forgexa-cli 1.29.4__tar.gz → 1.30.0__tar.gz

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.29.4
+Version: 1.30.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.29.4"
+__version__ = "1.30.0"

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/forgexa_cli/agent_core.py

@@ -213,11 +213,11 @@ def _redirect_prompt_through_task_file(
         return prompt, None
 
 
-def _agent_process_group_kwargs() -> dict[str, bool]:
-    """Isolate agent process groups where the platform supports POSIX sessions."""
-    # Windows cleanup uses taskkill /T, and starting cmd.exe with a new session
-    # differs from the command path proven during agent discovery.
-    return {"start_new_session": True} if sys.platform != "win32" else {}
+def _agent_process_group_kwargs() -> dict[str, int | bool]:
+    """Return platform-specific subprocess kwargs for headless subprocesses."""
+    if sys.platform == "win32":
+        return {"creationflags": getattr(subprocess, "CREATE_NO_WINDOW", 0)}
+    return {"start_new_session": True}
 
 
 def _parse_semver(v: str) -> tuple[int, int, int] | None:
@@ -542,6 +542,7 @@ class AgentDiscovery:
                 stdin=asyncio.subprocess.DEVNULL,
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
+                **_agent_process_group_kwargs(),
             )
             stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=10)
             if proc.returncode != 0:

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/forgexa_cli/daemon.py

@@ -910,7 +910,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.29.4"
+DAEMON_VERSION = "1.30.0"
 
 
 def _detect_client_type() -> str:
@@ -1955,6 +1955,7 @@ async def _validate_local_workspace_binding(binding: dict[str, Any], runtime_id:
             cwd=str(local_path),
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.DEVNULL,
+            **_agent_process_group_kwargs(),
         )
         stdout, _ = await asyncio.wait_for(proc.communicate(), timeout=10)
     except asyncio.TimeoutError:
@@ -2911,6 +2912,7 @@ class WorkspaceManager:
                     cwd=str(ws_path),
                     stdout=asyncio.subprocess.PIPE,
                     stderr=asyncio.subprocess.PIPE,
+                    **_agent_process_group_kwargs(),
                 )
                 st_out, _ = await asyncio.wait_for(st_proc.communicate(), timeout=10)
                 if st_proc.returncode == 0 and st_out.decode().strip():
@@ -3083,6 +3085,7 @@ class WorkspaceManager:
                 cwd=str(repo_path),
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
+                **_agent_process_group_kwargs(),
             )
             local_out, _ = await asyncio.wait_for(local_proc.communicate(), timeout=10)
             if local_proc.returncode != 0:
@@ -3111,6 +3114,7 @@ class WorkspaceManager:
                     cwd=str(repo_path),
                     stdout=asyncio.subprocess.PIPE,
                     stderr=asyncio.subprocess.PIPE,
+                    **_agent_process_group_kwargs(),
                 )
                 ahead_out, _ = await asyncio.wait_for(ahead_proc.communicate(), timeout=10)
                 if ahead_proc.returncode == 0:
@@ -3132,6 +3136,7 @@ class WorkspaceManager:
                 cwd=str(repo_path),
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
+                **_agent_process_group_kwargs(),
             )
             out, err = await asyncio.wait_for(check_proc.communicate(), timeout=10)
             if check_proc.returncode != 0:
@@ -3984,6 +3989,7 @@ class WorkspaceManager:
                     cwd=str(main_repo),
                     stdout=asyncio.subprocess.PIPE,
                     stderr=asyncio.subprocess.PIPE,
+                    **_agent_process_group_kwargs(),
                 )
                 await check_proc.communicate()
                 branch_exists_remote = check_proc.returncode == 0
@@ -5863,10 +5869,6 @@ class ProcessManager:
         # stdin=DEVNULL (below) covers the primary check (GetConsoleMode on stdin);
         # CREATE_NO_WINDOW covers this secondary check so Copilot always sees a fully
         # headless environment and processes -p as the complete task specification.
-        _win_flags: dict = {}
-        if sys.platform == "win32":
-            _win_flags["creationflags"] = subprocess.CREATE_NO_WINDOW
-
         try:
             proc = await asyncio.create_subprocess_exec(
                 *cmd,
@@ -5888,7 +5890,6 @@ class ProcessManager:
                 env=env,
                 limit=100 * 1024 * 1024,
                 **_agent_process_group_kwargs(),
-                **_win_flags,
             )
             self.active_processes[task_id] = proc
             stdout, stderr, returncode = await self._stream_process(
@@ -6187,6 +6188,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout, _ = await asyncio.wait_for(proc.communicate(), timeout=10)
             stat_output = stdout.decode()
@@ -6197,6 +6199,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout2, _ = await asyncio.wait_for(proc2.communicate(), timeout=10)
             stat_output += stdout2.decode()
@@ -6207,6 +6210,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout3, _ = await asyncio.wait_for(proc3.communicate(), timeout=10)
             files = [f for f in stdout3.decode().strip().split("\n") if f]
@@ -6218,6 +6222,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout4, _ = await asyncio.wait_for(proc4.communicate(), timeout=10)
             shortstat = stdout4.decode()
@@ -6232,6 +6237,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout5, _ = await asyncio.wait_for(proc5.communicate(), timeout=10)
             info["branch"] = stdout5.decode().strip()
@@ -6242,6 +6248,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout6, _ = await asyncio.wait_for(proc6.communicate(), timeout=10)
             info["commit_sha"] = stdout6.decode().strip()
@@ -6287,6 +6294,7 @@ class ProcessManager:
                         stdout=asyncio.subprocess.PIPE,
                         stderr=asyncio.subprocess.PIPE,
                         cwd=str(cwd),
+                        **_agent_process_group_kwargs(),
                     )
                     mb_stdout, _ = await asyncio.wait_for(proc_mb.communicate(), timeout=10)
                     if proc_mb.returncode == 0 and mb_stdout.strip():
@@ -6299,6 +6307,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout, _ = await asyncio.wait_for(proc.communicate(), timeout=10)
             files = [f for f in stdout.decode().strip().split("\n") if f]
@@ -6310,6 +6319,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout2, _ = await asyncio.wait_for(proc2.communicate(), timeout=10)
             shortstat = stdout2.decode()
@@ -6324,6 +6334,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout3, _ = await asyncio.wait_for(proc3.communicate(), timeout=10)
             info["branch"] = stdout3.decode().strip()
@@ -6334,6 +6345,7 @@ class ProcessManager:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=str(cwd),
+                **_agent_process_group_kwargs(),
             )
             stdout4, _ = await asyncio.wait_for(proc4.communicate(), timeout=10)
             info["commit_sha"] = stdout4.decode().strip()
@@ -7759,6 +7771,18 @@ def _validate_test_evidence(
     return issues
 
 
+def _configured_daemon_api_token() -> str:
+    token = str(settings.DAEMON_API_TOKEN or "").strip()
+    if token.startswith("pat_"):
+        logger.warning(
+            "Ignoring personal access token for daemon authentication because "
+            "PATs cannot register runtimes. Use an enrolled runtime credential "
+            "or a saved login session instead."
+        )
+        return ""
+    return token
+
+
 class RuntimeDaemon:
     """Main Daemon orchestrator — runs on the host machine.
 
@@ -7778,8 +7802,8 @@ class RuntimeDaemon:
         # prevents duplicate registrations when the hostname changes.
         self.daemon_id = settings.DAEMON_ID or self.hardware_id or platform.node()
         self.server_urls = settings.get_daemon_server_urls()
-        self._has_explicit_api_token = bool(str(settings.DAEMON_API_TOKEN or "").strip())
-        self.api_token = settings.DAEMON_API_TOKEN
+        self.api_token = _configured_daemon_api_token()
+        self._has_explicit_api_token = bool(self.api_token)
         # Fallback token for connections whose issuer has no stored credentials
         # yet: the ~/.forgexa/token compat mirror written by `forgexa login`.
         # Issuer-scoped credentials take precedence per connection (see
@@ -11520,6 +11544,7 @@ class RuntimeDaemon:
                         cwd=str(workspace_path),
                         stdout=asyncio.subprocess.PIPE,
                         stderr=asyncio.subprocess.PIPE,
+                        **_agent_process_group_kwargs(),
                     )
                     await proc.communicate()
                 except Exception as exc:
@@ -11574,6 +11599,7 @@ class RuntimeDaemon:
             cwd=str(workspace_path),
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
+            **_agent_process_group_kwargs(),
         )
         stdout, stderr = await proc.communicate()
         if proc.returncode != 0:
@@ -11690,6 +11716,7 @@ class RuntimeDaemon:
                     env={**os.environ,
                          "GIT_AUTHOR_NAME": _git_name, "GIT_AUTHOR_EMAIL": _git_email,
                          "GIT_COMMITTER_NAME": _git_name, "GIT_COMMITTER_EMAIL": _git_email},
+                    **_agent_process_group_kwargs(),
                 )
                 commit_stdout, commit_stderr = await proc.communicate()
                 if proc.returncode != 0:
@@ -11790,6 +11817,7 @@ class RuntimeDaemon:
                 cwd=str(workspace_path),
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
+                **_agent_process_group_kwargs(),
             )
             stdout, _ = await proc.communicate()
 
@@ -11808,6 +11836,7 @@ class RuntimeDaemon:
                     cwd=str(workspace_path),
                     stdout=asyncio.subprocess.PIPE,
                     stderr=asyncio.subprocess.PIPE,
+                    **_agent_process_group_kwargs(),
                 )
                 add_stdout, add_stderr = await proc.communicate()
                 if proc.returncode != 0:
@@ -11859,6 +11888,7 @@ class RuntimeDaemon:
                     env={**os.environ,
                          "GIT_AUTHOR_NAME": _git_name, "GIT_AUTHOR_EMAIL": _git_email,
                          "GIT_COMMITTER_NAME": _git_name, "GIT_COMMITTER_EMAIL": _git_email},
+                    **_agent_process_group_kwargs(),
                 )
                 commit_stdout, commit_stderr = await proc.communicate()
                 if proc.returncode != 0:
@@ -11948,6 +11978,7 @@ class RuntimeDaemon:
             cwd=str(cwd),
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
+            **_agent_process_group_kwargs(),
         )
         out, _ = await proc.communicate()
         for line in out.decode(errors="replace").strip().splitlines():
@@ -11961,6 +11992,7 @@ class RuntimeDaemon:
             cwd=str(cwd),
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
+            **_agent_process_group_kwargs(),
         )
         out, _ = await proc.communicate()
         for line in out.decode(errors="replace").strip().splitlines():
@@ -11989,6 +12021,7 @@ class RuntimeDaemon:
             cwd=str(cwd),
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
+            **_agent_process_group_kwargs(),
         )
         out, _ = await proc.communicate()
         stat_lines = out.decode(errors="replace").strip().splitlines()
@@ -12017,6 +12050,7 @@ class RuntimeDaemon:
                 cwd=str(cwd),
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
+                **_agent_process_group_kwargs(),
             )
             out, _ = await asyncio.wait_for(proc.communicate(), timeout=10)
         except Exception:
@@ -13061,6 +13095,7 @@ class RuntimeDaemon:
                 cwd=str(workspace_path),
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
+                **_agent_process_group_kwargs(),
             )
             stdout, _ = await proc.communicate()
             remaining = [f.strip() for f in stdout.decode().strip().splitlines() if f.strip()]

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/forgexa_cli/main.py

@@ -415,6 +415,14 @@ def _token() -> str | None:
     return cfg.get("token") or None
 
 
+def _daemon_token_environment() -> tuple[str | None, bool]:
+    for name in ("DAEMON_API_TOKEN", "FORGEXA_TOKEN"):
+        token = str(os.environ.get(name) or "").strip()
+        if token:
+            return name, token.startswith("pat_")
+    return None, False
+
+
 # ── Cross-process refresh coordination (~/.forgexa/auth-refresh.<hash>.lock) ──
 #
 # CLI and daemon processes share the same on-disk session credentials, so a
@@ -680,7 +688,19 @@ def _cli_distribution() -> importlib_metadata.Distribution | None:
 
 def _installed_cli_version() -> str | None:
     dist = _cli_distribution()
-    return dist.version if dist is not None else None
+    if dist is None:
+        return None
+
+    direct_url = _direct_url_metadata(dist)
+    dir_info = direct_url.get("dir_info") if isinstance(direct_url, dict) else None
+    if isinstance(dir_info, dict) and dir_info.get("editable"):
+        from forgexa_cli import __version__
+
+        runtime_version = str(__version__).strip()
+        if runtime_version:
+            return runtime_version
+
+    return dist.version
 
 
 def _distribution_root(dist: importlib_metadata.Distribution | None) -> Path | None:
@@ -820,13 +840,6 @@ def _build_upgrade_plan(target_version: str | None) -> UpgradePlan:
             "Use your original install command to update it manually."
         )
 
-    dist_root = _distribution_root(dist)
-    if not _running_from_distribution_root(dist_root):
-        raise RuntimeError(
-            "The current process is not running from the installed forgexa-cli package. "
-            "Run the installed `forgexa` command instead of a source checkout when using `forgexa upgrade`."
-        )
-
     unsupported_source = _unsupported_upgrade_source(_direct_url_metadata(dist))
     if unsupported_source:
         raise RuntimeError(
@@ -834,6 +847,13 @@ def _build_upgrade_plan(target_version: str | None) -> UpgradePlan:
             f"({unsupported_source}). Reinstall it manually using the same source instead of `forgexa upgrade`."
         )
 
+    dist_root = _distribution_root(dist)
+    if not _running_from_distribution_root(dist_root):
+        raise RuntimeError(
+            "The current process is not running from the installed forgexa-cli package. "
+            "Run the installed `forgexa` command instead of a source checkout when using `forgexa upgrade`."
+        )
+
     current_version = dist.version
     python = sys.executable or "python3"
 
@@ -1006,6 +1026,7 @@ def _maybe_install_update() -> None:
         return
     if autoupgrade.has_fresh_active_install(state, target_version):
         return
+
     if not autoupgrade.try_acquire_lock(target_version):
         return
 
@@ -1166,7 +1187,6 @@ def _launch_update_check_process(allow_install: bool) -> None:
     except Exception:
         pass
 
-
 def _format_epoch(value: object) -> str:
     """Format an epoch-seconds timestamp for human display. Never raises."""
     if not isinstance(value, (int, float)):
@@ -1199,7 +1219,6 @@ def _print_background_install_success_notice_once(current_version: str) -> bool:
     autoupgrade.write_state(state)
     return True
 
-
 def _print_update_notice_if_available() -> None:
     """Print an update notice to stderr when a newer version is cached, or a
     one-time notice when a silent background install just completed.
@@ -1426,6 +1445,154 @@ def _start_daemon_after_upgrade() -> tuple[bool, str | None]:
     return True, server_url
 
 
+def _windows_upgrade_launcher_paths() -> list[str]:
+    python_path = Path(sys.executable)
+    invocation = Path(sys.argv[0])
+    candidates = [
+        invocation,
+        invocation.with_suffix(".exe"),
+        python_path.parent / "forgexa.exe",
+        python_path.parent / "Scripts" / "forgexa.exe",
+    ]
+    if invocation.stem.lower().endswith("-script"):
+        candidates.append(invocation.with_name(f"{invocation.stem[:-7]}.exe"))
+    paths: list[str] = []
+    for candidate in candidates:
+        try:
+            resolved = candidate.resolve()
+        except OSError:
+            continue
+        if (
+            resolved.name.lower() == "forgexa.exe"
+            and resolved.exists()
+            and str(resolved) not in paths
+        ):
+            paths.append(str(resolved))
+    return paths
+
+
+def _windows_path_is_unlocked(path: str) -> bool:
+    """Return whether a launcher can be replaced without a sharing violation."""
+    try:
+        import ctypes
+        from ctypes import wintypes
+
+        kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+        create_file = kernel32.CreateFileW
+        create_file.argtypes = [
+            wintypes.LPCWSTR,
+            wintypes.DWORD,
+            wintypes.DWORD,
+            ctypes.c_void_p,
+            wintypes.DWORD,
+            wintypes.DWORD,
+            wintypes.HANDLE,
+        ]
+        create_file.restype = wintypes.HANDLE
+        close_handle = kernel32.CloseHandle
+        close_handle.argtypes = [wintypes.HANDLE]
+        close_handle.restype = wintypes.BOOL
+        delete_access = 0x00010000
+        share_all = 0x00000007
+        handle = create_file(path, delete_access, share_all, None, 3, 0, None)
+        if handle == ctypes.c_void_p(-1).value:
+            return False
+        close_handle(handle)
+        return True
+    except Exception:
+        return False
+
+
+def _wait_for_windows_upgrade_release(parent_pid: int, launcher_paths: list[str]) -> bool:
+    deadline = time.monotonic() + 30.0
+    while time.monotonic() < deadline:
+        parent_exited = not _windows_process_is_running(parent_pid)
+        launchers_released = all(_windows_path_is_unlocked(path) for path in launcher_paths)
+        if parent_exited and launchers_released:
+            return True
+        time.sleep(0.1)
+    return False
+
+
+def _run_windows_upgrade_worker(payload: str) -> None:
+    """Run a deferred Windows upgrade after the invoking launcher exits."""
+    try:
+        data = json.loads(payload)
+        command = data["command"]
+        parent_pid = int(data["parent_pid"])
+        launcher_paths = data.get("launcher_paths", [])
+        daemon_stopped = bool(data.get("daemon_stopped"))
+        target_version = str(data.get("target_version") or "latest")
+    except (KeyError, TypeError, ValueError, json.JSONDecodeError):
+        return
+    if not isinstance(command, list) or not all(isinstance(part, str) for part in command):
+        return
+    if not isinstance(launcher_paths, list) or not all(isinstance(path, str) for path in launcher_paths):
+        return
+
+    try:
+        log_path = _upgrade_log_path()
+        log_path.parent.mkdir(parents=True, exist_ok=True)
+        with log_path.open("a", encoding="utf-8") as log_file:
+            log_file.write(
+                f"\n[{time.strftime('%Y-%m-%dT%H:%M:%S')}] "
+                f"Deferred Windows upgrade to {target_version}: {shlex.join(command)}\n"
+            )
+            if not _wait_for_windows_upgrade_release(parent_pid, launcher_paths):
+                log_file.write("Upgrade aborted: timed out waiting for the CLI launcher to exit.\n")
+                return
+            try:
+                result = subprocess.run(command, stdout=log_file, stderr=subprocess.STDOUT)
+            except OSError as exc:
+                log_file.write(f"Upgrade failed to start: {exc}\n")
+                return
+            if result.returncode != 0:
+                log_file.write(f"Upgrade failed (returncode={result.returncode}).\n")
+                return
+            log_file.write("Upgrade complete.\n")
+            if daemon_stopped:
+                restarted, server_url = _start_daemon_after_upgrade()
+                if restarted:
+                    detail = f" (server={server_url})" if server_url else ""
+                    log_file.write(f"Daemon restarted in background{detail}.\n")
+                else:
+                    log_file.write("Restart the daemon with: forgexa daemon start\n")
+    except OSError:
+        return
+
+
+def _launch_windows_upgrade_worker(plan: UpgradePlan, daemon_stopped: bool) -> bool:
+    payload = json.dumps(
+        {
+            "command": plan.command,
+            "parent_pid": os.getpid(),
+            "launcher_paths": _windows_upgrade_launcher_paths(),
+            "daemon_stopped": daemon_stopped,
+            "target_version": plan.target_version,
+        }
+    )
+    try:
+        subprocess.Popen(
+            [
+                sys.executable,
+                "-c",
+                "import sys; from forgexa_cli.main import _run_windows_upgrade_worker; "
+                "_run_windows_upgrade_worker(sys.argv[1])",
+                payload,
+            ],
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            creationflags=(
+                getattr(subprocess, "CREATE_NO_WINDOW", 0)
+                | getattr(subprocess, "DETACHED_PROCESS", 0)
+            ),
+        )
+    except OSError:
+        return False
+    return True
+
+
 def _request_json(
     path: str,
     *,
@@ -1561,10 +1728,28 @@ def cmd_login(args: argparse.Namespace) -> None:
     ).strip()
     _save_tokens(token, refresh_token or None, server_url=_SERVER_URL_OVERRIDE if server else None)
 
-    active_server = _api_url()
-    print(f"Login successful.")
-    print(f"  Server : {active_server}")
-    print(f"  Session: saved (~/.forgexa/credentials.json)")
+    print("Login successful.")
+    print(f"  Server : {_api_url()}")
+    print("  Session: saved (~/.forgexa/credentials.json)")
+    if not refresh_token:
+        print(
+            "Warning: no refresh token was saved; run 'forgexa daemon enroll' "
+            "before starting a long-running daemon.",
+            file=sys.stderr,
+        )
+    daemon_token_env, daemon_token_is_pat = _daemon_token_environment()
+    if daemon_token_env and daemon_token_is_pat:
+        print(
+            f"Note: {daemon_token_env} is a personal access token and is "
+            "ignored for daemon registration.",
+            file=sys.stderr,
+        )
+    elif daemon_token_env:
+        print(
+            f"Warning: {daemon_token_env} overrides the saved login credentials "
+            "for the daemon. Clear it unless it is a valid daemon credential.",
+            file=sys.stderr,
+        )
 
 
 def cmd_logout(_args: argparse.Namespace) -> None:
@@ -1623,6 +1808,14 @@ def cmd_config_show(_args: argparse.Namespace) -> None:
     print(f"Auth token : {'set' if token else 'not set'}")
     record = _credential_record(active_url)
     print(f"Refresh tok: {'set' if record.get('refresh_token') else 'not set'}")
+    daemon_token_env, daemon_token_is_pat = _daemon_token_environment()
+    if daemon_token_env:
+        detail = (
+            "ignored for daemon registration (personal access token)"
+            if daemon_token_is_pat
+            else "overrides saved daemon credentials"
+        )
+        print(f"Daemon env : {daemon_token_env} ({detail})")
     if _legacy_credentials_unattributed():
         print(
             "Legacy creds: present in ~/.forgexa/config but not attributable "
@@ -1792,8 +1985,12 @@ def cmd_daemon_status(args: argparse.Namespace) -> None:
     # ── Daemon credential source (raw values are never shown) ────────────────
     record = _credential_record()
     runtime_credential = str(record.get("runtime_credential") or "").strip()
-    if os.environ.get("DAEMON_API_TOKEN") or os.environ.get("FORGEXA_TOKEN"):
-        print("Credential   : explicit env override (DAEMON_API_TOKEN/FORGEXA_TOKEN,")
+    daemon_token_env, daemon_token_is_pat = _daemon_token_environment()
+    if daemon_token_env and daemon_token_is_pat:
+        print(f"Credential   : {daemon_token_env} personal access token ignored")
+        print("               (PATs cannot register runtimes)")
+    if daemon_token_env and not daemon_token_is_pat:
+        print(f"Credential   : explicit env override ({daemon_token_env},")
         print("               not persisted, not automatically renewed)")
     elif runtime_credential:
         prefix = str(record.get("token_prefix") or runtime_credential[:12])
@@ -1957,6 +2154,19 @@ def cmd_daemon_start(args: argparse.Namespace) -> None:
 
     server_url = getattr(args, "server_url", None) or _api_url()
     os.environ["DAEMON_SERVER_URL"] = server_url
+    daemon_token_env, daemon_token_is_pat = _daemon_token_environment()
+    if daemon_token_env and daemon_token_is_pat:
+        print(
+            f"Note: daemon ignores {daemon_token_env} because personal access "
+            "tokens cannot register runtimes."
+        )
+        print()
+    elif daemon_token_env:
+        print(
+            f"Warning: daemon will use {daemon_token_env} instead of "
+            "the saved login credentials. Clear it if the token is stale."
+        )
+        print()
 
     # Do NOT inject the interactive session token into the daemon via
     # DAEMON_API_TOKEN: the daemon reads and refreshes issuer-scoped
@@ -1999,7 +2209,17 @@ def cmd_daemon_start(args: argparse.Namespace) -> None:
 
         detected = _wait_and_show_daemon_agents(start_ts)
         if not detected:
-            if _token():
+            if daemon_token_env and not daemon_token_is_pat:
+                print(
+                    "  (The explicit daemon token may be invalid. Clear the environment "
+                    "override and run 'forgexa login' again.)"
+                )
+            elif daemon_token_env:
+                print(
+                    "  (The personal access token was ignored. Run 'forgexa daemon enroll' "
+                    "or 'forgexa login' to provide daemon credentials.)"
+                )
+            elif _token():
                 print("  (Agent registration not confirmed yet — check with: forgexa daemon status)")
             else:
                 print("  (Not logged in — run 'forgexa login' to verify agent registration)")
@@ -3170,6 +3390,16 @@ def cmd_upgrade(args: argparse.Namespace) -> None:
     print(f"Upgrade mode    : {plan.installer}")
     print(f"Running         : {shlex.join(plan.command)}")
 
+    if sys.platform == "win32":
+        if not _launch_windows_upgrade_worker(plan, daemon_stopped):
+            print("Could not start the Windows upgrade worker.", file=sys.stderr)
+            if daemon_stopped:
+                print("Restart the daemon with: forgexa daemon start", file=sys.stderr)
+            sys.exit(1)
+        print("Upgrade continues in the background after this CLI process exits.")
+        print(f"Upgrade log     : {_upgrade_log_path()}")
+        return
+
     result = subprocess.run(plan.command)
     if result.returncode != 0:
         if daemon_stopped:

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.29.4
+Version: 1.30.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.29.4"
+version = "1.30.0"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/tests/test_auth_and_runtime_commands.py

@@ -65,6 +65,31 @@ def test_login_persists_refresh_token(tmp_path: Path, monkeypatch: pytest.Monkey
     assert (tmp_path / ".forgexa" / "token").read_text() == "access-1"
 
 
+def test_login_warns_when_refresh_token_is_missing_and_daemon_token_overrides(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str],
+) -> None:
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("FORGEXA_TOKEN", "explicit-token")
+    monkeypatch.setattr(main, "_SERVER_URL_OVERRIDE", None)
+    monkeypatch.setattr(
+        main,
+        "_request_json",
+        lambda path, **kw: {"access_token": "access-1", "refresh_token": None},
+    )
+
+    main.cmd_login(
+        SimpleNamespace(
+            server="https://api.example.com",
+            email="user@example.com",
+            password="secret",
+        )
+    )
+
+    err = capsys.readouterr().err
+    assert "no refresh token was saved" in err
+    assert "FORGEXA_TOKEN overrides the saved login credentials" in err
+
+
 @pytest.mark.parametrize("suffix", [".cmd", ".bat"])
 def test_windows_batch_agent_commands_use_cmd_exe(
     suffix: str, monkeypatch: pytest.MonkeyPatch,
@@ -229,6 +254,25 @@ def test_cmd_daemon_start_no_stale_pid_message_on_clean_start(
     assert "stale daemon record" not in buffer.getvalue()
 
 
+def test_cmd_daemon_start_explains_explicit_token_override(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("FORGEXA_TOKEN", "stale-token")
+    monkeypatch.delenv("DAEMON_SERVER_URL", raising=False)
+    monkeypatch.setattr(main, "_SERVER_URL_OVERRIDE", None)
+    monkeypatch.setattr(main, "_wait_and_show_daemon_agents", lambda start_ts: False)
+    monkeypatch.setattr(main.subprocess, "Popen", lambda *args, **kwargs: SimpleNamespace(pid=12345))
+
+    buffer = io.StringIO()
+    with contextlib.redirect_stdout(buffer):
+        main.cmd_daemon_start(SimpleNamespace(detach=True, server_url=None))
+
+    output = buffer.getvalue()
+    assert "daemon will use FORGEXA_TOKEN instead of the saved login credentials" in output
+    assert "The explicit daemon token may be invalid" in output
+
+
 def test_get_retries_once_after_refresh_on_401(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
@@ -643,10 +687,12 @@ def test_pep668_detection_returns_true_when_marker_present(tmp_path: Path, monke
     assert main._is_pep668_environment() is True
 
 
-def test_build_upgrade_plan_rejects_editable_install(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_build_upgrade_plan_rejects_editable_install_before_package_root_validation(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
     monkeypatch.setattr(main, "_cli_distribution", lambda: SimpleNamespace(version="1.12.2"))
     monkeypatch.setattr(main, "_distribution_root", lambda dist: Path("/installed/site-packages"))
-    monkeypatch.setattr(main, "_running_from_distribution_root", lambda root: True)
+    monkeypatch.setattr(main, "_running_from_distribution_root", lambda root: False)
     monkeypatch.setattr(main, "_direct_url_metadata", lambda dist: {"dir_info": {"editable": True}})
 
     with pytest.raises(RuntimeError, match="editable source install"):
@@ -683,6 +729,136 @@ def test_cmd_upgrade_runs_planned_command(monkeypatch: pytest.MonkeyPatch) -> No
     assert "Upgrade complete. Installed version: 1.12.3" in output
 
 
+def test_cmd_upgrade_defers_windows_install_until_cli_exits(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    plan = main.UpgradePlan(
+        installer="pip",
+        command=["python", "-m", "pip", "install", "--upgrade", "forgexa-cli==1.12.3"],
+        current_version="1.12.2",
+        target_version="1.12.3",
+    )
+    popen_calls: list[tuple[list[str], dict]] = []
+
+    monkeypatch.setattr(main.sys, "platform", "win32")
+    monkeypatch.setattr(main, "_build_upgrade_plan", lambda target: plan)
+    monkeypatch.setattr(main, "_normalize_target_version", lambda value: value)
+    monkeypatch.setattr(main, "_stop_daemon_if_running", lambda: (False, None))
+    monkeypatch.setattr(
+        main,
+        "_windows_upgrade_launcher_paths",
+        lambda: [r"C:\Python312\Scripts\forgexa.exe"],
+    )
+    monkeypatch.setattr(
+        main.subprocess,
+        "Popen",
+        lambda command, **kwargs: popen_calls.append((command, kwargs)),
+    )
+    monkeypatch.setattr(
+        main.subprocess,
+        "run",
+        lambda *args, **kwargs: pytest.fail("Windows upgrade must not synchronously run pip"),
+    )
+
+    buffer = io.StringIO()
+    with contextlib.redirect_stdout(buffer):
+        main.cmd_upgrade(SimpleNamespace(target_version="1.12.3"))
+
+    assert len(popen_calls) == 1
+    command, kwargs = popen_calls[0]
+    assert command[:2] == [main.sys.executable, "-c"]
+    assert "_run_windows_upgrade_worker" in command[2]
+    assert json.loads(command[3]) == {
+        "command": plan.command,
+        "parent_pid": os.getpid(),
+        "launcher_paths": [r"C:\Python312\Scripts\forgexa.exe"],
+        "daemon_stopped": False,
+        "target_version": "1.12.3",
+    }
+    assert kwargs["stdin"] is main.subprocess.DEVNULL
+    assert kwargs["stdout"] is main.subprocess.DEVNULL
+    assert kwargs["stderr"] is main.subprocess.DEVNULL
+    assert "Upgrade continues in the background" in buffer.getvalue()
+
+
+def test_windows_upgrade_launcher_paths_includes_user_console_launcher(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    scripts_dir = tmp_path / "AppData" / "Roaming" / "Python" / "Python312" / "Scripts"
+    scripts_dir.mkdir(parents=True)
+    launcher = scripts_dir / "forgexa.exe"
+    launcher.write_text("")
+
+    monkeypatch.setattr(main.sys, "argv", [str(scripts_dir / "forgexa-script.py")])
+    monkeypatch.setattr(main.sys, "executable", str(tmp_path / "Python312" / "python.exe"))
+
+    assert main._windows_upgrade_launcher_paths() == [str(launcher.resolve())]
+
+
+def test_windows_upgrade_worker_waits_before_running_pip(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    events: list[str] = []
+    log_path = tmp_path / "upgrade.log"
+    monkeypatch.setattr(main, "_upgrade_log_path", lambda: log_path)
+    monkeypatch.setattr(
+        main,
+        "_wait_for_windows_upgrade_release",
+        lambda parent_pid, launcher_paths: events.append("wait") or True,
+    )
+    monkeypatch.setattr(
+        main.subprocess,
+        "run",
+        lambda command, **kwargs: events.append("run") or SimpleNamespace(returncode=0),
+    )
+
+    main._run_windows_upgrade_worker(
+        json.dumps(
+            {
+                "command": ["python", "-m", "pip", "install", "--upgrade", "forgexa-cli"],
+                "parent_pid": 4242,
+                "launcher_paths": [r"C:\Python312\Scripts\forgexa.exe"],
+                "daemon_stopped": False,
+                "target_version": "1.12.3",
+            }
+        )
+    )
+
+    assert events == ["wait", "run"]
+    assert "Deferred Windows upgrade to 1.12.3" in log_path.read_text()
+    assert "Upgrade complete." in log_path.read_text()
+
+
+def test_windows_upgrade_worker_restarts_stopped_daemon_after_success(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    log_path = tmp_path / "upgrade.log"
+    restart_calls: list[bool] = []
+    monkeypatch.setattr(main, "_upgrade_log_path", lambda: log_path)
+    monkeypatch.setattr(main, "_wait_for_windows_upgrade_release", lambda *args: True)
+    monkeypatch.setattr(main.subprocess, "run", lambda *args, **kwargs: SimpleNamespace(returncode=0))
+    monkeypatch.setattr(
+        main,
+        "_start_daemon_after_upgrade",
+        lambda: restart_calls.append(True) or (True, "https://api.example.com"),
+    )
+
+    main._run_windows_upgrade_worker(
+        json.dumps(
+            {
+                "command": ["python", "-m", "pip", "install", "--upgrade", "forgexa-cli"],
+                "parent_pid": 4242,
+                "launcher_paths": [],
+                "daemon_stopped": True,
+                "target_version": "1.12.3",
+            }
+        )
+    )
+
+    assert restart_calls == [True]
+    assert "Daemon restarted in background (server=https://api.example.com)." in log_path.read_text()
+
+
 def test_cmd_upgrade_restarts_background_daemon_after_success(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/tests/test_expiry_warnings_and_revoke.py

@@ -236,6 +236,19 @@ def test_status_env_override_notes_no_auto_renewal(
     assert "not automatically renewed" in out
 
 
+def test_status_personal_access_token_is_ignored_for_daemon(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _write_credentials(tmp_path, {"runtime_credential": "frt_secret_value"})
+    monkeypatch.setenv("FORGEXA_TOKEN", "pat_personal_access_token")
+
+    out = _status_output(monkeypatch)
+
+    assert "FORGEXA_TOKEN personal access token ignored" in out
+    assert "PATs cannot register runtimes" in out
+    assert "runtime credential" in out
+
+
 # ── (c) forgexa daemon revoke-credential ─────────────────────────────────────
 
 

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/tests/test_runtime_credentials.py

@@ -325,6 +325,20 @@ def test_token_for_server_priority(tmp_path: Path) -> None:
     assert runtime._token_for_server(_ISSUER) == "env-token"
 
 
+def test_personal_access_token_does_not_override_daemon_credentials(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture,
+) -> None:
+    _write_credentials(tmp_path, {"runtime_credential": "frt_cred"})
+    monkeypatch.setattr(daemon.settings, "DAEMON_API_TOKEN", "pat_personal_access_token")
+
+    with caplog.at_level(logging.WARNING, logger="daemon"):
+        runtime = daemon.RuntimeDaemon()
+
+    assert runtime._has_explicit_api_token is False
+    assert runtime._token_for_server(_ISSUER) == "frt_cred"
+    assert "PATs cannot register runtimes" in caplog.text
+
+
 # ── (f) daemon_credential_upgrade_required is not retryable ──────────────────
 
 

{forgexa_cli-1.29.4 → forgexa_cli-1.30.0}/tests/test_upgrade_observability.py

@@ -5,12 +5,15 @@ from types import SimpleNamespace
 
 import pytest
 
+import forgexa_cli
 from forgexa_cli import autoupgrade, main
 
 
 @pytest.fixture(autouse=True)
 def _isolated_home(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+    monkeypatch.setattr(autoupgrade, "_state_path", lambda: tmp_path / "upgrade-state.json")
 
 
 def _make_interactive(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -78,6 +81,20 @@ def test_regular_update_notice_still_works_without_pending_success(
     assert "Update available: forgexa 1.20.0 → 1.21.0" in err
 
 
+def test_installed_version_uses_runtime_version_for_editable_install(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(main, "_cli_distribution", lambda: SimpleNamespace(version="1.21.7"))
+    monkeypatch.setattr(
+        main,
+        "_direct_url_metadata",
+        lambda _dist: {"dir_info": {"editable": True}},
+    )
+    monkeypatch.setattr(forgexa_cli, "__version__", "1.29.4")
+
+    assert main._installed_cli_version() == "1.29.4"
+
+
 # ── cmd_version / --status ──────────────────────────────────────────────────
 
 def test_version_prints_failure_hint_when_last_attempt_failed(