forgexa-cli 1.48.1__tar.gz → 1.48.3__tar.gz

{forgexa_cli-1.48.1 → forgexa_cli-1.48.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.48.1
+Version: 1.48.3
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.48.1 → forgexa_cli-1.48.3}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.48.1"
+__version__ = "1.48.3"

{forgexa_cli-1.48.1 → forgexa_cli-1.48.3}/forgexa_cli/daemon.py

@@ -1120,7 +1120,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.48.1"
+DAEMON_VERSION = "1.48.3"
 
 
 def _detect_client_type() -> str:
@@ -5189,6 +5189,10 @@ class _IdleTimeoutError(asyncio.TimeoutError):
         self.stderr = ""
 
 
+class _TaskAttachmentDownloadError(RuntimeError):
+    """Raised when a required task attachment cannot be staged safely."""
+
+
 def _workspace_has_recent_activity(
     workspace_path: "Path", since_monotonic: float, max_depth: int = 4
 ) -> bool:
@@ -5444,18 +5448,22 @@ class ProcessManager:
         return "unable to run"
 
     @staticmethod
-    def is_silent_idle_timeout(result: "TaskResult") -> bool:
-        """Return whether an agent was killed before producing any evidence.
-
-        A timeout after output or workspace changes can represent completed work
-        and must be handled by the normal recovery path. A completely silent
-        timeout instead means this specific CLI is stuck before it can begin,
-        so one alternate agent is safe to try.
+    def is_idle_timeout_without_work(result: "TaskResult") -> bool:
+        """Return whether an idle-killed agent left no work worth preserving.
+
+        The deciding evidence is workspace output (``files_changed``), NOT
+        stdout/stderr chatter: an agent can emit an intro sentence and a
+        todowrite event and then stall forever on a hung model request
+        (SI-1453: OpenCode produced 2 output lines in 39 minutes, zero file
+        changes).  Streamed text is conversation, not work, so it must not
+        block recovery.  When no files were changed, trying an alternate
+        agent is safe: the pre-fallback guard in the task runner re-checks
+        the workspace (uncommitted AND committed changes since
+        node_before_sha) before switching agents, and timeouts that occurred
+        after real work still go through the normal recovery path.
         """
         return (
             result.failure_code == "agent_idle_timeout"
-            and not result.stdout.strip()
-            and not result.stderr.strip()
             and not result.files_changed
         )
 
@@ -8220,6 +8228,7 @@ class ServerConnection:
                 "platform": platform.platform(),
                 "python_version": platform.python_version(),
                 "local_workspace_bindings": {"protocol_version": 3},
+                "task_attachment_staging": {"protocol_version": 1, "runtime_proxy": True},
             },
             "server_url": self.server_url,
             "expires_in_days": 90,
@@ -8619,7 +8628,7 @@ class ServerConnection:
                     "python_version": platform.python_version(),
                     "local_workspace_bindings": {"protocol_version": 3},
                     "local_evidence": {"protocol_version": 1, "structured_summary": True},
-                    "local_evidence": {"protocol_version": 1, "structured_summary": True},
+                    "task_attachment_staging": {"protocol_version": 1, "runtime_proxy": True},
                 },
                 "server_url": self.server_url,
             }
@@ -8955,6 +8964,261 @@ def _validate_test_evidence(
     return issues
 
 
+_QA_TEST_LEVELS = frozenset({"unit", "integration", "e2e"})
+
+
+def _parse_frozen_qa_test_level_policy(
+    snapshot: object,
+) -> tuple[dict[str, Any] | None, list[str]]:
+    """Parse a server-owned policy snapshot without backend-package imports.
+
+    The daemon also runs standalone in CLI/Desktop bundles, so this mirrors the
+    server contract with stdlib-only validation rather than importing a backend
+    service. A missing snapshot is a historical task and intentionally keeps
+    legacy validation behavior.
+    """
+    if snapshot is None:
+        return None, []
+    if not isinstance(snapshot, dict):
+        return None, [
+            "qa_policy.configuration_invalid: frozen QA test-level policy snapshot must be an object."
+        ]
+    policy = snapshot.get("policy")
+    if not isinstance(policy, dict):
+        return None, [
+            "qa_policy.configuration_invalid: frozen QA test-level policy snapshot is missing its policy."
+        ]
+    expected_fingerprint = hashlib.sha256(
+        json.dumps(policy, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    ).hexdigest()
+    if snapshot.get("fingerprint") != expected_fingerprint:
+        return None, [
+            "qa_policy.configuration_invalid: frozen QA test-level policy fingerprint does not match its payload."
+        ]
+    if set(policy) != {"schema_version", "enforcement", "levels"}:
+        return None, [
+            "qa_policy.configuration_invalid: frozen QA test-level policy has unexpected fields."
+        ]
+    if type(policy.get("schema_version")) is not int or policy["schema_version"] != 1:
+        return None, [
+            "qa_policy.configuration_invalid: frozen QA test-level policy schema_version is unsupported."
+        ]
+    enforcement = policy.get("enforcement")
+    if enforcement not in {"legacy", "enforce"}:
+        return None, [
+            "qa_policy.configuration_invalid: frozen QA test-level policy enforcement is invalid."
+        ]
+    levels = policy.get("levels")
+    if not isinstance(levels, dict) or set(levels) != _QA_TEST_LEVELS:
+        return None, [
+            "qa_policy.configuration_invalid: frozen QA test-level policy levels are invalid."
+        ]
+
+    normalized_levels: dict[str, dict[str, bool]] = {}
+    for level in _QA_TEST_LEVELS:
+        config = levels.get(level)
+        if not isinstance(config, dict) or set(config) != {"enabled", "workflow_auto_run"}:
+            return None, [
+                "qa_policy.configuration_invalid: frozen QA test-level policy level configuration is invalid."
+            ]
+        enabled = config.get("enabled")
+        auto_run = config.get("workflow_auto_run")
+        if type(enabled) is not bool or type(auto_run) is not bool:
+            return None, [
+                "qa_policy.configuration_invalid: frozen QA test-level policy switches must be boolean."
+            ]
+        if auto_run and not enabled:
+            return None, [
+                "qa_policy.configuration_invalid: workflow_auto_run requires an enabled test level."
+            ]
+        normalized_levels[level] = {
+            "enabled": enabled,
+            "workflow_auto_run": auto_run,
+        }
+    return {
+        "enforcement": enforcement,
+        "fingerprint": expected_fingerprint,
+        "levels": normalized_levels,
+    }, []
+
+
+def _validate_enforced_qa_test_level_artifacts(
+    policy: dict[str, Any],
+    test_intent_data: object,
+    test_cases_data: object,
+    workspace_path: Path,
+) -> list[str]:
+    """Validate a testing node's artifacts against its frozen policy snapshot."""
+    if policy.get("enforcement") != "enforce":
+        return []
+
+    issues: list[str] = []
+    if not isinstance(test_intent_data, dict):
+        return [
+            "qa_policy.test_intent_missing: enforced QA policy requires test-intent.json."
+        ]
+    declared_fingerprint = test_intent_data.get("qa_test_level_policy_fingerprint")
+    if not isinstance(declared_fingerprint, str) or not declared_fingerprint.strip():
+        issues.append(
+            "qa_policy.fingerprint_missing: test-intent.json must echo the frozen QA policy fingerprint."
+        )
+    elif declared_fingerprint.strip() != policy["fingerprint"]:
+        issues.append(
+            "qa_policy.fingerprint_mismatch: test-intent.json does not match the frozen QA policy."
+        )
+
+    raw_intents = test_intent_data.get("intents")
+    if not isinstance(raw_intents, list):
+        return issues + [
+            "qa_policy.test_intent_invalid: test-intent.json intents must be an array."
+        ]
+
+    automated_intent_ids: dict[str, set[str]] = {
+        level: set() for level in _QA_TEST_LEVELS
+    }
+    manual_intent_reasons: dict[str, str] = {}
+    for index, raw_intent in enumerate(raw_intents[:200]):
+        if not isinstance(raw_intent, dict):
+            issues.append(f"qa_policy.test_intent_invalid: intent {index} must be an object.")
+            continue
+        intent_id = raw_intent.get("id") or raw_intent.get("test_id") or raw_intent.get("intent_id")
+        if not isinstance(intent_id, str) or not intent_id.strip():
+            issues.append(f"qa_policy.test_intent_invalid: intent {index} is missing id.")
+            continue
+        intent_id = intent_id.strip()
+        raw_target = raw_intent.get("automation_target")
+        target = raw_target.strip().lower() if isinstance(raw_target, str) else ""
+        if target == "manual":
+            reason = raw_intent.get("manual_reason_code")
+            if not isinstance(reason, str) or not reason.strip():
+                issues.append(
+                    f"qa_policy.manual_reason_code_missing: manual intent {intent_id} must define manual_reason_code."
+                )
+            else:
+                manual_intent_reasons[intent_id] = reason.strip()
+        elif target not in _QA_TEST_LEVELS:
+            issues.append(
+                f"qa_policy.test_level_unclassified: intent {intent_id} has unsupported automation_target {target!r}."
+            )
+        elif not policy["levels"][target]["enabled"]:
+            issues.append(
+                f"qa_policy.level_disabled: intent {intent_id} uses disabled automation_target {target!r}."
+            )
+        else:
+            automated_intent_ids[target].add(intent_id)
+
+    if not isinstance(test_cases_data, dict):
+        return issues + [
+            "qa_policy.test_cases_missing: enforced QA policy requires test-cases.json."
+        ]
+    raw_cases = test_cases_data.get("test_cases")
+    if not isinstance(raw_cases, list):
+        return issues + [
+            "qa_policy.test_cases_invalid: test-cases.json test_cases must be an array."
+        ]
+
+    covered_automated_intents: dict[str, set[str]] = {
+        level: set() for level in _QA_TEST_LEVELS
+    }
+    covered_manual_intents: set[str] = set()
+    for index, raw_case in enumerate(raw_cases[:200]):
+        if not isinstance(raw_case, dict):
+            issues.append(f"qa_policy.test_case_invalid: test case {index} must be an object.")
+            continue
+        case_id = raw_case.get("id")
+        case_label = str(case_id).strip() if case_id else f"index {index}"
+        raw_type = raw_case.get("test_type")
+        case_type = raw_type.strip().lower() if isinstance(raw_type, str) else ""
+        intent_id = raw_case.get("intent_id") or raw_case.get("test_intent_id")
+        intent_id = intent_id.strip() if isinstance(intent_id, str) else ""
+
+        if case_type == "manual":
+            if intent_id not in manual_intent_reasons:
+                issues.append(
+                    f"qa_policy.manual_case_intent_mismatch: manual test case {case_label} must reference a manual intent."
+                )
+            else:
+                covered_manual_intents.add(intent_id)
+                reason = raw_case.get("manual_reason_code")
+                if not isinstance(reason, str) or reason.strip() != manual_intent_reasons[intent_id]:
+                    issues.append(
+                        f"qa_policy.manual_reason_code_mismatch: manual test case {case_label} must preserve its intent reason."
+                    )
+            if not isinstance(raw_case.get("acceptance_criteria_refs"), list) or not raw_case["acceptance_criteria_refs"]:
+                issues.append(
+                    f"qa_policy.manual_case_missing_acceptance_refs: manual test case {case_label} must list acceptance_criteria_refs."
+                )
+            if not isinstance(raw_case.get("steps"), list) or not raw_case["steps"]:
+                issues.append(
+                    f"qa_policy.manual_case_missing_steps: manual test case {case_label} must define executable steps."
+                )
+            if raw_case.get("script_path") or str(raw_case.get("script_content") or "").strip():
+                issues.append(
+                    f"qa_policy.manual_case_has_script: manual test case {case_label} must not define a script."
+                )
+            continue
+
+        if case_type not in _QA_TEST_LEVELS:
+            issues.append(
+                f"qa_policy.test_level_unclassified: test case {case_label} has unsupported test_type {case_type!r}."
+            )
+            continue
+        if not policy["levels"][case_type]["enabled"]:
+            issues.append(
+                f"qa_policy.level_disabled: test case {case_label} uses disabled test_type {case_type!r}."
+            )
+            continue
+        if intent_id:
+            covered_automated_intents[case_type].add(intent_id)
+
+        runner_family = raw_case.get("runner_family")
+        runner = runner_family.strip().lower() if isinstance(runner_family, str) else ""
+        if not runner:
+            issues.append(
+                f"qa_policy.runner_family_missing: automated test case {case_label} must define runner_family."
+            )
+        elif (case_type == "e2e" and runner != "playwright") or (
+            case_type in {"unit", "integration"} and runner == "playwright"
+        ):
+            issues.append(
+                f"qa_policy.runner_level_mismatch: test case {case_label} runner_family {runner!r} conflicts with test_type {case_type!r}."
+            )
+
+        script_content = raw_case.get("script_content")
+        if not isinstance(script_content, str) or not script_content.strip():
+            issues.append(
+                f"qa_policy.script_content_missing: automated test case {case_label} must define non-empty script_content."
+            )
+        script_path = raw_case.get("script_path")
+        if not isinstance(script_path, str) or not script_path.strip():
+            issues.append(
+                f"qa_policy.script_path_missing: automated test case {case_label} must define script_path."
+            )
+        else:
+            candidate_path = Path(script_path)
+            if candidate_path.is_absolute() or ".." in candidate_path.parts:
+                issues.append(
+                    f"qa_policy.script_path_invalid: automated test case {case_label} script_path must stay inside the workspace."
+                )
+            elif not (workspace_path / candidate_path).is_file():
+                issues.append(
+                    f"qa_policy.script_path_missing: automated test case {case_label} script_path '{script_path}' does not exist on disk."
+                )
+
+    for level, intent_ids in automated_intent_ids.items():
+        missing = sorted(intent_ids - covered_automated_intents[level])
+        if missing:
+            issues.append(
+                f"qa_policy.test_case_missing: test-cases.json lacks {level} test cases for intents {missing}."
+            )
+    missing_manual = sorted(set(manual_intent_reasons) - covered_manual_intents)
+    if missing_manual:
+        issues.append(
+            f"qa_policy.manual_case_missing: test-cases.json lacks manual test cases for intents {missing_manual}."
+        )
+    return issues
+
+
 def _configured_daemon_api_token() -> str:
     token = str(settings.DAEMON_API_TOKEN or "").strip()
     if token.startswith("pat_"):
@@ -8998,6 +9262,10 @@ class RuntimeDaemon:
     """
 
     AGENT_REFRESH_INTERVAL_SECONDS = 60
+    _TASK_ATTACHMENT_DOWNLOAD_TIMEOUT_SECONDS = 120
+    _TASK_ATTACHMENT_MAX_BYTES = 50 * 1024 * 1024
+    _TASK_ATTACHMENT_MAX_COUNT = 20
+    _TASK_ATTACHMENT_MAX_TOTAL_BYTES = 100 * 1024 * 1024
 
     def __init__(self):
         # Compute stable hardware fingerprint from machine-id / MAC address.
@@ -9189,6 +9457,296 @@ class RuntimeDaemon:
 
         target_dir.mkdir(parents=True, exist_ok=True)
 
+    @staticmethod
+    def _task_attachments_to_stage(task: TaskInfo) -> list[dict]:
+        input_data = task.input_data if isinstance(task.input_data, dict) else {}
+        attachment_groups = [input_data.get("attachments")]
+        context = input_data.get("context")
+        if isinstance(context, dict):
+            attachment_groups.append(context.get("attachments"))
+        fix_context = input_data.get("fix_context")
+        if isinstance(fix_context, dict):
+            attachment_groups.append(fix_context.get("gate_attachments"))
+
+        attachments: list[dict] = []
+        attachments_by_artifact_id: dict[str, dict] = {}
+        attachments_by_url: dict[str, dict] = {}
+        for group in attachment_groups:
+            if not isinstance(group, list):
+                continue
+            for attachment in group:
+                if not isinstance(attachment, dict):
+                    continue
+                artifact_id = str(attachment.get("artifact_id") or attachment.get("id") or "").strip()
+                raw_download_url = attachment.get("download_url")
+                download_url = raw_download_url.strip() if isinstance(raw_download_url, str) else ""
+                if not artifact_id and not download_url:
+                    continue
+                existing = (
+                    attachments_by_artifact_id.get(artifact_id)
+                    if artifact_id else None
+                ) or (attachments_by_url.get(download_url) if download_url else None)
+                if existing is None:
+                    existing = dict(attachment)
+                    attachments.append(existing)
+                else:
+                    for field, value in attachment.items():
+                        if value and not existing.get(field):
+                            existing[field] = value
+                existing_artifact_id = str(
+                    existing.get("artifact_id") or existing.get("id") or ""
+                ).strip()
+                if existing_artifact_id:
+                    attachments_by_artifact_id[existing_artifact_id] = existing
+                if download_url:
+                    attachments_by_url[download_url] = existing
+
+        def _artifact_id_is_valid(attachment: dict) -> bool:
+            try:
+                UUID(str(attachment.get("artifact_id") or attachment.get("id") or ""))
+                return True
+            except (TypeError, ValueError, AttributeError):
+                return False
+
+        def _legacy_key(attachment: dict) -> tuple[str, str, int]:
+            try:
+                size_bytes = int(attachment.get("size_bytes") or 0)
+            except (TypeError, ValueError):
+                size_bytes = 0
+            return (
+                str(attachment.get("file_path") or attachment.get("file_name") or ""),
+                str(attachment.get("mime_type") or ""),
+                size_bytes,
+            )
+
+        identified_by_key: dict[tuple[str, str, int], list[dict]] = {}
+        for attachment in attachments:
+            if _artifact_id_is_valid(attachment):
+                identified_by_key.setdefault(_legacy_key(attachment), []).append(attachment)
+
+        deduplicated: list[dict] = []
+        for attachment in attachments:
+            if _artifact_id_is_valid(attachment):
+                deduplicated.append(attachment)
+                continue
+            candidates = identified_by_key.get(_legacy_key(attachment), [])
+            if len(candidates) != 1:
+                deduplicated.append(attachment)
+                continue
+            identified = candidates[0]
+            for field, value in attachment.items():
+                if value and not identified.get(field):
+                    identified[field] = value
+        return deduplicated
+
+    @staticmethod
+    def _task_attachment_filename(attachment: dict, position: int) -> str:
+        raw_name = str(
+            attachment.get("file_path") or attachment.get("file_name") or "attachment"
+        )
+        file_name = Path(raw_name.replace("\\", "/")).name
+        file_name = re.sub(r"[^A-Za-z0-9._-]+", "_", file_name).strip("._")
+        return f"{position:02d}-{file_name[:160] or 'attachment'}"
+
+    @staticmethod
+    def _rewrite_staged_attachment_references(
+        prompt: str,
+        staged: list[tuple[str, str, str]],
+    ) -> str:
+        if not staged:
+            return prompt
+
+        local_files = []
+        for file_name, download_url, local_path in staged:
+            if download_url:
+                command_pattern = r"`curl -L '" + re.escape(download_url) + r"' -o /tmp/[^`]+`"
+                prompt = re.sub(command_pattern, lambda _match, path=local_path: f"`{path}`", prompt)
+                prompt = prompt.replace(f"Download: {download_url}", f"Staged local file: `{local_path}`")
+                prompt = prompt.replace(download_url, local_path)
+            local_files.append(f"- `{local_path}` ({file_name})")
+
+        preamble = "\n".join([
+            "## Runtime-Prepared Attachments",
+            "The runtime downloaded these files before this task began. Use the local copies directly; do not download attachment URLs yourself.",
+            *local_files,
+        ])
+        return f"{preamble}\n\n{prompt}" if prompt else preamble
+
+    async def _download_task_attachment(
+        self,
+        client: httpx.AsyncClient,
+        url: str,
+        destination: Path,
+        *,
+        attachment_name: str,
+        expected_size: int | None,
+        expected_checksum: str | None,
+        max_bytes: int,
+        timeout_seconds: float,
+    ) -> None:
+        parsed_url = urlparse(url)
+        if parsed_url.scheme not in {"http", "https"} or not parsed_url.netloc:
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' has an unsupported download URL"
+            )
+        if expected_size is not None and expected_size < 0:
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' has an invalid size"
+            )
+        if expected_size is not None and expected_size > max_bytes:
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' exceeds the task download budget"
+            )
+        if expected_checksum and not re.fullmatch(r"[0-9a-fA-F]{64}", expected_checksum):
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' has an invalid integrity checksum"
+            )
+
+        temporary_path = destination.with_name(f"{destination.name}.part")
+
+        async def download() -> None:
+            try:
+                async with client.stream(
+                    "GET",
+                    url,
+                    timeout=httpx.Timeout(connect=10.0, read=30.0, write=10.0, pool=10.0),
+                ) as response:
+                    if not 200 <= response.status_code < 300:
+                        raise _TaskAttachmentDownloadError(
+                            f"Attachment '{attachment_name}' download failed with HTTP {response.status_code}"
+                        )
+                    content_length = response.headers.get("content-length")
+                    if content_length:
+                        try:
+                            if int(content_length) > max_bytes:
+                                raise _TaskAttachmentDownloadError(
+                                    f"Attachment '{attachment_name}' exceeds the task download budget"
+                                )
+                        except ValueError:
+                            pass
+
+                    total_bytes = 0
+                    digest = hashlib.sha256()
+                    with temporary_path.open("wb") as output:
+                        try:
+                            os.chmod(temporary_path, 0o600)
+                        except OSError:
+                            pass
+                        async for chunk in response.aiter_bytes():
+                            total_bytes += len(chunk)
+                            if total_bytes > max_bytes:
+                                raise _TaskAttachmentDownloadError(
+                                    f"Attachment '{attachment_name}' exceeds the task download budget"
+                                )
+                            output.write(chunk)
+                            digest.update(chunk)
+                    if expected_checksum:
+                        if not secrets.compare_digest(digest.hexdigest(), expected_checksum.lower()):
+                            raise _TaskAttachmentDownloadError(
+                                f"Attachment '{attachment_name}' failed its integrity check"
+                            )
+                    temporary_path.replace(destination)
+            except _TaskAttachmentDownloadError:
+                raise
+            except httpx.HTTPError as exc:
+                raise _TaskAttachmentDownloadError(
+                    f"Attachment '{attachment_name}' download failed ({type(exc).__name__})"
+                ) from exc
+            except OSError as exc:
+                raise _TaskAttachmentDownloadError(
+                    f"Attachment '{attachment_name}' could not be saved ({exc})"
+                ) from exc
+
+        try:
+            await asyncio.wait_for(
+                download(),
+                timeout=timeout_seconds,
+            )
+        except asyncio.TimeoutError as exc:
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' download timed out after "
+                f"{timeout_seconds:.0f}s"
+            ) from exc
+        finally:
+            temporary_path.unlink(missing_ok=True)
+
+    async def _stage_task_attachments(
+        self,
+        task: TaskInfo,
+        conn: ServerConnection,
+    ) -> Path | None:
+        attachments = self._task_attachments_to_stage(task)
+        if not attachments:
+            return None
+        if len(attachments) > self._TASK_ATTACHMENT_MAX_COUNT:
+            raise _TaskAttachmentDownloadError(
+                f"Task has {len(attachments)} attachments; the runtime limit is "
+                f"{self._TASK_ATTACHMENT_MAX_COUNT}"
+            )
+
+        staging_dir = Path(tempfile.mkdtemp(prefix=f"forgexa-attachments-{task.task_id[:8]}-"))
+        staged: list[tuple[str, str, str]] = []
+        deadline = time.monotonic() + self._TASK_ATTACHMENT_DOWNLOAD_TIMEOUT_SECONDS
+        remaining_bytes = self._TASK_ATTACHMENT_MAX_TOTAL_BYTES
+        try:
+            for position, attachment in enumerate(attachments, start=1):
+                file_name = str(
+                    attachment.get("file_path") or attachment.get("file_name") or "attachment"
+                )
+                download_url = str(attachment.get("download_url") or "")
+                destination = staging_dir / self._task_attachment_filename(attachment, position)
+                try:
+                    expected_size = int(attachment.get("size_bytes") or 0)
+                except (TypeError, ValueError):
+                    expected_size = 0
+                if expected_size > remaining_bytes:
+                    raise _TaskAttachmentDownloadError(
+                        f"Attachment '{file_name}' exceeds the task download budget"
+                    )
+                artifact_id = str(attachment.get("artifact_id") or attachment.get("id") or "")
+                try:
+                    UUID(artifact_id)
+                except (TypeError, ValueError, AttributeError):
+                    raise _TaskAttachmentDownloadError(
+                        f"Attachment '{file_name}' cannot be staged securely because it has no artifact ID"
+                    )
+                remaining_seconds = deadline - time.monotonic()
+                if remaining_seconds <= 0:
+                    raise _TaskAttachmentDownloadError(
+                        f"Task attachment staging timed out after "
+                        f"{self._TASK_ATTACHMENT_DOWNLOAD_TIMEOUT_SECONDS}s"
+                    )
+                if not conn.runtime_id:
+                    raise _TaskAttachmentDownloadError(
+                        f"Attachment '{file_name}' cannot be staged because this runtime is not registered"
+                    )
+                source_url = (
+                    f"{conn.server_url.rstrip('/')}/api/v1/runtimes/{conn.runtime_id}/"
+                    f"tasks/{task.task_id}/attachments/{artifact_id}"
+                )
+                await self._download_task_attachment(
+                    conn.client,
+                    source_url,
+                    destination,
+                    attachment_name=file_name,
+                    expected_size=expected_size or None,
+                    expected_checksum=str(attachment.get("checksum") or ""),
+                    max_bytes=min(self._TASK_ATTACHMENT_MAX_BYTES, remaining_bytes),
+                    timeout_seconds=remaining_seconds,
+                )
+                remaining_bytes -= destination.stat().st_size
+                staged.append((file_name, download_url, str(destination)))
+        except Exception:
+            shutil.rmtree(staging_dir, ignore_errors=True)
+            raise
+
+        task.input_prompt = self._rewrite_staged_attachment_references(task.input_prompt, staged)
+        input_data = dict(task.input_data or {})
+        input_data["prompt"] = task.input_prompt
+        task.input_data = input_data
+        logger.info("Prepared %d attachment(s) for task %s", len(staged), task.task_id)
+        return staging_dir
+
     @staticmethod
     async def _mint_local_dev_token() -> str:
         """Mint a JWT for local development when no explicit token is configured.
@@ -10033,6 +10591,7 @@ class RuntimeDaemon:
         await project_lock.acquire()
         workspace_execution_lock: _WorkspaceFileLock | None = None
         local_bind_file_lock = None
+        attachment_staging_dir: Path | None = None
         if is_local_bind and task.local_workspace_binding_id:
             # OS-level file lock keyed by binding_id (docs/designs/forgexa-
             # ide-design.md §6.3): the DB lease (orchestrator.py) prevents
@@ -10128,6 +10687,34 @@ class RuntimeDaemon:
             logger.info("Workspace ready: %s", workspace_path)
             self._ensure_task_output_dir(workspace_path, task)
 
+            try:
+                if self._task_attachments_to_stage(task):
+                    await reporter.report_progress(
+                        task.task_id,
+                        8,
+                        "preparing_attachments",
+                        output_lines=["[daemon] Preparing task attachments"],
+                    )
+                attachment_staging_dir = await self._stage_task_attachments(task, conn)
+            except _TaskAttachmentDownloadError as exc:
+                logger.warning("Task %s could not stage attachments: %s", task.task_id, exc)
+                await reporter.report_progress(
+                    task.task_id,
+                    8,
+                    "attachment_download_failed",
+                    output_lines=["[daemon] Required task attachment could not be downloaded"],
+                )
+                await report_task_complete(TaskResult(
+                    status="failed",
+                    exit_code=-1,
+                    stdout="",
+                    stderr="",
+                    error=str(exc),
+                    failure_code="attachment_download_failed",
+                    execution_attempt_id=task.execution_attempt_id,
+                ))
+                return
+
             # 2.1 Workspace health check: detect broken checkout — skipped for
             # local_bind (the user's own real directory, not a disposable
             # checkout the daemon controls). See
@@ -10254,7 +10841,7 @@ class RuntimeDaemon:
 
             tried_agents.add(agent.agent_id)
 
-            # ── Agent fallback: try another CLI after a backend failure or a fully silent hang ──
+            # ── Agent fallback: try another CLI after a backend failure or a work-free hang ──
             # Guard: if the agent already produced file changes in the workspace, it DID
             # meaningful work — don't trigger fallback even if it crashed after completing.
             # Let the recovery logic (step 4.1) handle non-zero exit with committed work.
@@ -10268,12 +10855,12 @@ class RuntimeDaemon:
                 else ProcessManager.agent_failure_kind(result)
             )
             is_agent_fallback_eligible = agent_failure_kind is not None
-            is_silent_idle_timeout = self.process_manager.is_silent_idle_timeout(result)
+            is_idle_timeout_without_work = self.process_manager.is_idle_timeout_without_work(result)
             fallback_reason = (
                 agent_failure_kind
                 if is_agent_fallback_eligible
                 else "agent_idle_timeout"
-                if is_silent_idle_timeout
+                if is_idle_timeout_without_work
                 else ""
             )
             fallback_label = (
@@ -10872,6 +11459,8 @@ class RuntimeDaemon:
                 execution_attempt_id=task.execution_attempt_id,
             ))
         finally:
+            if attachment_staging_dir is not None:
+                shutil.rmtree(attachment_staging_dir, ignore_errors=True)
             if workspace_execution_lock is not None:
                 workspace_execution_lock.release()
             project_lock.release()
@@ -11396,6 +11985,10 @@ class RuntimeDaemon:
 
                 if not _skip_test_artifacts:
                     _input = task.input_data or {}
+                    _qa_policy, _qa_policy_issues = _parse_frozen_qa_test_level_policy(
+                        _input.get("qa_test_level_policy_snapshot")
+                    )
+                    issues.extend(_qa_policy_issues)
                     doc_dir = (
                         _input.get("output_dir")
                         or _input.get("context", {}).get("output_dir")
@@ -11411,6 +12004,8 @@ class RuntimeDaemon:
                     # intents gets the same E2E chain validation as feature/improvement.
                     _e2e_intent_ids: set[str] = set()
                     _e2e_case_ids: list[str] = []
+                    _ti_data: dict[str, Any] | None = None
+                    _tc_data: dict[str, Any] | None = None
                     _analysis_dir = (
                         _input.get("analysis_output_dir")
                         or (_input.get("context") or {}).get("analysis_output_dir")
@@ -11424,6 +12019,8 @@ class RuntimeDaemon:
                                     _ti_path.read_text(encoding="utf-8")
                                 )
                                 for _ti in _ti_data.get("intents", []):
+                                    if not isinstance(_ti, dict):
+                                        continue
                                     if (_ti.get("automation_target") or "").lower() == "e2e":
                                         _ti_id = (
                                             _ti.get("id")
@@ -11445,8 +12042,8 @@ class RuntimeDaemon:
                     tc_path = base / "test-cases.json"
                     if tc_path.exists():
                         try:
-                            tc_data = _json.loads(tc_path.read_text(encoding="utf-8"))
-                            cases = tc_data.get("test_cases", [])
+                            _tc_data = _json.loads(tc_path.read_text(encoding="utf-8"))
+                            cases = _tc_data.get("test_cases", [])
                             _e2e_case_ids = [
                                 str(_tc.get("id"))
                                 for _tc in cases
@@ -11526,6 +12123,14 @@ class RuntimeDaemon:
                     elif _requires_structured_artifacts or _requires_e2e_artifacts:
                         issues.append(f"test-cases.json not found in {doc_dir or 'workspace root'}")
 
+                    if _qa_policy is not None:
+                        issues.extend(_validate_enforced_qa_test_level_artifacts(
+                            _qa_policy,
+                            _ti_data,
+                            _tc_data,
+                            workspace_path,
+                        ))
+
                     # --- coverage-matrix.json validation ---
                     cm_path = base / "coverage-matrix.json"
                     if cm_path.exists():

{forgexa_cli-1.48.1 → forgexa_cli-1.48.3}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.48.1
+Version: 1.48.3
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.48.1 → forgexa_cli-1.48.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.48.1"
+version = "1.48.3"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"