forgexa-cli 1.46.2__tar.gz → 1.47.0__tar.gz

{forgexa_cli-1.46.2 → forgexa_cli-1.47.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.46.2
+Version: 1.47.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.46.2 → forgexa_cli-1.47.0}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.46.2"
+__version__ = "1.47.0"

{forgexa_cli-1.46.2 → forgexa_cli-1.47.0}/forgexa_cli/agent_core.py

@@ -1744,7 +1744,7 @@ def build_copilot_command(
 
     Host-only option (the daemon leaves it at its default):
     ``resume_session_id`` continues a previous session via
-    ``--resume=<id>`` (session state lives under ``~/.copilot/session-state/``).
+    ``--resume=<id>`` (session state lives under ``COPILOT_HOME/session-state/``).
     """
     cmd = [
         binary,

{forgexa_cli-1.46.2 → forgexa_cli-1.47.0}/forgexa_cli/daemon.py

@@ -75,6 +75,14 @@ except ImportError:
     except ImportError:
         import agent_core  # type: ignore[no-redef]  # flat script layout (desktop resources)
 
+try:
+    from app import runtime_evidence
+except ImportError:
+    try:
+        from . import runtime_evidence  # type: ignore[no-redef]  # CLI package layout
+    except ImportError:
+        import runtime_evidence  # type: ignore[no-redef]  # flat script layout (desktop resources)
+
 # Backwards-compatible aliases: keep every moved symbol importable from
 # app.daemon (tests patch e.g. app.daemon._kill_proc) while the single source
 # of truth lives in agent_core.
@@ -1067,7 +1075,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.46.2"
+DAEMON_VERSION = "1.47.0"
 
 
 def _detect_client_type() -> str:
@@ -1404,6 +1412,9 @@ class TaskInfo:
     local_workspace_binding_id: str | None = None
     effective_operator_user_id: str | None = None
     required_commit_shas: list[str] = field(default_factory=list)
+    execution_attempt_id: str | None = None
+    runtime_evidence_plan: dict | None = None
+    local_evidence_upload: bool = False
 
 
 @dataclass
@@ -1432,6 +1443,62 @@ class TaskResult:
     git: dict = field(default_factory=dict)
     # Set from the complete agent stream before stdout is retained as a bounded tail.
     has_verified_completion: bool = False
+    execution_attempt_id: str | None = None
+    evidence_summary: dict | None = None
+
+
+_ACTIONABLE_REFLECTION_KINDS = frozenset({
+    "defect",
+    "failed_check",
+    "vulnerability",
+    "coverage_gap",
+    "requirement_gap",
+})
+
+
+def _reflection_finding_text(value: object, limit: int = 1000) -> str:
+    return value.replace("\x00", "").strip()[:limit] if isinstance(value, str) else ""
+
+
+def _format_reflection_findings(findings: object) -> str:
+    """Format server-filtered actionable findings for the next agent turn."""
+    if not isinstance(findings, list):
+        return ""
+    lines: list[str] = []
+    for finding in findings[:10]:
+        if not isinstance(finding, dict):
+            continue
+        if _reflection_finding_text(finding.get("finding_kind"), 50) not in _ACTIONABLE_REFLECTION_KINDS:
+            continue
+        message = _reflection_finding_text(finding.get("message"))
+        if not message:
+            continue
+        severity = _reflection_finding_text(finding.get("severity"), 20) or "major"
+        dimension = _reflection_finding_text(finding.get("dimension"), 100) or "gate"
+        title = _reflection_finding_text(finding.get("title"), 200)
+        lines.append(f"- [{severity}] [{dimension}] {title or message}")
+        if title and title != message:
+            lines.append(f"  Finding: {message}")
+        path = _reflection_finding_text(finding.get("file"), 1000)
+        line = finding.get("line")
+        end_line = finding.get("end_line")
+        if path:
+            location = path
+            if isinstance(line, int) and line > 0:
+                location += f":{line}"
+                if isinstance(end_line, int) and end_line >= line:
+                    location += f"-{end_line}"
+            lines.append(f"  Location: {location}")
+        for label, key in (
+            ("Evidence", "evidence"),
+            ("Impact", "impact"),
+            ("Suggested change", "suggestion"),
+            ("Verification", "verification"),
+        ):
+            value = _reflection_finding_text(finding.get(key))
+            if value:
+                lines.append(f"  {label}: {value}")
+    return "\n".join(lines)
 
 
 def _filter_local_bind_task_result(result: "TaskResult") -> None:
@@ -1441,7 +1508,7 @@ def _filter_local_bind_task_result(result: "TaskResult") -> None:
     agent observations are classified as data that must NEVER leave the
     user's machine by default for workspace_resolution="local_bind" tasks —
     only Git-tracked artifacts (already pushed) and status/metrics/Git
-    metadata sync. error/failure_code/metrics/git/artifacts are left as-is
+    metadata sync. error/failure_code/metrics/git/artifacts/evidence_summary are left as-is
     (status metadata, not raw output) — only stdout/stderr tail and raw
     agent observations are cleared. Mutates `result` in place; call this
     right before ProgressReporter.report_complete().
@@ -5457,16 +5524,27 @@ class ProcessManager:
 
         # Layer 3: Append CriticAgent reflection context if present
         reflection = (task.input_data or {}).get("reflection_context")
-        if reflection:
+        if isinstance(reflection, dict):
             issues = reflection.get("issues", [])
             score = reflection.get("score", "N/A")
-            issues_text = "\n".join(f"- {iss}" for iss in issues)
-            prompt += (
-                "\n\n## CriticAgent Feedback (MUST address before finishing)\n"
-                f"Previous submission scored {score}. The following issues were identified:\n"
-                f"{issues_text}\n\n"
-                "Fix ALL listed issues. Focus on the specific problems above."
+            findings_text = _format_reflection_findings(
+                reflection.get("remediation_findings")
             )
+            if findings_text:
+                prompt += (
+                    "\n\n## CriticAgent Feedback (MUST address before finishing)\n"
+                    f"Previous submission scored {score}. The following frozen findings were identified:\n"
+                    f"{findings_text}\n\n"
+                    "Address each actionable finding above. Stay within the approved task scope."
+                )
+            else:
+                issues_text = "\n".join(f"- {iss}" for iss in issues)
+                prompt += (
+                    "\n\n## CriticAgent Feedback (MUST address before finishing)\n"
+                    f"Previous submission scored {score}. The following issues were identified:\n"
+                    f"{issues_text}\n\n"
+                    "Fix ALL listed issues. Focus on the specific problems above."
+                )
 
         return prompt
 
@@ -7049,6 +7127,7 @@ class ProgressReporter:
             "stdout_tail": result.stdout[-20000:] if result.stdout else "",
             "stderr_tail": result.stderr[-5000:] if result.stderr else "",
             "verified_completion": result.has_verified_completion,
+            "execution_attempt_id": result.execution_attempt_id,
             "error": result.error,
             "failure_code": result.failure_code,
             "preflight": result.preflight,
@@ -7057,6 +7136,7 @@ class ProgressReporter:
             "lines_removed": result.lines_removed,
             "artifacts": result.artifacts,
             "observations": result.observations,
+            "evidence_summary": result.evidence_summary,
             "metrics": result.metrics,
             "git": result.git,
         }
@@ -7660,6 +7740,12 @@ class TaskPoller:
                     local_workspace_binding_id=t.get("local_workspace_binding_id"),
                     effective_operator_user_id=t.get("effective_operator_user_id"),
                     required_commit_shas=t.get("required_commit_shas", []),
+                    execution_attempt_id=t.get("execution_attempt_id"),
+                    runtime_evidence_plan=(
+                        t.get("runtime_evidence_plan")
+                        if isinstance(t.get("runtime_evidence_plan"), dict) else None
+                    ),
+                    local_evidence_upload=t.get("local_evidence_upload") is True,
                 ))
             return tasks
         except Exception as e:
@@ -8216,6 +8302,8 @@ class ServerConnection:
                     "platform": platform.platform(),
                     "python_version": platform.python_version(),
                     "local_workspace_bindings": {"protocol_version": 2},
+                    "local_evidence": {"protocol_version": 1, "structured_summary": True},
+                    "local_evidence": {"protocol_version": 1, "structured_summary": True},
                 },
                 "server_url": self.server_url,
             }
@@ -9611,6 +9699,7 @@ class RuntimeDaemon:
                         "machine is already using this local workspace binding"
                     ),
                     failure_code="local_binding_unavailable",
+                    execution_attempt_id=task.execution_attempt_id,
                 ))
                 return
         try:
@@ -9636,6 +9725,7 @@ class RuntimeDaemon:
                         f"Agent '{task.agent_type}' is not available on this runtime. "
                         f"Install it: {hint}"
                     ),
+                    execution_attempt_id=task.execution_attempt_id,
                 ))
                 return
 
@@ -9668,6 +9758,7 @@ class RuntimeDaemon:
                     error=_pf_detail,
                     failure_code="project_preflight_failed",
                     preflight=project_preflight,
+                    execution_attempt_id=task.execution_attempt_id,
                 ))
                 return
 
@@ -10339,6 +10430,23 @@ class RuntimeDaemon:
                 result.lines_added = 0
                 result.lines_removed = 0
 
+            if result.status == "success":
+                if is_local_bind:
+                    self._collect_local_bind_evidence_summary(task, result)
+                else:
+                    await self._collect_runtime_evidence(
+                        workspace_path,
+                        task,
+                        result,
+                        before_sha=node_before_sha,
+                    )
+                    await self._collect_runtime_static_evidence(
+                        workspace_path,
+                        task,
+                        result,
+                        before_sha=node_before_sha,
+                    )
+
             # 6. Report completion (include actual agent used if different from requested)
             result.metrics["actual_agent"] = agent.agent_id
             if agent.agent_id != task.agent_type:
@@ -10348,6 +10456,7 @@ class RuntimeDaemon:
                     or fallback_reason
                     or "validation_retry_exhausted"
                 )
+            result.execution_attempt_id = task.execution_attempt_id
             if is_local_bind:
                 # See docs/designs/forgexa-ide-design.md §6.6 — full terminal
                 # output and raw agent observations must never leave the
@@ -10363,6 +10472,7 @@ class RuntimeDaemon:
             await reporter.report_complete(task.task_id, TaskResult(
                 status="failed", exit_code=-1, stdout="", stderr="",
                 error=str(e),
+                execution_attempt_id=task.execution_attempt_id,
             ))
         finally:
             if workspace_execution_lock is not None:
@@ -13066,6 +13176,321 @@ class RuntimeDaemon:
             logger.warning("Auto-commit failed: %s", e)
             return {"commit_error": str(e)}
 
+    async def _run_runtime_evidence_in_worktree(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        after_sha: str,
+        check: dict,
+        execute_check: Callable[[Path, dict], Awaitable[dict]],
+    ) -> dict:
+        """Run one frozen evidence check in a disposable detached worktree."""
+        evidence_root = workspace_path.parent / ".forgexa-evidence-worktrees"
+        evidence_worktree = evidence_root / uuid4().hex
+        worktree_created = False
+        worktree_removed = False
+        try:
+            evidence_root.mkdir(parents=True, exist_ok=True, mode=0o700)
+            await self.workspace_manager._git(
+                "worktree", "add", "--detach", str(evidence_worktree), after_sha,
+                cwd=workspace_path,
+            )
+            worktree_created = True
+            return await execute_check(evidence_worktree, check)
+        except Exception:
+            logger.warning(
+                "Runtime evidence worktree setup failed for task %s",
+                task.task_id,
+                exc_info=True,
+            )
+            return {
+                "status": "worktree_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "evidence_worktree_unavailable",
+                "summary": "A detached evidence worktree could not be prepared.",
+            }
+        finally:
+            if worktree_created:
+                try:
+                    await self.workspace_manager._git(
+                        "worktree", "remove", "--force", str(evidence_worktree),
+                        cwd=workspace_path,
+                    )
+                    worktree_removed = True
+                except Exception:
+                    logger.warning(
+                        "Runtime evidence worktree cleanup failed for task %s; retaining %s",
+                        task.task_id,
+                        evidence_worktree,
+                        exc_info=True,
+                    )
+            if worktree_removed:
+                shutil.rmtree(evidence_worktree, ignore_errors=True)
+
+    async def _collect_runtime_evidence(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        result: TaskResult,
+        *,
+        before_sha: str,
+    ) -> None:
+        """Run one frozen pytest coverage check in a disposable post-commit worktree."""
+        if (
+            task.workspace_resolution != "cloud_worktree"
+            or task.node_type not in ("testing", "fix")
+            or not isinstance(task.runtime_evidence_plan, dict)
+        ):
+            return
+
+        plan = task.runtime_evidence_plan
+        plan_hash = plan.get("plan_hash")
+        checks = plan.get("checks")
+        check = next(
+            (
+                item for item in checks
+                if isinstance(item, dict) and item.get("kind") == runtime_evidence.TEST_COVERAGE_CHECK_KIND
+            ),
+            None,
+        ) if isinstance(checks, list) else None
+        if not isinstance(check, dict):
+            return
+        after_sha = str((result.git or {}).get("commit_sha") or "").strip()
+        if (
+            plan.get("version") != runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION
+            or not isinstance(plan_hash, str)
+            or re.fullmatch(r"[0-9a-f]{64}", plan_hash) is None
+        ):
+            run = {
+                "status": "invalid_plan",
+                "collection_status": "unavailable",
+                "failure_reason": "invalid_frozen_plan",
+                "summary": "The frozen test evidence plan is invalid.",
+            }
+        elif re.fullmatch(r"[0-9a-fA-F]{40}", after_sha) is None:
+            run = {
+                "status": "source_commit_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "source_commit_unavailable",
+                "summary": "The committed source revision is unavailable for evidence collection.",
+            }
+        else:
+            run = await self._run_runtime_evidence_in_worktree(
+                workspace_path,
+                task,
+                after_sha,
+                check,
+                runtime_evidence.run_test_coverage_evidence,
+            )
+
+        source_commit_range = {"after_sha": after_sha} if after_sha else {}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", before_sha or ""):
+            source_commit_range["before_sha"] = before_sha
+        report = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": plan_hash if isinstance(plan_hash, str) else "",
+            "execution_attempt_id": task.execution_attempt_id,
+            "check_kind": runtime_evidence.TEST_COVERAGE_CHECK_KIND,
+            "command": check.get("command") if isinstance(check, dict) else "",
+            "source_commit_range": source_commit_range,
+            "result": run,
+        }
+        report_content = json.dumps(report, sort_keys=True, separators=(",", ":"))
+        report_checksum = hashlib.sha256(report_content.encode("utf-8")).hexdigest()
+        artifact_path = (
+            f".forgexa/evidence/{task.task_id}/{after_sha[:12] or 'unavailable'}/"
+            "test-coverage.json"
+        )
+        artifact_ref = {"path": artifact_path, "checksum": report_checksum}
+        result.artifacts.append({
+            "path": artifact_path,
+            "content": report_content,
+            "content_hash": report_checksum,
+            "type": "application/vnd.forgexa.gate-evidence+json",
+            "system_generated": True,
+            "artifact_role": "gate_evidence_report",
+        })
+
+        evidence_identity = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": report["plan_hash"],
+            "check_kind": runtime_evidence.TEST_COVERAGE_CHECK_KIND,
+            "execution_attempt_id": task.execution_attempt_id,
+            "source_commit_range": source_commit_range,
+        }
+        test_observation = {
+            "type": "test_results",
+            "collection_status": run.get("collection_status"),
+            "summary": run.get("summary"),
+            "tool": "pytest",
+            "command": check.get("command") if isinstance(check, dict) else "",
+            "artifact_refs": [artifact_ref],
+            "runtime_evidence": evidence_identity,
+        }
+        for key in ("test_pass_rate", "passed", "failed", "skipped", "errors", "total", "failed_tests"):
+            if key in run:
+                test_observation[key] = run[key]
+        if run.get("failure_reason"):
+            test_observation["collection_failure_reason"] = run["failure_reason"]
+        result.observations.append(test_observation)
+
+        coverage_observation = {
+            "type": "coverage_results",
+            "tool": "pytest-cov",
+            "command": check.get("command") if isinstance(check, dict) else "",
+            "artifact_refs": [artifact_ref],
+            "runtime_evidence": evidence_identity,
+        }
+        line_coverage = run.get("line_coverage")
+        if run.get("collection_status") == "completed" and isinstance(line_coverage, (int, float)):
+            coverage_observation.update({
+                "collection_status": "completed",
+                "line_coverage": float(line_coverage),
+                "summary": f"pytest coverage completed: {round(float(line_coverage) * 100)}% line coverage.",
+            })
+        elif run.get("collection_status") == "completed":
+            coverage_observation.update({
+                "collection_status": "incomplete",
+                "collection_failure_reason": "coverage_report_unparseable",
+                "summary": "pytest completed but did not emit a parseable coverage total.",
+            })
+        else:
+            coverage_observation.update({
+                "collection_status": run.get("collection_status", "unavailable"),
+                "collection_failure_reason": run.get("failure_reason", "evidence_unavailable"),
+                "summary": run.get("summary", "Coverage evidence is unavailable."),
+            })
+        result.observations.append(coverage_observation)
+
+    def _collect_local_bind_evidence_summary(
+        self,
+        task: TaskInfo,
+        result: TaskResult,
+    ) -> None:
+        """Extract the allowed local-bind test summary before raw output is cleared."""
+        if (
+            not task.local_evidence_upload
+            or task.node_type not in ("testing", "fix")
+        ):
+            return
+        raw_output = "\n".join(part for part in (result.stdout, result.stderr) if part)
+        pytest_summary = runtime_evidence.build_local_pytest_evidence_summary(raw_output)
+        ruff_summary = runtime_evidence.build_local_ruff_evidence_summary(raw_output)
+        summary = {"version": runtime_evidence.LOCAL_EVIDENCE_SUMMARY_VERSION}
+        if pytest_summary is not None:
+            summary["pytest"] = pytest_summary["pytest"]
+        if ruff_summary is not None:
+            summary["ruff"] = ruff_summary["ruff"]
+        result.evidence_summary = summary if len(summary) > 1 else None
+
+    async def _collect_runtime_static_evidence(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        result: TaskResult,
+        *,
+        before_sha: str,
+    ) -> None:
+        """Run a frozen Ruff check in a disposable post-commit worktree."""
+        if (
+            task.workspace_resolution != "cloud_worktree"
+            or task.node_type not in ("testing", "fix")
+            or not isinstance(task.runtime_evidence_plan, dict)
+        ):
+            return
+
+        plan = task.runtime_evidence_plan
+        plan_hash = plan.get("plan_hash")
+        checks = plan.get("checks")
+        check = next(
+            (
+                item for item in checks
+                if isinstance(item, dict) and item.get("kind") == runtime_evidence.STATIC_CHECK_KIND
+            ),
+            None,
+        ) if isinstance(checks, list) else None
+        if not isinstance(check, dict):
+            return
+        after_sha = str((result.git or {}).get("commit_sha") or "").strip()
+        if (
+            plan.get("version") != runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION
+            or not isinstance(plan_hash, str)
+            or re.fullmatch(r"[0-9a-f]{64}", plan_hash) is None
+        ):
+            run = {
+                "status": "invalid_plan",
+                "collection_status": "unavailable",
+                "failure_reason": "invalid_frozen_plan",
+                "summary": "The frozen static-check evidence plan is invalid.",
+            }
+        elif re.fullmatch(r"[0-9a-fA-F]{40}", after_sha) is None:
+            run = {
+                "status": "source_commit_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "source_commit_unavailable",
+                "summary": "The committed source revision is unavailable for static checking.",
+            }
+        else:
+            run = await self._run_runtime_evidence_in_worktree(
+                workspace_path,
+                task,
+                after_sha,
+                check,
+                runtime_evidence.run_static_check_evidence,
+            )
+
+        source_commit_range = {"after_sha": after_sha} if after_sha else {}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", before_sha or ""):
+            source_commit_range["before_sha"] = before_sha
+        report = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": plan_hash if isinstance(plan_hash, str) else "",
+            "execution_attempt_id": task.execution_attempt_id,
+            "check_kind": runtime_evidence.STATIC_CHECK_KIND,
+            "command": check.get("command"),
+            "source_commit_range": source_commit_range,
+            "result": run,
+        }
+        report_content = json.dumps(report, sort_keys=True, separators=(",", ":"))
+        report_checksum = hashlib.sha256(report_content.encode("utf-8")).hexdigest()
+        artifact_path = (
+            f".forgexa/evidence/{task.task_id}/{after_sha[:12] or 'unavailable'}/"
+            "static-check.json"
+        )
+        artifact_ref = {"path": artifact_path, "checksum": report_checksum}
+        result.artifacts.append({
+            "path": artifact_path,
+            "content": report_content,
+            "content_hash": report_checksum,
+            "type": "application/vnd.forgexa.gate-evidence+json",
+            "system_generated": True,
+            "artifact_role": "gate_evidence_report",
+        })
+
+        evidence_identity = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": report["plan_hash"],
+            "check_kind": runtime_evidence.STATIC_CHECK_KIND,
+            "execution_attempt_id": task.execution_attempt_id,
+            "source_commit_range": source_commit_range,
+        }
+        observation = {
+            "type": "lint_results",
+            "collection_status": run.get("collection_status"),
+            "summary": run.get("summary"),
+            "lint_tool": "ruff",
+            "lint_command": check.get("command"),
+            "command": check.get("command"),
+            "artifact_refs": [artifact_ref],
+            "runtime_evidence": evidence_identity,
+        }
+        for key in ("lint_score", "issues", "type_errors", "truncated_count"):
+            if key in run:
+                observation[key] = run[key]
+        if run.get("failure_reason"):
+            observation["collection_failure_reason"] = run["failure_reason"]
+        result.observations.append(observation)
+
     async def _collect_staged_diff_stats(self, cwd: Path) -> dict:
         """Collect staged diff stats for building a rich commit message."""
         status_map: dict[str, str] = {}

forgexa_cli-1.47.0/forgexa_cli/runtime_evidence.py

@@ -0,0 +1,583 @@
+"""Portable planning and parsing for controlled runtime evidence checks."""
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import re
+import shlex
+import time
+from pathlib import Path
+from typing import Any
+
+
+RUNTIME_EVIDENCE_PLAN_VERSION = 1
+TEST_COVERAGE_CHECK_KIND = "test_coverage"
+STATIC_CHECK_KIND = "static_check"
+LOCAL_EVIDENCE_SUMMARY_VERSION = 1
+_DEFAULT_TIMEOUT_SECONDS = 600
+_MAX_FAILED_TESTS = 20
+_MAX_LINT_ISSUES = 50
+_MAX_OUTPUT_CHARS = 100_000
+_SHELL_METACHARACTERS = (";", "`", "$", ">", "<", "&", "|", "\n", "\r", "\x00")
+_SENSITIVE_ARGUMENT = re.compile(
+    r"^-{1,2}(?:api[-_]?key|authorization|password|secret|token)(?:=|$)",
+    re.IGNORECASE,
+)
+_WINDOWS_ABSOLUTE_PATH = re.compile(r"^[A-Za-z]:[\\/]")
+_SAFE_TRACEBACK_MODES = frozenset({"auto", "long", "short", "line", "native", "no"})
+_SAFE_COVERAGE_REPORTS = frozenset({"term", "term-missing"})
+_RUFF_STATIC_CHECK_ARGV = (
+    "python", "-m", "ruff", "check", ".", "--output-format=json",
+)
+_SAFE_LOCAL_TEST_NAME = re.compile(r"^[A-Za-z0-9_./:-]+$")
+_SAFE_LOCAL_RUFF_RULE = re.compile(r"^[A-Za-z][A-Za-z0-9_-]{0,199}$")
+
+
+def _safe_workspace_path(value: str, *, allow_node_id: bool = False) -> bool:
+    candidate = value.strip().replace("\\", "/")
+    if allow_node_id:
+        candidate = candidate.split("::", 1)[0]
+    if (
+        not candidate
+        or candidate.startswith(("/", "~", "@"))
+        or _WINDOWS_ABSOLUTE_PATH.match(candidate)
+    ):
+        return False
+    return all(part not in {"", ".."} for part in candidate.split("/"))
+
+
+def pytest_coverage_command_argv(command: object) -> list[str] | None:
+    """Return a whitelisted pytest-with-coverage argv, or ``None`` when disallowed."""
+    if not isinstance(command, str) or not command.strip():
+        return None
+    if any(character in command for character in _SHELL_METACHARACTERS):
+        return None
+    try:
+        argv = shlex.split(command)
+    except ValueError:
+        return None
+    if argv[:3] != ["python", "-m", "pytest"]:
+        return None
+    coverage_seen = False
+    for argument in argv[3:]:
+        if _SENSITIVE_ARGUMENT.match(argument):
+            return None
+        if re.fullmatch(r"-q+", argument) or argument == "--disable-warnings":
+            continue
+        if argument.startswith("--tb="):
+            if argument.removeprefix("--tb=") in _SAFE_TRACEBACK_MODES:
+                continue
+            return None
+        if argument.startswith("--cov="):
+            if _safe_workspace_path(argument.removeprefix("--cov=")):
+                coverage_seen = True
+                continue
+            return None
+        if argument.startswith("--cov-report="):
+            if argument.removeprefix("--cov-report=") in _SAFE_COVERAGE_REPORTS:
+                continue
+            return None
+        if argument.startswith("-") or not _safe_workspace_path(argument, allow_node_id=True):
+            return None
+    if not coverage_seen:
+        return None
+    return argv
+
+
+def ruff_static_check_command_argv(command: object) -> list[str] | None:
+    """Return the sole supported Ruff static-check argv, or ``None``."""
+    if not isinstance(command, str) or not command.strip():
+        return None
+    if any(character in command for character in _SHELL_METACHARACTERS):
+        return None
+    try:
+        argv = shlex.split(command)
+    except ValueError:
+        return None
+    return list(_RUFF_STATIC_CHECK_ARGV) if tuple(argv) == _RUFF_STATIC_CHECK_ARGV else None
+
+
+def _single_hook_command(policy: object, hook_name: str) -> str | None:
+    hooks = policy.get("hooks") if isinstance(policy, dict) else None
+    configured = hooks.get(hook_name) if isinstance(hooks, dict) else None
+    if isinstance(configured, str):
+        return configured
+    if (
+        isinstance(configured, list)
+        and len(configured) == 1
+        and isinstance(configured[0], str)
+    ):
+        return configured[0]
+    return None
+
+
+def _finalize_evidence_plan(
+    checks: list[dict[str, Any]],
+    policy_snapshot: object,
+) -> dict[str, Any] | None:
+    if not checks:
+        return None
+    snapshot = {
+        key: value
+        for key, value in (policy_snapshot.items() if isinstance(policy_snapshot, dict) else [])
+        if key in {"id", "version", "checksum"} and value is not None
+    }
+    plan: dict[str, Any] = {
+        "version": RUNTIME_EVIDENCE_PLAN_VERSION,
+        "checks": checks,
+    }
+    if snapshot:
+        plan["policy_snapshot"] = snapshot
+    serialized = json.dumps(plan, sort_keys=True, separators=(",", ":"))
+    plan["plan_hash"] = hashlib.sha256(serialized.encode("utf-8")).hexdigest()
+    return plan
+
+
+def _test_coverage_check(policy: object) -> dict[str, Any] | None:
+    command = _single_hook_command(policy, "test")
+    argv = pytest_coverage_command_argv(command)
+    if argv is None or command is None:
+        return None
+    return {
+        "kind": TEST_COVERAGE_CHECK_KIND,
+        "tool": "pytest",
+        "command": command.strip(),
+        "argv": argv,
+        "timeout_seconds": _DEFAULT_TIMEOUT_SECONDS,
+        "report_format": "pytest_stdout_coverage",
+    }
+
+
+def _static_check(policy: object) -> dict[str, Any] | None:
+    command = _single_hook_command(policy, "lint")
+    argv = ruff_static_check_command_argv(command)
+    if argv is None or command is None:
+        return None
+    return {
+        "kind": STATIC_CHECK_KIND,
+        "tool": "ruff",
+        "command": command.strip(),
+        "argv": argv,
+        "timeout_seconds": _DEFAULT_TIMEOUT_SECONDS,
+        "report_format": "ruff_json",
+    }
+
+
+def build_test_coverage_evidence_plan(
+    policy: object,
+    policy_snapshot: object = None,
+) -> dict[str, Any] | None:
+    """Freeze one opt-in, server-approved pytest coverage check for a graph."""
+    check = _test_coverage_check(policy)
+    return _finalize_evidence_plan([check] if check is not None else [], policy_snapshot)
+
+
+def build_runtime_evidence_plan(
+    policy: object,
+    policy_snapshot: object = None,
+) -> dict[str, Any] | None:
+    """Freeze all supported, opt-in runtime evidence checks for one graph."""
+    checks = [
+        check
+        for check in (_test_coverage_check(policy), _static_check(policy))
+        if check is not None
+    ]
+    return _finalize_evidence_plan(checks, policy_snapshot)
+
+
+def parse_pytest_coverage_output(output: object, exit_code: int) -> dict[str, Any]:
+    """Parse bounded pytest stdout into a non-sensitive evidence summary."""
+    text = output[:_MAX_OUTPUT_CHARS] if isinstance(output, str) else ""
+    if "No module named pytest" in text:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "pytest_unavailable",
+            "summary": "pytest is unavailable on this runtime.",
+        }
+    if re.search(r"\bno tests ran\b", text, re.IGNORECASE):
+        return {
+            "status": "not_executed",
+            "collection_status": "not_executed",
+            "failure_reason": "no_tests_collected",
+            "summary": "pytest completed without collecting tests.",
+        }
+
+    counts = {
+        "passed": _pytest_count(text, "passed"),
+        "failed": _pytest_count(text, "failed"),
+        "skipped": _pytest_count(text, "skipped"),
+        "errors": _pytest_count(text, "error"),
+    }
+    total = sum(counts.values())
+    if total == 0:
+        return {
+            "status": "parse_failed",
+            "collection_status": "incomplete",
+            "failure_reason": "pytest_summary_unparseable",
+            "summary": "pytest output did not contain a parseable test summary.",
+        }
+
+    coverage_match = re.search(
+        r"^TOTAL\s+\d+\s+\d+\s+(\d+(?:\.\d+)?)%",
+        text,
+        re.MULTILINE,
+    )
+    coverage = float(coverage_match.group(1)) / 100.0 if coverage_match else None
+    failed_tests = _failed_test_names(text)
+    passed = counts["passed"]
+    summary = (
+        f"pytest completed: {passed} passed, {counts['failed']} failed, "
+        f"{counts['skipped']} skipped, {counts['errors']} errors."
+    )
+    return {
+        "status": "completed",
+        "collection_status": "completed",
+        "test_pass_rate": passed / total,
+        "passed": passed,
+        "failed": counts["failed"],
+        "skipped": counts["skipped"],
+        "errors": counts["errors"],
+        "total": total,
+        "failed_tests": [{"name": name} for name in failed_tests],
+        "line_coverage": coverage,
+        "summary": summary,
+        "exit_code": exit_code,
+    }
+
+
+def build_local_pytest_evidence_summary(output: object) -> dict[str, Any] | None:
+    """Return a secret-free, reported-only local-bind pytest summary."""
+    result = parse_pytest_coverage_output(output, 0)
+    if result.get("collection_status") != "completed":
+        return None
+    counts = {
+        key: result.get(key)
+        for key in ("passed", "failed", "skipped", "errors")
+    }
+    if (
+        not all(
+            isinstance(value, int) and not isinstance(value, bool) and value >= 0
+            for value in counts.values()
+        )
+        or sum(counts.values()) == 0
+    ):
+        return None
+    pytest_summary: dict[str, Any] = counts
+    failed_tests: list[dict[str, str]] = []
+    for failed_test in result.get("failed_tests", []):
+        name = failed_test.get("name") if isinstance(failed_test, dict) else None
+        safe_name = _safe_local_test_name(name)
+        if safe_name is not None:
+            failed_tests.append({"name": safe_name})
+    if failed_tests:
+        pytest_summary["failed_tests"] = failed_tests
+    truncated_count = _local_failed_test_truncated_count(output)
+    if truncated_count:
+        pytest_summary["truncated_count"] = truncated_count
+    line_coverage = result.get("line_coverage")
+    if isinstance(line_coverage, (int, float)) and not isinstance(line_coverage, bool):
+        pytest_summary["line_coverage"] = float(line_coverage)
+    return {
+        "version": LOCAL_EVIDENCE_SUMMARY_VERSION,
+        "pytest": pytest_summary,
+    }
+
+
+def build_local_ruff_evidence_summary(output: object) -> dict[str, Any] | None:
+    """Return a secret-free, reported-only local-bind Ruff summary."""
+    text = output[:_MAX_OUTPUT_CHARS] if isinstance(output, str) else ""
+    try:
+        raw_findings = json.loads(text)
+    except json.JSONDecodeError:
+        return None
+    if not isinstance(raw_findings, list):
+        return None
+    result = parse_ruff_json_output(text, 0)
+    if result.get("collection_status") != "completed":
+        return None
+    issues: list[dict[str, Any]] = []
+    for issue in result.get("issues", []):
+        rule = issue.get("rule") if isinstance(issue, dict) else None
+        if not isinstance(rule, str) or _SAFE_LOCAL_RUFF_RULE.fullmatch(rule) is None:
+            continue
+        summary_issue: dict[str, Any] = {"rule": rule}
+        for key in ("file", "line", "column", "end_line", "end_column"):
+            value = issue.get(key)
+            if isinstance(value, str) or (
+                isinstance(value, int) and not isinstance(value, bool) and value > 0
+            ):
+                summary_issue[key] = value
+        issues.append(summary_issue)
+    if raw_findings and not issues:
+        return None
+    ruff_summary: dict[str, Any] = {"issues": issues}
+    truncated_count = result.get("truncated_count")
+    if isinstance(truncated_count, int) and not isinstance(truncated_count, bool) and truncated_count > 0:
+        ruff_summary["truncated_count"] = truncated_count
+    return {
+        "version": LOCAL_EVIDENCE_SUMMARY_VERSION,
+        "ruff": ruff_summary,
+    }
+
+
+def parse_ruff_json_output(output: object, exit_code: int) -> dict[str, Any]:
+    """Parse Ruff JSON into bounded, repository-relative static findings."""
+    text = output[:_MAX_OUTPUT_CHARS] if isinstance(output, str) else ""
+    if "No module named ruff" in text:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "ruff_unavailable",
+            "summary": "Ruff is unavailable on this runtime.",
+        }
+    if exit_code not in (0, 1):
+        return {
+            "status": "execution_failed",
+            "collection_status": "incomplete",
+            "failure_reason": "ruff_execution_failed",
+            "summary": f"Ruff exited with status {exit_code} before completing static checks.",
+            "exit_code": exit_code,
+        }
+    try:
+        raw_findings = json.loads(text)
+    except json.JSONDecodeError:
+        return {
+            "status": "parse_failed",
+            "collection_status": "incomplete",
+            "failure_reason": "ruff_json_unparseable",
+            "summary": "Ruff did not emit a parseable JSON report.",
+        }
+    if not isinstance(raw_findings, list):
+        return {
+            "status": "parse_failed",
+            "collection_status": "incomplete",
+            "failure_reason": "ruff_json_invalid_shape",
+            "summary": "Ruff emitted an invalid JSON report shape.",
+        }
+
+    issues: list[dict[str, Any]] = []
+    for raw_finding in raw_findings:
+        if not isinstance(raw_finding, dict):
+            continue
+        message = raw_finding.get("message")
+        rule = raw_finding.get("code")
+        if not isinstance(message, str) or not message.strip() or not isinstance(rule, str) or not rule.strip():
+            continue
+        finding: dict[str, Any] = {
+            "rule": rule.strip()[:200],
+            "message": message.strip()[:1000],
+        }
+        filename = raw_finding.get("filename")
+        if isinstance(filename, str) and _safe_workspace_path(filename):
+            finding["file"] = filename.strip().replace("\\", "/")
+        location = raw_finding.get("location")
+        if isinstance(location, dict):
+            row = location.get("row")
+            column = location.get("column")
+            if isinstance(row, int) and not isinstance(row, bool) and row > 0:
+                finding["line"] = row
+            if isinstance(column, int) and not isinstance(column, bool) and column > 0:
+                finding["column"] = column
+        end_location = raw_finding.get("end_location")
+        if isinstance(end_location, dict):
+            row = end_location.get("row")
+            column = end_location.get("column")
+            if isinstance(row, int) and not isinstance(row, bool) and row > 0:
+                finding["end_line"] = row
+            if isinstance(column, int) and not isinstance(column, bool) and column > 0:
+                finding["end_column"] = column
+        issues.append(finding)
+        if len(issues) >= _MAX_LINT_ISSUES:
+            break
+
+    result: dict[str, Any] = {
+        "status": "completed",
+        "collection_status": "completed",
+        "lint_score": 1.0 if not issues else 0.0,
+        "issues": issues,
+        "type_errors": [],
+        "summary": f"Ruff completed: {len(issues)} issue(s).",
+        "exit_code": exit_code,
+    }
+    if len(raw_findings) > len(issues):
+        result["truncated_count"] = len(raw_findings) - len(issues)
+    return result
+
+
+async def run_test_coverage_evidence(
+    workspace_path: str | Path,
+    check: object,
+) -> dict[str, Any]:
+    """Run one frozen pytest coverage check without invoking a shell."""
+    command = check.get("command") if isinstance(check, dict) else None
+    argv = pytest_coverage_command_argv(command)
+    if argv is None:
+        return {
+            "status": "invalid_plan",
+            "collection_status": "unavailable",
+            "failure_reason": "invalid_frozen_command",
+            "summary": "The frozen test evidence command is invalid.",
+        }
+    timeout = check.get("timeout_seconds") if isinstance(check, dict) else None
+    timeout_seconds = (
+        timeout if isinstance(timeout, int) and 1 <= timeout <= 3600 else _DEFAULT_TIMEOUT_SECONDS
+    )
+    started_at = time.monotonic()
+    try:
+        process = await asyncio.create_subprocess_exec(
+            *argv,
+            cwd=str(Path(workspace_path)),
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+    except FileNotFoundError:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "python_unavailable",
+            "summary": "Python is unavailable on this runtime.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+    except OSError:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "pytest_start_failed",
+            "summary": "pytest could not be started on this runtime.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+
+    try:
+        stdout, stderr = await asyncio.wait_for(process.communicate(), timeout_seconds)
+    except asyncio.TimeoutError:
+        process.kill()
+        await process.communicate()
+        return {
+            "status": "timed_out",
+            "collection_status": "unavailable",
+            "failure_reason": "timeout",
+            "summary": f"pytest evidence collection timed out after {timeout_seconds}s.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+
+    output = (stdout + b"\n" + stderr).decode("utf-8", errors="replace")
+    report = parse_pytest_coverage_output(output, process.returncode or 0)
+    report["duration_ms"] = int((time.monotonic() - started_at) * 1000)
+    report["tool"] = "pytest"
+    report["command"] = command
+    return report
+
+
+async def run_static_check_evidence(
+    workspace_path: str | Path,
+    check: object,
+) -> dict[str, Any]:
+    """Run the frozen Ruff static check without invoking a shell."""
+    command = check.get("command") if isinstance(check, dict) else None
+    argv = ruff_static_check_command_argv(command)
+    if argv is None:
+        return {
+            "status": "invalid_plan",
+            "collection_status": "unavailable",
+            "failure_reason": "invalid_frozen_command",
+            "summary": "The frozen static-check command is invalid.",
+        }
+    timeout = check.get("timeout_seconds") if isinstance(check, dict) else None
+    timeout_seconds = (
+        timeout if isinstance(timeout, int) and 1 <= timeout <= 3600 else _DEFAULT_TIMEOUT_SECONDS
+    )
+    started_at = time.monotonic()
+    try:
+        process = await asyncio.create_subprocess_exec(
+            *argv,
+            cwd=str(Path(workspace_path)),
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+    except FileNotFoundError:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "python_unavailable",
+            "summary": "Python is unavailable on this runtime.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+    except OSError:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "ruff_start_failed",
+            "summary": "Ruff could not be started on this runtime.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+
+    try:
+        stdout, stderr = await asyncio.wait_for(process.communicate(), timeout_seconds)
+    except asyncio.TimeoutError:
+        process.kill()
+        await process.communicate()
+        return {
+            "status": "timed_out",
+            "collection_status": "unavailable",
+            "failure_reason": "timeout",
+            "summary": f"Ruff evidence collection timed out after {timeout_seconds}s.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+
+    stdout_text = stdout.decode("utf-8", errors="replace")
+    stderr_text = stderr.decode("utf-8", errors="replace")
+    if "No module named ruff" in f"{stdout_text}\n{stderr_text}":
+        report = {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "ruff_unavailable",
+            "summary": "Ruff is unavailable on this runtime.",
+        }
+    else:
+        report = parse_ruff_json_output(stdout_text, process.returncode or 0)
+    report["duration_ms"] = int((time.monotonic() - started_at) * 1000)
+    report["tool"] = "ruff"
+    report["command"] = command
+    return report
+
+
+def _pytest_count(output: str, label: str) -> int:
+    match = re.search(rf"(\d+)\s+{label}s?\b", output, re.IGNORECASE)
+    return int(match.group(1)) if match else 0
+
+
+def _failed_test_names(output: str) -> list[str]:
+    names: list[str] = []
+    seen: set[str] = set()
+    for match in re.finditer(r"^(?:FAILED|ERROR)\s+([^\s]+)", output, re.MULTILINE):
+        name = match.group(1).strip()
+        if not name or name.startswith(("/", "\\")) or ".." in name:
+            continue
+        if name not in seen:
+            seen.add(name)
+            names.append(name[:500])
+        if len(names) >= _MAX_FAILED_TESTS:
+            break
+    return names
+
+
+def _safe_local_test_name(value: object) -> str | None:
+    if not isinstance(value, str):
+        return None
+    name = value.split("[", 1)[0].strip()
+    if not name or len(name) > 500 or _SAFE_LOCAL_TEST_NAME.fullmatch(name) is None:
+        return None
+    return name
+
+
+def _local_failed_test_truncated_count(output: object) -> int:
+    if not isinstance(output, str):
+        return 0
+    names = {
+        name
+        for match in re.finditer(r"^(?:FAILED|ERROR)\s+([^\s]+)", output, re.MULTILINE)
+        if (name := _safe_local_test_name(match.group(1))) is not None
+    }
+    return max(0, len(names) - _MAX_FAILED_TESTS)

{forgexa_cli-1.46.2 → forgexa_cli-1.47.0}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.46.2
+Version: 1.47.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.46.2 → forgexa_cli-1.47.0}/forgexa_cli.egg-info/SOURCES.txt

@@ -8,6 +8,7 @@ forgexa_cli/autoupgrade.py
 forgexa_cli/daemon.py
 forgexa_cli/main.py
 forgexa_cli/py.typed
+forgexa_cli/runtime_evidence.py
 forgexa_cli.egg-info/PKG-INFO
 forgexa_cli.egg-info/SOURCES.txt
 forgexa_cli.egg-info/dependency_links.txt

{forgexa_cli-1.46.2 → forgexa_cli-1.47.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.46.2"
+version = "1.47.0"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"