forgexa-cli 1.42.0__tar.gz → 1.43.2__tar.gz

{forgexa_cli-1.42.0 → forgexa_cli-1.43.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.42.0
+Version: 1.43.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.42.0 → forgexa_cli-1.43.2}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.42.0"
+__version__ = "1.43.2"

{forgexa_cli-1.42.0 → forgexa_cli-1.43.2}/forgexa_cli/agent_core.py

@@ -41,11 +41,15 @@ if sys.version_info < (3, 9):  # noqa: UP036 - gate guards 3.9+ runtime on end-u
 
 import asyncio
 import base64
+import errno
+import hashlib
 import json
 import logging
 import os
 import shutil
 import subprocess
+import tempfile
+import time
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
@@ -223,14 +227,14 @@ def _agent_process_group_kwargs() -> dict[str, int | bool]:
 def _parse_semver(v: str) -> tuple[int, int, int] | None:
     """Parse a semver string into a comparable (major, minor, patch) tuple.
 
-    Strips a leading 'v' and ignores pre-release/build suffixes so that
-    '1.4.0-beta.1' and 'v1.4.0' both return (1, 4, 0).
+    Finds an embedded version and ignores pre-release/build suffixes so that
+    'GitHub Copilot CLI 1.0.81.' and 'v1.4.0-beta.1' are both supported.
     Returns None when the string cannot be parsed (e.g. 'unknown', 'latest'),
     so callers can skip the version check rather than erroneously rejecting
     a valid agent whose version string is non-standard.
     """
     import re as _re
-    m = _re.match(r"^v?(\d+)\.(\d+)\.(\d+)", v.strip())
+    m = _re.search(r"(?<!\d)v?(\d+)\.(\d+)\.(\d+)", v.strip())
     if m:
         return (int(m.group(1)), int(m.group(2)), int(m.group(3)))
     return None
@@ -241,10 +245,9 @@ def _check_agent_min_version(agent_id: str, version: str, spec: dict) -> tuple[b
 
     Returns (min_version_ok, version_warning). version_warning is empty
     whenever there's nothing to warn about: no minimum is defined for this
-    agent (``spec`` has no ``min_version`` key), the version string couldn't
-    be parsed (never treated as a hard failure -- unparseable versions are
-    skipped, not rejected, matching the pre-existing opencode behavior), or
-    the installed version already meets the minimum.
+    agent, an optional minimum has an unparseable version, or the installed
+    version meets the minimum. ``strict_min_version`` makes an unparseable
+    version a hard failure for integrations with known incompatible releases.
 
     This is the single source of truth for per-agent minimum-version gating,
     consumed by both AgentDiscovery.discover() (so `forgexa check` and the
@@ -257,6 +260,14 @@ def _check_agent_min_version(agent_id: str, version: str, spec: dict) -> tuple[b
         return True, ""
     parsed = _parse_semver(version)
     if parsed is None:
+        if spec.get("strict_min_version"):
+            min_str = ".".join(str(x) for x in min_version)
+            upgrade_hint = spec.get("upgrade_hint", f"upgrade the {agent_id} CLI")
+            return (
+                False,
+                f"Could not verify that {agent_id} meets the minimum supported "
+                f"version v{min_str}+. Fix: {upgrade_hint}.",
+            )
         return True, ""
     if parsed >= tuple(min_version):
         return True, ""
@@ -337,6 +348,13 @@ class AgentDiscovery:
             "invoke_modes": ["cli"],
             "env_path_override": "FACTORY_COPILOT_PATH",
             "compatibility_level": "L3",
+            "min_version": (1, 0, 70),
+            "strict_min_version": True,
+            "min_version_reason": (
+                "Older releases have known authentication persistence bugs in "
+                "one-shot prompt sessions and across runtime restarts."
+            ),
+            "upgrade_hint": "copilot update",
         },
     }
 
@@ -634,23 +652,50 @@ class AgentDiscovery:
 # ── Advisory file locks ──
 
 
-def acquire_file_lock(path: str | Path):
-    """Open ``path`` and take a non-blocking exclusive OS-level lock on it.
-
-    POSIX: ``fcntl.flock(LOCK_EX|LOCK_NB)``; Windows: ``msvcrt.locking`` with
-    ``LK_NBLCK``.  Returns the open file handle to hold for the lock's
-    duration, or ``None`` when another process already holds the lock.
+def acquire_file_lock(
+    path: str | Path,
+    *,
+    blocking: bool = False,
+    timeout_seconds: float = 10.0,
+):
+    """Open ``path`` and take an exclusive OS-level lock on it.
+
+    By default the lock is non-blocking. Set ``blocking=True`` for short,
+    bounded serialized state updates. Returns the open file handle to hold for
+    the lock's duration, or ``None`` when the lock cannot be acquired in time.
     Callers must release via :func:`release_file_lock` in a ``finally`` block.
     """
     lock_path = Path(path)
     lock_path.parent.mkdir(parents=True, exist_ok=True)
-    lock_file = open(lock_path, "w")
+    lock_file = open(lock_path, "a+b")
     try:
+        lock_file.seek(0, os.SEEK_END)
+        if lock_file.tell() == 0:
+            lock_file.write(b"\0")
+            lock_file.flush()
+        lock_file.seek(0)
+        deadline = time.monotonic() + timeout_seconds if blocking else None
         if sys.platform == "win32":
             import msvcrt
-            msvcrt.locking(lock_file.fileno(), msvcrt.LK_NBLCK, 1)
-        else:
-            fcntl.flock(lock_file.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        while True:
+            try:
+                if sys.platform == "win32":
+                    msvcrt.locking(lock_file.fileno(), msvcrt.LK_NBLCK, 1)
+                else:
+                    fcntl.flock(
+                        lock_file.fileno(),
+                        fcntl.LOCK_EX | fcntl.LOCK_NB,
+                    )
+                break
+            except OSError as exc:
+                if (
+                    not blocking
+                    or exc.errno not in {errno.EACCES, errno.EAGAIN}
+                    or deadline is None
+                    or time.monotonic() >= deadline
+                ):
+                    raise
+                time.sleep(0.05)
     except OSError:
         lock_file.close()
         return None
@@ -668,10 +713,13 @@ def release_file_lock(lock_file) -> None:
             msvcrt.locking(lock_file.fileno(), msvcrt.LK_UNLCK, 1)
         else:
             fcntl.flock(lock_file.fileno(), fcntl.LOCK_UN)
-    except OSError:
+    except Exception:
         pass
     finally:
-        lock_file.close()
+        try:
+            lock_file.close()
+        except Exception:
+            pass
 
 
 # ── Process Manager ──
@@ -1721,6 +1769,194 @@ def copilot_base_env(env: dict[str, str], *, copilot_home: str | Path) -> dict[s
     return env
 
 
+COPILOT_TOKEN_ENV_VARS = ("COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN")
+
+
+def copilot_interactive_home() -> Path:
+    """Return the login home selected for interactive Copilot CLI use."""
+    configured_home = os.environ.get("COPILOT_HOME", "").strip()
+    if configured_home:
+        return Path(configured_home).expanduser()
+    return Path.home() / ".copilot"
+
+
+def copilot_recovery_home(destination_home: str | Path) -> Path | None:
+    """Return a populated login home distinct from the failed destination."""
+    destination = Path(destination_home).resolve()
+    candidates = (copilot_interactive_home(), Path.home() / ".copilot")
+    seen: set[Path] = set()
+    for candidate in candidates:
+        resolved = candidate.resolve()
+        if resolved in seen or resolved == destination:
+            continue
+        seen.add(resolved)
+        if (resolved / "config.json").is_file():
+            return resolved
+    return None
+
+
+def is_copilot_model_discovery_auth_error(*messages: str | None) -> bool:
+    """Return whether Copilot failed before work while resolving model access."""
+    detail = " ".join(str(message or "").lower() for message in messages)
+    return (
+        "421" in detail
+        and "misdirected request" in detail
+        and (
+            "retrieve the list of available models" in detail
+            or "failed to load models" in detail
+        )
+    )
+
+
+def copilot_auth_state_signature(copilot_home: str | Path) -> str | None:
+    """Return a content signature for Copilot's persisted authentication state."""
+    config_file = Path(copilot_home) / "config.json"
+    if not config_file.exists():
+        return ""
+    try:
+        return hashlib.sha256(config_file.read_bytes()).hexdigest()
+    except OSError:
+        logger.warning("Could not read Copilot authentication state", exc_info=True)
+        return None
+
+
+def _copilot_auth_lock_path(copilot_home: str | Path) -> Path:
+    home = Path(copilot_home)
+    return home.with_name(f".{home.name}-auth-state.lock")
+
+
+def replace_copilot_auth_state(
+    source_home: str | Path,
+    destination_home: str | Path,
+    expected_destination_signature: str | None = None,
+) -> bool:
+    """Replace an isolated Copilot auth file from a known login home."""
+    source = Path(source_home) / "config.json"
+    destination_dir = Path(destination_home)
+    destination = destination_dir / source.name
+    if not source.is_file():
+        return False
+    lock_file = None
+    temp_name: str | None = None
+    try:
+        source_signature = copilot_auth_state_signature(source_home)
+        if source_signature is None:
+            return False
+        destination_dir.mkdir(parents=True, exist_ok=True)
+        lock_file = acquire_file_lock(
+            _copilot_auth_lock_path(destination_dir),
+            blocking=True,
+        )
+        if lock_file is None:
+            logger.warning("Could not lock Copilot authentication state for restore")
+            return False
+        destination_signature = copilot_auth_state_signature(destination_home)
+        if (
+            expected_destination_signature is not None
+            and destination_signature != expected_destination_signature
+        ):
+            return False
+        if destination_signature == source_signature:
+            return False
+        temp_fd, temp_name = tempfile.mkstemp(prefix=".config.json.", dir=destination_dir)
+        os.close(temp_fd)
+        shutil.copy2(source, temp_name)
+        os.chmod(temp_name, 0o600)
+        for attempt in range(3):
+            try:
+                os.replace(temp_name, destination)
+                temp_name = None
+                break
+            except PermissionError:
+                if sys.platform != "win32" or attempt == 2:
+                    raise
+                time.sleep(0.05)
+        return True
+    except OSError:
+        logger.warning("Could not restore interactive Copilot credentials", exc_info=True)
+        return False
+    finally:
+        if temp_name is not None:
+            try:
+                Path(temp_name).unlink(missing_ok=True)
+            except OSError:
+                logger.debug("Could not remove temporary Copilot config", exc_info=True)
+        release_file_lock(lock_file)
+
+
+def persist_copilot_auth_state(
+    run_home: str | Path,
+    persistent_home: str | Path,
+    baseline_signature: str | None = None,
+) -> None:
+    """Persist credentials refreshed inside an isolated Copilot home.
+
+    Copilot stores credentials in ``config.json`` when no system credential
+    store is available. Session data must remain isolated because reusing it
+    can make retries inherit completed todos from an earlier task.
+    """
+    lock_file = None
+    temp_name: str | None = None
+    try:
+        source = Path(run_home) / "config.json"
+        if not source.is_file():
+            return
+        source_signature = copilot_auth_state_signature(run_home)
+        if baseline_signature is not None and source_signature == baseline_signature:
+            return
+
+        destination_dir = Path(persistent_home)
+        destination_dir.mkdir(parents=True, exist_ok=True)
+        lock_file = acquire_file_lock(
+            _copilot_auth_lock_path(destination_dir),
+            blocking=True,
+        )
+        if lock_file is None:
+            logger.warning("Could not lock Copilot authentication state for update")
+            return
+
+        destination = destination_dir / source.name
+        destination_signature = copilot_auth_state_signature(destination_dir)
+        if destination_signature == source_signature:
+            return
+        if (
+            baseline_signature is not None
+            and destination_signature != baseline_signature
+        ):
+            logger.info(
+                "Skipping stale Copilot authentication update because another "
+                "run refreshed the persistent state first"
+            )
+            return
+        if baseline_signature is None and destination.is_file():
+            if destination.stat().st_mtime_ns >= source.stat().st_mtime_ns:
+                return
+
+        temp_fd, temp_name = tempfile.mkstemp(prefix=".config.json.", dir=destination_dir)
+        os.close(temp_fd)
+        shutil.copy2(source, temp_name)
+        os.chmod(temp_name, 0o600)
+        os.utime(temp_name, None)
+        for attempt in range(3):
+            try:
+                os.replace(temp_name, destination)
+                temp_name = None
+                break
+            except PermissionError:
+                if sys.platform != "win32" or attempt == 2:
+                    raise
+                time.sleep(0.05)
+    except OSError:
+        logger.warning("Could not persist refreshed Copilot credentials", exc_info=True)
+    finally:
+        if temp_name is not None:
+            try:
+                Path(temp_name).unlink(missing_ok=True)
+            except OSError:
+                logger.debug("Could not remove temporary Copilot config", exc_info=True)
+        release_file_lock(lock_file)
+
+
 def prepare_copilot_home() -> str:
     """Prepare a writable Copilot home under ~/.forgexa for sandboxed runs.
 
@@ -1733,80 +1969,122 @@ def prepare_copilot_home() -> str:
     Mirror the user-facing ~/.copilot state into a writable daemon-owned
     directory, then point COPILOT_HOME there for non-interactive runs.
 
-    Stale-auth cleanup: Before the per-task isolation fix, the daemon
-    pointed COPILOT_HOME directly at this master directory, so Copilot
-    wrote its own OAuth token (plain-text on Linux systems without a
-    credential store) here. Those files are NOT present in ~/.copilot/
-    (the user's interactive home), so the normal mirror loop never
-    overwrites them — they persist across restarts and poison isolated
-    temp dirs.  We clean up any file/dir in the master home that has no
-    counterpart in ~/.copilot/ (excluding session-state and logs which
-    are deliberately retained) to ensure the master home stays a clean
-    mirror of the user-facing directory.
+    A one-time migration removes stale files left when older daemons pointed
+    COPILOT_HOME directly at the master directory. After migration, refreshed
+    authentication state written by isolated runs is retained even when it
+    has no counterpart in the interactive home.
     """
-    source_root = Path.home() / ".copilot"
+    source_root = copilot_interactive_home()
     target_root = Path.home() / ".forgexa" / "copilot-home"
-    target_root.mkdir(parents=True, exist_ok=True)
-
-    if not source_root.exists():
-        return str(target_root)
-
-    # P3-3.5: Prune old session-state WAL/SHM files and log files > 7 days.
-    # These accumulate indefinitely without cleanup.
-    import time as _time
-    _prune_cutoff = _time.time() - 7 * 86400  # 7 days
-    for _prune_dir_name in ("session-state", "logs"):
-        _prune_dir = target_root / _prune_dir_name
-        if not _prune_dir.is_dir():
-            continue
-        for _old_file in _prune_dir.iterdir():
-            try:
-                if _old_file.is_file() and _old_file.stat().st_mtime < _prune_cutoff:
-                    _old_file.unlink(missing_ok=True)
-                    logger.debug("Pruned old Copilot home file: %s", _old_file)
-            except Exception as _prune_err:
-                logger.debug("Could not prune %s: %s", _old_file, _prune_err)
-
-    # Collect names present in source for stale-file detection.
-    source_names: set[str] = {child.name for child in source_root.iterdir()}
-
-    # Remove master-home entries that are absent from ~/.copilot/.
-    # These are typically old Copilot OAuth token files written when
-    # COPILOT_HOME pointed here directly (pre-isolation-fix era).
-    _keep_always = {"session-state", "logs"}
-    for target_child in list(target_root.iterdir()):
-        if target_child.name in _keep_always:
-            continue
-        if target_child.name not in source_names:
+    lock_file = None
+    try:
+        target_root.mkdir(parents=True, exist_ok=True)
+        lock_file = acquire_file_lock(
+            _copilot_auth_lock_path(target_root),
+            blocking=True,
+        )
+        if lock_file is None:
+            logger.warning("Could not lock Copilot home for synchronization")
+            return str(target_root)
+        if source_root.resolve() == target_root.resolve():
+            return str(target_root)
+        if not source_root.exists():
+            return str(target_root)
+
+        prune_cutoff = time.time() - 7 * 86400
+        for prune_dir_name in ("session-state", "logs"):
+            prune_dir = target_root / prune_dir_name
+            if not prune_dir.is_dir():
+                continue
+            for old_file in prune_dir.iterdir():
+                try:
+                    if old_file.is_file() and old_file.stat().st_mtime < prune_cutoff:
+                        old_file.unlink(missing_ok=True)
+                        logger.debug("Pruned old Copilot home file: %s", old_file)
+                except OSError as exc:
+                    logger.debug("Could not prune %s: %s", old_file, exc)
+
+        source_names = {child.name for child in source_root.iterdir()}
+        migration_marker = target_root.parent / ".copilot-stale-auth-cleaned-v2"
+        if not migration_marker.exists():
+            cleanup_succeeded = True
+            for target_child in list(target_root.iterdir()):
+                if target_child.name in {"session-state", "logs"}:
+                    continue
+                if target_child.name not in source_names:
+                    try:
+                        if target_child.is_dir():
+                            shutil.rmtree(str(target_child))
+                        else:
+                            target_child.unlink(missing_ok=True)
+                        logger.debug("Copilot home: removed stale %s", target_child.name)
+                    except OSError as exc:
+                        cleanup_succeeded = False
+                        logger.debug(
+                            "Copilot home: could not remove stale %s: %s",
+                            target_child.name,
+                            exc,
+                        )
+            if cleanup_succeeded:
+                migration_marker.touch(exist_ok=True)
+                os.chmod(migration_marker, 0o600)
+
+        source_auth_signature = copilot_auth_state_signature(source_root)
+        source_signature_marker = target_root.parent / ".copilot-login-source.sha256"
+        recorded_source_signature: str | None = None
+        if source_signature_marker.is_file():
             try:
-                if target_child.is_dir():
-                    shutil.rmtree(str(target_child), ignore_errors=True)
-                else:
-                    target_child.unlink(missing_ok=True)
-                logger.debug("Copilot home: removed stale %s", target_child.name)
-            except Exception as exc:
-                logger.debug("Copilot home: could not remove stale %s: %s", target_child.name, exc)
-
-    for child in source_root.iterdir():
-        if child.name in {"logs", "session-state"}:
-            continue
+                recorded_source_signature = source_signature_marker.read_text().strip()
+            except OSError:
+                logger.debug("Could not read Copilot login source signature", exc_info=True)
+        source_auth_changed = bool(
+            source_auth_signature
+            and recorded_source_signature is not None
+            and source_auth_signature != recorded_source_signature
+        )
+        source_config_synced = False
+        for child in source_root.iterdir():
+            if child.name in {"logs", "session-state"}:
+                continue
 
-        dest = target_root / child.name
-        try:
-            if child.is_dir():
-                if child.name != "ide":
-                    continue
-                dest.mkdir(parents=True, exist_ok=True)
-                for sub in child.iterdir():
-                    if not sub.is_file() or sub.name.endswith(".lock"):
+            dest = target_root / child.name
+            try:
+                if child.is_dir():
+                    if child.name != "ide":
                         continue
-                    shutil.copy2(sub, dest / sub.name)
-            elif child.is_file():
-                shutil.copy2(child, dest)
-        except Exception as exc:
-            logger.debug(
-                "Copilot home mirror skipped %s -> %s: %s",
-                child, dest, exc,
-            )
+                    dest.mkdir(parents=True, exist_ok=True)
+                    for sub in child.iterdir():
+                        if not sub.is_file() or sub.name.endswith(".lock"):
+                            continue
+                        shutil.copy2(sub, dest / sub.name)
+                elif child.is_file():
+                    if (
+                        child.name == "config.json"
+                        and not source_auth_changed
+                        and dest.is_file()
+                        and dest.stat().st_mtime_ns >= child.stat().st_mtime_ns
+                    ):
+                        source_config_synced = True
+                        continue
+                    shutil.copy2(child, dest)
+                    if child.name == "config.json":
+                        source_config_synced = True
+            except OSError as exc:
+                logger.debug(
+                    "Copilot home mirror skipped %s -> %s: %s",
+                    child,
+                    dest,
+                    exc,
+                )
+        if source_config_synced and source_auth_signature:
+            try:
+                source_signature_marker.write_text(source_auth_signature)
+                os.chmod(source_signature_marker, 0o600)
+            except OSError:
+                logger.debug("Could not record Copilot login source signature", exc_info=True)
+    except OSError:
+        logger.warning("Could not prepare writable Copilot home", exc_info=True)
+    finally:
+        release_file_lock(lock_file)
 
     return str(target_root)

{forgexa_cli-1.42.0 → forgexa_cli-1.43.2}/forgexa_cli/daemon.py

@@ -910,7 +910,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.42.0"
+DAEMON_VERSION = "1.43.2"
 
 
 def _detect_client_type() -> str:
@@ -972,6 +972,9 @@ logging.basicConfig(
     format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
     handlers=_log_handlers,
 )
+# Routine poll/heartbeat requests otherwise consume the entire 500-line remote
+# log tail in about 20 minutes, hiding the task failure operators need to see.
+logging.getLogger("httpx").setLevel(logging.WARNING)
 logger = logging.getLogger("daemon")
 logger.info("Daemon log: %s", DAEMON_LOG_PATH)
 
@@ -984,6 +987,29 @@ def _format_exc(exc: BaseException) -> str:
     return f"{type(exc).__name__}: {detail}" if detail else type(exc).__name__
 
 
+def _safe_agent_error_detail(value: object) -> str:
+    """Return a bounded agent error detail without credentials or tokens."""
+    text = re.sub(r"\s+", " ", str(value or "")).strip()
+    text = re.sub(
+        r"(?i)\b(authorization|api[_-]?key|token|password|secret)\b"
+        r"(\s*[:=]\s*)(?:bearer\s+)?[^\s,;]+",
+        r"\1\2[redacted]",
+        text,
+    )
+    text = re.sub(
+        r"(?i)([?&](?:authorization|api[_-]?key|token|password|secret)=)[^&\s]+",
+        r"\1[redacted]",
+        text,
+    )
+    text = re.sub(r"(?i)\bbearer\s+[^\s,;]+", "Bearer [redacted]", text)
+    text = re.sub(
+        r"(?i)\b(?:github_pat_[a-z0-9_]+|gh[pousr]_[a-z0-9]+)\b",
+        "[redacted-github-token]",
+        text,
+    )
+    return text[:1500]
+
+
 # ── Hardware ID — stable cross-IP machine fingerprint ──
 
 
@@ -4755,7 +4781,8 @@ class ProcessManager:
         "error during sign-in",
         "websockettransporterror",
         "websocket receive failed",
-        "421 misdirected request",
+        "misdirected request",
+        "could not retrieve the list of available models",
         "failed to initialize mcp client",
         # "api error" removed: too broad — matches agent-generated code/output
         # discussing API errors. Real API transport errors are covered by the
@@ -5034,7 +5061,10 @@ class ProcessManager:
         # ── Copilot: JSONL mode but no turn completion and no content ──
         if agent_id == "copilot" and json_line_count > 0:
             if not has_result and not has_meaningful_content and not has_assistant_events:
-                return "Copilot produced no result output (check GitHub authentication: run 'gh auth login')"
+                return (
+                    "Copilot produced no result output "
+                    "(check authentication: run 'copilot login')"
+                )
 
         return None
 
@@ -5967,13 +5997,15 @@ class ProcessManager:
         *,
         disable_builtin_mcps: bool = False,
         _retry_without_effort: bool = False,
+        _retry_without_token_env: bool = False,
         _isolated_copilot_home: str | None = None,
+        _auth_state: dict[str, bool] | None = None,
     ) -> TaskResult:
         """Run GitHub Copilot CLI in non-interactive JSON-streaming mode.
 
         Uses TERM=dumb to suppress TTY-detection (copilot suspends when it
-        can't acquire a pseudo-terminal).  Requires GitHub login:
-        ``gh auth login`` or GITHUB_TOKEN env var must be set.
+        can't acquire a pseudo-terminal). Requires ``copilot login`` or an
+        explicitly configured supported token environment variable.
 
         Flags:
           -p / --prompt          Non-interactive prompt (exits after completion).
@@ -6003,11 +6035,15 @@ class ProcessManager:
         # session-state persists from the prior attempt all todos are already
         # "done" and the agent exits immediately without producing any output.
         _is_outer_call = _isolated_copilot_home is None
+        if _auth_state is None:
+            _auth_state = {"persist": True}
+        _master_copilot_home: str | None = None
+        _copilot_auth_baseline: str | None = None
         if _is_outer_call:
-            master_home = self._prepare_copilot_home()
+            _master_copilot_home = await asyncio.to_thread(self._prepare_copilot_home)
             _isolated_copilot_home = tempfile.mkdtemp(prefix=f"copilot-{task_id[:8]}-")
             try:
-                for child in Path(master_home).iterdir():
+                for child in Path(_master_copilot_home).iterdir():
                     if child.name in {"session-state", "logs"}:
                         continue
                     dest = Path(_isolated_copilot_home) / child.name
@@ -6020,42 +6056,30 @@ class ProcessManager:
                         logger.debug("Copilot home copy %s -> %s: %s", child, dest, _cp_exc)
             except Exception as _iter_exc:
                 logger.debug("Copilot home isolation warning: %s", _iter_exc)
+            _copilot_auth_baseline = agent_core.copilot_auth_state_signature(
+                _isolated_copilot_home,
+            )
 
         env = agent_core.copilot_base_env(
             os.environ.copy(),
             copilot_home=_isolated_copilot_home,
         )
-
-        # Inject GH_TOKEN from the gh CLI for headless/automation auth.
-        # Per `copilot login --help`, env-var auth is the recommended method
-        # for automation: COPILOT_GITHUB_TOKEN > GH_TOKEN > GITHUB_TOKEN.
-        # GH_TOKEN accepts OAuth tokens from the GitHub CLI (gh) app, which
-        # is exactly what `gh auth token` returns.
-        #
-        # This bypasses any stale Copilot-specific OAuth token file that may
-        # be cached in COPILOT_HOME from an earlier run (e.g., after a
-        # password change when `gh auth login` refreshes gh's token but does
-        # NOT update Copilot's own stored token).  After `gh auth login` the
-        # daemon works again without requiring `copilot login` or manual
-        # deletion of ~/.forgexa/copilot-home/.
-        if not any(env.get(k) for k in ("COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN")):
-            try:
-                _gh_proc = await asyncio.create_subprocess_exec(
-                    "gh", "auth", "token",
-                    stdout=asyncio.subprocess.PIPE,
-                    stderr=asyncio.subprocess.DEVNULL,
-                    stdin=asyncio.subprocess.DEVNULL,
-                )
-                _gh_token_out, _ = await asyncio.wait_for(_gh_proc.communicate(), timeout=10.0)
-                _gh_token = (_gh_token_out or b"").decode().strip()
-                if _gh_token:
-                    env["GH_TOKEN"] = _gh_token
-                    logger.debug("Copilot task %s: injected GH_TOKEN from gh CLI", task_id)
-            except Exception as _gh_exc:
-                logger.debug(
-                    "Copilot task %s: could not inject GH_TOKEN (%s); falling back to stored auth",
-                    task_id, _gh_exc,
-                )
+        if _retry_without_token_env:
+            for key in agent_core.COPILOT_TOKEN_ENV_VARS:
+                env.pop(key, None)
+        auth_env_var = next(
+            (
+                key
+                for key in agent_core.COPILOT_TOKEN_ENV_VARS
+                if env.get(key)
+            ),
+            None,
+        )
+        logger.info(
+            "Copilot task %s authentication source: %s",
+            task_id,
+            auth_env_var or "stored Copilot login",
+        )
 
         model_override = os.environ.get("FACTORY_COPILOT_MODEL")
         # FACTORY_COPILOT_REASONING is opt-in: only pass --effort when the env
@@ -6112,6 +6136,19 @@ class ProcessManager:
         # stdin=DEVNULL (below) covers the primary check (GetConsoleMode on stdin);
         # CREATE_NO_WINDOW covers this secondary check so Copilot always sees a fully
         # headless environment and processes -p as the complete task specification.
+        proc: asyncio.subprocess.Process | None = None
+
+        async def _terminate_copilot_process(
+            process: asyncio.subprocess.Process | None,
+        ) -> None:
+            if process is None:
+                return
+            _kill_proc(process)
+            try:
+                await asyncio.wait_for(process.wait(), timeout=5)
+            except (Exception, asyncio.CancelledError):
+                pass
+
         try:
             proc = await asyncio.create_subprocess_exec(
                 *cmd,
@@ -6201,11 +6238,58 @@ class ProcessManager:
                     on_chunk,
                     disable_builtin_mcps=True,
                     _retry_without_effort=_retry_without_effort,
+                    _retry_without_token_env=_retry_without_token_env,
                     _isolated_copilot_home=_isolated_copilot_home,
+                    _auth_state=_auth_state,
                 )
                 retry_result.metrics["copilot_builtin_mcp_fallback"] = True
                 return retry_result
 
+            model_discovery_error = agent_core.is_copilot_model_discovery_auth_error(
+                *structured_errors,
+                stderr,
+            )
+            if model_discovery_error and not self._copilot_called_any_tools(stdout):
+                isolated_config = Path(_isolated_copilot_home) / "config.json"
+                recovery_home = agent_core.copilot_recovery_home(
+                    _isolated_copilot_home,
+                )
+                can_retry_native_auth = bool(
+                    isolated_config.is_file()
+                    or recovery_home is not None
+                )
+                if not _retry_without_token_env and can_retry_native_auth:
+                    restored_interactive_auth = bool(
+                        recovery_home
+                        and await asyncio.to_thread(
+                            agent_core.replace_copilot_auth_state,
+                            recovery_home,
+                            _isolated_copilot_home,
+                        )
+                    )
+                    logger.warning(
+                        "Copilot model discovery failed with HTTP 421 before work for "
+                        "task %s; retrying once with token environment variables removed%s",
+                        task_id,
+                        " and interactive login restored" if restored_interactive_auth else "",
+                    )
+                    retry_result = await self._run_copilot(
+                        agent,
+                        prompt,
+                        cwd,
+                        timeout,
+                        task_id,
+                        on_chunk,
+                        disable_builtin_mcps=disable_builtin_mcps,
+                        _retry_without_effort=_retry_without_effort,
+                        _retry_without_token_env=True,
+                        _isolated_copilot_home=_isolated_copilot_home,
+                        _auth_state=_auth_state,
+                    )
+                    retry_result.metrics["copilot_model_discovery_recovery"] = True
+                    return retry_result
+                _auth_state["persist"] = False
+
             if copilot_exit == 0 and returncode == 0:
                 return TaskResult(
                     status="success",
@@ -6261,14 +6345,17 @@ class ProcessManager:
                         agent, prompt, cwd, timeout, task_id, on_chunk,
                         disable_builtin_mcps=disable_builtin_mcps,
                         _retry_without_effort=True,
+                        _retry_without_token_env=_retry_without_token_env,
                         _isolated_copilot_home=_isolated_copilot_home,
+                        _auth_state=_auth_state,
                     )
                 # Exhausted retries — emit an actionable diagnostic hint
                 if effective_rc == 1 and _no_tools and not copilot_specific_error:
                     logger.error(
                         "Copilot exitCode=1 with no tool calls for task %s after retries. "
-                        "Likely causes: (1) GitHub auth expired — run `gh auth status`; if "
-                        "expired, run `copilot login` (Copilot's own auth) and `gh auth login`; "
+                        "Likely causes: (1) Copilot auth expired — run `copilot login`; "
+                        "if COPILOT_GITHUB_TOKEN, GH_TOKEN, or GITHUB_TOKEN is explicitly set, "
+                        "verify that it belongs to the intended Copilot account; "
                         "(2) Copilot subscription inactive; "
                         "(3) --allow-all flag not supported by this CLI version (%s). "
                         "To reproduce manually: %s",
@@ -6282,9 +6369,9 @@ class ProcessManager:
                 if _is_auth_error:
                     logger.error(
                         "Copilot auth error for task %s: %s. "
-                        "Fix: (1) run 'gh auth login' to refresh gh credentials; "
-                        "(2) run 'copilot login' to refresh Copilot's own OAuth token; "
-                        "(3) if the issue persists, delete ~/.forgexa/copilot-home/ and retry.",
+                        "Fix: (1) run 'copilot login' to refresh Copilot credentials; "
+                        "(2) verify any explicitly configured COPILOT_GITHUB_TOKEN, GH_TOKEN, "
+                        "or GITHUB_TOKEN belongs to the intended Copilot account.",
                         task_id,
                         structured_errors[-1] if structured_errors else "auth failure",
                     )
@@ -6299,6 +6386,13 @@ class ProcessManager:
                     failure_error = f"Copilot exited with code {effective_rc}: {stderr[-500:].strip()}"
                 else:
                     failure_error = f"Copilot exited with code {effective_rc}"
+                logger.error(
+                    "Copilot task %s failed (process_rc=%s, result_exit=%s): %s",
+                    task_id,
+                    returncode,
+                    copilot_exit,
+                    _safe_agent_error_detail(failure_error),
+                )
                 return TaskResult(
                     status="failed",
                     exit_code=effective_rc,
@@ -6307,6 +6401,10 @@ class ProcessManager:
                     error=failure_error,
                     metrics=metrics,
                 )
+        except asyncio.CancelledError:
+            active_proc = self.active_processes.get(task_id) or proc
+            await _terminate_copilot_process(active_proc)
+            raise
         except FileNotFoundError as exc:
             logger.exception("Copilot executable was not found for task %s", task_id)
             return TaskResult(
@@ -6321,7 +6419,9 @@ class ProcessManager:
                 failure_code="agent_launch_not_found",
             )
         except asyncio.TimeoutError as exc:
-            _kill_proc(self.active_processes.pop(task_id, None) or proc)
+            await _terminate_copilot_process(
+                self.active_processes.pop(task_id, None) or proc,
+            )
             _err = (
                 f"Agent produced no stdout, stderr, or workspace changes for "
                 f"{exc.idle_seconds:.0f}s — process terminated. Inspect retained "
@@ -6337,11 +6437,9 @@ class ProcessManager:
             )
         except Exception as exc:
             logger.exception("Copilot stream error for task %s", task_id)
-            if task_id in self.active_processes:
-                try:
-                    self.active_processes[task_id].kill()
-                except Exception:
-                    pass
+            await _terminate_copilot_process(
+                self.active_processes.pop(task_id, None) or proc,
+            )
             return TaskResult(
                 status="failed", exit_code=-1, stdout="", stderr="",
                 error=f"Stream processing error: {exc}",
@@ -6349,6 +6447,13 @@ class ProcessManager:
         finally:
             self.active_processes.pop(task_id, None)
             if _is_outer_call and _isolated_copilot_home:
+                if _master_copilot_home and _auth_state["persist"]:
+                    await asyncio.to_thread(
+                        agent_core.persist_copilot_auth_state,
+                        _isolated_copilot_home,
+                        _master_copilot_home,
+                        _copilot_auth_baseline,
+                    )
                 WorkspaceManager._safe_rmtree(Path(_isolated_copilot_home))
             if _task_file is not None:
                 try:
@@ -9054,7 +9159,10 @@ class RuntimeDaemon:
                     "opencode": "curl -sSL https://opencode.ai/install | sh",
                     "gemini": "npm install -g @google/gemini-cli",
                     "kimi": "curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash",
-                    "copilot": "Install VS Code GitHub Copilot Chat extension, or run: gh copilot. Then: gh auth login",
+                    "copilot": (
+                        "Install GitHub Copilot CLI or the VS Code Copilot Chat "
+                        "extension. Then run: copilot login"
+                    ),
                 }
                 hint = _INSTALL_HINTS.get(task.agent_type, f"install the '{task.agent_type}' CLI tool")
                 logger.error("No agent found for type '%s' on this runtime", task.agent_type)
@@ -11157,7 +11265,10 @@ class RuntimeDaemon:
                     "opencode": "curl -sSL https://opencode.ai/install | sh",
                     "gemini": "npm install -g @google/gemini-cli",
                     "kimi": "curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash",
-                    "copilot": "Install VS Code GitHub Copilot Chat extension, or run: gh copilot. Then: gh auth login",
+                    "copilot": (
+                        "Install GitHub Copilot CLI or the VS Code Copilot Chat "
+                        "extension. Then run: copilot login"
+                    ),
                 }
                 hint = _INSTALL_HINTS.get(agent_type, f"install the '{agent_type}' CLI tool")
                 no_agent_attempts = (

{forgexa_cli-1.42.0 → forgexa_cli-1.43.2}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.42.0
+Version: 1.43.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.42.0 → forgexa_cli-1.43.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.42.0"
+version = "1.43.2"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"