflict-resolve-{batch_no}",
+                        graph_id=f"deploy-merge-{merge_job_id}",
+                        node_type="conflict_resolution",
+                        agent_type=cr_agent.agent_id,
+                        input_prompt=resolve_prompt,
+                        input_data={},
+                        timeout_seconds=timeout_seconds,
+                        max_retries=0,
+                        retry_count=0,
+                        project=project_info,
+                        work_item={},
+                        fallback_chain=fallback_chain or [],
+                    )
+                    try:
+                        cr_result = await self.process_manager.run_agent(
+                            cr_agent, _cr_task, workspace_path,
+                        )
+                        # Rate-limit fallback loop.
+                        while self.process_manager.is_rate_limited(cr_result):
+                            _cr_fallback = self._select_fallback_agent(
+                                cr_agent.agent_id, fallback_chain, _cr_tried,
+                            )
+                            if not _cr_fallback:
+                                logger.warning(
+                                    "deployment_merge: all agents rate-limited for job %s",
+                                    job_id,
+                                )
+                                break
+                            logger.warning(
+                                "deployment_merge: agent '%s' rate-limited, falling back to '%s'",
+                                cr_agent.agent_id, _cr_fallback.agent_id,
+                            )
+                            cr_agent = _cr_fallback
+                            _cr_tried.add(cr_agent.agent_id)
+                            _cr_task.agent_type = cr_agent.agent_id
+                            cr_result = await self.process_manager.run_agent(
+                                cr_agent, _cr_task, workspace_path,
+                            )
+                        if not self.process_manager.is_rate_limited(cr_result):
+                            # Remember the last agent that actually ran to completion.
+                            resolved_agent_id = cr_agent.agent_id
+                    except Exception as exc:
+                        logger.warning(
+                            "deployment_merge: AI resolution exception for job %s: %s",
+                            job_id, exc,
+                        )
+                        break
+
+                    # Re-check remaining conflicts after this batch.
+                    try:
+                        diff_u = await git("diff", "--name-only", "--diff-filter=U", cwd=workspace_path)
+                        remaining = [
+                            f.strip() for f in diff_u.strip().splitlines() if f.strip()
+                        ]
+                    except RuntimeError:
+                        pass  # keep the previous remaining list
+
+                resolution_succeeded = not remaining
+                if not resolution_succeeded:
+                    logger.warning(
+                        "deployment_merge: AI could not resolve all conflicts "
+                        "(%d remaining after %d batch(es)) for job %s",
+                        len(remaining), MAX_BATCHES, job_id,
+                    )
+                    # AI failed or unavailable — abort and report for human.
+                    try:
+                        await git("merge", "--abort", cwd=workspace_path)
+                    except RuntimeError:
+                        await git("reset", "--hard", "HEAD", cwd=workspace_path)
+                    await _report({
+                        "merge_outcome": "conflict_needs_human",
+                        "conflicted_files": (remaining or conflicted_files)[:30],
+                        "candidate_ref": candidate_ref,
+                        "base_integration_sha": base_ref,
+                    })
+                    return
+
+                # All conflicts resolved — stage resolved files and complete the merge.
+                await git("add", "-A", cwd=workspace_path)
+                try:
+                    await git(
+                        "-c", f"user.name={_git_name}",
+                        "-c", f"user.email={_git_email}",
+                        "commit", "--no-edit",
+                        cwd=workspace_path,
+                    )
+                except RuntimeError:
+                    pass  # merge may have already committed
+                logger.info(
+                    "deployment_merge: AI resolution succeeded for job %s via %s",
+                    job_id, resolved_agent_id,
+                )
+
+                # AI resolution succeeded — falls through to the shared
+                # deterministic precheck + reporting block below.
+
+            # Deterministic precheck: scan for residual conflict markers.
+            # Applies to both clean merges and AI-resolved merges.
+            candidate_sha = (await git("rev-parse", "HEAD", cwd=workspace_path)).strip()
+            marker_proc = await asyncio.create_subprocess_exec(
+                "git", "grep", "-l", "-E", r"^(<<<<<<<|=======|>>>>>>>)",
+                cwd=str(workspace_path),
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.DEVNULL,
+            )
+            marker_stdout, _ = await marker_proc.communicate()
+            marker_files = [f.strip() for f in marker_stdout.decode().strip().splitlines() if f.strip()]
+
+            if marker_files:
+                logger.warning(
+                    "deployment_merge: job %s precheck failed — residual markers in %d file(s)",
+                    job_id, len(marker_files),
+                )
+                await _report({
+                    "merge_outcome": "precheck_failed",
+                    "conflicted_files": marker_files[:30],
+                    "candidate_commit_sha": candidate_sha,
+                })
+                return
+
+            # Deterministic precheck: the working tree must be clean (no
+            # unstaged/staged leftovers) after merge/commit. Untracked files
+            # are ignored — worktrees may contain unrelated artifacts.
+            try:
+                status_out = await git(
+                    "status", "--porcelain", "--untracked-files=no", cwd=workspace_path,
+                )
+            except RuntimeError:
+                status_out = ""
+            dirty_files = [
+                (line[3:].strip() if len(line) > 3 else line.strip())
+                for line in status_out.strip().splitlines()
+                if line.strip()
+            ]
+            if dirty_files:
+                logger.warning(
+                    "deployment_merge: job %s precheck failed — working tree not clean (%d file(s))",
+                    job_id, len(dirty_files),
+                )
+                await _report({
+                    "merge_outcome": "precheck_failed",
+                    "conflicted_files": dirty_files[:30],
+                    "candidate_commit_sha": candidate_sha,
+                })
+                return
+
+            # Push the candidate commit to origin so external CI can check it
+            # out and subsequent merges can fetch it as a base.
+            try:
+                await git("push", "origin", f"HEAD:{candidate_ref}", cwd=workspace_path)
+            except RuntimeError as exc:
+                logger.warning(
+                    "deployment_merge: job %s candidate push failed: %s", job_id, exc,
+                )
+                await _report(
+                    {
+                        "merge_outcome": "precheck_failed",
+                        "candidate_commit_sha": candidate_sha,
+                        "candidate_ref": candidate_ref,
+                    },
+                    status="failed",
+                    error=f"candidate push failed: {exc}",
+                )
+                return
+
+            # Success — determine outcome label.
+            if resolved_agent_id:
+                outcome = "ai_resolved"
+                step_msg = f"AI resolved merge via {resolved_agent_id}"
+            else:
+                outcome = "clean_merged"
+                step_msg = "Merge completed cleanly"
+
+            await conn.client.post(
+                f"{reporter_url}/progress",
+                json={"current_phase": "completed", "current_step": step_msg, "progress_pct": 100},
+                timeout=10,
+            )
+            logger.info(
+                "deployment_merge: job %s %s → %s",
+                job_id, outcome, candidate_sha[:12],
+            )
+            await _report({
+                "merge_outcome": outcome,
+                "resolved_agent": resolved_agent_id,
+                "candidate_commit_sha": candidate_sha,
+                "candidate_ref": candidate_ref,
+                "merge_commit_sha": candidate_sha,
+                "base_integration_sha": base_ref,
+                "source_commit_sha": source_commit_sha,
+            })
+
+        except Exception as exc:
+            logger.error("deployment_merge: job %s exception: %s", job_id, exc)
+            await _report(
+                {"merge_outcome": "conflict_needs_human"},
+                status="failed",
+                error=str(exc),
+            )
+        finally:
+            project_lock.release()
+
     async def _execute_ai_job(self, aj: dict, conn: "ServerConnection"):
         """Execute an AIJob in daemon workspace and report results back.
 
@@ -9848,6 +10614,10 @@ class RuntimeDaemon:
         """
         job_id = aj.get("job_id", "")
         task_type = aj.get("task_type", "unknown")
+        # Deployment merge has a specialized flow (git merge + conflict detection).
+        if task_type == "deployment_merge":
+            await self._execute_deployment_merge_job(aj, conn)
+            return
         project_info = aj.get("project", {})
         requirement_key = aj.get("requirement_key")
         agent_override = aj.get("agent_override")
@@ -9876,6 +10646,7 @@ class RuntimeDaemon:
                 project_lock_key,
             )
         await project_lock.acquire()
+        workspace_execution_lock: _WorkspaceFileLock | None = None
 
         try:
             # Report progress: starting
@@ -9940,6 +10711,10 @@ class RuntimeDaemon:
                 workspace_source_mode=qa_ws_source.get("mode"),
                 workspace_branch=qa_ws_source.get("branch"),
             )
+            workspace_execution_lock = await self.workspace_manager.acquire_workspace_execution_lock(
+                project_info,
+                fake_task,
+            )
             workspace_path = await self.workspace_manager.prepare_workspace(
                 project_info, fake_task,
             )
@@ -10163,6 +10938,8 @@ class RuntimeDaemon:
             except Exception:
                 pass
         finally:
+            if workspace_execution_lock is not None:
+                workspace_execution_lock.release()
             project_lock.release()
 
     async def _collect_workspace_git_info(self, workspace_path: Path) -> dict:

{forgexa_cli-1.22.5 → forgexa_cli-1.23.0}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.22.5
+Version: 1.23.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.22.5 → forgexa_cli-1.23.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.22.5"
+version = "1.23.0"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"