forgexa-cli 1.47.0__tar.gz → 1.47.1__tar.gz

{forgexa_cli-1.47.0 → forgexa_cli-1.47.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.47.0
+Version: 1.47.1
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.47.0 → forgexa_cli-1.47.1}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.47.0"
+__version__ = "1.47.1"

{forgexa_cli-1.47.0 → forgexa_cli-1.47.1}/forgexa_cli/daemon.py

@@ -1075,7 +1075,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.47.0"
+DAEMON_VERSION = "1.47.1"
 
 
 def _detect_client_type() -> str:
@@ -5992,8 +5992,13 @@ class ProcessManager:
         if not match:
             return None
         missing_model, suggested_model = match.groups()
-        if missing_model.strip().lower() == suggested_model.lower():
+        missing_model = missing_model.strip()
+        if missing_model.lower() == suggested_model.lower():
             return None
+        if "/" not in suggested_model and "/" in missing_model:
+            provider = missing_model.split("/", 1)[0]
+            if provider:
+                suggested_model = f"{provider}/{suggested_model}"
         return suggested_model
 
     async def _run_opencode(
@@ -10446,6 +10451,18 @@ class RuntimeDaemon:
                         result,
                         before_sha=node_before_sha,
                     )
+                    await self._collect_runtime_type_evidence(
+                        workspace_path,
+                        task,
+                        result,
+                        before_sha=node_before_sha,
+                    )
+                    await self._collect_runtime_security_evidence(
+                        workspace_path,
+                        task,
+                        result,
+                        before_sha=node_before_sha,
+                    )
 
             # 6. Report completion (include actual agent used if different from requested)
             result.metrics["actual_agent"] = agent.agent_id
@@ -13491,6 +13508,221 @@ class RuntimeDaemon:
             observation["collection_failure_reason"] = run["failure_reason"]
         result.observations.append(observation)
 
+    async def _collect_runtime_type_evidence(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        result: TaskResult,
+        *,
+        before_sha: str,
+    ) -> None:
+        """Run a frozen mypy check in a disposable post-commit worktree."""
+        if (
+            task.workspace_resolution != "cloud_worktree"
+            or task.node_type not in ("testing", "fix")
+            or not isinstance(task.runtime_evidence_plan, dict)
+        ):
+            return
+
+        plan = task.runtime_evidence_plan
+        plan_hash = plan.get("plan_hash")
+        checks = plan.get("checks")
+        check = next(
+            (
+                item for item in checks
+                if isinstance(item, dict) and item.get("kind") == runtime_evidence.TYPE_CHECK_KIND
+            ),
+            None,
+        ) if isinstance(checks, list) else None
+        if not isinstance(check, dict):
+            return
+        after_sha = str((result.git or {}).get("commit_sha") or "").strip()
+        if (
+            plan.get("version") != runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION
+            or not isinstance(plan_hash, str)
+            or re.fullmatch(r"[0-9a-f]{64}", plan_hash) is None
+        ):
+            run = {
+                "status": "invalid_plan",
+                "collection_status": "unavailable",
+                "failure_reason": "invalid_frozen_plan",
+                "summary": "The frozen type-check evidence plan is invalid.",
+            }
+        elif re.fullmatch(r"[0-9a-fA-F]{40}", after_sha) is None:
+            run = {
+                "status": "source_commit_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "source_commit_unavailable",
+                "summary": "The committed source revision is unavailable for type checking.",
+            }
+        else:
+            run = await self._run_runtime_evidence_in_worktree(
+                workspace_path,
+                task,
+                after_sha,
+                check,
+                runtime_evidence.run_type_check_evidence,
+            )
+
+        source_commit_range = {"after_sha": after_sha} if after_sha else {}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", before_sha or ""):
+            source_commit_range["before_sha"] = before_sha
+        report = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": plan_hash if isinstance(plan_hash, str) else "",
+            "execution_attempt_id": task.execution_attempt_id,
+            "check_kind": runtime_evidence.TYPE_CHECK_KIND,
+            "command": check.get("command"),
+            "source_commit_range": source_commit_range,
+            "result": run,
+        }
+        report_content = json.dumps(report, sort_keys=True, separators=(",", ":"))
+        report_checksum = hashlib.sha256(report_content.encode("utf-8")).hexdigest()
+        artifact_path = (
+            f".forgexa/evidence/{task.task_id}/{after_sha[:12] or 'unavailable'}/"
+            "type-check.json"
+        )
+        artifact_ref = {"path": artifact_path, "checksum": report_checksum}
+        result.artifacts.append({
+            "path": artifact_path,
+            "content": report_content,
+            "content_hash": report_checksum,
+            "type": "application/vnd.forgexa.gate-evidence+json",
+            "system_generated": True,
+            "artifact_role": "gate_evidence_report",
+        })
+
+        evidence_identity = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": report["plan_hash"],
+            "check_kind": runtime_evidence.TYPE_CHECK_KIND,
+            "execution_attempt_id": task.execution_attempt_id,
+            "source_commit_range": source_commit_range,
+        }
+        observation = {
+            "type": "lint_results",
+            "collection_status": run.get("collection_status"),
+            "summary": run.get("summary"),
+            "lint_tool": "mypy",
+            "lint_command": check.get("command"),
+            "command": check.get("command"),
+            "artifact_refs": [artifact_ref],
+            "runtime_evidence": evidence_identity,
+        }
+        for key in ("lint_score", "issues", "type_errors", "truncated_count"):
+            if key in run:
+                observation[key] = run[key]
+        if run.get("failure_reason"):
+            observation["collection_failure_reason"] = run["failure_reason"]
+        result.observations.append(observation)
+
+    async def _collect_runtime_security_evidence(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        result: TaskResult,
+        *,
+        before_sha: str,
+    ) -> None:
+        """Run a frozen Bandit scan in a disposable post-commit worktree."""
+        if (
+            task.workspace_resolution != "cloud_worktree"
+            or task.node_type not in ("testing", "fix")
+            or not isinstance(task.runtime_evidence_plan, dict)
+        ):
+            return
+
+        plan = task.runtime_evidence_plan
+        plan_hash = plan.get("plan_hash")
+        checks = plan.get("checks")
+        check = next(
+            (
+                item for item in checks
+                if isinstance(item, dict) and item.get("kind") == runtime_evidence.SECURITY_CHECK_KIND
+            ),
+            None,
+        ) if isinstance(checks, list) else None
+        if not isinstance(check, dict):
+            return
+        after_sha = str((result.git or {}).get("commit_sha") or "").strip()
+        if (
+            plan.get("version") != runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION
+            or not isinstance(plan_hash, str)
+            or re.fullmatch(r"[0-9a-f]{64}", plan_hash) is None
+        ):
+            run = {
+                "status": "invalid_plan",
+                "collection_status": "unavailable",
+                "failure_reason": "invalid_frozen_plan",
+                "summary": "The frozen security-check evidence plan is invalid.",
+            }
+        elif re.fullmatch(r"[0-9a-fA-F]{40}", after_sha) is None:
+            run = {
+                "status": "source_commit_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "source_commit_unavailable",
+                "summary": "The committed source revision is unavailable for security scanning.",
+            }
+        else:
+            run = await self._run_runtime_evidence_in_worktree(
+                workspace_path,
+                task,
+                after_sha,
+                check,
+                runtime_evidence.run_security_check_evidence,
+            )
+
+        source_commit_range = {"after_sha": after_sha} if after_sha else {}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", before_sha or ""):
+            source_commit_range["before_sha"] = before_sha
+        report = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": plan_hash if isinstance(plan_hash, str) else "",
+            "execution_attempt_id": task.execution_attempt_id,
+            "check_kind": runtime_evidence.SECURITY_CHECK_KIND,
+            "command": check.get("command"),
+            "source_commit_range": source_commit_range,
+            "result": run,
+        }
+        report_content = json.dumps(report, sort_keys=True, separators=(",", ":"))
+        report_checksum = hashlib.sha256(report_content.encode("utf-8")).hexdigest()
+        artifact_path = (
+            f".forgexa/evidence/{task.task_id}/{after_sha[:12] or 'unavailable'}/"
+            "security-check.json"
+        )
+        artifact_ref = {"path": artifact_path, "checksum": report_checksum}
+        result.artifacts.append({
+            "path": artifact_path,
+            "content": report_content,
+            "content_hash": report_checksum,
+            "type": "application/vnd.forgexa.gate-evidence+json",
+            "system_generated": True,
+            "artifact_role": "gate_evidence_report",
+        })
+
+        evidence_identity = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": report["plan_hash"],
+            "check_kind": runtime_evidence.SECURITY_CHECK_KIND,
+            "execution_attempt_id": task.execution_attempt_id,
+            "source_commit_range": source_commit_range,
+        }
+        observation = {
+            "type": "security_scan",
+            "collection_status": run.get("collection_status"),
+            "summary": run.get("summary"),
+            "scanner": "bandit",
+            "command": check.get("command"),
+            "artifact_refs": [artifact_ref],
+            "runtime_evidence": evidence_identity,
+        }
+        for key in ("security_scan_score", "vulnerabilities", "truncated_count"):
+            if key in run:
+                observation[key] = run[key]
+        if run.get("failure_reason"):
+            observation["collection_failure_reason"] = run["failure_reason"]
+        result.observations.append(observation)
+
     async def _collect_staged_diff_stats(self, cwd: Path) -> dict:
         """Collect staged diff stats for building a rich commit message."""
         status_map: dict[str, str] = {}

{forgexa_cli-1.47.0 → forgexa_cli-1.47.1}/forgexa_cli/runtime_evidence.py

@@ -14,6 +14,8 @@ from typing import Any
 RUNTIME_EVIDENCE_PLAN_VERSION = 1
 TEST_COVERAGE_CHECK_KIND = "test_coverage"
 STATIC_CHECK_KIND = "static_check"
+TYPE_CHECK_KIND = "type_check"
+SECURITY_CHECK_KIND = "security_check"
 LOCAL_EVIDENCE_SUMMARY_VERSION = 1
 _DEFAULT_TIMEOUT_SECONDS = 600
 _MAX_FAILED_TESTS = 20
@@ -30,8 +32,23 @@ _SAFE_COVERAGE_REPORTS = frozenset({"term", "term-missing"})
 _RUFF_STATIC_CHECK_ARGV = (
     "python", "-m", "ruff", "check", ".", "--output-format=json",
 )
+_MYPY_TYPE_CHECK_ARGV = (
+    "python", "-m", "mypy", ".", "--show-error-codes", "--no-error-summary",
+)
+_BANDIT_SECURITY_CHECK_ARGV = (
+    "python", "-m", "bandit", "-r", ".", "-f", "json", "-q",
+)
 _SAFE_LOCAL_TEST_NAME = re.compile(r"^[A-Za-z0-9_./:-]+$")
 _SAFE_LOCAL_RUFF_RULE = re.compile(r"^[A-Za-z][A-Za-z0-9_-]{0,199}$")
+_SAFE_SECURITY_RULE = re.compile(r"^[A-Za-z][A-Za-z0-9_.-]{0,199}$")
+_MYPY_DIAGNOSTIC = re.compile(
+    r"^(?P<file>[^:\n]+):(?P<line>[1-9]\d*)(?::(?P<column>[1-9]\d*))?: "
+    r"error: (?P<message>.+?)(?:\s+\[(?P<code>[A-Za-z0-9_-]+)\])?\s*$"
+)
+_SENSITIVE_EVIDENCE_VALUE = re.compile(
+    r"(?i)\b(authorization|api[_-]?key|token|password|secret)\b"
+    r"(\s*[:=]\s*)(?:bearer\s+)?[^\s,;]+"
+)
 
 
 def _safe_workspace_path(value: str, *, allow_node_id: bool = False) -> bool:
@@ -98,6 +115,32 @@ def ruff_static_check_command_argv(command: object) -> list[str] | None:
     return list(_RUFF_STATIC_CHECK_ARGV) if tuple(argv) == _RUFF_STATIC_CHECK_ARGV else None
 
 
+def mypy_type_check_command_argv(command: object) -> list[str] | None:
+    """Return the sole supported mypy type-check argv, or ``None``."""
+    if not isinstance(command, str) or not command.strip():
+        return None
+    if any(character in command for character in _SHELL_METACHARACTERS):
+        return None
+    try:
+        argv = shlex.split(command)
+    except ValueError:
+        return None
+    return list(_MYPY_TYPE_CHECK_ARGV) if tuple(argv) == _MYPY_TYPE_CHECK_ARGV else None
+
+
+def bandit_security_check_command_argv(command: object) -> list[str] | None:
+    """Return the sole supported Bandit security-check argv, or ``None``."""
+    if not isinstance(command, str) or not command.strip():
+        return None
+    if any(character in command for character in _SHELL_METACHARACTERS):
+        return None
+    try:
+        argv = shlex.split(command)
+    except ValueError:
+        return None
+    return list(_BANDIT_SECURITY_CHECK_ARGV) if tuple(argv) == _BANDIT_SECURITY_CHECK_ARGV else None
+
+
 def _single_hook_command(policy: object, hook_name: str) -> str | None:
     hooks = policy.get("hooks") if isinstance(policy, dict) else None
     configured = hooks.get(hook_name) if isinstance(hooks, dict) else None
@@ -164,6 +207,36 @@ def _static_check(policy: object) -> dict[str, Any] | None:
     }
 
 
+def _type_check(policy: object) -> dict[str, Any] | None:
+    command = _single_hook_command(policy, "type_check")
+    argv = mypy_type_check_command_argv(command)
+    if argv is None or command is None:
+        return None
+    return {
+        "kind": TYPE_CHECK_KIND,
+        "tool": "mypy",
+        "command": command.strip(),
+        "argv": argv,
+        "timeout_seconds": _DEFAULT_TIMEOUT_SECONDS,
+        "report_format": "mypy_text",
+    }
+
+
+def _security_check(policy: object) -> dict[str, Any] | None:
+    command = _single_hook_command(policy, "security_check")
+    argv = bandit_security_check_command_argv(command)
+    if argv is None or command is None:
+        return None
+    return {
+        "kind": SECURITY_CHECK_KIND,
+        "tool": "bandit",
+        "command": command.strip(),
+        "argv": argv,
+        "timeout_seconds": _DEFAULT_TIMEOUT_SECONDS,
+        "report_format": "bandit_json",
+    }
+
+
 def build_test_coverage_evidence_plan(
     policy: object,
     policy_snapshot: object = None,
@@ -180,7 +253,12 @@ def build_runtime_evidence_plan(
     """Freeze all supported, opt-in runtime evidence checks for one graph."""
     checks = [
         check
-        for check in (_test_coverage_check(policy), _static_check(policy))
+        for check in (
+            _test_coverage_check(policy),
+            _static_check(policy),
+            _type_check(policy),
+            _security_check(policy),
+        )
         if check is not None
     ]
     return _finalize_evidence_plan(checks, policy_snapshot)
@@ -406,6 +484,198 @@ def parse_ruff_json_output(output: object, exit_code: int) -> dict[str, Any]:
     return result
 
 
+def parse_mypy_output(output: object, exit_code: int) -> dict[str, Any]:
+    """Parse bounded mypy diagnostics into repository-relative type errors."""
+    raw_text = output if isinstance(output, str) else ""
+    output_truncated = len(raw_text) > _MAX_OUTPUT_CHARS
+    text = raw_text[:_MAX_OUTPUT_CHARS]
+    if "No module named mypy" in text:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "mypy_unavailable",
+            "summary": "mypy is unavailable on this runtime.",
+        }
+    if exit_code not in (0, 1):
+        return {
+            "status": "execution_failed",
+            "collection_status": "incomplete",
+            "failure_reason": "mypy_execution_failed",
+            "summary": f"mypy exited with status {exit_code} before completing type checks.",
+            "exit_code": exit_code,
+        }
+
+    type_errors: list[dict[str, Any]] = []
+    rejected_diagnostics = 0
+    for raw_line in text.splitlines():
+        match = _MYPY_DIAGNOSTIC.match(raw_line.strip())
+        if match is None:
+            continue
+        file_path = match.group("file").strip().replace("\\", "/")
+        if not _safe_workspace_path(file_path):
+            rejected_diagnostics += 1
+            continue
+        type_error: dict[str, Any] = {
+            "file": file_path,
+            "line": int(match.group("line")),
+            "message": _safe_evidence_message(match.group("message")),
+        }
+        column = match.group("column")
+        code = match.group("code")
+        if column is not None:
+            type_error["column"] = int(column)
+        if code is not None:
+            type_error["code"] = code
+        type_errors.append(type_error)
+        if len(type_errors) >= _MAX_LINT_ISSUES:
+            break
+
+    if exit_code == 1 and not type_errors:
+        return {
+            "status": "parse_failed",
+            "collection_status": "incomplete",
+            "failure_reason": (
+                "mypy_diagnostic_path_invalid"
+                if rejected_diagnostics else "mypy_diagnostics_unparseable"
+            ),
+            "summary": "mypy did not emit usable repository-relative type diagnostics.",
+            "exit_code": exit_code,
+        }
+    result: dict[str, Any] = {
+        "status": "completed",
+        "collection_status": "completed",
+        "lint_score": 1.0 if not type_errors else 0.0,
+        "issues": [],
+        "type_errors": type_errors,
+        "summary": f"mypy completed: {len(type_errors)} type error(s).",
+        "exit_code": exit_code,
+    }
+    parsed_diagnostic_count = sum(
+        1 for line in text.splitlines() if _MYPY_DIAGNOSTIC.match(line.strip())
+    )
+    omitted_diagnostic_count = max(
+        0,
+        parsed_diagnostic_count - rejected_diagnostics - len(type_errors),
+    )
+    truncated_count = rejected_diagnostics + omitted_diagnostic_count + int(output_truncated)
+    if truncated_count:
+        result["truncated_count"] = truncated_count
+    return result
+
+
+def parse_bandit_json_output(output: object, exit_code: int) -> dict[str, Any]:
+    """Parse bounded Bandit JSON into safe, repository-relative findings."""
+    text = output[:_MAX_OUTPUT_CHARS] if isinstance(output, str) else ""
+    if "No module named bandit" in text:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "bandit_unavailable",
+            "summary": "Bandit is unavailable on this runtime.",
+        }
+    if exit_code not in (0, 1):
+        return {
+            "status": "execution_failed",
+            "collection_status": "incomplete",
+            "failure_reason": "bandit_execution_failed",
+            "summary": f"Bandit exited with status {exit_code} before completing security checks.",
+            "exit_code": exit_code,
+        }
+    try:
+        document = json.loads(text)
+    except json.JSONDecodeError:
+        return {
+            "status": "parse_failed",
+            "collection_status": "incomplete",
+            "failure_reason": "bandit_json_unparseable",
+            "summary": "Bandit did not emit a parseable JSON report.",
+        }
+    if not isinstance(document, dict) or not isinstance(document.get("results"), list):
+        return {
+            "status": "parse_failed",
+            "collection_status": "incomplete",
+            "failure_reason": "bandit_json_invalid_shape",
+            "summary": "Bandit emitted an invalid JSON report shape.",
+        }
+    if document.get("errors"):
+        return {
+            "status": "execution_failed",
+            "collection_status": "incomplete",
+            "failure_reason": "bandit_scanner_errors",
+            "summary": "Bandit reported scanner errors before completing security checks.",
+            "exit_code": exit_code,
+        }
+
+    findings: list[dict[str, Any]] = []
+    invalid_findings = 0
+    severity_counts = {"high": 0, "medium": 0, "low": 0, "info": 0}
+    for raw_finding in document["results"]:
+        if not isinstance(raw_finding, dict):
+            invalid_findings += 1
+            continue
+        rule_id = raw_finding.get("test_id")
+        message = raw_finding.get("issue_text")
+        filename = raw_finding.get("filename")
+        raw_severity = raw_finding.get("issue_severity")
+        if (
+            not isinstance(rule_id, str)
+            or _SAFE_SECURITY_RULE.fullmatch(rule_id.strip()) is None
+            or not isinstance(message, str)
+            or not message.strip()
+            or not isinstance(filename, str)
+            or not isinstance(raw_severity, str)
+        ):
+            invalid_findings += 1
+            continue
+        file_path = filename.strip().replace("\\", "/")
+        while file_path.startswith("./"):
+            file_path = file_path[2:]
+        if not _safe_workspace_path(file_path):
+            invalid_findings += 1
+            continue
+        severity = raw_severity.strip().lower()
+        if severity not in severity_counts:
+            severity = "info"
+        finding: dict[str, Any] = {
+            "severity": severity,
+            "rule_id": rule_id.strip(),
+            "message": _safe_evidence_message(message),
+            "file": file_path,
+        }
+        line = raw_finding.get("line_number")
+        if isinstance(line, int) and not isinstance(line, bool) and line > 0:
+            finding["line"] = line
+        severity_counts[severity] += 1
+        if len(findings) < _MAX_LINT_ISSUES:
+            findings.append(finding)
+
+    if invalid_findings or (exit_code == 1 and not findings):
+        return {
+            "status": "parse_failed",
+            "collection_status": "incomplete",
+            "failure_reason": (
+                "bandit_finding_invalid"
+                if invalid_findings else "bandit_findings_unparseable"
+            ),
+            "summary": "Bandit did not emit usable repository-relative security findings.",
+            "exit_code": exit_code,
+        }
+    result: dict[str, Any] = {
+        "status": "completed",
+        "collection_status": "completed",
+        "security_scan_score": _security_score(
+            severity_counts["high"], severity_counts["medium"], severity_counts["low"],
+        ),
+        "vulnerabilities": findings,
+        "summary": f"Bandit completed: {len(findings)} security finding(s).",
+        "exit_code": exit_code,
+    }
+    total_findings = len(document["results"])
+    if total_findings > len(findings):
+        result["truncated_count"] = total_findings - len(findings)
+    return result
+
+
 async def run_test_coverage_evidence(
     workspace_path: str | Path,
     check: object,
@@ -543,6 +813,143 @@ async def run_static_check_evidence(
     return report
 
 
+async def run_type_check_evidence(
+    workspace_path: str | Path,
+    check: object,
+) -> dict[str, Any]:
+    """Run the frozen mypy type check without invoking a shell."""
+    command = check.get("command") if isinstance(check, dict) else None
+    argv = mypy_type_check_command_argv(command)
+    if argv is None:
+        return {
+            "status": "invalid_plan",
+            "collection_status": "unavailable",
+            "failure_reason": "invalid_frozen_command",
+            "summary": "The frozen type-check command is invalid.",
+        }
+    timeout = check.get("timeout_seconds") if isinstance(check, dict) else None
+    timeout_seconds = (
+        timeout if isinstance(timeout, int) and 1 <= timeout <= 3600 else _DEFAULT_TIMEOUT_SECONDS
+    )
+    started_at = time.monotonic()
+    try:
+        process = await asyncio.create_subprocess_exec(
+            *argv,
+            cwd=str(Path(workspace_path)),
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+    except FileNotFoundError:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "python_unavailable",
+            "summary": "Python is unavailable on this runtime.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+    except OSError:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "mypy_start_failed",
+            "summary": "mypy could not be started on this runtime.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+
+    try:
+        stdout, stderr = await asyncio.wait_for(process.communicate(), timeout_seconds)
+    except asyncio.TimeoutError:
+        process.kill()
+        await process.communicate()
+        return {
+            "status": "timed_out",
+            "collection_status": "unavailable",
+            "failure_reason": "timeout",
+            "summary": f"mypy evidence collection timed out after {timeout_seconds}s.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+
+    output = (stdout + b"\n" + stderr).decode("utf-8", errors="replace")
+    report = parse_mypy_output(output, process.returncode or 0)
+    report["duration_ms"] = int((time.monotonic() - started_at) * 1000)
+    report["tool"] = "mypy"
+    report["command"] = command
+    return report
+
+
+async def run_security_check_evidence(
+    workspace_path: str | Path,
+    check: object,
+) -> dict[str, Any]:
+    """Run the frozen Bandit security check without invoking a shell."""
+    command = check.get("command") if isinstance(check, dict) else None
+    argv = bandit_security_check_command_argv(command)
+    if argv is None:
+        return {
+            "status": "invalid_plan",
+            "collection_status": "unavailable",
+            "failure_reason": "invalid_frozen_command",
+            "summary": "The frozen security-check command is invalid.",
+        }
+    timeout = check.get("timeout_seconds") if isinstance(check, dict) else None
+    timeout_seconds = (
+        timeout if isinstance(timeout, int) and 1 <= timeout <= 3600 else _DEFAULT_TIMEOUT_SECONDS
+    )
+    started_at = time.monotonic()
+    try:
+        process = await asyncio.create_subprocess_exec(
+            *argv,
+            cwd=str(Path(workspace_path)),
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+    except FileNotFoundError:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "python_unavailable",
+            "summary": "Python is unavailable on this runtime.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+    except OSError:
+        return {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "bandit_start_failed",
+            "summary": "Bandit could not be started on this runtime.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+
+    try:
+        stdout, stderr = await asyncio.wait_for(process.communicate(), timeout_seconds)
+    except asyncio.TimeoutError:
+        process.kill()
+        await process.communicate()
+        return {
+            "status": "timed_out",
+            "collection_status": "unavailable",
+            "failure_reason": "timeout",
+            "summary": f"Bandit evidence collection timed out after {timeout_seconds}s.",
+            "duration_ms": int((time.monotonic() - started_at) * 1000),
+        }
+
+    stdout_text = stdout.decode("utf-8", errors="replace")
+    stderr_text = stderr.decode("utf-8", errors="replace")
+    if "No module named bandit" in f"{stdout_text}\n{stderr_text}":
+        report = {
+            "status": "tool_unavailable",
+            "collection_status": "unavailable",
+            "failure_reason": "bandit_unavailable",
+            "summary": "Bandit is unavailable on this runtime.",
+        }
+    else:
+        report = parse_bandit_json_output(stdout_text, process.returncode or 0)
+    report["duration_ms"] = int((time.monotonic() - started_at) * 1000)
+    report["tool"] = "bandit"
+    report["command"] = command
+    return report
+
+
 def _pytest_count(output: str, label: str) -> int:
     match = re.search(rf"(\d+)\s+{label}s?\b", output, re.IGNORECASE)
     return int(match.group(1)) if match else 0
@@ -580,4 +987,25 @@ def _local_failed_test_truncated_count(output: object) -> int:
         for match in re.finditer(r"^(?:FAILED|ERROR)\s+([^\s]+)", output, re.MULTILINE)
         if (name := _safe_local_test_name(match.group(1))) is not None
     }
-    return max(0, len(names) - _MAX_FAILED_TESTS)
+    return max(0, len(names) - _MAX_FAILED_TESTS)
+
+
+def _safe_evidence_message(value: object) -> str:
+    text = re.sub(r"\s+", " ", str(value or "")).strip()
+    text = _SENSITIVE_EVIDENCE_VALUE.sub(r"\1\2[redacted]", text)
+    text = re.sub(r"(?i)\bbearer\s+[^\s,;]+", "Bearer [redacted]", text)
+    return text[:1000]
+
+
+def _security_score(high: int, medium: int, low: int) -> float:
+    if high > 0:
+        return 0.0
+    if medium > 3:
+        return 0.3
+    if medium > 0:
+        return max(0.5, 1.0 - medium * 0.15)
+    if low > 5:
+        return 0.8
+    if low > 0:
+        return max(0.85, 1.0 - low * 0.03)
+    return 1.0

{forgexa_cli-1.47.0 → forgexa_cli-1.47.1}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.47.0
+Version: 1.47.1
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.47.0 → forgexa_cli-1.47.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.47.0"
+version = "1.47.1"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"