forgexa-cli 1.47.1__tar.gz → 1.47.2__tar.gz

{forgexa_cli-1.47.1 → forgexa_cli-1.47.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.47.1
+Version: 1.47.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.47.1 → forgexa_cli-1.47.2}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.47.1"
+__version__ = "1.47.2"

{forgexa_cli-1.47.1 → forgexa_cli-1.47.2}/forgexa_cli/daemon.py

@@ -1075,7 +1075,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.47.1"
+DAEMON_VERSION = "1.47.2"
 
 
 def _detect_client_type() -> str:
@@ -10463,6 +10463,12 @@ class RuntimeDaemon:
                         result,
                         before_sha=node_before_sha,
                     )
+                    await self._collect_runtime_acceptance_criteria_coverage_evidence(
+                        workspace_path,
+                        task,
+                        result,
+                        before_sha=node_before_sha,
+                    )
 
             # 6. Report completion (include actual agent used if different from requested)
             result.metrics["actual_agent"] = agent.agent_id
@@ -13292,11 +13298,15 @@ class RuntimeDaemon:
                 "summary": "The committed source revision is unavailable for evidence collection.",
             }
         else:
+            evidence_check = {
+                **check,
+                "output_dir": self._resolve_task_output_dir(task),
+            }
             run = await self._run_runtime_evidence_in_worktree(
                 workspace_path,
                 task,
                 after_sha,
-                check,
+                evidence_check,
                 runtime_evidence.run_test_coverage_evidence,
             )
 
@@ -13344,7 +13354,10 @@ class RuntimeDaemon:
             "artifact_refs": [artifact_ref],
             "runtime_evidence": evidence_identity,
         }
-        for key in ("test_pass_rate", "passed", "failed", "skipped", "errors", "total", "failed_tests"):
+        for key in (
+            "test_pass_rate", "passed", "failed", "skipped", "errors", "total",
+            "failed_tests", "test_case_results", "exit_code",
+        ):
             if key in run:
                 test_observation[key] = run[key]
         if run.get("failure_reason"):
@@ -13723,6 +13736,83 @@ class RuntimeDaemon:
             observation["collection_failure_reason"] = run["failure_reason"]
         result.observations.append(observation)
 
+    async def _collect_runtime_acceptance_criteria_coverage_evidence(
+        self,
+        workspace_path: Path,
+        task: TaskInfo,
+        result: TaskResult,
+        *,
+        before_sha: str,
+    ) -> None:
+        """Bind generated testing artifacts to the committed testing attempt."""
+        if task.workspace_resolution != "cloud_worktree" or task.node_type != "testing":
+            return
+
+        after_sha = str((result.git or {}).get("commit_sha") or "").strip()
+        check = {"output_dir": self._resolve_task_output_dir(task)}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", after_sha) is None:
+            run = {
+                "status": "source_commit_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "source_commit_unavailable",
+                "coverage_links": [],
+                "source_artifacts": [],
+                "summary": "The committed source revision is unavailable for acceptance-criteria evidence.",
+            }
+        else:
+            run = await self._run_runtime_evidence_in_worktree(
+                workspace_path,
+                task,
+                after_sha,
+                check,
+                runtime_evidence.run_acceptance_criteria_coverage_evidence,
+            )
+        run.setdefault("coverage_links", [])
+        run.setdefault("source_artifacts", [])
+
+        source_commit_range = {"after_sha": after_sha} if after_sha else {}
+        if re.fullmatch(r"[0-9a-fA-F]{40}", before_sha or ""):
+            source_commit_range["before_sha"] = before_sha
+        report = {
+            "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+            "execution_attempt_id": task.execution_attempt_id,
+            "check_kind": runtime_evidence.ACCEPTANCE_CRITERIA_COVERAGE_CHECK_KIND,
+            "source_commit_range": source_commit_range,
+            "result": run,
+        }
+        report_content = json.dumps(report, sort_keys=True, separators=(",", ":"))
+        report_checksum = hashlib.sha256(report_content.encode("utf-8")).hexdigest()
+        artifact_path = (
+            f".forgexa/evidence/{task.task_id}/{after_sha[:12] or 'unavailable'}/"
+            "acceptance-criteria.json"
+        )
+        artifact_ref = {"path": artifact_path, "checksum": report_checksum}
+        result.artifacts.append({
+            "path": artifact_path,
+            "content": report_content,
+            "content_hash": report_checksum,
+            "type": "application/vnd.forgexa.gate-evidence+json",
+            "system_generated": True,
+            "artifact_role": "gate_evidence_report",
+        })
+        observation = {
+            "type": runtime_evidence.ACCEPTANCE_CRITERIA_COVERAGE_CHECK_KIND,
+            "collection_status": run.get("collection_status"),
+            "summary": run.get("summary"),
+            "artifact_refs": [artifact_ref],
+            "runtime_evidence": {
+                "version": runtime_evidence.RUNTIME_EVIDENCE_PLAN_VERSION,
+                "check_kind": runtime_evidence.ACCEPTANCE_CRITERIA_COVERAGE_CHECK_KIND,
+                "execution_attempt_id": task.execution_attempt_id,
+                "source_commit_range": source_commit_range,
+            },
+            "coverage_links": run.get("coverage_links", []),
+            "source_artifacts": run.get("source_artifacts", []),
+        }
+        if run.get("failure_reason"):
+            observation["collection_failure_reason"] = run["failure_reason"]
+        result.observations.append(observation)
+
     async def _collect_staged_diff_stats(self, cwd: Path) -> dict:
         """Collect staged diff stats for building a rich commit message."""
         status_map: dict[str, str] = {}

{forgexa_cli-1.47.1 → forgexa_cli-1.47.2}/forgexa_cli/runtime_evidence.py

@@ -1,12 +1,16 @@
 """Portable planning and parsing for controlled runtime evidence checks."""
 from __future__ import annotations
 
+import ast
 import asyncio
 import hashlib
 import json
+import os
 import re
 import shlex
+import tempfile
 import time
+import xml.etree.ElementTree as ElementTree
 from pathlib import Path
 from typing import Any
 
@@ -16,11 +20,13 @@ TEST_COVERAGE_CHECK_KIND = "test_coverage"
 STATIC_CHECK_KIND = "static_check"
 TYPE_CHECK_KIND = "type_check"
 SECURITY_CHECK_KIND = "security_check"
+ACCEPTANCE_CRITERIA_COVERAGE_CHECK_KIND = "acceptance_criteria_coverage"
 LOCAL_EVIDENCE_SUMMARY_VERSION = 1
 _DEFAULT_TIMEOUT_SECONDS = 600
 _MAX_FAILED_TESTS = 20
 _MAX_LINT_ISSUES = 50
 _MAX_OUTPUT_CHARS = 100_000
+_MAX_TEST_CASE_RESULTS = 200
 _SHELL_METACHARACTERS = (";", "`", "$", ">", "<", "&", "|", "\n", "\r", "\x00")
 _SENSITIVE_ARGUMENT = re.compile(
     r"^-{1,2}(?:api[-_]?key|authorization|password|secret|token)(?:=|$)",
@@ -41,6 +47,12 @@ _BANDIT_SECURITY_CHECK_ARGV = (
 _SAFE_LOCAL_TEST_NAME = re.compile(r"^[A-Za-z0-9_./:-]+$")
 _SAFE_LOCAL_RUFF_RULE = re.compile(r"^[A-Za-z][A-Za-z0-9_-]{0,199}$")
 _SAFE_SECURITY_RULE = re.compile(r"^[A-Za-z][A-Za-z0-9_.-]{0,199}$")
+_SAFE_TEST_CASE_ID = re.compile(r"^[A-Za-z][A-Za-z0-9_.:-]{0,99}$")
+_SAFE_TEST_INTENT_ID = re.compile(r"^[A-Za-z][A-Za-z0-9_.:-]{0,99}$")
+_SAFE_ACCEPTANCE_REFERENCE = re.compile(r"^AC-(\d+)$", re.IGNORECASE)
+_CANONICAL_TEST_CASE_ID = re.compile(r"^TC-(?:00[1-9]|0[1-9]\d|[1-9]\d{2})$", re.IGNORECASE)
+_TEST_CASE_MARKER = re.compile(r"(?<![A-Za-z0-9_-])TC-(\d+)(?![A-Za-z0-9_-])", re.IGNORECASE)
+_SAFE_PYTHON_IDENTIFIER = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 _MYPY_DIAGNOSTIC = re.compile(
     r"^(?P<file>[^:\n]+):(?P<line>[1-9]\d*)(?::(?P<column>[1-9]\d*))?: "
     r"error: (?P<message>.+?)(?:\s+\[(?P<code>[A-Za-z0-9_-]+)\])?\s*$"
@@ -676,6 +688,343 @@ def parse_bandit_json_output(output: object, exit_code: int) -> dict[str, Any]:
     return result
 
 
+def parse_acceptance_criteria_coverage_artifacts(
+    test_cases_output: object,
+    coverage_matrix_output: object,
+) -> dict[str, Any]:
+    """Project bounded AC-to-test-case links without retaining raw artifacts."""
+    test_cases_text = _bounded_evidence_text(test_cases_output)
+    coverage_matrix_text = _bounded_evidence_text(coverage_matrix_output)
+    if test_cases_text is None or coverage_matrix_text is None:
+        return _acceptance_criteria_coverage_failure("acceptance_criteria_artifact_too_large")
+    try:
+        test_cases_document = json.loads(test_cases_text)
+        coverage_matrix_document = json.loads(coverage_matrix_text)
+    except json.JSONDecodeError:
+        return _acceptance_criteria_coverage_failure("acceptance_criteria_json_unparseable")
+    if (
+        not isinstance(test_cases_document, dict)
+        or not isinstance(test_cases_document.get("test_cases"), list)
+        or not isinstance(coverage_matrix_document, dict)
+        or not isinstance(coverage_matrix_document.get("acceptance_criteria"), list)
+    ):
+        return _acceptance_criteria_coverage_failure("acceptance_criteria_json_invalid_shape")
+
+    test_case_intents: dict[str, str] = {}
+    for raw_test_case in test_cases_document["test_cases"][:_MAX_LINT_ISSUES]:
+        if not isinstance(raw_test_case, dict):
+            return _acceptance_criteria_coverage_failure("test_case_invalid")
+        test_case_id = raw_test_case.get("id")
+        intent_id = raw_test_case.get("intent_id") or raw_test_case.get("test_intent_id")
+        if (
+            not isinstance(test_case_id, str)
+            or _SAFE_TEST_CASE_ID.fullmatch(test_case_id.strip()) is None
+            or not isinstance(intent_id, str)
+            or _SAFE_TEST_INTENT_ID.fullmatch(intent_id.strip()) is None
+            or test_case_id.strip() in test_case_intents
+        ):
+            return _acceptance_criteria_coverage_failure("test_case_invalid")
+        test_case_intents[test_case_id.strip()] = intent_id.strip()
+    if len(test_cases_document["test_cases"]) > _MAX_LINT_ISSUES:
+        return _acceptance_criteria_coverage_failure("test_case_limit_exceeded")
+
+    coverage_links: list[dict[str, Any]] = []
+    seen_acceptance_ids: set[str] = set()
+    for raw_criterion in coverage_matrix_document["acceptance_criteria"][:_MAX_LINT_ISSUES]:
+        if not isinstance(raw_criterion, dict):
+            return _acceptance_criteria_coverage_failure("coverage_matrix_invalid")
+        acceptance_id = _canonical_acceptance_criteria_reference(raw_criterion.get("id"))
+        status = raw_criterion.get("status")
+        covered_by = raw_criterion.get("covered_by")
+        if (
+            acceptance_id is None
+            or acceptance_id in seen_acceptance_ids
+            or not isinstance(status, str)
+            or status.strip().lower() != "covered"
+            or not isinstance(covered_by, list)
+            or not covered_by
+        ):
+            return _acceptance_criteria_coverage_failure("coverage_matrix_invalid")
+        test_case_ids: list[str] = []
+        for raw_test_case_id in covered_by:
+            if (
+                not isinstance(raw_test_case_id, str)
+                or raw_test_case_id.strip() not in test_case_intents
+            ):
+                return _acceptance_criteria_coverage_failure("coverage_matrix_test_case_unknown")
+            test_case_id = raw_test_case_id.strip()
+            if test_case_id not in test_case_ids:
+                test_case_ids.append(test_case_id)
+        seen_acceptance_ids.add(acceptance_id)
+        coverage_links.append({
+            "acceptance_criteria_ref": acceptance_id,
+            "test_case_ids": test_case_ids,
+            "test_intent_ids": [test_case_intents[test_case_id] for test_case_id in test_case_ids],
+        })
+    if len(coverage_matrix_document["acceptance_criteria"]) > _MAX_LINT_ISSUES:
+        return _acceptance_criteria_coverage_failure("coverage_matrix_limit_exceeded")
+    return {
+        "status": "completed",
+        "collection_status": "completed",
+        "coverage_links": coverage_links,
+        "summary": f"Validated {len(coverage_links)} acceptance-criteria coverage link(s).",
+    }
+
+
+async def run_acceptance_criteria_coverage_evidence(
+    workspace_path: str | Path,
+    check: object,
+) -> dict[str, Any]:
+    """Read bounded testing artifacts from a committed detached worktree."""
+    output_dir = check.get("output_dir") if isinstance(check, dict) else None
+    paths = acceptance_criteria_coverage_artifact_paths(output_dir)
+    if paths is None:
+        return _acceptance_criteria_coverage_unavailable(
+            "testing_artifact_path_unavailable",
+        )
+    test_cases_path, coverage_matrix_path = paths
+    test_cases_content, test_cases_reason = _read_bounded_workspace_file(
+        workspace_path,
+        test_cases_path,
+    )
+    coverage_matrix_content, coverage_matrix_reason = _read_bounded_workspace_file(
+        workspace_path,
+        coverage_matrix_path,
+    )
+    if test_cases_content is None or coverage_matrix_content is None:
+        reason = (
+            "testing_artifact_too_large"
+            if "too_large" in {test_cases_reason, coverage_matrix_reason}
+            else "testing_artifact_unavailable"
+        )
+        return _acceptance_criteria_coverage_unavailable(reason)
+
+    report = parse_acceptance_criteria_coverage_artifacts(
+        test_cases_content,
+        coverage_matrix_content,
+    )
+    report["source_artifacts"] = [
+        {
+            "path": test_cases_path,
+            "sha256": hashlib.sha256(test_cases_content.encode("utf-8")).hexdigest(),
+        },
+        {
+            "path": coverage_matrix_path,
+            "sha256": hashlib.sha256(coverage_matrix_content.encode("utf-8")).hexdigest(),
+        },
+    ]
+    return report
+
+
+def _temporary_junit_report_path() -> Path | None:
+    try:
+        descriptor, raw_path = tempfile.mkstemp(
+            prefix="forgexa-pytest-evidence-",
+            suffix=".xml",
+        )
+    except OSError:
+        return None
+    try:
+        os.close(descriptor)
+    except OSError:
+        try:
+            Path(raw_path).unlink(missing_ok=True)
+        except OSError:
+            pass
+        return None
+    return Path(raw_path)
+
+
+def _test_case_results_from_junit(
+    workspace_path: str | Path,
+    output_dir: object,
+    junit_path: Path,
+) -> list[dict[str, str]]:
+    paths = acceptance_criteria_coverage_artifact_paths(output_dir)
+    if paths is None:
+        return []
+    test_cases_content, _ = _read_bounded_workspace_file(workspace_path, paths[0])
+    if test_cases_content is None:
+        return []
+    try:
+        test_cases_document = json.loads(test_cases_content)
+    except json.JSONDecodeError:
+        return []
+    declared_ids = _declared_test_case_ids(test_cases_document)
+    if not declared_ids:
+        return []
+    junit_content = _read_bounded_file_bytes(junit_path)
+    if junit_content is None:
+        return []
+    try:
+        junit_document = ElementTree.fromstring(junit_content)
+    except ElementTree.ParseError:
+        return []
+
+    workspace_root = Path(workspace_path).resolve()
+    outcomes: dict[str, str] = {}
+    marker_cache: dict[tuple[str, tuple[str, ...], str], set[str]] = {}
+    for testcase in junit_document.iter():
+        if _xml_tag_name(testcase.tag) != "testcase":
+            continue
+        classname = testcase.get("classname")
+        test_name = testcase.get("name")
+        source = _pytest_junit_source_file(workspace_root, classname)
+        function_name = _pytest_junit_function_name(test_name)
+        if source is None or function_name is None:
+            continue
+        source_path, class_path = source
+        cache_key = (str(source_path), class_path, function_name)
+        case_ids = marker_cache.get(cache_key)
+        if case_ids is None:
+            case_ids = _test_case_ids_in_python_test(
+                source_path,
+                class_path,
+                function_name,
+                set(declared_ids),
+            )
+            marker_cache[cache_key] = case_ids
+        outcome = _pytest_junit_outcome(testcase)
+        for case_id in case_ids:
+            outcomes[case_id] = _more_conservative_test_outcome(
+                outcomes.get(case_id),
+                outcome,
+            )
+    return [
+        {"id": case_id, "outcome": outcomes[case_id]}
+        for case_id in declared_ids
+        if case_id in outcomes
+    ]
+
+
+def _declared_test_case_ids(document: object) -> list[str]:
+    if not isinstance(document, dict) or not isinstance(document.get("test_cases"), list):
+        return []
+    test_cases = document["test_cases"]
+    if len(test_cases) > _MAX_TEST_CASE_RESULTS:
+        return []
+    identifiers: list[str] = []
+    for test_case in test_cases:
+        identifier = test_case.get("id") if isinstance(test_case, dict) else None
+        if not isinstance(identifier, str) or _CANONICAL_TEST_CASE_ID.fullmatch(identifier) is None:
+            return []
+        identifier = identifier.upper()
+        if identifier in identifiers:
+            return []
+        identifiers.append(identifier)
+    return identifiers
+
+
+def _pytest_junit_source_file(
+    workspace_root: Path,
+    classname: object,
+) -> tuple[Path, tuple[str, ...]] | None:
+    if not isinstance(classname, str) or not classname:
+        return None
+    components = classname.split(".")
+    if not all(_SAFE_PYTHON_IDENTIFIER.fullmatch(component) for component in components):
+        return None
+    for source_end in range(len(components), 0, -1):
+        relative_path = "/".join(components[:source_end]) + ".py"
+        if not _safe_workspace_path(relative_path):
+            return None
+        try:
+            source_path = (workspace_root / relative_path).resolve(strict=True)
+            source_path.relative_to(workspace_root)
+        except (OSError, ValueError):
+            continue
+        if source_path.is_file():
+            return source_path, tuple(components[source_end:])
+    return None
+
+
+def _pytest_junit_function_name(value: object) -> str | None:
+    if not isinstance(value, str):
+        return None
+    name = value.split("[", 1)[0]
+    return name if _SAFE_PYTHON_IDENTIFIER.fullmatch(name) else None
+
+
+def _test_case_ids_in_python_test(
+    source_path: Path,
+    class_path: tuple[str, ...],
+    function_name: str,
+    declared_ids: set[str],
+) -> set[str]:
+    source_content = _read_bounded_file_bytes(source_path)
+    if source_content is None:
+        return set()
+    try:
+        source_text = source_content.decode("utf-8")
+    except UnicodeDecodeError:
+        return set()
+    try:
+        document = ast.parse(source_text)
+    except SyntaxError:
+        return set()
+    lines = source_text.splitlines()
+    matched_ids: set[str] = set()
+
+    def visit(nodes: list[ast.stmt], parent_classes: tuple[str, ...]) -> None:
+        for child in nodes:
+            if isinstance(child, ast.ClassDef):
+                visit(child.body, (*parent_classes, child.name))
+            elif (
+                isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef))
+                and child.name == function_name
+                and parent_classes == class_path
+            ):
+                start_line = min(
+                    [child.lineno, *(decorator.lineno for decorator in child.decorator_list)],
+                )
+                while start_line > 1 and lines[start_line - 2].lstrip().startswith("#"):
+                    start_line -= 1
+                end_line = child.end_lineno or child.lineno
+                matched_ids.update(
+                    _test_case_ids_from_marker_text(
+                        "\n".join(lines[start_line - 1:end_line]),
+                        declared_ids,
+                    )
+                )
+
+    visit(document.body, ())
+    return matched_ids
+
+
+def _test_case_ids_from_marker_text(value: str, declared_ids: set[str]) -> set[str]:
+    return {
+        f"TC-{int(match.group(1)):03d}"
+        for match in _TEST_CASE_MARKER.finditer(value)
+        if 1 <= int(match.group(1)) <= 999
+        and f"TC-{int(match.group(1)):03d}" in declared_ids
+    }
+
+
+def _pytest_junit_outcome(testcase: ElementTree.Element) -> str:
+    child_tags = {_xml_tag_name(child.tag) for child in testcase}
+    if child_tags & {"failure", "error"}:
+        return "failed"
+    return "skipped" if "skipped" in child_tags else "passed"
+
+
+def _more_conservative_test_outcome(current: str | None, incoming: str) -> str:
+    severity = {"skipped": 0, "passed": 1, "failed": 2}
+    return incoming if current is None or severity[incoming] > severity[current] else current
+
+
+def _xml_tag_name(value: object) -> str:
+    return value.rsplit("}", 1)[-1] if isinstance(value, str) else ""
+
+
+def _read_bounded_file_bytes(file_path: Path) -> bytes | None:
+    try:
+        with file_path.open("rb") as handle:
+            content = handle.read(_MAX_OUTPUT_CHARS + 1)
+    except OSError:
+        return None
+    return content if len(content) <= _MAX_OUTPUT_CHARS else None
+
+
 async def run_test_coverage_evidence(
     workspace_path: str | Path,
     check: object,
@@ -694,50 +1043,70 @@ async def run_test_coverage_evidence(
     timeout_seconds = (
         timeout if isinstance(timeout, int) and 1 <= timeout <= 3600 else _DEFAULT_TIMEOUT_SECONDS
     )
+    junit_path = _temporary_junit_report_path()
+    execution_argv = [
+        *argv,
+        f"--junitxml={junit_path}",
+    ] if junit_path is not None else argv
     started_at = time.monotonic()
     try:
-        process = await asyncio.create_subprocess_exec(
-            *argv,
-            cwd=str(Path(workspace_path)),
-            stdout=asyncio.subprocess.PIPE,
-            stderr=asyncio.subprocess.PIPE,
-        )
-    except FileNotFoundError:
-        return {
-            "status": "tool_unavailable",
-            "collection_status": "unavailable",
-            "failure_reason": "python_unavailable",
-            "summary": "Python is unavailable on this runtime.",
-            "duration_ms": int((time.monotonic() - started_at) * 1000),
-        }
-    except OSError:
-        return {
-            "status": "tool_unavailable",
-            "collection_status": "unavailable",
-            "failure_reason": "pytest_start_failed",
-            "summary": "pytest could not be started on this runtime.",
-            "duration_ms": int((time.monotonic() - started_at) * 1000),
-        }
-
-    try:
-        stdout, stderr = await asyncio.wait_for(process.communicate(), timeout_seconds)
-    except asyncio.TimeoutError:
-        process.kill()
-        await process.communicate()
-        return {
-            "status": "timed_out",
-            "collection_status": "unavailable",
-            "failure_reason": "timeout",
-            "summary": f"pytest evidence collection timed out after {timeout_seconds}s.",
-            "duration_ms": int((time.monotonic() - started_at) * 1000),
-        }
-
-    output = (stdout + b"\n" + stderr).decode("utf-8", errors="replace")
-    report = parse_pytest_coverage_output(output, process.returncode or 0)
-    report["duration_ms"] = int((time.monotonic() - started_at) * 1000)
-    report["tool"] = "pytest"
-    report["command"] = command
-    return report
+        try:
+            process = await asyncio.create_subprocess_exec(
+                *execution_argv,
+                cwd=str(Path(workspace_path)),
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+            )
+        except FileNotFoundError:
+            return {
+                "status": "tool_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "python_unavailable",
+                "summary": "Python is unavailable on this runtime.",
+                "duration_ms": int((time.monotonic() - started_at) * 1000),
+            }
+        except OSError:
+            return {
+                "status": "tool_unavailable",
+                "collection_status": "unavailable",
+                "failure_reason": "pytest_start_failed",
+                "summary": "pytest could not be started on this runtime.",
+                "duration_ms": int((time.monotonic() - started_at) * 1000),
+            }
+
+        try:
+            stdout, stderr = await asyncio.wait_for(process.communicate(), timeout_seconds)
+        except asyncio.TimeoutError:
+            process.kill()
+            await process.communicate()
+            return {
+                "status": "timed_out",
+                "collection_status": "unavailable",
+                "failure_reason": "timeout",
+                "summary": f"pytest evidence collection timed out after {timeout_seconds}s.",
+                "duration_ms": int((time.monotonic() - started_at) * 1000),
+            }
+
+        output = (stdout + b"\n" + stderr).decode("utf-8", errors="replace")
+        report = parse_pytest_coverage_output(output, process.returncode or 0)
+        if junit_path is not None and report.get("collection_status") == "completed":
+            test_case_results = _test_case_results_from_junit(
+                workspace_path,
+                check.get("output_dir") if isinstance(check, dict) else None,
+                junit_path,
+            )
+            if test_case_results:
+                report["test_case_results"] = test_case_results
+        report["duration_ms"] = int((time.monotonic() - started_at) * 1000)
+        report["tool"] = "pytest"
+        report["command"] = command
+        return report
+    finally:
+        if junit_path is not None:
+            try:
+                junit_path.unlink(missing_ok=True)
+            except OSError:
+                pass
 
 
 async def run_static_check_evidence(
@@ -997,6 +1366,78 @@ def _safe_evidence_message(value: object) -> str:
     return text[:1000]
 
 
+def _bounded_evidence_text(value: object) -> str | None:
+    return value if isinstance(value, str) and len(value) <= _MAX_OUTPUT_CHARS else None
+
+
+def acceptance_criteria_coverage_artifact_paths(
+    output_dir: object,
+) -> tuple[str, str] | None:
+    """Return the sole pair of testing-artifact paths allowed for P3 evidence."""
+    if not isinstance(output_dir, str):
+        return None
+    normalized = output_dir.strip().replace("\\", "/")
+    while normalized.startswith("./"):
+        normalized = normalized[2:]
+    if not _safe_workspace_path(normalized):
+        return None
+    return (
+        f"{normalized}/test-cases.json",
+        f"{normalized}/coverage-matrix.json",
+    )
+
+
+def _read_bounded_workspace_file(
+    workspace_path: str | Path,
+    relative_path: str,
+) -> tuple[str | None, str]:
+    """Read one UTF-8 repository file without following a path outside root."""
+    root = Path(workspace_path).resolve()
+    try:
+        file_path = (root / relative_path).resolve(strict=True)
+        file_path.relative_to(root)
+        if not file_path.is_file():
+            return None, "unavailable"
+        with file_path.open("rb") as handle:
+            content = handle.read(_MAX_OUTPUT_CHARS + 1)
+    except (OSError, ValueError):
+        return None, "unavailable"
+    if len(content) > _MAX_OUTPUT_CHARS:
+        return None, "too_large"
+    try:
+        return content.decode("utf-8"), "completed"
+    except UnicodeDecodeError:
+        return None, "unavailable"
+
+
+def _canonical_acceptance_criteria_reference(value: object) -> str | None:
+    if not isinstance(value, str):
+        return None
+    match = _SAFE_ACCEPTANCE_REFERENCE.fullmatch(value.strip())
+    return f"AC-{int(match.group(1)):03d}" if match is not None else None
+
+
+def _acceptance_criteria_coverage_failure(reason: str) -> dict[str, Any]:
+    return {
+        "status": "parse_failed",
+        "collection_status": "incomplete",
+        "failure_reason": reason,
+        "coverage_links": [],
+        "summary": "Testing artifacts did not provide a usable acceptance-criteria coverage map.",
+    }
+
+
+def _acceptance_criteria_coverage_unavailable(reason: str) -> dict[str, Any]:
+    return {
+        "status": "artifact_unavailable",
+        "collection_status": "unavailable",
+        "failure_reason": reason,
+        "coverage_links": [],
+        "source_artifacts": [],
+        "summary": "Testing artifacts are unavailable for acceptance-criteria evidence.",
+    }
+
+
 def _security_score(high: int, medium: int, low: int) -> float:
     if high > 0:
         return 0.0

{forgexa_cli-1.47.1 → forgexa_cli-1.47.2}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.47.1
+Version: 1.47.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.47.1 → forgexa_cli-1.47.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.47.1"
+version = "1.47.2"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"