forgexa-cli 1.47.0__tar.gz → 1.47.2__tar.gz

{forgexa_cli-1.47.0 → forgexa_cli-1.47.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.47.0
+Version: 1.47.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.47.0 → forgexa_cli-1.47.2}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.47.0"
+__version__ = "1.47.2"

{forgexa_cli-1.47.0 → forgexa_cli-1.47.2}/forgexa_cli/daemon.py

@@ -1075,7 +1075,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.47.0"
+DAEMON_VERSION = "1.47.2"
 
 
 def _detect_client_type() -> str:
@@ -5992,8 +5992,13 @@ class ProcessManager:
         if not match:
             return None
         missing_model, suggested_model = match.groups()
-        if missing_model.strip().lower() == suggested_model.lower():
+        missing_model = missing_model.strip()
+        if missing_model.lower() == suggested_model.lower():
             return None
+        if "/" not in suggested_model and "/" in missing_model:
+            provider = missing_model.split("/", 1)[0]
+            if provider:
+                suggested_model = f"{provider}/{suggested_model}"
         return suggested_model
 
     async def _run_opencode(
@@ -10446,6 +10451,24 @@ class RuntimeDaemon:
                         result,
                         before_sha=node_before_sha,
                     )
+                    await self._collect_runtime_type_evidence(
+                        workspace_path,
+                        task,
+                        result,
+                        before_sha=node_before_sha,
+                    )
+                    await self._collect_runtime_security_evidence(
+                        workspace_path,
+                        task,
+                        result,
+                        before_sha=node_before_sha,
+                    )
+                    await self._collect_runtime_acceptance_criteria_coverage_evidence(
+                        workspace_path,
+                        task,
+                        result,
+                        before_sha=node_before_sha,
+                    )
 
             # 6. Report completion (include actual agent used if different from requested)
             result.metrics["actual_agent"] = agent.agent_id
@@ -13275,11 +13298,15 @@ class RuntimeDaemon:
                 "summary": "The committed source revision is unavailable for evidence collection.",
             }
         else:
+            evidence_check = {
+                **check,
+                "output_dir": self._resolve_task_output_dir(task),
+            }
             run = await self._run_runtime_evidence_in_worktree(
                 workspace_path,
                 task,
                 after_sha,
-                check,
+                evidence_check,
                 runtime_evidence.run_test_coverage_evidence,
             )
 
@@ -13327,7 +13354,10 @@ class RuntimeDaemon:
             "artifact_refs": [artifact_ref],
             "runtime_evidence": evidence_identity,
         }
-        for key in ("test_pass_rate", "passed", "failed", "skipped", "errors", "total", "failed_tests"):
+        for key in (
+            "test_pass_rate", "passed", "failed", "skipped", "errors", "total",
+            "failed_tests", "test_case_results", "exit_code",
+        ):
             if key in run:
                 test_observation[key] = run[key]
         if run.get("failure_reason"):
@@ -13491,6 +13521,298 @@ class RuntimeDaemon:
             observation["collection_failure_reason"] = run["failure_reason"]
         result.observations.append(observation)
 
+    async def _collect_runtime_type_evidence(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        result: TaskResult,
+        *,
+        before_sha: str,
+    ) -> None:
+        """Run a frozen mypy check in a disposable post-commit worktree."""
+        if (
+            task.workspace_resolution != "cloud_worktree"
+            or task.node_type not in ("testing", "fix")
+            or not isinstance(task.runtime_evidence_plan, dict)
+        ):
+            return
+
+        plan = task.runtime_evidence_plan
+        plan_hash = plan.get("plan_hash")
+        checks = plan.get("checks")
+        check = next(
+            (
+                item for item in checks
+                if isinstance(item, dict) and item.get("kind") == runtime_evidence.TYPE_CHECK_KIND
+            ),
+            None,
+        ) if isinstance(checks, list) else None
+        if not isinstance(check, dict):
+            return
+        after_sha = str((result.git or {}).get("commit_sha") or "").strip()
+        if (
+            plan.get("version") != runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION
+            or not isinstance(plan_hash, str)
+            or re.fullmatch(r"[0-9a-f]{64}", plan_hash) is None
+        ):
+            run = {
+                "status": "invalid_plan",
+                "collection_status": "unavailable",
+                "failure_reason": "invalid_frozen_plan",
+                "summary": "The frozen type-check evidence plan is invalid.",
+            }
+        elif re.fullmatch(r"[0-9a-fA-F]{40}", after_sha) is None:
+            run = {
+                "status": "source_commit_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "source_commit_unavailable",
+                "summary": "The committed source revision is unavailable for type checking.",
+            }
+        else:
+            run = await self._run_runtime_evidence_in_worktree(
+                workspace_path,
+                task,
+                after_sha,
+                check,
+                runtime_evidence.run_type_check_evidence,
+            )
+
+        source_commit_range = {"after_sha": after_sha} if after_sha else {}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", before_sha or ""):
+            source_commit_range["before_sha"] = before_sha
+        report = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": plan_hash if isinstance(plan_hash, str) else "",
+            "execution_attempt_id": task.execution_attempt_id,
+            "check_kind": runtime_evidence.TYPE_CHECK_KIND,
+            "command": check.get("command"),
+            "source_commit_range": source_commit_range,
+            "result": run,
+        }
+        report_content = json.dumps(report, sort_keys=True, separators=(",", ":"))
+        report_checksum = hashlib.sha256(report_content.encode("utf-8")).hexdigest()
+        artifact_path = (
+            f".forgexa/evidence/{task.task_id}/{after_sha[:12] or 'unavailable'}/"
+            "type-check.json"
+        )
+        artifact_ref = {"path": artifact_path, "checksum": report_checksum}
+        result.artifacts.append({
+            "path": artifact_path,
+            "content": report_content,
+            "content_hash": report_checksum,
+            "type": "application/vnd.forgexa.gate-evidence+json",
+            "system_generated": True,
+            "artifact_role": "gate_evidence_report",
+        })
+
+        evidence_identity = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": report["plan_hash"],
+            "check_kind": runtime_evidence.TYPE_CHECK_KIND,
+            "execution_attempt_id": task.execution_attempt_id,
+            "source_commit_range": source_commit_range,
+        }
+        observation = {
+            "type": "lint_results",
+            "collection_status": run.get("collection_status"),
+            "summary": run.get("summary"),
+            "lint_tool": "mypy",
+            "lint_command": check.get("command"),
+            "command": check.get("command"),
+            "artifact_refs": [artifact_ref],
+            "runtime_evidence": evidence_identity,
+        }
+        for key in ("lint_score", "issues", "type_errors", "truncated_count"):
+            if key in run:
+                observation[key] = run[key]
+        if run.get("failure_reason"):
+            observation["collection_failure_reason"] = run["failure_reason"]
+        result.observations.append(observation)
+
+    async def _collect_runtime_security_evidence(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        result: TaskResult,
+        *,
+        before_sha: str,
+    ) -> None:
+        """Run a frozen Bandit scan in a disposable post-commit worktree."""
+        if (
+            task.workspace_resolution != "cloud_worktree"
+            or task.node_type not in ("testing", "fix")
+            or not isinstance(task.runtime_evidence_plan, dict)
+        ):
+            return
+
+        plan = task.runtime_evidence_plan
+        plan_hash = plan.get("plan_hash")
+        checks = plan.get("checks")
+        check = next(
+            (
+                item for item in checks
+                if isinstance(item, dict) and item.get("kind") == runtime_evidence.SECURITY_CHECK_KIND
+            ),
+            None,
+        ) if isinstance(checks, list) else None
+        if not isinstance(check, dict):
+            return
+        after_sha = str((result.git or {}).get("commit_sha") or "").strip()
+        if (
+            plan.get("version") != runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION
+            or not isinstance(plan_hash, str)
+            or re.fullmatch(r"[0-9a-f]{64}", plan_hash) is None
+        ):
+            run = {
+                "status": "invalid_plan",
+                "collection_status": "unavailable",
+                "failure_reason": "invalid_frozen_plan",
+                "summary": "The frozen security-check evidence plan is invalid.",
+            }
+        elif re.fullmatch(r"[0-9a-fA-F]{40}", after_sha) is None:
+            run = {
+                "status": "source_commit_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "source_commit_unavailable",
+                "summary": "The committed source revision is unavailable for security scanning.",
+            }
+        else:
+            run = await self._run_runtime_evidence_in_worktree(
+                workspace_path,
+                task,
+                after_sha,
+                check,
+                runtime_evidence.run_security_check_evidence,
+            )
+
+        source_commit_range = {"after_sha": after_sha} if after_sha else {}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", before_sha or ""):
+            source_commit_range["before_sha"] = before_sha
+        report = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": plan_hash if isinstance(plan_hash, str) else "",
+            "execution_attempt_id": task.execution_attempt_id,
+            "check_kind": runtime_evidence.SECURITY_CHECK_KIND,
+            "command": check.get("command"),
+            "source_commit_range": source_commit_range,
+            "result": run,
+        }
+        report_content = json.dumps(report, sort_keys=True, separators=(",", ":"))
+        report_checksum = hashlib.sha256(report_content.encode("utf-8")).hexdigest()
+        artifact_path = (
+            f".forgexa/evidence/{task.task_id}/{after_sha[:12] or 'unavailable'}/"
+            "security-check.json"
+        )
+        artifact_ref = {"path": artifact_path, "checksum": report_checksum}
+        result.artifacts.append({
+            "path": artifact_path,
+            "content": report_content,
+            "content_hash": report_checksum,
+            "type": "application/vnd.forgexa.gate-evidence+json",
+            "system_generated": True,
+            "artifact_role": "gate_evidence_report",
+        })
+
+        evidence_identity = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "plan_hash": report["plan_hash"],
+            "check_kind": runtime_evidence.SECURITY_CHECK_KIND,
+            "execution_attempt_id": task.execution_attempt_id,
+            "source_commit_range": source_commit_range,
+        }
+        observation = {
+            "type": "security_scan",
+            "collection_status": run.get("collection_status"),
+            "summary": run.get("summary"),
+            "scanner": "bandit",
+            "command": check.get("command"),
+            "artifact_refs": [artifact_ref],
+            "runtime_evidence": evidence_identity,
+        }
+        for key in ("security_scan_score", "vulnerabilities", "truncated_count"):
+            if key in run:
+                observation[key] = run[key]
+        if run.get("failure_reason"):
+            observation["collection_failure_reason"] = run["failure_reason"]
+        result.observations.append(observation)
+
+    async def _collect_runtime_acceptance_criteria_coverage_evidence(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        result: TaskResult,
+        *,
+        before_sha: str,
+    ) -> None:
+        """Bind generated testing artifacts to the committed testing attempt."""
+        if task.workspace_resolution != "cloud_worktree" or task.node_type != "testing":
+            return
+
+        after_sha = str((result.git or {}).get("commit_sha") or "").strip()
+        check = {"output_dir": self._resolve_task_output_dir(task)}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", after_sha) is None:
+            run = {
+                "status": "source_commit_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "source_commit_unavailable",
+                "coverage_links": [],
+                "source_artifacts": [],
+                "summary": "The committed source revision is unavailable for acceptance-criteria evidence.",
+            }
+        else:
+            run = await self._run_runtime_evidence_in_worktree(
+                workspace_path,
+                task,
+                after_sha,
+                check,
+                runtime_evidence.run_acceptance_criteria_coverage_evidence,
+            )
+        run.setdefault("coverage_links", [])
+        run.setdefault("source_artifacts", [])
+
+        source_commit_range = {"after_sha": after_sha} if after_sha else {}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", before_sha or ""):
+            source_commit_range["before_sha"] = before_sha
+        report = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "execution_attempt_id": task.execution_attempt_id,
+            "check_kind": runtime_evidence.ACCEPTANCE_CRITERIA_COVERAGE_CHECK_KIND,
+            "source_commit_range": source_commit_range,
+            "result": run,
+        }
+        report_content = json.dumps(report, sort_keys=True, separators=(",", ":"))
+        report_checksum = hashlib.sha256(report_content.encode("utf-8")).hexdigest()
+        artifact_path = (
+            f".forgexa/evidence/{task.task_id}/{after_sha[:12] or 'unavailable'}/"
+            "acceptance-criteria.json"
+        )
+        artifact_ref = {"path": artifact_path, "checksum": report_checksum}
+        result.artifacts.append({
+            "path": artifact_path,
+            "content": report_content,
+            "content_hash": report_checksum,
+            "type": "application/vnd.forgexa.gate-evidence+json",
+            "system_generated": True,
+            "artifact_role": "gate_evidence_report",
+        })
+        observation = {
+            "type": runtime_evidence.ACCEPTANCE_CRITERIA_COVERAGE_CHECK_KIND,
+            "collection_status": run.get("collection_status"),
+            "summary": run.get("summary"),
+            "artifact_refs": [artifact_ref],
+            "runtime_evidence": {
+                "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+                "check_kind": runtime_evidence.ACCEPTANCE_CRITERIA_COVERAGE_CHECK_KIND,
+                "execution_attempt_id": task.execution_attempt_id,
+                "source_commit_range": source_commit_range,
+            },
+            "coverage_links": run.get("coverage_links", []),
+            "source_artifacts": run.get("source_artifacts", []),
+        }
+        if run.get("failure_reason"):
+            observation["collection_failure_reason"] = run["failure_reason"]
+        result.observations.append(observation)
+
     async def _collect_staged_diff_stats(self, cwd: Path) -> dict:
         """Collect staged diff stats for building a rich commit message."""
         status_map: dict[str, str] = {}